/mandos/release

#!/usr/bin/python

# -*- mode: python; coding: utf-8 -*-

#

# Mandos server - give out binary blobs to connecting clients.

#

# This program is partly derived from an example program for an Avahi

# service publisher, downloaded from

# <http://avahi.org/wiki/PythonPublishExample>.  This includes the

# methods "add", "remove", "server_state_changed",

# "entry_group_state_changed", "cleanup", and "activate" in the

# "AvahiService" class, and some lines in "main".

#

# Everything else is

# Copyright © 2008-2016 Teddy Hogeborn

# Copyright © 2008-2016 Björn Påhlsson

#

# This program is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

#     This program is distributed in the hope that it will be useful,

#     but WITHOUT ANY WARRANTY; without even the implied warranty of

#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

#     GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see

# <http://www.gnu.org/licenses/>.

#

# Contact the authors at <mandos@recompile.se>.

#

from __future__ import (division, absolute_import, print_function,

                        unicode_literals)

try:

    from future_builtins import *

except ImportError:

    pass

try:

    import SocketServer as socketserver

except ImportError:

    import socketserver

import socket

import argparse

import datetime

import errno

try:

    import ConfigParser as configparser

except ImportError:

    import configparser

import sys

import re

import os

import signal

import subprocess

import atexit

import stat

import logging

import logging.handlers

import pwd

import contextlib

import struct

import fcntl

import functools

try:

    import cPickle as pickle

except ImportError:

    import pickle

import multiprocessing

import types

import binascii

import tempfile

import itertools

import collections

import codecs

import dbus

import dbus.service

from gi.repository import GLib

from dbus.mainloop.glib import DBusGMainLoop

import ctypes

import ctypes.util

import xml.dom.minidom

import inspect

# Try to find the value of SO_BINDTODEVICE:

try:

    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

    # newer, and it is also the most natural place for it:

    SO_BINDTODEVICE = socket.SO_BINDTODEVICE

except AttributeError:

    try:

        # This is where SO_BINDTODEVICE was up to and including Python

        # 2.6, and also 3.2:

        from IN import SO_BINDTODEVICE

    except ImportError:

        # In Python 2.7 it seems to have been removed entirely.

        # Try running the C preprocessor:

        try:

            cc = subprocess.Popen(["cc", "--language=c", "-E",

                                   "/dev/stdin"],

                                  stdin=subprocess.PIPE,

                                  stdout=subprocess.PIPE)

            stdout = cc.communicate(

                "#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

            SO_BINDTODEVICE = int(stdout.splitlines()[-1])

        except (OSError, ValueError, IndexError):

            # No value found

            SO_BINDTODEVICE = None

if sys.version_info.major == 2:

    str = unicode

version = "1.7.13"

stored_state_file = "clients.pickle"

logger = logging.getLogger()

syslogger = None

try:

    if_nametoindex = ctypes.cdll.LoadLibrary(

        ctypes.util.find_library("c")).if_nametoindex

except (OSError, AttributeError):

    def if_nametoindex(interface):

        "Get an interface index the hard way, i.e. using fcntl()"

        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h

        with contextlib.closing(socket.socket()) as s:

            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

                                struct.pack(b"16s16x", interface))

        interface_index = struct.unpack("I", ifreq[16:20])[0]

        return interface_index

def copy_function(func):

    """Make a copy of a function"""

    if sys.version_info.major == 2:

        return types.FunctionType(func.func_code,

                                  func.func_globals,

                                  func.func_name,

                                  func.func_defaults,

                                  func.func_closure)

    else:

        return types.FunctionType(func.__code__,

                                  func.__globals__,

                                  func.__name__,

                                  func.__defaults__,

                                  func.__closure__)

def initlogger(debug, level=logging.WARNING):

    """init logger and add loglevel"""

    global syslogger

    syslogger = (logging.handlers.SysLogHandler(

        facility=logging.handlers.SysLogHandler.LOG_DAEMON,

        address="/dev/log"))

    syslogger.setFormatter(logging.Formatter

                           ('Mandos [%(process)d]: %(levelname)s:'

                            ' %(message)s'))

    logger.addHandler(syslogger)

    if debug:

        console = logging.StreamHandler()

        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

                                               ' [%(process)d]:'

                                               ' %(levelname)s:'

                                               ' %(message)s'))

        logger.addHandler(console)

    logger.setLevel(level)

class PGPError(Exception):

    """Exception if encryption/decryption fails"""

    pass

class PGPEngine(object):

    """A simple class for OpenPGP symmetric encryption & decryption"""

    def __init__(self):

        self.tempdir = tempfile.mkdtemp(prefix="mandos-")

        self.gpg = "gpg"

        try:

            output = subprocess.check_output(["gpgconf"])

            for line in output.splitlines():

                name, text, path = line.split(b":")

                if name == "gpg":

                    self.gpg = path

                    break

        except OSError as e:

            if e.errno != errno.ENOENT:

                raise

        self.gnupgargs = ['--batch',

                          '--homedir', self.tempdir,

                          '--force-mdc',

                          '--quiet']

        # Only GPG version 1 has the --no-use-agent option.

        if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

            self.gnupgargs.append("--no-use-agent")

    def __enter__(self):

        return self

    def __exit__(self, exc_type, exc_value, traceback):

        self._cleanup()

        return False

    def __del__(self):

        self._cleanup()

    def _cleanup(self):

        if self.tempdir is not None:

            # Delete contents of tempdir

            for root, dirs, files in os.walk(self.tempdir,

                                             topdown=False):

                for filename in files:

                    os.remove(os.path.join(root, filename))

                for dirname in dirs:

                    os.rmdir(os.path.join(root, dirname))

            # Remove tempdir

            os.rmdir(self.tempdir)

            self.tempdir = None

    def password_encode(self, password):

        # Passphrase can not be empty and can not contain newlines or

        # NUL bytes.  So we prefix it and hex encode it.

        encoded = b"mandos" + binascii.hexlify(password)

        if len(encoded) > 2048:

            # GnuPG can't handle long passwords, so encode differently

            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

                       .replace(b"\n", b"\\n")

                       .replace(b"\0", b"\\x00"))

        return encoded

    def encrypt(self, data, password):

        passphrase = self.password_encode(password)

        with tempfile.NamedTemporaryFile(

                dir=self.tempdir) as passfile:

            passfile.write(passphrase)

            passfile.flush()

            proc = subprocess.Popen([self.gpg, '--symmetric',

                                     '--passphrase-file',

                                     passfile.name]

                                    + self.gnupgargs,

                                    stdin=subprocess.PIPE,

                                    stdout=subprocess.PIPE,

                                    stderr=subprocess.PIPE)

            ciphertext, err = proc.communicate(input=data)

        if proc.returncode != 0:

            raise PGPError(err)

        return ciphertext

    def decrypt(self, data, password):

        passphrase = self.password_encode(password)

        with tempfile.NamedTemporaryFile(

                dir=self.tempdir) as passfile:

            passfile.write(passphrase)

            passfile.flush()

            proc = subprocess.Popen([self.gpg, '--decrypt',

                                     '--passphrase-file',

                                     passfile.name]

                                    + self.gnupgargs,

                                    stdin=subprocess.PIPE,

                                    stdout=subprocess.PIPE,

                                    stderr=subprocess.PIPE)

            decrypted_plaintext, err = proc.communicate(input=data)

        if proc.returncode != 0:

            raise PGPError(err)

        return decrypted_plaintext

# Pretend that we have an Avahi module

class Avahi(object):

    """This isn't so much a class as it is a module-like namespace.

    It is instantiated once, and simulates having an Avahi module."""

    IF_UNSPEC = -1               # avahi-common/address.h

    PROTO_UNSPEC = -1            # avahi-common/address.h

    PROTO_INET = 0               # avahi-common/address.h

    PROTO_INET6 = 1              # avahi-common/address.h

    DBUS_NAME = "org.freedesktop.Avahi"

    DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

    DBUS_PATH_SERVER = "/"

    def string_array_to_txt_array(self, t):

        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

                           for s in t), signature="ay")

    ENTRY_GROUP_ESTABLISHED = 2  # avahi-common/defs.h

    ENTRY_GROUP_COLLISION = 3    # avahi-common/defs.h

    ENTRY_GROUP_FAILURE = 4      # avahi-common/defs.h

    SERVER_INVALID = 0           # avahi-common/defs.h

    SERVER_REGISTERING = 1       # avahi-common/defs.h

    SERVER_RUNNING = 2           # avahi-common/defs.h

    SERVER_COLLISION = 3         # avahi-common/defs.h

    SERVER_FAILURE = 4           # avahi-common/defs.h

avahi = Avahi()

class AvahiError(Exception):

    def __init__(self, value, *args, **kwargs):

        self.value = value

        return super(AvahiError, self).__init__(value, *args,

                                                **kwargs)

class AvahiServiceError(AvahiError):

    pass

class AvahiGroupError(AvahiError):

    pass

class AvahiService(object):

    """An Avahi (Zeroconf) service.

    Attributes:

    interface: integer; avahi.IF_UNSPEC or an interface index.

               Used to optionally bind to the specified interface.

    name: string; Example: 'Mandos'

    type: string; Example: '_mandos._tcp'.

     See <https://www.iana.org/assignments/service-names-port-numbers>

    port: integer; what port to announce

    TXT: list of strings; TXT record for the service

    domain: string; Domain to publish on, default to .local if empty.

    host: string; Host to publish records for, default is localhost

    max_renames: integer; maximum number of renames

    rename_count: integer; counter so we only rename after collisions

                  a sensible number of times

    group: D-Bus Entry Group

    server: D-Bus Server

    bus: dbus.SystemBus()

    """

    def __init__(self,

                 interface=avahi.IF_UNSPEC,

                 name=None,

                 servicetype=None,

                 port=None,

                 TXT=None,

                 domain="",

                 host="",

                 max_renames=32768,

                 protocol=avahi.PROTO_UNSPEC,

                 bus=None):

        self.interface = interface

        self.name = name

        self.type = servicetype

        self.port = port

        self.TXT = TXT if TXT is not None else []

        self.domain = domain

        self.host = host

        self.rename_count = 0

        self.max_renames = max_renames

        self.protocol = protocol

        self.group = None       # our entry group

        self.server = None

        self.bus = bus

        self.entry_group_state_changed_match = None

    def rename(self, remove=True):

        """Derived from the Avahi example code"""

        if self.rename_count >= self.max_renames:

            logger.critical("No suitable Zeroconf service name found"

                            " after %i retries, exiting.",

                            self.rename_count)

            raise AvahiServiceError("Too many renames")

        self.name = str(

            self.server.GetAlternativeServiceName(self.name))

        self.rename_count += 1

        logger.info("Changing Zeroconf service name to %r ...",

                    self.name)

        if remove:

            self.remove()

        try:

            self.add()

        except dbus.exceptions.DBusException as error:

            if (error.get_dbus_name()

                == "org.freedesktop.Avahi.CollisionError"):

                logger.info("Local Zeroconf service name collision.")

                return self.rename(remove=False)

            else:

                logger.critical("D-Bus Exception", exc_info=error)

                self.cleanup()

                os._exit(1)

    def remove(self):

        """Derived from the Avahi example code"""

        if self.entry_group_state_changed_match is not None:

            self.entry_group_state_changed_match.remove()

            self.entry_group_state_changed_match = None

        if self.group is not None:

            self.group.Reset()

    def add(self):

        """Derived from the Avahi example code"""

        self.remove()

        if self.group is None:

            self.group = dbus.Interface(

                self.bus.get_object(avahi.DBUS_NAME,

                                    self.server.EntryGroupNew()),

                avahi.DBUS_INTERFACE_ENTRY_GROUP)

        self.entry_group_state_changed_match = (

            self.group.connect_to_signal(

                'StateChanged', self.entry_group_state_changed))

        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

                     self.name, self.type)

        self.group.AddService(

            self.interface,

            self.protocol,

            dbus.UInt32(0),     # flags

            self.name, self.type,

            self.domain, self.host,

            dbus.UInt16(self.port),

            avahi.string_array_to_txt_array(self.TXT))

        self.group.Commit()

    def entry_group_state_changed(self, state, error):

        """Derived from the Avahi example code"""

        logger.debug("Avahi entry group state change: %i", state)

        if state == avahi.ENTRY_GROUP_ESTABLISHED:

            logger.debug("Zeroconf service established.")

        elif state == avahi.ENTRY_GROUP_COLLISION:

            logger.info("Zeroconf service name collision.")

            self.rename()

        elif state == avahi.ENTRY_GROUP_FAILURE:

            logger.critical("Avahi: Error in group state changed %s",

                            str(error))

            raise AvahiGroupError("State changed: {!s}".format(error))

    def cleanup(self):

        """Derived from the Avahi example code"""

        if self.group is not None:

            try:

                self.group.Free()

            except (dbus.exceptions.UnknownMethodException,

                    dbus.exceptions.DBusException):

                pass

            self.group = None

        self.remove()

    def server_state_changed(self, state, error=None):

        """Derived from the Avahi example code"""

        logger.debug("Avahi server state change: %i", state)

        bad_states = {

            avahi.SERVER_INVALID: "Zeroconf server invalid",

            avahi.SERVER_REGISTERING: None,

            avahi.SERVER_COLLISION: "Zeroconf server name collision",

            avahi.SERVER_FAILURE: "Zeroconf server failure",

        }

        if state in bad_states:

            if bad_states[state] is not None:

                if error is None:

                    logger.error(bad_states[state])

                else:

                    logger.error(bad_states[state] + ": %r", error)

            self.cleanup()

        elif state == avahi.SERVER_RUNNING:

            try:

                self.add()

            except dbus.exceptions.DBusException as error:

                if (error.get_dbus_name()

                    == "org.freedesktop.Avahi.CollisionError"):

                    logger.info("Local Zeroconf service name"

                                " collision.")

                    return self.rename(remove=False)

                else:

                    logger.critical("D-Bus Exception", exc_info=error)

                    self.cleanup()

                    os._exit(1)

        else:

            if error is None:

                logger.debug("Unknown state: %r", state)

            else:

                logger.debug("Unknown state: %r: %r", state, error)

    def activate(self):

        """Derived from the Avahi example code"""

        if self.server is None:

            self.server = dbus.Interface(

                self.bus.get_object(avahi.DBUS_NAME,

                                    avahi.DBUS_PATH_SERVER,

                                    follow_name_owner_changes=True),

                avahi.DBUS_INTERFACE_SERVER)

        self.server.connect_to_signal("StateChanged",

                                      self.server_state_changed)

        self.server_state_changed(self.server.GetState())

class AvahiServiceToSyslog(AvahiService):

    def rename(self, *args, **kwargs):

        """Add the new name to the syslog messages"""

        ret = AvahiService.rename(self, *args, **kwargs)

        syslogger.setFormatter(logging.Formatter(

            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

            .format(self.name)))

        return ret

# Pretend that we have a GnuTLS module

class GnuTLS(object):

    """This isn't so much a class as it is a module-like namespace.

    It is instantiated once, and simulates having a GnuTLS module."""

    library = ctypes.util.find_library("gnutls")

    if library is None:

        library = ctypes.util.find_library("gnutls-deb0")

    _library = ctypes.cdll.LoadLibrary(library)

    del library

    _need_version = b"3.3.0"

    def __init__(self):

        # Need to use class name "GnuTLS" here, since this method is

        # called before the assignment to the "gnutls" global variable

        # happens.

        if GnuTLS.check_version(self._need_version) is None:

            raise GnuTLS.Error("Needs GnuTLS {} or later"

                               .format(self._need_version))

    # Unless otherwise indicated, the constants and types below are

    # all from the gnutls/gnutls.h C header file.

    # Constants

    E_SUCCESS = 0

    E_INTERRUPTED = -52

    E_AGAIN = -28

    CRT_OPENPGP = 2

    CLIENT = 2

    SHUT_RDWR = 0

    CRD_CERTIFICATE = 1

    E_NO_CERTIFICATE_FOUND = -49

    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h

    # Types

    class session_int(ctypes.Structure):

        _fields_ = []

    session_t = ctypes.POINTER(session_int)

    class certificate_credentials_st(ctypes.Structure):

        _fields_ = []

    certificate_credentials_t = ctypes.POINTER(

        certificate_credentials_st)

    certificate_type_t = ctypes.c_int

    class datum_t(ctypes.Structure):

        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

                    ('size', ctypes.c_uint)]

    class openpgp_crt_int(ctypes.Structure):

        _fields_ = []

    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h

    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

    credentials_type_t = ctypes.c_int

    transport_ptr_t = ctypes.c_void_p

    close_request_t = ctypes.c_int

    # Exceptions

    class Error(Exception):

        # We need to use the class name "GnuTLS" here, since this

        # exception might be raised from within GnuTLS.__init__,

        # which is called before the assignment to the "gnutls"

        # global variable has happened.

        def __init__(self, message=None, code=None, args=()):

            # Default usage is by a message string, but if a return

            # code is passed, convert it to a string with

            # gnutls.strerror()

            self.code = code

            if message is None and code is not None:

                message = GnuTLS.strerror(code)

            return super(GnuTLS.Error, self).__init__(

                message, *args)

    class CertificateSecurityError(Error):

        pass

    # Classes

    class Credentials(object):

        def __init__(self):

            self._c_object = gnutls.certificate_credentials_t()

            gnutls.certificate_allocate_credentials(

                ctypes.byref(self._c_object))

            self.type = gnutls.CRD_CERTIFICATE

        def __del__(self):

            gnutls.certificate_free_credentials(self._c_object)

    class ClientSession(object):

        def __init__(self, socket, credentials=None):

            self._c_object = gnutls.session_t()

            gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

            gnutls.set_default_priority(self._c_object)

            gnutls.transport_set_ptr(self._c_object, socket.fileno())

            gnutls.handshake_set_private_extensions(self._c_object,

                                                    True)

            self.socket = socket

            if credentials is None:

                credentials = gnutls.Credentials()

            gnutls.credentials_set(self._c_object, credentials.type,

                                   ctypes.cast(credentials._c_object,

                                               ctypes.c_void_p))

            self.credentials = credentials

        def __del__(self):

            gnutls.deinit(self._c_object)

        def handshake(self):

            return gnutls.handshake(self._c_object)

        def send(self, data):

            data = bytes(data)

            data_len = len(data)

            while data_len > 0:

                data_len -= gnutls.record_send(self._c_object,

                                               data[-data_len:],

                                               data_len)

        def bye(self):