/mandos/release : revision 237.7.475

1

#!/usr/bin/python3 -bI

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This file is part of Mandos.

18

#

77

import itertools

78

import collections

79

import codecs

80

import unittest

81

import random

82

import shlex

83

80

84

81

import dbus

85

82

import dbus.service

86

import gi

87

83

from gi.repository import GLib

88

84

from dbus.mainloop.glib import DBusGMainLoop

89

85

import ctypes

91

87

import xml.dom.minidom

92

88

import inspect

93

89

94

if sys.version_info.major == 2:

95

__metaclass__ = type

96

str = unicode

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Show warnings by default

114

if not sys.warnoptions:

115

import warnings

116

warnings.simplefilter("default")

117

118

90

# Try to find the value of SO_BINDTODEVICE:

119

91

try:

120

92

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

140

112

# No value found

141

113

SO_BINDTODEVICE = None

142

114

143

if sys.version_info < (3, 2):

144

configparser.Configparser = configparser.SafeConfigParser

115

if sys.version_info.major == 2:

116

str = unicode

145

117

146

version = "1.8.14"

118

version = "1.7.16"

147

119

stored_state_file = "clients.pickle"

148

120

149

121

logger = logging.getLogger()

150

logging.captureWarnings(True) # Show warnings via the logging system

151

122

syslogger = None

152

123

153

124

try:

189

160

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

190

161

address="/dev/log"))

191

162

syslogger.setFormatter(logging.Formatter

192

("Mandos [%(process)d]: %(levelname)s:"

193

" %(message)s"))

163

('Mandos [%(process)d]: %(levelname)s:'

164

' %(message)s'))

194

165

logger.addHandler(syslogger)

195

166

196

167

if debug:

197

168

console = logging.StreamHandler()

198

console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

199

" [%(process)d]:"

200

" %(levelname)s:"

201

" %(message)s"))

169

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

170

' [%(process)d]:'

171

' %(levelname)s:'

172

' %(message)s'))

202

173

logger.addHandler(console)

203

174

logger.setLevel(level)

204

175

208

179

pass

209

180

210

181

211

class PGPEngine:

182

class PGPEngine(object):

212

183

"""A simple class for OpenPGP symmetric encryption & decryption"""

213

184

214

185

def __init__(self):

218

189

output = subprocess.check_output(["gpgconf"])

219

190

for line in output.splitlines():

220

191

name, text, path = line.split(b":")

221

if name == b"gpg":

192

if name == "gpg":

222

193

self.gpg = path

223

194

break

224

195

except OSError as e:

225

196

if e.errno != errno.ENOENT:

226

197

raise

227

self.gnupgargs = ["--batch",

228

"--homedir", self.tempdir,

229

"--force-mdc",

230

"--quiet"]

198

self.gnupgargs = ['--batch',

199

'--homedir', self.tempdir,

200

'--force-mdc',

201

'--quiet']

231

202

# Only GPG version 1 has the --no-use-agent option.

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

203

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

233

204

self.gnupgargs.append("--no-use-agent")

234

205

235

206

def __enter__(self):

272

243

dir=self.tempdir) as passfile:

273

244

passfile.write(passphrase)

274

245

passfile.flush()

275

proc = subprocess.Popen([self.gpg, "--symmetric",

276

"--passphrase-file",

246

proc = subprocess.Popen([self.gpg, '--symmetric',

247

'--passphrase-file',

277

248

passfile.name]

278

249

+ self.gnupgargs,

279

250

stdin=subprocess.PIPE,

290

261

dir=self.tempdir) as passfile:

291

262

passfile.write(passphrase)

292

263

passfile.flush()

293

proc = subprocess.Popen([self.gpg, "--decrypt",

294

"--passphrase-file",

264

proc = subprocess.Popen([self.gpg, '--decrypt',

265

'--passphrase-file',

295

266

passfile.name]

296

267

+ self.gnupgargs,

297

268

stdin=subprocess.PIPE,

304

275

305

276

306

277

# Pretend that we have an Avahi module

307

class avahi:

308

"""This isn't so much a class as it is a module-like namespace."""

278

class Avahi(object):

279

"""This isn't so much a class as it is a module-like namespace.

280

It is instantiated once, and simulates having an Avahi module."""

309

281

IF_UNSPEC = -1 # avahi-common/address.h

310

282

PROTO_UNSPEC = -1 # avahi-common/address.h

311

283

PROTO_INET = 0 # avahi-common/address.h

315

287

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

316

288

DBUS_PATH_SERVER = "/"

317

289

318

@staticmethod

319

def string_array_to_txt_array(t):

290

def string_array_to_txt_array(self, t):

320

291

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

321

292

for s in t), signature="ay")

322

293

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

327

298

SERVER_RUNNING = 2 # avahi-common/defs.h

328

299

SERVER_COLLISION = 3 # avahi-common/defs.h

329

300

SERVER_FAILURE = 4 # avahi-common/defs.h

301

avahi = Avahi()

330

302

331

303

332

304

class AvahiError(Exception):

344

316

pass

345

317

346

318

347

class AvahiService:

319

class AvahiService(object):

348

320

"""An Avahi (Zeroconf) service.

349

321

350

322

Attributes:

351

323

interface: integer; avahi.IF_UNSPEC or an interface index.

352

324

Used to optionally bind to the specified interface.

353

name: string; Example: "Mandos"

354

type: string; Example: "_mandos._tcp".

325

name: string; Example: 'Mandos'

326

type: string; Example: '_mandos._tcp'.

355

327

See <https://www.iana.org/assignments/service-names-port-numbers>

356

328

port: integer; what port to announce

357

329

TXT: list of strings; TXT record for the service

435

407

avahi.DBUS_INTERFACE_ENTRY_GROUP)

436

408

self.entry_group_state_changed_match = (

437

409

self.group.connect_to_signal(

438

"StateChanged", self.entry_group_state_changed))

410

'StateChanged', self.entry_group_state_changed))

439

411

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

440

412

self.name, self.type)

441

413

self.group.AddService(

524

496

class AvahiServiceToSyslog(AvahiService):

525

497

def rename(self, *args, **kwargs):

526

498

"""Add the new name to the syslog messages"""

527

ret = super(AvahiServiceToSyslog, self).rename(*args,

528

**kwargs)

499

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

529

500

syslogger.setFormatter(logging.Formatter(

530

"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

501

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

531

502

.format(self.name)))

532

503

return ret

533

504

534

505

535

506

# Pretend that we have a GnuTLS module

536

class gnutls:

537

"""This isn't so much a class as it is a module-like namespace."""

507

class GnuTLS(object):

508

"""This isn't so much a class as it is a module-like namespace.

509

It is instantiated once, and simulates having a GnuTLS module."""

538

510

539

511

library = ctypes.util.find_library("gnutls")

540

512

if library is None:

541

513

library = ctypes.util.find_library("gnutls-deb0")

542

514

_library = ctypes.cdll.LoadLibrary(library)

543

515

del library

516

_need_version = b"3.3.0"

517

518

def __init__(self):

519

# Need to use "self" here, since this method is called before

520

# the assignment to the "gnutls" global variable happens.

521

if self.check_version(self._need_version) is None:

522

raise self.Error("Needs GnuTLS {} or later"

523

.format(self._need_version))

544

524

545

525

# Unless otherwise indicated, the constants and types below are

546

526

# all from the gnutls/gnutls.h C header file.

550

530

E_INTERRUPTED = -52

551

531

E_AGAIN = -28

552

532

CRT_OPENPGP = 2

553

CRT_RAWPK = 3

554

533

CLIENT = 2

555

534

SHUT_RDWR = 0

556

535

CRD_CERTIFICATE = 1

557

536

E_NO_CERTIFICATE_FOUND = -49

558

X509_FMT_DER = 0

559

NO_TICKETS = 1<<10

560

ENABLE_RAWPK = 1<<18

561

CTYPE_PEERS = 3

562

KEYID_USE_SHA256 = 1 # gnutls/x509.h

563

537

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

564

538

565

539

# Types

566

class _session_int(ctypes.Structure):

540

class session_int(ctypes.Structure):

567

541

_fields_ = []

568

session_t = ctypes.POINTER(_session_int)

542

session_t = ctypes.POINTER(session_int)

569

543

570

544

class certificate_credentials_st(ctypes.Structure):

571

545

_fields_ = []

574

548

certificate_type_t = ctypes.c_int

575

549

576

550

class datum_t(ctypes.Structure):

577

_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

578

("size", ctypes.c_uint)]

551

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

552

('size', ctypes.c_uint)]

579

553

580

class _openpgp_crt_int(ctypes.Structure):

554

class openpgp_crt_int(ctypes.Structure):

581

555

_fields_ = []

582

openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

556

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

583

557

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

584

558

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

585

559

credentials_type_t = ctypes.c_int

588

562

589

563

# Exceptions

590

564

class Error(Exception):

565

# We need to use the class name "GnuTLS" here, since this

566

# exception might be raised from within GnuTLS.__init__,

567

# which is called before the assignment to the "gnutls"

568

# global variable has happened.

591

569

def __init__(self, message=None, code=None, args=()):

592

570

# Default usage is by a message string, but if a return

593

571

# code is passed, convert it to a string with

594

572

# gnutls.strerror()

595

573

self.code = code

596

574

if message is None and code is not None:

597

message = gnutls.strerror(code).decode(

598

"utf-8", errors="replace")

599

return super(gnutls.Error, self).__init__(

575

message = GnuTLS.strerror(code)

576

return super(GnuTLS.Error, self).__init__(

600

577

message, *args)

601

578

602

579

class CertificateSecurityError(Error):

603

580

pass

604

581

605

class PointerTo:

606

def __init__(self, cls):

607

self.cls = cls

608

609

def from_param(self, obj):

610

if not isinstance(obj, self.cls):

611

raise TypeError("Not of type {}: {!r}"

612

.format(self.cls.__name__, obj))

613

return ctypes.byref(obj.from_param(obj))

614

615

class CastToVoidPointer:

616

def __init__(self, cls):

617

self.cls = cls

618

619

def from_param(self, obj):

620

if not isinstance(obj, self.cls):

621

raise TypeError("Not of type {}: {!r}"

622

.format(self.cls.__name__, obj))

623

return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

624

625

class With_from_param:

626

@classmethod

627

def from_param(cls, obj):

628

return obj._as_parameter_

629

630

582

# Classes

631

class Credentials(With_from_param):

583

class Credentials(object):

632

584

def __init__(self):

633

self._as_parameter_ = gnutls.certificate_credentials_t()

634

gnutls.certificate_allocate_credentials(self)

585

self._c_object = gnutls.certificate_credentials_t()

586

gnutls.certificate_allocate_credentials(

587

ctypes.byref(self._c_object))

635

588

self.type = gnutls.CRD_CERTIFICATE

636

589

637

590

def __del__(self):

638

gnutls.certificate_free_credentials(self)

591

gnutls.certificate_free_credentials(self._c_object)

639

592

640

class ClientSession(With_from_param):

593

class ClientSession(object):

641

594

def __init__(self, socket, credentials=None):

642

self._as_parameter_ = gnutls.session_t()

643

gnutls_flags = gnutls.CLIENT

644

if gnutls.check_version(b"3.5.6"):

645

gnutls_flags |= gnutls.NO_TICKETS

646

if gnutls.has_rawpk:

647

gnutls_flags |= gnutls.ENABLE_RAWPK

648

gnutls.init(self, gnutls_flags)

649

del gnutls_flags

650

gnutls.set_default_priority(self)

651

gnutls.transport_set_ptr(self, socket.fileno())

652

gnutls.handshake_set_private_extensions(self, True)

595

self._c_object = gnutls.session_t()

596

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

597

gnutls.set_default_priority(self._c_object)

598

gnutls.transport_set_ptr(self._c_object, socket.fileno())

599

gnutls.handshake_set_private_extensions(self._c_object,

600

True)

653

601

self.socket = socket

654

602

if credentials is None:

655

603

credentials = gnutls.Credentials()

656

gnutls.credentials_set(self, credentials.type,

657

credentials)

604

gnutls.credentials_set(self._c_object, credentials.type,

605

ctypes.cast(credentials._c_object,

606

ctypes.c_void_p))

658

607

self.credentials = credentials

659

608

660

609

def __del__(self):

661

gnutls.deinit(self)

610

gnutls.deinit(self._c_object)

662

611

663

612

def handshake(self):

664

return gnutls.handshake(self)

613

return gnutls.handshake(self._c_object)

665

614

666

615

def send(self, data):

667

616

data = bytes(data)

668

617

data_len = len(data)

669

618

while data_len > 0:

670

data_len -= gnutls.record_send(self, data[-data_len:],

619

data_len -= gnutls.record_send(self._c_object,

620

data[-data_len:],

671

621

data_len)

672

622

673

623

def bye(self):

674

return gnutls.bye(self, gnutls.SHUT_RDWR)

624

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

675

625

676

626

# Error handling functions

677

627

def _error_code(result):

678

628

"""A function to raise exceptions on errors, suitable

679

for the "restype" attribute on ctypes functions"""

680

if result >= gnutls.E_SUCCESS:

629

for the 'restype' attribute on ctypes functions"""

630

if result >= 0:

681

631

return result

682

632

if result == gnutls.E_NO_CERTIFICATE_FOUND:

683

633

raise gnutls.CertificateSecurityError(code=result)

684

634

raise gnutls.Error(code=result)

685

635

686

def _retry_on_error(result, func, arguments,

687

_error_code=_error_code):

636

def _retry_on_error(result, func, arguments):

688

637

"""A function to retry on some errors, suitable

689

for the "errcheck" attribute on ctypes functions"""

690

while result < gnutls.E_SUCCESS:

638

for the 'errcheck' attribute on ctypes functions"""

639

while result < 0:

691

640

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

692

641

return _error_code(result)

693

642

result = func(*arguments)

698

647

699

648

# Functions

700

649

priority_set_direct = _library.gnutls_priority_set_direct

701

priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

650

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

702

651

ctypes.POINTER(ctypes.c_char_p)]

703

652

priority_set_direct.restype = _error_code

704

653

705

654

init = _library.gnutls_init

706

init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

655

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

707

656

init.restype = _error_code

708

657

709

658

set_default_priority = _library.gnutls_set_default_priority

710

set_default_priority.argtypes = [ClientSession]

659

set_default_priority.argtypes = [session_t]

711

660

set_default_priority.restype = _error_code

712

661

713

662

record_send = _library.gnutls_record_send

714

record_send.argtypes = [ClientSession, ctypes.c_void_p,

663

record_send.argtypes = [session_t, ctypes.c_void_p,

715

664

ctypes.c_size_t]

716

665

record_send.restype = ctypes.c_ssize_t

717

666

record_send.errcheck = _retry_on_error

719

668

certificate_allocate_credentials = (

720

669

_library.gnutls_certificate_allocate_credentials)

721

670

certificate_allocate_credentials.argtypes = [

722

PointerTo(Credentials)]

671

ctypes.POINTER(certificate_credentials_t)]

723

672

certificate_allocate_credentials.restype = _error_code

724

673

725

674

certificate_free_credentials = (

726

675

_library.gnutls_certificate_free_credentials)

727

certificate_free_credentials.argtypes = [Credentials]

676

certificate_free_credentials.argtypes = [

677

certificate_credentials_t]

728

678

certificate_free_credentials.restype = None

729

679

730

680

handshake_set_private_extensions = (

731

681

_library.gnutls_handshake_set_private_extensions)

732

handshake_set_private_extensions.argtypes = [ClientSession,

682

handshake_set_private_extensions.argtypes = [session_t,

733

683

ctypes.c_int]

734

684

handshake_set_private_extensions.restype = None

735

685

736

686

credentials_set = _library.gnutls_credentials_set

737

credentials_set.argtypes = [ClientSession, credentials_type_t,

738

CastToVoidPointer(Credentials)]

687

credentials_set.argtypes = [session_t, credentials_type_t,

688

ctypes.c_void_p]

739

689

credentials_set.restype = _error_code

740

690

741

691

strerror = _library.gnutls_strerror

743

693

strerror.restype = ctypes.c_char_p

744

694

745

695

certificate_type_get = _library.gnutls_certificate_type_get

746

certificate_type_get.argtypes = [ClientSession]

696

certificate_type_get.argtypes = [session_t]

747

697

certificate_type_get.restype = _error_code

748

698

749

699

certificate_get_peers = _library.gnutls_certificate_get_peers

750

certificate_get_peers.argtypes = [ClientSession,

700

certificate_get_peers.argtypes = [session_t,

751

701

ctypes.POINTER(ctypes.c_uint)]

752

702

certificate_get_peers.restype = ctypes.POINTER(datum_t)

753

703

760

710

global_set_log_function.restype = None

761

711

762

712

deinit = _library.gnutls_deinit

763

deinit.argtypes = [ClientSession]

713

deinit.argtypes = [session_t]

764

714

deinit.restype = None

765

715

766

716

handshake = _library.gnutls_handshake

767

handshake.argtypes = [ClientSession]

768

handshake.restype = ctypes.c_int

717

handshake.argtypes = [session_t]

718

handshake.restype = _error_code

769

719

handshake.errcheck = _retry_on_error

770

720

771

721

transport_set_ptr = _library.gnutls_transport_set_ptr

772

transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

722

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

773

723

transport_set_ptr.restype = None

774

724

775

725

bye = _library.gnutls_bye

776

bye.argtypes = [ClientSession, close_request_t]

777

bye.restype = ctypes.c_int

726

bye.argtypes = [session_t, close_request_t]

727

bye.restype = _error_code

778

728

bye.errcheck = _retry_on_error

779

729

780

730

check_version = _library.gnutls_check_version

781

731

check_version.argtypes = [ctypes.c_char_p]

782

732

check_version.restype = ctypes.c_char_p

783

733

784

_need_version = b"3.3.0"

785

if check_version(_need_version) is None:

786

raise self.Error("Needs GnuTLS {} or later"

787

.format(_need_version))

788

789

_tls_rawpk_version = b"3.6.6"

790

has_rawpk = bool(check_version(_tls_rawpk_version))

791

792

if has_rawpk:

793

# Types

794

class pubkey_st(ctypes.Structure):

795

_fields = []

796

pubkey_t = ctypes.POINTER(pubkey_st)

797

798

x509_crt_fmt_t = ctypes.c_int

799

800

# All the function declarations below are from

801

# gnutls/abstract.h

802

pubkey_init = _library.gnutls_pubkey_init

803

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

804

pubkey_init.restype = _error_code

805

806

pubkey_import = _library.gnutls_pubkey_import

807

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

808

x509_crt_fmt_t]

809

pubkey_import.restype = _error_code

810

811

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

812

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

813

ctypes.POINTER(ctypes.c_ubyte),

814

ctypes.POINTER(ctypes.c_size_t)]

815

pubkey_get_key_id.restype = _error_code

816

817

pubkey_deinit = _library.gnutls_pubkey_deinit

818

pubkey_deinit.argtypes = [pubkey_t]

819

pubkey_deinit.restype = None

820

else:

821

# All the function declarations below are from

822

# gnutls/openpgp.h

823

824

openpgp_crt_init = _library.gnutls_openpgp_crt_init

825

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

826

openpgp_crt_init.restype = _error_code

827

828

openpgp_crt_import = _library.gnutls_openpgp_crt_import

829

openpgp_crt_import.argtypes = [openpgp_crt_t,

830

ctypes.POINTER(datum_t),

831

openpgp_crt_fmt_t]

832

openpgp_crt_import.restype = _error_code

833

834

openpgp_crt_verify_self = \

835

_library.gnutls_openpgp_crt_verify_self

836

openpgp_crt_verify_self.argtypes = [

837

openpgp_crt_t,

838

ctypes.c_uint,

839

ctypes.POINTER(ctypes.c_uint),

840

]

841

openpgp_crt_verify_self.restype = _error_code

842

843

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

844

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

845

openpgp_crt_deinit.restype = None

846

847

openpgp_crt_get_fingerprint = (

848

_library.gnutls_openpgp_crt_get_fingerprint)

849

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

850

ctypes.c_void_p,

851

ctypes.POINTER(

852

ctypes.c_size_t)]

853

openpgp_crt_get_fingerprint.restype = _error_code

854

855

if check_version(b"3.6.4"):

856

certificate_type_get2 = _library.gnutls_certificate_type_get2

857

certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

858

certificate_type_get2.restype = _error_code

734

# All the function declarations below are from gnutls/openpgp.h

735

736

openpgp_crt_init = _library.gnutls_openpgp_crt_init

737

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

738

openpgp_crt_init.restype = _error_code

739

740

openpgp_crt_import = _library.gnutls_openpgp_crt_import

741

openpgp_crt_import.argtypes = [openpgp_crt_t,

742

ctypes.POINTER(datum_t),

743

openpgp_crt_fmt_t]

744

openpgp_crt_import.restype = _error_code

745

746

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

747

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

748

ctypes.POINTER(ctypes.c_uint)]

749

openpgp_crt_verify_self.restype = _error_code

750

751

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

752

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

753

openpgp_crt_deinit.restype = None

754

755

openpgp_crt_get_fingerprint = (

756

_library.gnutls_openpgp_crt_get_fingerprint)

757

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

758

ctypes.c_void_p,

759

ctypes.POINTER(

760

ctypes.c_size_t)]

761

openpgp_crt_get_fingerprint.restype = _error_code

859

762

860

763

# Remove non-public functions

861

764

del _error_code, _retry_on_error

765

# Create the global "gnutls" object, simulating a module

766

gnutls = GnuTLS()

862

767

863

768

864

769

def call_pipe(connection, # : multiprocessing.Connection

872

777

connection.close()

873

778

874

779

875

class Client:

780

class Client(object):

876

781

"""A representation of a client host served by this server.

877

782

878

783

Attributes:

879

approved: bool(); None if not yet approved/disapproved

784

approved: bool(); 'None' if not yet approved/disapproved

880

785

approval_delay: datetime.timedelta(); Time to wait for approval

881

786

approval_duration: datetime.timedelta(); Duration of one approval

882

checker: multiprocessing.Process(); a running checker process used

883

to see if the client lives. None if no process is

884

running.

787

checker: subprocess.Popen(); a running checker process used

788

to see if the client lives.

789

'None' if no process is running.

885

790

checker_callback_tag: a GLib event source tag, or None

886

791

checker_command: string; External command which is run to check

887

792

if client lives. %() expansions are done at

895

800

disable_initiator_tag: a GLib event source tag, or None

896

801

enabled: bool()

897

802

fingerprint: string (40 or 32 hexadecimal digits); used to

898

uniquely identify an OpenPGP client

899

key_id: string (64 hexadecimal digits); used to uniquely identify

900

a client using raw public keys

803

uniquely identify the client

901

804

host: string; available for use by the checker command

902

805

interval: datetime.timedelta(); How often to start a new checker

903

806

last_approval_request: datetime.datetime(); (UTC) or None

921

824

"""

922

825

923

826

runtime_expansions = ("approval_delay", "approval_duration",

924

"created", "enabled", "expires", "key_id",

827

"created", "enabled", "expires",

925

828

"fingerprint", "host", "interval",

926

829

"last_approval_request", "last_checked_ok",

927

830

"last_enabled", "name", "timeout")

957

860

client["enabled"] = config.getboolean(client_name,

958

861

"enabled")

959

862

960

# Uppercase and remove spaces from key_id and fingerprint

961

# for later comparison purposes with return value from the

962

# key_id() and fingerprint() functions

963

client["key_id"] = (section.get("key_id", "").upper()

964

.replace(" ", ""))

863

# Uppercase and remove spaces from fingerprint for later

864

# comparison purposes with return value from the

865

# fingerprint() function

965

866

client["fingerprint"] = (section["fingerprint"].upper()

966

867

.replace(" ", ""))

967

868

if "secret" in section:

1011

912

self.expires = None

1012

913

1013

914

logger.debug("Creating client %r", self.name)

1014

logger.debug(" Key ID: %s", self.key_id)

1015

915

logger.debug(" Fingerprint: %s", self.fingerprint)

1016

916

self.created = settings.get("created",

1017

917

datetime.datetime.utcnow())

1081

981

if self.checker_initiator_tag is not None:

1082

982

GLib.source_remove(self.checker_initiator_tag)

1083

983

self.checker_initiator_tag = GLib.timeout_add(

1084

random.randrange(int(self.interval.total_seconds() * 1000

1085

+ 1)),

984

int(self.interval.total_seconds() * 1000),

1086

985

self.start_checker)

1087

986

# Schedule a disable() when 'timeout' has passed

1088

987

if self.disable_initiator_tag is not None:

1095

994

def checker_callback(self, source, condition, connection,

1096

995

command):

1097

996

"""The checker has completed, so take appropriate actions."""

997

self.checker_callback_tag = None

998

self.checker = None

1098

999

# Read return code from connection (see call_pipe)

1099

1000

returncode = connection.recv()

1100

1001

connection.close()

1101

if self.checker is not None:

1102

self.checker.join()

1103

self.checker_callback_tag = None

1104

self.checker = None

1105

1002

1106

1003

if returncode >= 0:

1107

1004

self.last_checker_status = returncode

1163

1060

if self.checker is None:

1164

1061

# Escape attributes for the shell

1165

1062

escaped_attrs = {

1166

attr: shlex.quote(str(getattr(self, attr)))

1063

attr: re.escape(str(getattr(self, attr)))

1167

1064

for attr in self.runtime_expansions}

1168

1065

try:

1169

1066

command = self.checker_command % escaped_attrs

1196

1093

kwargs=popen_args)

1197

1094

self.checker.start()

1198

1095

self.checker_callback_tag = GLib.io_add_watch(

1199

GLib.IOChannel.unix_new(pipe[0].fileno()),

1200

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1096

pipe[0].fileno(), GLib.IO_IN,

1201

1097

self.checker_callback, pipe[0], command)

1202

1098

# Re-run this periodically if run by GLib.timeout_add

1203

1099

return True

1242

1138

func._dbus_name = func.__name__

1243

1139

if func._dbus_name.endswith("_dbus_property"):

1244

1140

func._dbus_name = func._dbus_name[:-14]

1245

func._dbus_get_args_options = {"byte_arrays": byte_arrays}

1141

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

1246

1142

return func

1247

1143

1248

1144

return decorator

1337

1233

1338

1234

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1339

1235

out_signature="s",

1340

path_keyword="object_path",

1341

connection_keyword="connection")

1236

path_keyword='object_path',

1237

connection_keyword='connection')

1342

1238

def Introspect(self, object_path, connection):

1343

1239

"""Overloading of standard D-Bus method.

1344

1240

1458

1354

raise ValueError("Byte arrays not supported for non-"

1459

1355

"'ay' signature {!r}"

1460

1356

.format(prop._dbus_signature))

1461

value = dbus.ByteArray(bytes(value))

1357

value = dbus.ByteArray(b''.join(chr(byte)

1358

for byte in value))

1462

1359

prop(value)

1463

1360

1464

1361

@dbus.service.method(dbus.PROPERTIES_IFACE,

1497

1394

1498

1395

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1499

1396

out_signature="s",

1500

path_keyword="object_path",

1501

connection_keyword="connection")

1397

path_keyword='object_path',

1398

connection_keyword='connection')

1502

1399

def Introspect(self, object_path, connection):

1503

1400

"""Overloading of standard D-Bus method.

1504

1401

1599

1496

1600

1497

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1601

1498

out_signature="s",

1602

path_keyword="object_path",

1603

connection_keyword="connection")

1499

path_keyword='object_path',

1500

connection_keyword='connection')

1604

1501

def Introspect(self, object_path, connection):

1605

1502

"""Overloading of standard D-Bus method.

1606

1503

2102

1999

def Name_dbus_property(self):

2103

2000

return dbus.String(self.name)

2104

2001

2105

# KeyID - property

2106

@dbus_annotations(

2107

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2108

@dbus_service_property(_interface, signature="s", access="read")

2109

def KeyID_dbus_property(self):

2110

return dbus.String(self.key_id)

2111

2112

2002

# Fingerprint - property

2113

2003

@dbus_annotations(

2114

2004

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2269

2159

del _interface

2270

2160

2271

2161

2272

class ProxyClient:

2273

def __init__(self, child_pipe, key_id, fpr, address):

2162

class ProxyClient(object):

2163

def __init__(self, child_pipe, fpr, address):

2274

2164

self._pipe = child_pipe

2275

self._pipe.send(("init", key_id, fpr, address))

2165

self._pipe.send(('init', fpr, address))

2276

2166

if not self._pipe.recv():

2277

raise KeyError(key_id or fpr)

2167

raise KeyError(fpr)

2278

2168

2279

2169

def __getattribute__(self, name):

2280

if name == "_pipe":

2170

if name == '_pipe':

2281

2171

return super(ProxyClient, self).__getattribute__(name)

2282

self._pipe.send(("getattr", name))

2172

self._pipe.send(('getattr', name))

2283

2173

data = self._pipe.recv()

2284

if data[0] == "data":

2174

if data[0] == 'data':

2285

2175

return data[1]

2286

if data[0] == "function":

2176

if data[0] == 'function':

2287

2177

2288

2178

def func(*args, **kwargs):

2289

self._pipe.send(("funcall", name, args, kwargs))

2179

self._pipe.send(('funcall', name, args, kwargs))

2290

2180

return self._pipe.recv()[1]

2291

2181

2292

2182

return func

2293

2183

2294

2184

def __setattr__(self, name, value):

2295

if name == "_pipe":

2185

if name == '_pipe':

2296

2186

return super(ProxyClient, self).__setattr__(name, value)

2297

self._pipe.send(("setattr", name, value))

2187

self._pipe.send(('setattr', name, value))

2298

2188

2299

2189

2300

2190

class ClientHandler(socketserver.BaseRequestHandler, object):

2312

2202

2313

2203

session = gnutls.ClientSession(self.request)

2314

2204

2315

# priority = ":".join(("NONE", "+VERS-TLS1.1",

2205

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2316

2206

# "+AES-256-CBC", "+SHA1",

2317

2207

# "+COMP-NULL", "+CTYPE-OPENPGP",

2318

2208

# "+DHE-DSS"))

2320

2210

priority = self.server.gnutls_priority

2321

2211

if priority is None:

2322

2212

priority = "NORMAL"

2323

gnutls.priority_set_direct(session,

2324

priority.encode("utf-8"), None)

2213

gnutls.priority_set_direct(session._c_object,

2214

priority.encode("utf-8"),

2215

None)

2325

2216

2326

2217

# Start communication using the Mandos protocol

2327

2218

# Get protocol number

2346

2237

2347

2238

approval_required = False

2348

2239

try:

2349

if gnutls.has_rawpk:

2350

fpr = b""

2351

try:

2352

key_id = self.key_id(

2353

self.peer_certificate(session))

2354

except (TypeError, gnutls.Error) as error:

2355

logger.warning("Bad certificate: %s", error)

2356

return

2357

logger.debug("Key ID: %s",

2358

key_id.decode("utf-8",

2359

errors="replace"))

2360

2361

else:

2362

key_id = b""

2363

try:

2364

fpr = self.fingerprint(

2365

self.peer_certificate(session))

2366

except (TypeError, gnutls.Error) as error:

2367

logger.warning("Bad certificate: %s", error)

2368

return

2369

logger.debug("Fingerprint: %s", fpr)

2370

2371

try:

2372

client = ProxyClient(child_pipe, key_id, fpr,

2240

try:

2241

fpr = self.fingerprint(

2242

self.peer_certificate(session))

2243

except (TypeError, gnutls.Error) as error:

2244

logger.warning("Bad certificate: %s", error)

2245

return

2246

logger.debug("Fingerprint: %s", fpr)

2247

2248

try:

2249

client = ProxyClient(child_pipe, fpr,

2373

2250

self.client_address)

2374

2251

except KeyError:

2375

2252

return

2452

2329

2453

2330

@staticmethod

2454

2331

def peer_certificate(session):

2455

"Return the peer's certificate as a bytestring"

2456

try:

2457

cert_type = gnutls.certificate_type_get2(

2458

session, gnutls.CTYPE_PEERS)

2459

except AttributeError:

2460

cert_type = gnutls.certificate_type_get(session)

2461

if gnutls.has_rawpk:

2462

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2463

else:

2464

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2465

# If not a valid certificate type...

2466

if cert_type not in valid_cert_types:

2467

logger.info("Cert type %r not in %r", cert_type,

2468

valid_cert_types)

2332

"Return the peer's OpenPGP certificate as a bytestring"

2333

# If not an OpenPGP certificate...

2334

if (gnutls.certificate_type_get(session._c_object)

2335

!= gnutls.CRT_OPENPGP):

2469

2336

# ...return invalid data

2470

2337

return b""

2471

2338

list_size = ctypes.c_uint(1)

2472

2339

cert_list = (gnutls.certificate_get_peers

2473

(session, ctypes.byref(list_size)))

2340

(session._c_object, ctypes.byref(list_size)))

2474

2341

if not bool(cert_list) and list_size.value != 0:

2475

2342

raise gnutls.Error("error getting peer certificate")

2476

2343

if list_size.value == 0:

2479

2346

return ctypes.string_at(cert.data, cert.size)

2480

2347

2481

2348

@staticmethod

2482

def key_id(certificate):

2483

"Convert a certificate bytestring to a hexdigit key ID"

2484

# New GnuTLS "datum" with the public key

2485

datum = gnutls.datum_t(

2486

ctypes.cast(ctypes.c_char_p(certificate),

2487

ctypes.POINTER(ctypes.c_ubyte)),

2488

ctypes.c_uint(len(certificate)))

2489

# XXX all these need to be created in the gnutls "module"

2490

# New empty GnuTLS certificate

2491

pubkey = gnutls.pubkey_t()

2492

gnutls.pubkey_init(ctypes.byref(pubkey))

2493

# Import the raw public key into the certificate

2494

gnutls.pubkey_import(pubkey,

2495

ctypes.byref(datum),

2496

gnutls.X509_FMT_DER)

2497

# New buffer for the key ID

2498

buf = ctypes.create_string_buffer(32)

2499

buf_len = ctypes.c_size_t(len(buf))

2500

# Get the key ID from the raw public key into the buffer

2501

gnutls.pubkey_get_key_id(

2502

pubkey,

2503

gnutls.KEYID_USE_SHA256,

2504

ctypes.cast(ctypes.byref(buf),

2505

ctypes.POINTER(ctypes.c_ubyte)),

2506

ctypes.byref(buf_len))

2507

# Deinit the certificate

2508

gnutls.pubkey_deinit(pubkey)

2509

2510

# Convert the buffer to a Python bytestring

2511

key_id = ctypes.string_at(buf, buf_len.value)

2512

# Convert the bytestring to hexadecimal notation

2513

hex_key_id = binascii.hexlify(key_id).upper()

2514

return hex_key_id

2515

2516

@staticmethod

2517

2349

def fingerprint(openpgp):

2518

2350

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2519

2351

# New GnuTLS "datum" with the OpenPGP public key

2533

2365

ctypes.byref(crtverify))

2534

2366

if crtverify.value != 0:

2535

2367

gnutls.openpgp_crt_deinit(crt)

2536

raise gnutls.CertificateSecurityError(code

2537

=crtverify.value)

2368

raise gnutls.CertificateSecurityError("Verify failed")

2538

2369

# New buffer for the fingerprint

2539

2370

buf = ctypes.create_string_buffer(20)

2540

2371

buf_len = ctypes.c_size_t()

2550

2381

return hex_fpr

2551

2382

2552

2383

2553

class MultiprocessingMixIn:

2384

class MultiprocessingMixIn(object):

2554

2385

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2555

2386

2556

2387

def sub_process_main(self, request, address):

2568

2399

return proc

2569

2400

2570

2401

2571

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

2402

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2572

2403

""" adds a pipe to the MixIn """

2573

2404

2574

2405

def process_request(self, request, client_address):

2589

2420

2590

2421

2591

2422

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2592

socketserver.TCPServer):

2593

"""IPv6-capable TCP server. Accepts None as address and/or port

2423

socketserver.TCPServer, object):

2424

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2594

2425

2595

2426

Attributes:

2596

2427

enabled: Boolean; whether this server is activated yet

2668

2499

raise

2669

2500

# Only bind(2) the socket if we really need to.

2670

2501

if self.server_address[0] or self.server_address[1]:

2671

if self.server_address[1]:

2672

self.allow_reuse_address = True

2673

2502

if not self.server_address[0]:

2674

2503

if self.address_family == socket.AF_INET6:

2675

2504

any_address = "::" # in6addr_any

2728

2557

def add_pipe(self, parent_pipe, proc):

2729

2558

# Call "handle_ipc" for both data and EOF events

2730

2559

GLib.io_add_watch(

2731

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2732

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2560

parent_pipe.fileno(),

2561

GLib.IO_IN | GLib.IO_HUP,

2733

2562

functools.partial(self.handle_ipc,

2734

2563

parent_pipe=parent_pipe,

2735

2564

proc=proc))

2748

2577

request = parent_pipe.recv()

2749

2578

command = request[0]

2750

2579

2751

if command == "init":

2752

key_id = request[1].decode("ascii")

2753

fpr = request[2].decode("ascii")

2754

address = request[3]

2580

if command == 'init':

2581

fpr = request[1].decode("ascii")

2582

address = request[2]

2755

2583

2756

2584

for c in self.clients.values():

2757

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2758

"27AE41E4649B934CA495991B7852B855"):

2759

continue

2760

if key_id and c.key_id == key_id:

2761

client = c

2762

break

2763

if fpr and c.fingerprint == fpr:

2585

if c.fingerprint == fpr:

2764

2586

client = c

2765

2587

break

2766

2588

else:

2767

logger.info("Client not found for key ID: %s, address"

2768

": %s", key_id or fpr, address)

2589

logger.info("Client not found for fingerprint: %s, ad"

2590

"dress: %s", fpr, address)

2769

2591

if self.use_dbus:

2770

2592

# Emit D-Bus signal

2771

mandos_dbus_service.ClientNotFound(key_id or fpr,

2593

mandos_dbus_service.ClientNotFound(fpr,

2772

2594

address[0])

2773

2595

parent_pipe.send(False)

2774

2596

return False

2775

2597

2776

2598

GLib.io_add_watch(

2777

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2778

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2599

parent_pipe.fileno(),

2600

GLib.IO_IN | GLib.IO_HUP,

2779

2601

functools.partial(self.handle_ipc,

2780

2602

parent_pipe=parent_pipe,

2781

2603

proc=proc,

2784

2606

# remove the old hook in favor of the new above hook on

2785

2607

# same fileno

2786

2608

return False

2787

if command == "funcall":

2609

if command == 'funcall':

2788

2610

funcname = request[1]

2789

2611

args = request[2]

2790

2612

kwargs = request[3]

2791

2613

2792

parent_pipe.send(("data", getattr(client_object,

2614

parent_pipe.send(('data', getattr(client_object,

2793

2615

funcname)(*args,

2794

2616

**kwargs)))

2795

2617

2796

if command == "getattr":

2618

if command == 'getattr':

2797

2619

attrname = request[1]

2798

2620

if isinstance(client_object.__getattribute__(attrname),

2799

collections.abc.Callable):

2800

parent_pipe.send(("function", ))

2621

collections.Callable):

2622

parent_pipe.send(('function', ))

2801

2623

else:

2802

2624

parent_pipe.send((

2803

"data", client_object.__getattribute__(attrname)))

2625

'data', client_object.__getattribute__(attrname)))

2804

2626

2805

if command == "setattr":

2627

if command == 'setattr':

2806

2628

attrname = request[1]

2807

2629

value = request[2]

2808

2630

setattr(client_object, attrname, value)

2813

2635

def rfc3339_duration_to_delta(duration):

2814

2636

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2815

2637

2816

>>> timedelta = datetime.timedelta

2817

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2818

True

2819

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2820

True

2821

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2822

True

2823

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2824

True

2825

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2826

True

2827

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2828

True

2829

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2830

True

2831

>>> del timedelta

2638

>>> rfc3339_duration_to_delta("P7D")

2639

datetime.timedelta(7)

2640

>>> rfc3339_duration_to_delta("PT60S")

2641

datetime.timedelta(0, 60)

2642

>>> rfc3339_duration_to_delta("PT60M")

2643

datetime.timedelta(0, 3600)

2644

>>> rfc3339_duration_to_delta("PT24H")

2645

datetime.timedelta(1)

2646

>>> rfc3339_duration_to_delta("P1W")

2647

datetime.timedelta(7)

2648

>>> rfc3339_duration_to_delta("PT5M30S")

2649

datetime.timedelta(0, 330)

2650

>>> rfc3339_duration_to_delta("P1DT3M20S")

2651

datetime.timedelta(1, 200)

2832

2652

"""

2833

2653

2834

2654

# Parsing an RFC 3339 duration with regular expressions is not

2914

2734

def string_to_delta(interval):

2915

2735

"""Parse a string and return a datetime.timedelta

2916

2736

2917

>>> string_to_delta("7d") == datetime.timedelta(7)

2918

True

2919

>>> string_to_delta("60s") == datetime.timedelta(0, 60)

2920

True

2921

>>> string_to_delta("60m") == datetime.timedelta(0, 3600)

2922

True

2923

>>> string_to_delta("24h") == datetime.timedelta(1)

2924

True

2925

>>> string_to_delta("1w") == datetime.timedelta(7)

2926

True

2927

>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

2928

True

2737

>>> string_to_delta('7d')

2738

datetime.timedelta(7)

2739

>>> string_to_delta('60s')

2740

datetime.timedelta(0, 60)

2741

>>> string_to_delta('60m')

2742

datetime.timedelta(0, 3600)

2743

>>> string_to_delta('24h')

2744

datetime.timedelta(1)

2745

>>> string_to_delta('1w')

2746

datetime.timedelta(7)

2747

>>> string_to_delta('5m 30s')

2748

datetime.timedelta(0, 330)

2929

2749

"""

2930

2750

2931

2751

try:

3033

2853

3034

2854

options = parser.parse_args()

3035

2855

2856

if options.check:

2857

import doctest

2858

fail_count, test_count = doctest.testmod()

2859

sys.exit(os.EX_OK if fail_count == 0 else 1)

2860

3036

2861

# Default values for config file for server-global settings

3037

if gnutls.has_rawpk:

3038

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3039

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

3040

else:

3041

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

3042

":+SIGN-DSA-SHA256")

3043

2862

server_defaults = {"interface": "",

3044

2863

"address": "",

3045

2864

"port": "",

3046

2865

"debug": "False",

3047

"priority": priority,

2866

"priority":

2867

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2868

":+SIGN-DSA-SHA256",

3048

2869

"servicename": "Mandos",

3049

2870

"use_dbus": "True",

3050

2871

"use_ipv6": "True",

3055

2876

"foreground": "False",

3056

2877

"zeroconf": "True",

3057

2878

}

3058

del priority

3059

2879

3060

2880

# Parse config file for server-global settings

3061

server_config = configparser.ConfigParser(server_defaults)

2881

server_config = configparser.SafeConfigParser(server_defaults)

3062

2882

del server_defaults

3063

2883

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3064

# Convert the ConfigParser object to a dict

2884

# Convert the SafeConfigParser object to a dict

3065

2885

server_settings = server_config.defaults()

3066

2886

# Use the appropriate methods on the non-string config options

3067

2887

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3134

2954

3135

2955

if server_settings["servicename"] != "Mandos":

3136

2956

syslogger.setFormatter(

3137

logging.Formatter("Mandos ({}) [%(process)d]:"

3138

" %(levelname)s: %(message)s".format(

2957

logging.Formatter('Mandos ({}) [%(process)d]:'

2958

' %(levelname)s: %(message)s'.format(

3139

2959

server_settings["servicename"])))

3140

2960

3141

2961

# Parse config file with clients

3142

client_config = configparser.ConfigParser(Client.client_defaults)

2962

client_config = configparser.SafeConfigParser(Client

2963

.client_defaults)

3143

2964

client_config.read(os.path.join(server_settings["configdir"],

3144

2965

"clients.conf"))

3145

2966

3201

3022

3202

3023

@gnutls.log_func

3203

3024

def debug_gnutls(level, string):

3204

logger.debug("GnuTLS: %s",

3205

string[:-1].decode("utf-8",

3206

errors="replace"))

3025

logger.debug("GnuTLS: %s", string[:-1])

3207

3026

3208

3027

gnutls.global_set_log_function(debug_gnutls)

3209

3028

3218

3037

# Close all input and output, do double fork, etc.

3219

3038

daemon()

3220

3039

3221

if gi.version_info < (3, 10, 2):

3222

# multiprocessing will use threads, so before we use GLib we

3223

# need to inform GLib that threads will be used.

3224

GLib.threads_init()

3040

# multiprocessing will use threads, so before we use GLib we need

3041

# to inform GLib that threads will be used.

3042

GLib.threads_init()

3225

3043

3226

3044

global main_loop

3227

3045

# From the Avahi example code

3303

3121

if isinstance(s, bytes)

3304

3122

else s) for s in

3305

3123

value["client_structure"]]

3306

# .name, .host, and .checker_command

3307

for k in ("name", "host", "checker_command"):

3124

# .name & .host

3125

for k in ("name", "host"):

3308

3126

if isinstance(value[k], bytes):

3309

3127

value[k] = value[k].decode("utf-8")

3310

if "key_id" not in value:

3311

value["key_id"] = ""

3312

elif "fingerprint" not in value:

3313

value["fingerprint"] = ""

3314

3128

# old_client_settings

3315

3129

# .keys()

3316

3130

old_client_settings = {

3320

3134

for key, value in

3321

3135

bytes_old_client_settings.items()}

3322

3136

del bytes_old_client_settings

3323

# .host and .checker_command

3137

# .host

3324

3138

for value in old_client_settings.values():

3325

for attribute in ("host", "checker_command"):

3326

if isinstance(value[attribute], bytes):

3327

value[attribute] = (value[attribute]

3328

.decode("utf-8"))

3139

if isinstance(value["host"], bytes):

3140

value["host"] = (value["host"]

3141

.decode("utf-8"))

3329

3142

os.remove(stored_state_path)

3330

3143

except IOError as e:

3331

3144

if e.errno == errno.ENOENT:

3454

3267

pass

3455

3268

3456

3269

@dbus.service.signal(_interface, signature="ss")

3457

def ClientNotFound(self, key_id, address):

3270

def ClientNotFound(self, fingerprint, address):

3458

3271

"D-Bus signal"

3459

3272

pass

3460

3273

3584

3397

3585

3398

try:

3586

3399

with tempfile.NamedTemporaryFile(

3587

mode="wb",

3400

mode='wb',

3588

3401

suffix=".pickle",

3589

prefix="clients-",

3402

prefix='clients-',

3590

3403

dir=os.path.dirname(stored_state_path),

3591

3404

delete=False) as stored_state:

3592

3405

pickle.dump((clients, client_settings), stored_state,

3656

3469

sys.exit(1)

3657

3470

# End of Avahi example code

3658

3471

3659

GLib.io_add_watch(

3660

GLib.IOChannel.unix_new(tcp_server.fileno()),

3661

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3662

lambda *args, **kwargs: (tcp_server.handle_request

3663

(*args[2:], **kwargs) or True))

3472

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3473

lambda *args, **kwargs:

3474

(tcp_server.handle_request

3475

(*args[2:], **kwargs) or True))

3664

3476

3665

3477

logger.debug("Starting main loop")

3666

3478

main_loop.run()

3676

3488

# Must run before the D-Bus bus name gets deregistered

3677

3489

cleanup()

3678

3490

3679

3680

def should_only_run_tests():

3681

parser = argparse.ArgumentParser(add_help=False)

3682

parser.add_argument("--check", action="store_true")

3683

args, unknown_args = parser.parse_known_args()

3684

run_tests = args.check

3685

if run_tests:

3686

# Remove --check argument from sys.argv

3687

sys.argv[1:] = unknown_args

3688

return run_tests

3689

3690

# Add all tests from doctest strings

3691

def load_tests(loader, tests, none):

3692

import doctest

3693

tests.addTests(doctest.DocTestSuite())

3694

return tests

3695

3696

if __name__ == "__main__":

3697

try:

3698

if should_only_run_tests():

3699

# Call using ./mandos --check [--verbose]

3700

unittest.main()

3701

else:

3702

main()

3703

finally:

3704

logging.shutdown()

3491

3492

if __name__ == '__main__':

3493

main()