/mandos/release

#!/usr/bin/python3 -bI

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

# Copyright © 2008-2020 Teddy Hogeborn

# Copyright © 2008-2020 Björn Påhlsson

#

# This file is part of Mandos.

#

# Mandos is free software: you can redistribute it and/or modify it

# under the terms of the GNU General Public License as published by

#     Mandos is distributed in the hope that it will be useful, but

#     WITHOUT ANY WARRANTY; without even the implied warranty of

# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.

import unittest

import random

import shlex

import gi

if sys.version_info.major == 2:

    __metaclass__ = type

    str = unicode

 

# Add collections.abc.Callable if it does not exist

try:

    collections.abc.Callable

except AttributeError:

    class abc:

        Callable = collections.Callable

    collections.abc = abc

    del abc

 

# Add shlex.quote if it does not exist

try:

    shlex.quote

except AttributeError:

    shlex.quote = re.escape

 

# Show warnings by default

if not sys.warnoptions:

    import warnings

    warnings.simplefilter("default")

 

if sys.version_info < (3, 2):

    configparser.Configparser = configparser.SafeConfigParser

version = "1.8.14"

log = logging.getLogger(os.path.basename(sys.argv[0]))

logging.captureWarnings(True)   # Show warnings via the logging system

                           ("Mandos [%(process)d]: %(levelname)s:"

                            " %(message)s"))

    log.addHandler(syslogger)

        console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

                                               " [%(process)d]:"

                                               " %(levelname)s:"

                                               " %(message)s"))

        log.addHandler(console)

    log.setLevel(level)

class PGPEngine:

                if name == b"gpg":

        self.gnupgargs = ["--batch",

                          "--homedir", self.tempdir,

                          "--force-mdc",

                          "--quiet"]

        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

            proc = subprocess.Popen([self.gpg, "--symmetric",

                                     "--passphrase-file",

            proc = subprocess.Popen([self.gpg, "--decrypt",

                                     "--passphrase-file",

class avahi:

    """This isn't so much a class as it is a module-like namespace."""

    @staticmethod

    def string_array_to_txt_array(t):

class AvahiService:

    name: string; Example: "Mandos"

    type: string; Example: "_mandos._tcp".

            log.critical("No suitable Zeroconf service name found"

                         " after %i retries, exiting.",

                         self.rename_count)

        log.info("Changing Zeroconf service name to %r ...",

                 self.name)

                log.info("Local Zeroconf service name collision.")

                log.critical("D-Bus Exception", exc_info=error)

                "StateChanged", self.entry_group_state_changed))

        log.debug("Adding Zeroconf service '%s' of type '%s' ...",

                  self.name, self.type)

        log.debug("Avahi entry group state change: %i", state)

            log.debug("Zeroconf service established.")

            log.info("Zeroconf service name collision.")

            log.critical("Avahi: Error in group state changed %s",

                         str(error))

        log.debug("Avahi server state change: %i", state)

                    log.error(bad_states[state])

                    log.error(bad_states[state] + ": %r", error)

                    log.info("Local Zeroconf service name collision.")

                    log.critical("D-Bus Exception", exc_info=error)

                log.debug("Unknown state: %r", state)

                log.debug("Unknown state: %r: %r", state, error)

        ret = super(AvahiServiceToSyslog, self).rename(*args,

                                                       **kwargs)

            "Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

class gnutls:

    """This isn't so much a class as it is a module-like namespace."""

    CRT_RAWPK = 3

    X509_FMT_DER = 0

    NO_TICKETS = 1<<10

    ENABLE_RAWPK = 1<<18

    CTYPE_PEERS = 3

    KEYID_USE_SHA256 = 1        # gnutls/x509.h

    class _session_int(ctypes.Structure):

    session_t = ctypes.POINTER(_session_int)

        _fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

                    ("size", ctypes.c_uint)]

    class _openpgp_crt_int(ctypes.Structure):

    openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

                message = gnutls.strerror(code).decode(

                    "utf-8", errors="replace")

            return super(gnutls.Error, self).__init__(

    class PointerTo:

        def __init__(self, cls):

            self.cls = cls

 

        def from_param(self, obj):

            if not isinstance(obj, self.cls):

                raise TypeError("Not of type {}: {!r}"

                                .format(self.cls.__name__, obj))

            return ctypes.byref(obj.from_param(obj))

 

    class CastToVoidPointer:

        def __init__(self, cls):

            self.cls = cls

 

        def from_param(self, obj):

            if not isinstance(obj, self.cls):

                raise TypeError("Not of type {}: {!r}"

                                .format(self.cls.__name__, obj))

            return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

 

    class With_from_param:

        @classmethod

        def from_param(cls, obj):

            return obj._as_parameter_

 

    class Credentials(With_from_param):

            self._as_parameter_ = gnutls.certificate_credentials_t()

            gnutls.certificate_allocate_credentials(self)

            gnutls.certificate_free_credentials(self)

    class ClientSession(With_from_param):

            self._as_parameter_ = gnutls.session_t()

            gnutls_flags = gnutls.CLIENT

            if gnutls.check_version(b"3.5.6"):

                gnutls_flags |= gnutls.NO_TICKETS

            if gnutls.has_rawpk:

                gnutls_flags |= gnutls.ENABLE_RAWPK

            gnutls.init(self, gnutls_flags)

            del gnutls_flags

            gnutls.set_default_priority(self)

            gnutls.transport_set_ptr(self, socket.fileno())

            gnutls.handshake_set_private_extensions(self, True)

            gnutls.credentials_set(self, credentials.type,

                                   credentials)

            gnutls.deinit(self)

            return gnutls.handshake(self)

                data_len -= gnutls.record_send(self, data[-data_len:],

            return gnutls.bye(self, gnutls.SHUT_RDWR)

        for the "restype" attribute on ctypes functions"""

        if result >= gnutls.E_SUCCESS:

    def _retry_on_error(result, func, arguments,

                        _error_code=_error_code):

        for the "errcheck" attribute on ctypes functions"""

        while result < gnutls.E_SUCCESS:

    priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

    init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

    set_default_priority.argtypes = [ClientSession]

    record_send.argtypes = [ClientSession, ctypes.c_void_p,

        PointerTo(Credentials)]

    certificate_free_credentials.argtypes = [Credentials]

    handshake_set_private_extensions.argtypes = [ClientSession,

    credentials_set.argtypes = [ClientSession, credentials_type_t,

                                CastToVoidPointer(Credentials)]

    certificate_type_get.argtypes = [ClientSession]

    certificate_get_peers.argtypes = [ClientSession,

    deinit.argtypes = [ClientSession]

    handshake.argtypes = [ClientSession]

    handshake.restype = ctypes.c_int

    transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

    bye.argtypes = [ClientSession, close_request_t]

    bye.restype = ctypes.c_int

    _need_version = b"3.3.0"

    if check_version(_need_version) is None:

        raise self.Error("Needs GnuTLS {} or later"

                         .format(_need_version))

 

    _tls_rawpk_version = b"3.6.6"

    has_rawpk = bool(check_version(_tls_rawpk_version))

 

    if has_rawpk:

        # Types

        class pubkey_st(ctypes.Structure):

            _fields = []

        pubkey_t = ctypes.POINTER(pubkey_st)

 

        x509_crt_fmt_t = ctypes.c_int

 

        # All the function declarations below are from

        # gnutls/abstract.h

        pubkey_init = _library.gnutls_pubkey_init

        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

        pubkey_init.restype = _error_code

 

        pubkey_import = _library.gnutls_pubkey_import

        pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

                                  x509_crt_fmt_t]

        pubkey_import.restype = _error_code

 

        pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

        pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

                                      ctypes.POINTER(ctypes.c_ubyte),

                                      ctypes.POINTER(ctypes.c_size_t)]

        pubkey_get_key_id.restype = _error_code

 

        pubkey_deinit = _library.gnutls_pubkey_deinit

        pubkey_deinit.argtypes = [pubkey_t]

        pubkey_deinit.restype = None

    else:

        # All the function declarations below are from

        # gnutls/openpgp.h

 

        openpgp_crt_init = _library.gnutls_openpgp_crt_init

        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

        openpgp_crt_init.restype = _error_code

 

        openpgp_crt_import = _library.gnutls_openpgp_crt_import

        openpgp_crt_import.argtypes = [openpgp_crt_t,

                                       ctypes.POINTER(datum_t),

                                       openpgp_crt_fmt_t]

        openpgp_crt_import.restype = _error_code

 

        openpgp_crt_verify_self = \

            _library.gnutls_openpgp_crt_verify_self

        openpgp_crt_verify_self.argtypes = [

            openpgp_crt_t,

            ctypes.c_uint,

            ctypes.POINTER(ctypes.c_uint),

        ]

        openpgp_crt_verify_self.restype = _error_code

 

        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

        openpgp_crt_deinit.argtypes = [openpgp_crt_t]

        openpgp_crt_deinit.restype = None

 

        openpgp_crt_get_fingerprint = (

            _library.gnutls_openpgp_crt_get_fingerprint)

        openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

                                                ctypes.c_void_p,

                                                ctypes.POINTER(

                                                    ctypes.c_size_t)]

        openpgp_crt_get_fingerprint.restype = _error_code

 

    if check_version(b"3.6.4"):

        certificate_type_get2 = _library.gnutls_certificate_type_get2

        certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

        certificate_type_get2.restype = _error_code

class Client:

    approved:   bool(); None if not yet approved/disapproved

    checker: multiprocessing.Process(); a running checker process used

             to see if the client lives. None if no process is

             running.

                 uniquely identify an OpenPGP client

    key_id: string (64 hexadecimal digits); used to uniquely identify

            a client using raw public keys

                          "created", "enabled", "expires", "key_id",

            # Uppercase and remove spaces from key_id and fingerprint

            # for later comparison purposes with return value from the

            # key_id() and fingerprint() functions

            client["key_id"] = (section.get("key_id", "").upper()

                                .replace(" ", ""))

        log.debug("Creating client %r", self.name)

        log.debug("  Key ID: %s", self.key_id)

        log.debug("  Fingerprint: %s", self.fingerprint)

            log.info("Disabling client %s", self.name)

            random.randrange(int(self.interval.total_seconds() * 1000

                                 + 1)),

        if self.checker is not None:

            self.checker.join()

        self.checker_callback_tag = None

        self.checker = None

                log.info("Checker for %(name)s succeeded", vars(self))

                log.info("Checker for %(name)s failed", vars(self))

            log.warning("Checker for %(name)s crashed?", vars(self))

            log.warning("Checker was not alive; joining")

                attr: shlex.quote(str(getattr(self, attr)))

                log.error('Could not format string "%s"',

                          self.checker_command, exc_info=error)

            log.info("Starting checker %r for %s", command, self.name)

                GLib.IOChannel.unix_new(pipe[0].fileno()),

                GLib.PRIORITY_DEFAULT, GLib.IO_IN,

        log.debug("Stopping checker for %(name)s", vars(self))

        func._dbus_get_args_options = {"byte_arrays": byte_arrays}

                         path_keyword="object_path",

                         connection_keyword="connection")

            log.error("Failed to override Introspection method",

                      exc_info=error)

            value = dbus.ByteArray(bytes(value))

                         path_keyword="object_path",

                         connection_keyword="connection")

            log.error("Failed to override Introspection method",

                      exc_info=error)

                         path_keyword="object_path",

                         connection_keyword="connection")

            log.error("Failed to override Introspection method",

                      exc_info=error)

    # KeyID - property

    @dbus_annotations(

        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

    @dbus_service_property(_interface, signature="s", access="read")

    def KeyID_dbus_property(self):

        return dbus.String(self.key_id)

 

class ProxyClient:

    def __init__(self, child_pipe, key_id, fpr, address):

        self._pipe.send(("init", key_id, fpr, address))

            raise KeyError(key_id or fpr)

        if name == "_pipe":

        self._pipe.send(("getattr", name))

        if data[0] == "data":

        if data[0] == "function":

                self._pipe.send(("funcall", name, args, kwargs))

        if name == "_pipe":

        self._pipe.send(("setattr", name, value))

            log.info("TCP connection from: %s",

                     str(self.client_address))

            log.debug("Pipe FD: %d", self.server.child_pipe.fileno())

            # priority = ":".join(("NONE", "+VERS-TLS1.1",

            gnutls.priority_set_direct(session,

                                       priority.encode("utf-8"), None)

            log.debug("Protocol version: %r", line)

                log.error("Unknown protocol version: %s", error)

                log.warning("Handshake failed: %s", error)

            log.debug("Handshake succeeded")

                if gnutls.has_rawpk:

                    fpr = b""

                    try:

                        key_id = self.key_id(

                            self.peer_certificate(session))

                    except (TypeError, gnutls.Error) as error:

                        log.warning("Bad certificate: %s", error)

                        return

                    log.debug("Key ID: %s",

                              key_id.decode("utf-8",

                                            errors="replace"))

 

                else:

                    key_id = b""

                    try:

                        fpr = self.fingerprint(

                            self.peer_certificate(session))

                    except (TypeError, gnutls.Error) as error:

                        log.warning("Bad certificate: %s", error)

                        return

                    log.debug("Fingerprint: %s", fpr)

 

                try:

                    client = ProxyClient(child_pipe, key_id, fpr,

                        log.info("Client %s is disabled", client.name)

                        log.info("Client %s needs approval",

                                 client.name)

                        log.warning("Client %s was not approved",

                                    client.name)

                            log.warning("Client %s timed out while"

                                        " waiting for approval",

                                        client.name)

                    log.warning("gnutls send failed", exc_info=error)

                log.info("Sending secret to %s", client.name)

                    log.warning("GnuTLS bye failed", exc_info=error)

        "Return the peer's certificate as a bytestring"

        try:

            cert_type = gnutls.certificate_type_get2(

                session, gnutls.CTYPE_PEERS)

        except AttributeError:

            cert_type = gnutls.certificate_type_get(session)

        if gnutls.has_rawpk:

            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

        else:

            valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

        # If not a valid certificate type...

        if cert_type not in valid_cert_types:

            log.info("Cert type %r not in %r", cert_type,

                     valid_cert_types)

                     (session, ctypes.byref(list_size)))

    def key_id(certificate):

        "Convert a certificate bytestring to a hexdigit key ID"

        # New GnuTLS "datum" with the public key

        datum = gnutls.datum_t(

            ctypes.cast(ctypes.c_char_p(certificate),

                        ctypes.POINTER(ctypes.c_ubyte)),

            ctypes.c_uint(len(certificate)))

        # XXX all these need to be created in the gnutls "module"

        # New empty GnuTLS certificate

        pubkey = gnutls.pubkey_t()

        gnutls.pubkey_init(ctypes.byref(pubkey))

        # Import the raw public key into the certificate

        gnutls.pubkey_import(pubkey,

                             ctypes.byref(datum),

                             gnutls.X509_FMT_DER)

        # New buffer for the key ID

        buf = ctypes.create_string_buffer(32)

        buf_len = ctypes.c_size_t(len(buf))

        # Get the key ID from the raw public key into the buffer

        gnutls.pubkey_get_key_id(

            pubkey,

            gnutls.KEYID_USE_SHA256,

            ctypes.cast(ctypes.byref(buf),

                        ctypes.POINTER(ctypes.c_ubyte)),

            ctypes.byref(buf_len))

        # Deinit the certificate

        gnutls.pubkey_deinit(pubkey)

 

        # Convert the buffer to a Python bytestring

        key_id = ctypes.string_at(buf, buf_len.value)

        # Convert the bytestring to hexadecimal notation

        hex_key_id = binascii.hexlify(key_id).upper()

        return hex_key_id

 

    @staticmethod

            raise gnutls.CertificateSecurityError(code

                                                  =crtverify.value)

class MultiprocessingMixIn:

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

                     socketserver.TCPServer):

    """IPv6-capable TCP server.  Accepts None as address and/or port

                log.warning("SO_BINDTODEVICE not found, trying 25")

                    log.error("No permission to bind to interface %s",

                              self.interface)

                    log.error("SO_BINDTODEVICE not available; cannot"

                              " bind to interface %s", self.interface)

                    log.error("Interface %s does not exist, cannot"

                              " bind", self.interface)

            if self.server_address[1]:

                self.allow_reuse_address = True

            GLib.IOChannel.unix_new(parent_pipe.fileno()),

            GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

        if command == "init":

            key_id = request[1].decode("ascii")

            fpr = request[2].decode("ascii")

            address = request[3]

                if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

                              "27AE41E4649B934CA495991B7852B855"):

                    continue

                if key_id and c.key_id == key_id:

                    client = c

                    break

                if fpr and c.fingerprint == fpr:

                log.info("Client not found for key ID: %s, address:"

                         " %s", key_id or fpr, address)

                    mandos_dbus_service.ClientNotFound(key_id or fpr,

                GLib.IOChannel.unix_new(parent_pipe.fileno()),

                GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

        if command == "funcall":

            parent_pipe.send(("data", getattr(client_object,

        if command == "getattr":

                          collections.abc.Callable):

                parent_pipe.send(("function", ))

                    "data", client_object.__getattribute__(attrname)))

        if command == "setattr":

    >>> timedelta = datetime.timedelta

    >>> rfc3339_duration_to_delta("P7D") == timedelta(7)

    True

    >>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

    True

    >>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

    True

    >>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

    True

    >>> rfc3339_duration_to_delta("P1W") == timedelta(7)

    True

    >>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

    True

    >>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

    True

    >>> del timedelta