/mandos/release : revision 237.7.699

1

#!/usr/bin/python3 -bI

2

# -*- coding: utf-8; lexical-binding: t -*-

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This file is part of Mandos.

18

#

31

#

32

# Contact the authors at <mandos@recompile.se>.

33

#

34

35

from __future__ import (division, absolute_import, print_function,

35

36

unicode_literals)

36

37

39

40

except ImportError:

40

41

pass

41

42

import sys

43

import unittest

44

import argparse

45

import logging

46

import os

47

43

try:

48

44

import SocketServer as socketserver

49

45

except ImportError:

50

46

import socketserver

51

47

import socket

48

import argparse

52

49

import datetime

53

50

import errno

54

51

try:

55

52

import ConfigParser as configparser

56

53

except ImportError:

57

54

import configparser

55

import sys

58

56

import re

57

import os

59

58

import signal

60

59

import subprocess

61

60

import atexit

62

61

import stat

62

import logging

63

import logging.handlers

64

import pwd

65

import contextlib

77

import itertools

78

import collections

79

import codecs

80

import random

81

import shlex

82

80

83

81

import dbus

84

82

import dbus.service

90

88

import xml.dom.minidom

91

89

import inspect

92

90

93

if sys.version_info.major == 2:

94

__metaclass__ = type

95

str = unicode

96

input = raw_input

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Show warnings by default

114

if not sys.warnoptions:

115

import warnings

116

warnings.simplefilter("default")

117

118

91

# Try to find the value of SO_BINDTODEVICE:

119

92

try:

120

93

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

140

113

# No value found

141

114

SO_BINDTODEVICE = None

142

115

116

if sys.version_info.major == 2:

117

str = unicode

118

143

119

if sys.version_info < (3, 2):

144

120

configparser.Configparser = configparser.SafeConfigParser

145

121

146

version = "1.8.17"

122

version = "1.8.6"

147

123

stored_state_file = "clients.pickle"

148

124

149

log = logging.getLogger(os.path.basename(sys.argv[0]))

150

logging.captureWarnings(True) # Show warnings via the logging system

125

logger = logging.getLogger()

151

126

syslogger = None

152

127

153

128

try:

189

164

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

190

165

address="/dev/log"))

191

166

syslogger.setFormatter(logging.Formatter

192

("Mandos [%(process)d]: %(levelname)s:"

193

" %(message)s"))

194

log.addHandler(syslogger)

167

('Mandos [%(process)d]: %(levelname)s:'

168

' %(message)s'))

169

logger.addHandler(syslogger)

195

170

196

171

if debug:

197

172

console = logging.StreamHandler()

198

console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

199

" [%(process)d]:"

200

" %(levelname)s:"

201

" %(message)s"))

202

log.addHandler(console)

203

log.setLevel(level)

173

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

174

' [%(process)d]:'

175

' %(levelname)s:'

176

' %(message)s'))

177

logger.addHandler(console)

178

logger.setLevel(level)

204

179

205

180

206

181

class PGPError(Exception):

208

183

pass

209

184

210

185

211

class PGPEngine:

186

class PGPEngine(object):

212

187

"""A simple class for OpenPGP symmetric encryption & decryption"""

213

188

214

189

def __init__(self):

218

193

output = subprocess.check_output(["gpgconf"])

219

194

for line in output.splitlines():

220

195

name, text, path = line.split(b":")

221

if name == b"gpg":

196

if name == "gpg":

222

197

self.gpg = path

223

198

break

224

199

except OSError as e:

225

200

if e.errno != errno.ENOENT:

226

201

raise

227

self.gnupgargs = ["--batch",

228

"--homedir", self.tempdir,

229

"--force-mdc",

230

"--quiet"]

202

self.gnupgargs = ['--batch',

203

'--homedir', self.tempdir,

204

'--force-mdc',

205

'--quiet']

231

206

# Only GPG version 1 has the --no-use-agent option.

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

207

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

233

208

self.gnupgargs.append("--no-use-agent")

234

209

235

210

def __enter__(self):

272

247

dir=self.tempdir) as passfile:

273

248

passfile.write(passphrase)

274

249

passfile.flush()

275

proc = subprocess.Popen([self.gpg, "--symmetric",

276

"--passphrase-file",

250

proc = subprocess.Popen([self.gpg, '--symmetric',

251

'--passphrase-file',

277

252

passfile.name]

278

253

+ self.gnupgargs,

279

254

stdin=subprocess.PIPE,

290

265

dir=self.tempdir) as passfile:

291

266

passfile.write(passphrase)

292

267

passfile.flush()

293

proc = subprocess.Popen([self.gpg, "--decrypt",

294

"--passphrase-file",

268

proc = subprocess.Popen([self.gpg, '--decrypt',

269

'--passphrase-file',

295

270

passfile.name]

296

271

+ self.gnupgargs,

297

272

stdin=subprocess.PIPE,

304

279

305

280

306

281

# Pretend that we have an Avahi module

307

class avahi:

282

class avahi(object):

308

283

"""This isn't so much a class as it is a module-like namespace."""

309

284

IF_UNSPEC = -1 # avahi-common/address.h

310

285

PROTO_UNSPEC = -1 # avahi-common/address.h

344

319

pass

345

320

346

321

347

class AvahiService:

322

class AvahiService(object):

348

323

"""An Avahi (Zeroconf) service.

349

324

350

325

Attributes:

351

326

interface: integer; avahi.IF_UNSPEC or an interface index.

352

327

Used to optionally bind to the specified interface.

353

name: string; Example: "Mandos"

354

type: string; Example: "_mandos._tcp".

328

name: string; Example: 'Mandos'

329

type: string; Example: '_mandos._tcp'.

355

330

See <https://www.iana.org/assignments/service-names-port-numbers>

356

331

port: integer; what port to announce

357

332

TXT: list of strings; TXT record for the service

394

369

def rename(self, remove=True):

395

370

"""Derived from the Avahi example code"""

396

371

if self.rename_count >= self.max_renames:

397

log.critical("No suitable Zeroconf service name found"

398

" after %i retries, exiting.",

399

self.rename_count)

372

logger.critical("No suitable Zeroconf service name found"

373

" after %i retries, exiting.",

374

self.rename_count)

400

375

raise AvahiServiceError("Too many renames")

401

376

self.name = str(

402

377

self.server.GetAlternativeServiceName(self.name))

403

378

self.rename_count += 1

404

log.info("Changing Zeroconf service name to %r ...",

405

self.name)

379

logger.info("Changing Zeroconf service name to %r ...",

380

self.name)

406

381

if remove:

407

382

self.remove()

408

383

try:

410

385

except dbus.exceptions.DBusException as error:

411

386

if (error.get_dbus_name()

412

387

== "org.freedesktop.Avahi.CollisionError"):

413

log.info("Local Zeroconf service name collision.")

388

logger.info("Local Zeroconf service name collision.")

414

389

return self.rename(remove=False)

415

390

else:

416

log.critical("D-Bus Exception", exc_info=error)

391

logger.critical("D-Bus Exception", exc_info=error)

417

392

self.cleanup()

418

393

os._exit(1)

419

394

435

410

avahi.DBUS_INTERFACE_ENTRY_GROUP)

436

411

self.entry_group_state_changed_match = (

437

412

self.group.connect_to_signal(

438

"StateChanged", self.entry_group_state_changed))

439

log.debug("Adding Zeroconf service '%s' of type '%s' ...",

440

self.name, self.type)

413

'StateChanged', self.entry_group_state_changed))

414

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

415

self.name, self.type)

441

416

self.group.AddService(

442

417

self.interface,

443

418

self.protocol,

450

425

451

426

def entry_group_state_changed(self, state, error):

452

427

"""Derived from the Avahi example code"""

453

log.debug("Avahi entry group state change: %i", state)

428

logger.debug("Avahi entry group state change: %i", state)

454

429

455

430

if state == avahi.ENTRY_GROUP_ESTABLISHED:

456

log.debug("Zeroconf service established.")

431

logger.debug("Zeroconf service established.")

457

432

elif state == avahi.ENTRY_GROUP_COLLISION:

458

log.info("Zeroconf service name collision.")

433

logger.info("Zeroconf service name collision.")

459

434

self.rename()

460

435

elif state == avahi.ENTRY_GROUP_FAILURE:

461

log.critical("Avahi: Error in group state changed %s",

462

str(error))

436

logger.critical("Avahi: Error in group state changed %s",

437

str(error))

463

438

raise AvahiGroupError("State changed: {!s}".format(error))

464

439

465

440

def cleanup(self):

475

450

476

451

def server_state_changed(self, state, error=None):

477

452

"""Derived from the Avahi example code"""

478

log.debug("Avahi server state change: %i", state)

453

logger.debug("Avahi server state change: %i", state)

479

454

bad_states = {

480

455

avahi.SERVER_INVALID: "Zeroconf server invalid",

481

456

avahi.SERVER_REGISTERING: None,

485

460

if state in bad_states:

486

461

if bad_states[state] is not None:

487

462

if error is None:

488

log.error(bad_states[state])

463

logger.error(bad_states[state])

489

464

else:

490

log.error(bad_states[state] + ": %r", error)

465

logger.error(bad_states[state] + ": %r", error)

491

466

self.cleanup()

492

467

elif state == avahi.SERVER_RUNNING:

493

468

try:

495

470

except dbus.exceptions.DBusException as error:

496

471

if (error.get_dbus_name()

497

472

== "org.freedesktop.Avahi.CollisionError"):

498

log.info("Local Zeroconf service name collision.")

473

logger.info("Local Zeroconf service name"

474

" collision.")

499

475

return self.rename(remove=False)

500

476

else:

501

log.critical("D-Bus Exception", exc_info=error)

477

logger.critical("D-Bus Exception", exc_info=error)

502

478

self.cleanup()

503

479

os._exit(1)

504

480

else:

505

481

if error is None:

506

log.debug("Unknown state: %r", state)

482

logger.debug("Unknown state: %r", state)

507

483

else:

508

log.debug("Unknown state: %r: %r", state, error)

484

logger.debug("Unknown state: %r: %r", state, error)

509

485

510

486

def activate(self):

511

487

"""Derived from the Avahi example code"""

523

499

class AvahiServiceToSyslog(AvahiService):

524

500

def rename(self, *args, **kwargs):

525

501

"""Add the new name to the syslog messages"""

526

ret = super(AvahiServiceToSyslog, self).rename(*args,

527

**kwargs)

502

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

528

503

syslogger.setFormatter(logging.Formatter(

529

"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

504

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

530

505

.format(self.name)))

531

506

return ret

532

507

533

508

534

509

# Pretend that we have a GnuTLS module

535

class gnutls:

510

class gnutls(object):

536

511

"""This isn't so much a class as it is a module-like namespace."""

537

512

538

513

library = ctypes.util.find_library("gnutls")

562

537

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

563

538

564

539

# Types

565

class _session_int(ctypes.Structure):

540

class session_int(ctypes.Structure):

566

541

_fields_ = []

567

session_t = ctypes.POINTER(_session_int)

542

session_t = ctypes.POINTER(session_int)

568

543

569

544

class certificate_credentials_st(ctypes.Structure):

570

545

_fields_ = []

573

548

certificate_type_t = ctypes.c_int

574

549

575

550

class datum_t(ctypes.Structure):

576

_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

577

("size", ctypes.c_uint)]

551

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

552

('size', ctypes.c_uint)]

578

553

579

class _openpgp_crt_int(ctypes.Structure):

554

class openpgp_crt_int(ctypes.Structure):

580

555

_fields_ = []

581

openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

556

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

582

557

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

583

558

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

584

559

credentials_type_t = ctypes.c_int

593

568

# gnutls.strerror()

594

569

self.code = code

595

570

if message is None and code is not None:

596

message = gnutls.strerror(code).decode(

597

"utf-8", errors="replace")

571

message = gnutls.strerror(code)

598

572

return super(gnutls.Error, self).__init__(

599

573

message, *args)

600

574

601

575

class CertificateSecurityError(Error):

602

576

pass

603

577

604

class PointerTo:

605

def __init__(self, cls):

606

self.cls = cls

607

608

def from_param(self, obj):

609

if not isinstance(obj, self.cls):

610

raise TypeError("Not of type {}: {!r}"

611

.format(self.cls.__name__, obj))

612

return ctypes.byref(obj.from_param(obj))

613

614

class CastToVoidPointer:

615

def __init__(self, cls):

616

self.cls = cls

617

618

def from_param(self, obj):

619

if not isinstance(obj, self.cls):

620

raise TypeError("Not of type {}: {!r}"

621

.format(self.cls.__name__, obj))

622

return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

623

624

class With_from_param:

625

@classmethod

626

def from_param(cls, obj):

627

return obj._as_parameter_

628

629

578

# Classes

630

class Credentials(With_from_param):

579

class Credentials(object):

631

580

def __init__(self):

632

self._as_parameter_ = gnutls.certificate_credentials_t()

633

gnutls.certificate_allocate_credentials(self)

581

self._c_object = gnutls.certificate_credentials_t()

582

gnutls.certificate_allocate_credentials(

583

ctypes.byref(self._c_object))

634

584

self.type = gnutls.CRD_CERTIFICATE

635

585

636

586

def __del__(self):

637

gnutls.certificate_free_credentials(self)

587

gnutls.certificate_free_credentials(self._c_object)

638

588

639

class ClientSession(With_from_param):

589

class ClientSession(object):

640

590

def __init__(self, socket, credentials=None):

641

self._as_parameter_ = gnutls.session_t()

591

self._c_object = gnutls.session_t()

642

592

gnutls_flags = gnutls.CLIENT

643

593

if gnutls.check_version(b"3.5.6"):

644

594

gnutls_flags |= gnutls.NO_TICKETS

645

595

if gnutls.has_rawpk:

646

596

gnutls_flags |= gnutls.ENABLE_RAWPK

647

gnutls.init(self, gnutls_flags)

597

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

648

598

del gnutls_flags

649

gnutls.set_default_priority(self)

650

gnutls.transport_set_ptr(self, socket.fileno())

651

gnutls.handshake_set_private_extensions(self, True)

599

gnutls.set_default_priority(self._c_object)

600

gnutls.transport_set_ptr(self._c_object, socket.fileno())

601

gnutls.handshake_set_private_extensions(self._c_object,

602

True)

652

603

self.socket = socket

653

604

if credentials is None:

654

605

credentials = gnutls.Credentials()

655

gnutls.credentials_set(self, credentials.type,

656

credentials)

606

gnutls.credentials_set(self._c_object, credentials.type,

607

ctypes.cast(credentials._c_object,

608

ctypes.c_void_p))

657

609

self.credentials = credentials

658

610

659

611

def __del__(self):

660

gnutls.deinit(self)

612

gnutls.deinit(self._c_object)

661

613

662

614

def handshake(self):

663

return gnutls.handshake(self)

615

return gnutls.handshake(self._c_object)

664

616

665

617

def send(self, data):

666

618

data = bytes(data)

667

619

data_len = len(data)

668

620

while data_len > 0:

669

data_len -= gnutls.record_send(self, data[-data_len:],

621

data_len -= gnutls.record_send(self._c_object,

622

data[-data_len:],

670

623

data_len)

671

624

672

625

def bye(self):

673

return gnutls.bye(self, gnutls.SHUT_RDWR)

626

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

674

627

675

628

# Error handling functions

676

629

def _error_code(result):

677

630

"""A function to raise exceptions on errors, suitable

678

for the "restype" attribute on ctypes functions"""

679

if result >= gnutls.E_SUCCESS:

631

for the 'restype' attribute on ctypes functions"""

632

if result >= 0:

680

633

return result

681

634

if result == gnutls.E_NO_CERTIFICATE_FOUND:

682

635

raise gnutls.CertificateSecurityError(code=result)

683

636

raise gnutls.Error(code=result)

684

637

685

def _retry_on_error(result, func, arguments,

686

_error_code=_error_code):

638

def _retry_on_error(result, func, arguments):

687

639

"""A function to retry on some errors, suitable

688

for the "errcheck" attribute on ctypes functions"""

689

while result < gnutls.E_SUCCESS:

640

for the 'errcheck' attribute on ctypes functions"""

641

while result < 0:

690

642

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

691

643

return _error_code(result)

692

644

result = func(*arguments)

697

649

698

650

# Functions

699

651

priority_set_direct = _library.gnutls_priority_set_direct

700

priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

652

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

701

653

ctypes.POINTER(ctypes.c_char_p)]

702

654

priority_set_direct.restype = _error_code

703

655

704

656

init = _library.gnutls_init

705

init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

657

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

706

658

init.restype = _error_code

707

659

708

660

set_default_priority = _library.gnutls_set_default_priority

709

set_default_priority.argtypes = [ClientSession]

661

set_default_priority.argtypes = [session_t]

710

662

set_default_priority.restype = _error_code

711

663

712

664

record_send = _library.gnutls_record_send

713

record_send.argtypes = [ClientSession, ctypes.c_void_p,

665

record_send.argtypes = [session_t, ctypes.c_void_p,

714

666

ctypes.c_size_t]

715

667

record_send.restype = ctypes.c_ssize_t

716

668

record_send.errcheck = _retry_on_error

718

670

certificate_allocate_credentials = (

719

671

_library.gnutls_certificate_allocate_credentials)

720

672

certificate_allocate_credentials.argtypes = [

721

PointerTo(Credentials)]

673

ctypes.POINTER(certificate_credentials_t)]

722

674

certificate_allocate_credentials.restype = _error_code

723

675

724

676

certificate_free_credentials = (

725

677

_library.gnutls_certificate_free_credentials)

726

certificate_free_credentials.argtypes = [Credentials]

678

certificate_free_credentials.argtypes = [

679

certificate_credentials_t]

727

680

certificate_free_credentials.restype = None

728

681

729

682

handshake_set_private_extensions = (

730

683

_library.gnutls_handshake_set_private_extensions)

731

handshake_set_private_extensions.argtypes = [ClientSession,

684

handshake_set_private_extensions.argtypes = [session_t,

732

685

ctypes.c_int]

733

686

handshake_set_private_extensions.restype = None

734

687

735

688

credentials_set = _library.gnutls_credentials_set

736

credentials_set.argtypes = [ClientSession, credentials_type_t,

737

CastToVoidPointer(Credentials)]

689

credentials_set.argtypes = [session_t, credentials_type_t,

690

ctypes.c_void_p]

738

691

credentials_set.restype = _error_code

739

692

740

693

strerror = _library.gnutls_strerror

742

695

strerror.restype = ctypes.c_char_p

743

696

744

697

certificate_type_get = _library.gnutls_certificate_type_get

745

certificate_type_get.argtypes = [ClientSession]

698

certificate_type_get.argtypes = [session_t]

746

699

certificate_type_get.restype = _error_code

747

700

748

701

certificate_get_peers = _library.gnutls_certificate_get_peers

749

certificate_get_peers.argtypes = [ClientSession,

702

certificate_get_peers.argtypes = [session_t,

750

703

ctypes.POINTER(ctypes.c_uint)]

751

704

certificate_get_peers.restype = ctypes.POINTER(datum_t)

752

705

759

712

global_set_log_function.restype = None

760

713

761

714

deinit = _library.gnutls_deinit

762

deinit.argtypes = [ClientSession]

715

deinit.argtypes = [session_t]

763

716

deinit.restype = None

764

717

765

718

handshake = _library.gnutls_handshake

766

handshake.argtypes = [ClientSession]

767

handshake.restype = ctypes.c_int

719

handshake.argtypes = [session_t]

720

handshake.restype = _error_code

768

721

handshake.errcheck = _retry_on_error

769

722

770

723

transport_set_ptr = _library.gnutls_transport_set_ptr

771

transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

724

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

772

725

transport_set_ptr.restype = None

773

726

774

727

bye = _library.gnutls_bye

775

bye.argtypes = [ClientSession, close_request_t]

776

bye.restype = ctypes.c_int

728

bye.argtypes = [session_t, close_request_t]

729

bye.restype = _error_code

777

730

bye.errcheck = _retry_on_error

778

731

779

732

check_version = _library.gnutls_check_version

796

749

797

750

x509_crt_fmt_t = ctypes.c_int

798

751

799

# All the function declarations below are from

800

# gnutls/abstract.h

752

# All the function declarations below are from gnutls/abstract.h

801

753

pubkey_init = _library.gnutls_pubkey_init

802

754

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

803

755

pubkey_init.restype = _error_code

817

769

pubkey_deinit.argtypes = [pubkey_t]

818

770

pubkey_deinit.restype = None

819

771

else:

820

# All the function declarations below are from

821

# gnutls/openpgp.h

772

# All the function declarations below are from gnutls/openpgp.h

822

773

823

774

openpgp_crt_init = _library.gnutls_openpgp_crt_init

824

775

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

830

781

openpgp_crt_fmt_t]

831

782

openpgp_crt_import.restype = _error_code

832

783

833

openpgp_crt_verify_self = \

834

_library.gnutls_openpgp_crt_verify_self

835

openpgp_crt_verify_self.argtypes = [

836

openpgp_crt_t,

837

ctypes.c_uint,

838

ctypes.POINTER(ctypes.c_uint),

839

]

784

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

785

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

786

ctypes.POINTER(ctypes.c_uint)]

840

787

openpgp_crt_verify_self.restype = _error_code

841

788

842

789

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

853

800

854

801

if check_version(b"3.6.4"):

855

802

certificate_type_get2 = _library.gnutls_certificate_type_get2

856

certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

803

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

857

804

certificate_type_get2.restype = _error_code

858

805

859

806

# Remove non-public functions

871

818

connection.close()

872

819

873

820

874

class Client:

821

class Client(object):

875

822

"""A representation of a client host served by this server.

876

823

877

824

Attributes:

878

approved: bool(); None if not yet approved/disapproved

825

approved: bool(); 'None' if not yet approved/disapproved

879

826

approval_delay: datetime.timedelta(); Time to wait for approval

880

827

approval_duration: datetime.timedelta(); Duration of one approval

881

828

checker: multiprocessing.Process(); a running checker process used

882

to see if the client lives. None if no process is

829

to see if the client lives. 'None' if no process is

883

830

running.

884

831

checker_callback_tag: a GLib event source tag, or None

885

832

checker_command: string; External command which is run to check

961

908

# key_id() and fingerprint() functions

962

909

client["key_id"] = (section.get("key_id", "").upper()

963

910

.replace(" ", ""))

964

client["fingerprint"] = (section.get("fingerprint",

965

"").upper()

911

client["fingerprint"] = (section["fingerprint"].upper()

966

912

.replace(" ", ""))

967

if not (client["key_id"] or client["fingerprint"]):

968

log.error("Skipping client %s without key_id or"

969

" fingerprint", client_name)

970

del settings[client_name]

971

continue

972

913

if "secret" in section:

973

914

client["secret"] = codecs.decode(section["secret"]

974

915

.encode("utf-8"),

1015

956

self.last_enabled = None

1016

957

self.expires = None

1017

958

1018

log.debug("Creating client %r", self.name)

1019

log.debug(" Key ID: %s", self.key_id)

1020

log.debug(" Fingerprint: %s", self.fingerprint)

959

logger.debug("Creating client %r", self.name)

960

logger.debug(" Key ID: %s", self.key_id)

961

logger.debug(" Fingerprint: %s", self.fingerprint)

1021

962

self.created = settings.get("created",

1022

963

datetime.datetime.utcnow())

1023

964

1051

992

if getattr(self, "enabled", False):

1052

993

# Already enabled

1053

994

return

995

self.expires = datetime.datetime.utcnow() + self.timeout

1054

996

self.enabled = True

1055

997

self.last_enabled = datetime.datetime.utcnow()

1056

998

self.init_checker()

1061

1003

if not getattr(self, "enabled", False):

1062

1004

return False

1063

1005

if not quiet:

1064

log.info("Disabling client %s", self.name)

1006

logger.info("Disabling client %s", self.name)

1065

1007

if getattr(self, "disable_initiator_tag", None) is not None:

1066

1008

GLib.source_remove(self.disable_initiator_tag)

1067

1009

self.disable_initiator_tag = None

1079

1021

def __del__(self):

1080

1022

self.disable()

1081

1023

1082

def init_checker(self, randomize_start=False):

1083

# Schedule a new checker to be started a randomly selected

1084

# time (a fraction of 'interval') from now. This spreads out

1085

# the startup of checkers over time when the server is

1086

# started.

1024

def init_checker(self):

1025

# Schedule a new checker to be started an 'interval' from now,

1026

# and every interval from then on.

1087

1027

if self.checker_initiator_tag is not None:

1088

1028

GLib.source_remove(self.checker_initiator_tag)

1089

interval_milliseconds = int(self.interval.total_seconds()

1090

* 1000)

1091

if randomize_start:

1092

delay_milliseconds = random.randrange(

1093

interval_milliseconds + 1)

1094

else:

1095

delay_milliseconds = interval_milliseconds

1096

1029

self.checker_initiator_tag = GLib.timeout_add(

1097

delay_milliseconds, self.start_checker, randomize_start)

1098

delay = datetime.timedelta(0, 0, 0, delay_milliseconds)

1099

# A checker might take up to an 'interval' of time, so we can

1100

# expire at the soonest one interval after a checker was

1101

# started. Since the initial checker is delayed, the expire

1102

# time might have to be extended.

1103

now = datetime.datetime.utcnow()

1104

self.expires = now + delay + self.interval

1105

# Schedule a disable() at expire time

1030

int(self.interval.total_seconds() * 1000),

1031

self.start_checker)

1032

# Schedule a disable() when 'timeout' has passed

1106

1033

if self.disable_initiator_tag is not None:

1107

1034

GLib.source_remove(self.disable_initiator_tag)

1108

1035

self.disable_initiator_tag = GLib.timeout_add(

1109

int((self.expires - now).total_seconds() * 1000),

1110

self.disable)

1036

int(self.timeout.total_seconds() * 1000), self.disable)

1037

# Also start a new checker *right now*.

1038

self.start_checker()

1111

1039

1112

1040

def checker_callback(self, source, condition, connection,

1113

1041

command):

1115

1043

# Read return code from connection (see call_pipe)

1116

1044

returncode = connection.recv()

1117

1045

connection.close()

1118

if self.checker is not None:

1119

self.checker.join()

1046

self.checker.join()

1120

1047

self.checker_callback_tag = None

1121

1048

self.checker = None

1122

1049

1124

1051

self.last_checker_status = returncode

1125

1052

self.last_checker_signal = None

1126

1053

if self.last_checker_status == 0:

1127

log.info("Checker for %(name)s succeeded", vars(self))

1054

logger.info("Checker for %(name)s succeeded",

1055

vars(self))

1128

1056

self.checked_ok()

1129

1057

else:

1130

log.info("Checker for %(name)s failed", vars(self))

1058

logger.info("Checker for %(name)s failed", vars(self))

1131

1059

else:

1132

1060

self.last_checker_status = -1

1133

1061

self.last_checker_signal = -returncode

1134

log.warning("Checker for %(name)s crashed?", vars(self))

1062

logger.warning("Checker for %(name)s crashed?",

1063

vars(self))

1135

1064

return False

1136

1065

1137

1066

def checked_ok(self):

1156

1085

def need_approval(self):

1157

1086

self.last_approval_request = datetime.datetime.utcnow()

1158

1087

1159

def start_checker(self, start_was_randomized=False):

1088

def start_checker(self):

1160

1089

"""Start a new checker subprocess if one is not running.

1161

1090

1162

1091

If a checker already exists, leave it running and do

1171

1100

# should be.

1172

1101

1173

1102

if self.checker is not None and not self.checker.is_alive():

1174

log.warning("Checker was not alive; joining")

1103

logger.warning("Checker was not alive; joining")

1175

1104

self.checker.join()

1176

1105

self.checker = None

1177

1106

# Start a new checker if needed

1178

1107

if self.checker is None:

1179

1108

# Escape attributes for the shell

1180

1109

escaped_attrs = {

1181

attr: shlex.quote(str(getattr(self, attr)))

1110

attr: re.escape(str(getattr(self, attr)))

1182

1111

for attr in self.runtime_expansions}

1183

1112

try:

1184

1113

command = self.checker_command % escaped_attrs

1185

1114

except TypeError as error:

1186

log.error('Could not format string "%s"',

1187

self.checker_command, exc_info=error)

1115

logger.error('Could not format string "%s"',

1116

self.checker_command,

1117

exc_info=error)

1188

1118

return True # Try again later

1189

1119

self.current_checker_command = command

1190

log.info("Starting checker %r for %s", command, self.name)

1120

logger.info("Starting checker %r for %s", command,

1121

self.name)

1191

1122

# We don't need to redirect stdout and stderr, since

1192

1123

# in normal mode, that is already done by daemon(),

1193

1124

# and in debug mode we don't want to. (Stdin is

1209

1140

kwargs=popen_args)

1210

1141

self.checker.start()

1211

1142

self.checker_callback_tag = GLib.io_add_watch(

1212

GLib.IOChannel.unix_new(pipe[0].fileno()),

1213

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1143

pipe[0].fileno(), GLib.IO_IN,

1214

1144

self.checker_callback, pipe[0], command)

1215

if start_was_randomized:

1216

# We were started after a random delay; Schedule a new

1217

# checker to be started an 'interval' from now, and every

1218

# interval from then on.

1219

now = datetime.datetime.utcnow()

1220

self.checker_initiator_tag = GLib.timeout_add(

1221

int(self.interval.total_seconds() * 1000),

1222

self.start_checker)

1223

self.expires = max(self.expires, now + self.interval)

1224

# Don't start a new checker again after same random delay

1225

return False

1226

1145

# Re-run this periodically if run by GLib.timeout_add

1227

1146

return True

1228

1147

1233

1152

self.checker_callback_tag = None

1234

1153

if getattr(self, "checker", None) is None:

1235

1154

return

1236

log.debug("Stopping checker for %(name)s", vars(self))

1155

logger.debug("Stopping checker for %(name)s", vars(self))

1237

1156

self.checker.terminate()

1238

1157

self.checker = None

1239

1158

1266

1185

func._dbus_name = func.__name__

1267

1186

if func._dbus_name.endswith("_dbus_property"):

1268

1187

func._dbus_name = func._dbus_name[:-14]

1269

func._dbus_get_args_options = {"byte_arrays": byte_arrays}

1188

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

1270

1189

return func

1271

1190

1272

1191

return decorator

1361

1280

1362

1281

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1363

1282

out_signature="s",

1364

path_keyword="object_path",

1365

connection_keyword="connection")

1283

path_keyword='object_path',

1284

connection_keyword='connection')

1366

1285

def Introspect(self, object_path, connection):

1367

1286

"""Overloading of standard D-Bus method.

1368

1287

1417

1336

document.unlink()

1418

1337

except (AttributeError, xml.dom.DOMException,

1419

1338

xml.parsers.expat.ExpatError) as error:

1420

log.error("Failed to override Introspection method",

1421

exc_info=error)

1339

logger.error("Failed to override Introspection method",

1340

exc_info=error)

1422

1341

return xmlstring

1423

1342

1424

1343

1482

1401

raise ValueError("Byte arrays not supported for non-"

1483

1402

"'ay' signature {!r}"

1484

1403

.format(prop._dbus_signature))

1485

value = dbus.ByteArray(bytes(value))

1404

value = dbus.ByteArray(b''.join(chr(byte)

1405

for byte in value))

1486

1406

prop(value)

1487

1407

1488

1408

@dbus.service.method(dbus.PROPERTIES_IFACE,

1521

1441

1522

1442

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1523

1443

out_signature="s",

1524

path_keyword="object_path",

1525

connection_keyword="connection")

1444

path_keyword='object_path',

1445

connection_keyword='connection')

1526

1446

def Introspect(self, object_path, connection):

1527

1447

"""Overloading of standard D-Bus method.

1528

1448

1584

1504

document.unlink()

1585

1505

except (AttributeError, xml.dom.DOMException,

1586

1506

xml.parsers.expat.ExpatError) as error:

1587

log.error("Failed to override Introspection method",

1588

exc_info=error)

1507

logger.error("Failed to override Introspection method",

1508

exc_info=error)

1589

1509

return xmlstring

1590

1510

1591

1511

1623

1543

1624

1544

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1625

1545

out_signature="s",

1626

path_keyword="object_path",

1627

connection_keyword="connection")

1546

path_keyword='object_path',

1547

connection_keyword='connection')

1628

1548

def Introspect(self, object_path, connection):

1629

1549

"""Overloading of standard D-Bus method.

1630

1550

1655

1575

document.unlink()

1656

1576

except (AttributeError, xml.dom.DOMException,

1657

1577

xml.parsers.expat.ExpatError) as error:

1658

log.error("Failed to override Introspection method",

1659

exc_info=error)

1578

logger.error("Failed to override Introspection method",

1579

exc_info=error)

1660

1580

return xmlstring

1661

1581

1662

1582

2293

2213

del _interface

2294

2214

2295

2215

2296

class ProxyClient:

2216

class ProxyClient(object):

2297

2217

def __init__(self, child_pipe, key_id, fpr, address):

2298

2218

self._pipe = child_pipe

2299

self._pipe.send(("init", key_id, fpr, address))

2219

self._pipe.send(('init', key_id, fpr, address))

2300

2220

if not self._pipe.recv():

2301

2221

raise KeyError(key_id or fpr)

2302

2222

2303

2223

def __getattribute__(self, name):

2304

if name == "_pipe":

2224

if name == '_pipe':

2305

2225

return super(ProxyClient, self).__getattribute__(name)

2306

self._pipe.send(("getattr", name))

2226

self._pipe.send(('getattr', name))

2307

2227

data = self._pipe.recv()

2308

if data[0] == "data":

2228

if data[0] == 'data':

2309

2229

return data[1]

2310

if data[0] == "function":

2230

if data[0] == 'function':

2311

2231

2312

2232

def func(*args, **kwargs):

2313

self._pipe.send(("funcall", name, args, kwargs))

2233

self._pipe.send(('funcall', name, args, kwargs))

2314

2234

return self._pipe.recv()[1]

2315

2235

2316

2236

return func

2317

2237

2318

2238

def __setattr__(self, name, value):

2319

if name == "_pipe":

2239

if name == '_pipe':

2320

2240

return super(ProxyClient, self).__setattr__(name, value)

2321

self._pipe.send(("setattr", name, value))

2241

self._pipe.send(('setattr', name, value))

2322

2242

2323

2243

2324

2244

class ClientHandler(socketserver.BaseRequestHandler, object):

2329

2249

2330

2250

def handle(self):

2331

2251

with contextlib.closing(self.server.child_pipe) as child_pipe:

2332

log.info("TCP connection from: %s",

2333

str(self.client_address))

2334

log.debug("Pipe FD: %d", self.server.child_pipe.fileno())

2252

logger.info("TCP connection from: %s",

2253

str(self.client_address))

2254

logger.debug("Pipe FD: %d",

2255

self.server.child_pipe.fileno())

2335

2256

2336

2257

session = gnutls.ClientSession(self.request)

2337

2258

2338

# priority = ":".join(("NONE", "+VERS-TLS1.1",

2259

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2339

2260

# "+AES-256-CBC", "+SHA1",

2340

2261

# "+COMP-NULL", "+CTYPE-OPENPGP",

2341

2262

# "+DHE-DSS"))

2343

2264

priority = self.server.gnutls_priority

2344

2265

if priority is None:

2345

2266

priority = "NORMAL"

2346

gnutls.priority_set_direct(session,

2347

priority.encode("utf-8"), None)

2267

gnutls.priority_set_direct(session._c_object,

2268

priority.encode("utf-8"),

2269

None)

2348

2270

2349

2271

# Start communication using the Mandos protocol

2350

2272

# Get protocol number

2351

2273

line = self.request.makefile().readline()

2352

log.debug("Protocol version: %r", line)

2274

logger.debug("Protocol version: %r", line)

2353

2275

try:

2354

2276

if int(line.strip().split()[0]) > 1:

2355

2277

raise RuntimeError(line)

2356

2278

except (ValueError, IndexError, RuntimeError) as error:

2357

log.error("Unknown protocol version: %s", error)

2279

logger.error("Unknown protocol version: %s", error)

2358

2280

return

2359

2281

2360

2282

# Start GnuTLS connection

2361

2283

try:

2362

2284

session.handshake()

2363

2285

except gnutls.Error as error:

2364

log.warning("Handshake failed: %s", error)

2286

logger.warning("Handshake failed: %s", error)

2365

2287

# Do not run session.bye() here: the session is not

2366

2288

# established. Just abandon the request.

2367

2289

return

2368

log.debug("Handshake succeeded")

2290

logger.debug("Handshake succeeded")

2369

2291

2370

2292

approval_required = False

2371

2293

try:

2375

2297

key_id = self.key_id(

2376

2298

self.peer_certificate(session))

2377

2299

except (TypeError, gnutls.Error) as error:

2378

log.warning("Bad certificate: %s", error)

2300

logger.warning("Bad certificate: %s", error)

2379

2301

return

2380

log.debug("Key ID: %s",

2381

key_id.decode("utf-8",

2382

errors="replace"))

2302

logger.debug("Key ID: %s", key_id)

2383

2303

2384

2304

else:

2385

2305

key_id = b""

2387

2307

fpr = self.fingerprint(

2388

2308

self.peer_certificate(session))

2389

2309

except (TypeError, gnutls.Error) as error:

2390

log.warning("Bad certificate: %s", error)

2310

logger.warning("Bad certificate: %s", error)

2391

2311

return

2392

log.debug("Fingerprint: %s", fpr)

2312

logger.debug("Fingerprint: %s", fpr)

2393

2313

2394

2314

try:

2395

2315

client = ProxyClient(child_pipe, key_id, fpr,

2404

2324

2405

2325

while True:

2406

2326

if not client.enabled:

2407

log.info("Client %s is disabled", client.name)

2327

logger.info("Client %s is disabled",

2328

client.name)

2408

2329

if self.server.use_dbus:

2409

2330

# Emit D-Bus signal

2410

2331

client.Rejected("Disabled")

2414

2335

# We are approved or approval is disabled

2415

2336

break

2416

2337

elif client.approved is None:

2417

log.info("Client %s needs approval",

2418

client.name)

2338

logger.info("Client %s needs approval",

2339

client.name)

2419

2340

if self.server.use_dbus:

2420

2341

# Emit D-Bus signal

2421

2342

client.NeedApproval(

2422

2343

client.approval_delay.total_seconds()

2423

2344

* 1000, client.approved_by_default)

2424

2345

else:

2425

log.warning("Client %s was not approved",

2426

client.name)

2346

logger.warning("Client %s was not approved",

2347

client.name)

2427

2348

if self.server.use_dbus:

2428

2349

# Emit D-Bus signal

2429

2350

client.Rejected("Denied")

2437

2358

time2 = datetime.datetime.now()

2438

2359

if (time2 - time) >= delay:

2439

2360

if not client.approved_by_default:

2440

log.warning("Client %s timed out while"

2441

" waiting for approval",

2442

client.name)

2361

logger.warning("Client %s timed out while"

2362

" waiting for approval",

2363

client.name)

2443

2364

if self.server.use_dbus:

2444

2365

# Emit D-Bus signal

2445

2366

client.Rejected("Approval timed out")

2452

2373

try:

2453

2374

session.send(client.secret)

2454

2375

except gnutls.Error as error:

2455

log.warning("gnutls send failed", exc_info=error)

2376

logger.warning("gnutls send failed",

2377

exc_info=error)

2456

2378

return

2457

2379

2458

log.info("Sending secret to %s", client.name)

2380

logger.info("Sending secret to %s", client.name)

2459

2381

# bump the timeout using extended_timeout

2460

2382

client.bump_timeout(client.extended_timeout)

2461

2383

if self.server.use_dbus:

2468

2390

try:

2469

2391

session.bye()

2470

2392

except gnutls.Error as error:

2471

log.warning("GnuTLS bye failed", exc_info=error)

2393

logger.warning("GnuTLS bye failed",

2394

exc_info=error)

2472

2395

2473

2396

@staticmethod

2474

2397

def peer_certificate(session):

2475

2398

"Return the peer's certificate as a bytestring"

2476

2399

try:

2477

cert_type = gnutls.certificate_type_get2(

2478

session, gnutls.CTYPE_PEERS)

2400

cert_type = gnutls.certificate_type_get2(session._c_object,

2401

gnutls.CTYPE_PEERS)

2479

2402

except AttributeError:

2480

cert_type = gnutls.certificate_type_get(session)

2403

cert_type = gnutls.certificate_type_get(session._c_object)

2481

2404

if gnutls.has_rawpk:

2482

2405

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2483

2406

else:

2484

2407

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2485

2408

# If not a valid certificate type...

2486

2409

if cert_type not in valid_cert_types:

2487

log.info("Cert type %r not in %r", cert_type,

2488

valid_cert_types)

2410

logger.info("Cert type %r not in %r", cert_type,

2411

valid_cert_types)

2489

2412

# ...return invalid data

2490

2413

return b""

2491

2414

list_size = ctypes.c_uint(1)

2492

2415

cert_list = (gnutls.certificate_get_peers

2493

(session, ctypes.byref(list_size)))

2416

(session._c_object, ctypes.byref(list_size)))

2494

2417

if not bool(cert_list) and list_size.value != 0:

2495

2418

raise gnutls.Error("error getting peer certificate")

2496

2419

if list_size.value == 0:

2518

2441

buf = ctypes.create_string_buffer(32)

2519

2442

buf_len = ctypes.c_size_t(len(buf))

2520

2443

# Get the key ID from the raw public key into the buffer

2521

gnutls.pubkey_get_key_id(

2522

pubkey,

2523

gnutls.KEYID_USE_SHA256,

2524

ctypes.cast(ctypes.byref(buf),

2525

ctypes.POINTER(ctypes.c_ubyte)),

2526

ctypes.byref(buf_len))

2444

gnutls.pubkey_get_key_id(pubkey,

2445

gnutls.KEYID_USE_SHA256,

2446

ctypes.cast(ctypes.byref(buf),

2447

ctypes.POINTER(ctypes.c_ubyte)),

2448

ctypes.byref(buf_len))

2527

2449

# Deinit the certificate

2528

2450

gnutls.pubkey_deinit(pubkey)

2529

2451

2570

2492

return hex_fpr

2571

2493

2572

2494

2573

class MultiprocessingMixIn:

2495

class MultiprocessingMixIn(object):

2574

2496

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2575

2497

2576

2498

def sub_process_main(self, request, address):

2588

2510

return proc

2589

2511

2590

2512

2591

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

2513

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2592

2514

""" adds a pipe to the MixIn """

2593

2515

2594

2516

def process_request(self, request, client_address):

2609

2531

2610

2532

2611

2533

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2612

socketserver.TCPServer):

2613

"""IPv6-capable TCP server. Accepts None as address and/or port

2534

socketserver.TCPServer, object):

2535

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2614

2536

2615

2537

Attributes:

2616

2538

enabled: Boolean; whether this server is activated yet

2667

2589

if SO_BINDTODEVICE is None:

2668

2590

# Fall back to a hard-coded value which seems to be

2669

2591

# common enough.

2670

log.warning("SO_BINDTODEVICE not found, trying 25")

2592

logger.warning("SO_BINDTODEVICE not found, trying 25")

2671

2593

SO_BINDTODEVICE = 25

2672

2594

try:

2673

2595

self.socket.setsockopt(

2675

2597

(self.interface + "\0").encode("utf-8"))

2676

2598

except socket.error as error:

2677

2599

if error.errno == errno.EPERM:

2678

log.error("No permission to bind to interface %s",

2679

self.interface)

2600

logger.error("No permission to bind to"

2601

" interface %s", self.interface)

2680

2602

elif error.errno == errno.ENOPROTOOPT:

2681

log.error("SO_BINDTODEVICE not available; cannot"

2682

" bind to interface %s", self.interface)

2603

logger.error("SO_BINDTODEVICE not available;"

2604

" cannot bind to interface %s",

2605

self.interface)

2683

2606

elif error.errno == errno.ENODEV:

2684

log.error("Interface %s does not exist, cannot"

2685

" bind", self.interface)

2607

logger.error("Interface %s does not exist,"

2608

" cannot bind", self.interface)

2686

2609

else:

2687

2610

raise

2688

2611

# Only bind(2) the socket if we really need to.

2747

2670

def add_pipe(self, parent_pipe, proc):

2748

2671

# Call "handle_ipc" for both data and EOF events

2749

2672

GLib.io_add_watch(

2750

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2751

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2673

parent_pipe.fileno(),

2674

GLib.IO_IN | GLib.IO_HUP,

2752

2675

functools.partial(self.handle_ipc,

2753

2676

parent_pipe=parent_pipe,

2754

2677

proc=proc))

2767

2690

request = parent_pipe.recv()

2768

2691

command = request[0]

2769

2692

2770

if command == "init":

2693

if command == 'init':

2771

2694

key_id = request[1].decode("ascii")

2772

2695

fpr = request[2].decode("ascii")

2773

2696

address = request[3]

2774

2697

2775

2698

for c in self.clients.values():

2776

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2777

"27AE41E4649B934CA495991B7852B855"):

2699

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2778

2700

continue

2779

2701

if key_id and c.key_id == key_id:

2780

2702

client = c

2783

2705

client = c

2784

2706

break

2785

2707

else:

2786

log.info("Client not found for key ID: %s, address:"

2787

" %s", key_id or fpr, address)

2708

logger.info("Client not found for key ID: %s, address"

2709

": %s", key_id or fpr, address)

2788

2710

if self.use_dbus:

2789

2711

# Emit D-Bus signal

2790

2712

mandos_dbus_service.ClientNotFound(key_id or fpr,

2793

2715

return False

2794

2716

2795

2717

GLib.io_add_watch(

2796

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2797

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2718

parent_pipe.fileno(),

2719

GLib.IO_IN | GLib.IO_HUP,

2798

2720

functools.partial(self.handle_ipc,

2799

2721

parent_pipe=parent_pipe,

2800

2722

proc=proc,

2803

2725

# remove the old hook in favor of the new above hook on

2804

2726

# same fileno

2805

2727

return False

2806

if command == "funcall":

2728

if command == 'funcall':

2807

2729

funcname = request[1]

2808

2730

args = request[2]

2809

2731

kwargs = request[3]

2810

2732

2811

parent_pipe.send(("data", getattr(client_object,

2733

parent_pipe.send(('data', getattr(client_object,

2812

2734

funcname)(*args,

2813

2735

**kwargs)))

2814

2736

2815

if command == "getattr":

2737

if command == 'getattr':

2816

2738

attrname = request[1]

2817

2739

if isinstance(client_object.__getattribute__(attrname),

2818

collections.abc.Callable):

2819

parent_pipe.send(("function", ))

2740

collections.Callable):

2741

parent_pipe.send(('function', ))

2820

2742

else:

2821

2743

parent_pipe.send((

2822

"data", client_object.__getattribute__(attrname)))

2744

'data', client_object.__getattribute__(attrname)))

2823

2745

2824

if command == "setattr":

2746

if command == 'setattr':

2825

2747

attrname = request[1]

2826

2748

value = request[2]

2827

2749

setattr(client_object, attrname, value)

2832

2754

def rfc3339_duration_to_delta(duration):

2833

2755

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2834

2756

2835

>>> timedelta = datetime.timedelta

2836

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2837

True

2838

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2839

True

2840

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2841

True

2842

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2843

True

2844

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2845

True

2846

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2847

True

2848

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2849

True

2850

>>> del timedelta

2757

>>> rfc3339_duration_to_delta("P7D")

2758

datetime.timedelta(7)

2759

>>> rfc3339_duration_to_delta("PT60S")

2760

datetime.timedelta(0, 60)

2761

>>> rfc3339_duration_to_delta("PT60M")

2762

datetime.timedelta(0, 3600)

2763

>>> rfc3339_duration_to_delta("PT24H")

2764

datetime.timedelta(1)

2765

>>> rfc3339_duration_to_delta("P1W")

2766

datetime.timedelta(7)

2767

>>> rfc3339_duration_to_delta("PT5M30S")

2768

datetime.timedelta(0, 330)

2769

>>> rfc3339_duration_to_delta("P1DT3M20S")

2770

datetime.timedelta(1, 200)

2851

2771

"""

2852

2772

2853

2773

# Parsing an RFC 3339 duration with regular expressions is not

2933

2853

def string_to_delta(interval):

2934

2854

"""Parse a string and return a datetime.timedelta

2935

2855

2936

>>> string_to_delta("7d") == datetime.timedelta(7)

2937

True

2938

>>> string_to_delta("60s") == datetime.timedelta(0, 60)

2939

True

2940

>>> string_to_delta("60m") == datetime.timedelta(0, 3600)

2941

True

2942

>>> string_to_delta("24h") == datetime.timedelta(1)

2943

True

2944

>>> string_to_delta("1w") == datetime.timedelta(7)

2945

True

2946

>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

2947

True

2856

>>> string_to_delta('7d')

2857

datetime.timedelta(7)

2858

>>> string_to_delta('60s')

2859

datetime.timedelta(0, 60)

2860

>>> string_to_delta('60m')

2861

datetime.timedelta(0, 3600)

2862

>>> string_to_delta('24h')

2863

datetime.timedelta(1)

2864

>>> string_to_delta('1w')

2865

datetime.timedelta(7)

2866

>>> string_to_delta('5m 30s')

2867

datetime.timedelta(0, 330)

2948

2868

"""

2949

2869

2950

2870

try:

3052

2972

3053

2973

options = parser.parse_args()

3054

2974

2975

if options.check:

2976

import doctest

2977

fail_count, test_count = doctest.testmod()

2978

sys.exit(os.EX_OK if fail_count == 0 else 1)

2979

3055

2980

# Default values for config file for server-global settings

3056

2981

if gnutls.has_rawpk:

3057

2982

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3153

3078

3154

3079

if server_settings["servicename"] != "Mandos":

3155

3080

syslogger.setFormatter(

3156

logging.Formatter("Mandos ({}) [%(process)d]:"

3157

" %(levelname)s: %(message)s".format(

3081

logging.Formatter('Mandos ({}) [%(process)d]:'

3082

' %(levelname)s: %(message)s'.format(

3158

3083

server_settings["servicename"])))

3159

3084

3160

3085

# Parse config file with clients

3184

3109

try:

3185

3110

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

3186

3111

except IOError as e:

3187

log.error("Could not open file %r", pidfilename,

3188

exc_info=e)

3112

logger.error("Could not open file %r", pidfilename,

3113

exc_info=e)

3189

3114

3190

3115

for name, group in (("_mandos", "_mandos"),

3191

3116

("mandos", "mandos"),

3202

3127

try:

3203

3128

os.setgid(gid)

3204

3129

os.setuid(uid)

3205

log.debug("Did setuid/setgid to %s:%s", uid, gid)

3130

if debug:

3131

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3132

gid))

3206

3133

except OSError as error:

3207

log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,

3208

os.strerror(error.errno))

3134

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3135

.format(uid, gid, os.strerror(error.errno)))

3209

3136

if error.errno != errno.EPERM:

3210

3137

raise

3211

3138

3218

3145

3219

3146

@gnutls.log_func

3220

3147

def debug_gnutls(level, string):

3221

log.debug("GnuTLS: %s",

3222

string[:-1].decode("utf-8", errors="replace"))

3148

logger.debug("GnuTLS: %s", string[:-1])

3223

3149

3224

3150

gnutls.global_set_log_function(debug_gnutls)

3225

3151

3243

3169

# From the Avahi example code

3244

3170

DBusGMainLoop(set_as_default=True)

3245

3171

main_loop = GLib.MainLoop()

3246

if use_dbus or zeroconf:

3247

bus = dbus.SystemBus()

3172

bus = dbus.SystemBus()

3248

3173

# End of Avahi example code

3249

3174

if use_dbus:

3250

3175

try:

3255

3180

"se.bsnet.fukt.Mandos", bus,

3256

3181

do_not_queue=True)

3257

3182

except dbus.exceptions.DBusException as e:

3258

log.error("Disabling D-Bus:", exc_info=e)

3183

logger.error("Disabling D-Bus:", exc_info=e)

3259

3184

use_dbus = False

3260

3185

server_settings["use_dbus"] = False

3261

3186

tcp_server.use_dbus = False

3320

3245

if isinstance(s, bytes)

3321

3246

else s) for s in

3322

3247

value["client_structure"]]

3323

# .name, .host, and .checker_command

3324

for k in ("name", "host", "checker_command"):

3248

# .name & .host

3249

for k in ("name", "host"):

3325

3250

if isinstance(value[k], bytes):

3326

3251

value[k] = value[k].decode("utf-8")

3327

3252

if "key_id" not in value:

3337

3262

for key, value in

3338

3263

bytes_old_client_settings.items()}

3339

3264

del bytes_old_client_settings

3340

# .host and .checker_command

3265

# .host

3341

3266

for value in old_client_settings.values():

3342

for attribute in ("host", "checker_command"):

3343

if isinstance(value[attribute], bytes):

3344

value[attribute] = (value[attribute]

3345

.decode("utf-8"))

3267

if isinstance(value["host"], bytes):

3268

value["host"] = (value["host"]

3269

.decode("utf-8"))

3346

3270

os.remove(stored_state_path)

3347

3271

except IOError as e:

3348

3272

if e.errno == errno.ENOENT:

3349

log.warning("Could not load persistent state:"

3350

" %s", os.strerror(e.errno))

3273

logger.warning("Could not load persistent state:"

3274

" {}".format(os.strerror(e.errno)))

3351

3275

else:

3352

log.critical("Could not load persistent state:",

3353

exc_info=e)

3276

logger.critical("Could not load persistent state:",

3277

exc_info=e)

3354

3278

raise

3355

3279

except EOFError as e:

3356

log.warning("Could not load persistent state: EOFError:",

3357

exc_info=e)

3280

logger.warning("Could not load persistent state: "

3281

"EOFError:",

3282

exc_info=e)

3358

3283

3359

3284

with PGPEngine() as pgp:

3360

3285

for client_name, client in clients_data.items():

3387

3312

if client["enabled"]:

3388

3313

if datetime.datetime.utcnow() >= client["expires"]:

3389

3314

if not client["last_checked_ok"]:

3390

log.warning("disabling client %s - Client"

3391

" never performed a successful"

3392

" checker", client_name)

3315

logger.warning(

3316

"disabling client {} - Client never "

3317

"performed a successful checker".format(

3318

client_name))

3393

3319

client["enabled"] = False

3394

3320

elif client["last_checker_status"] != 0:

3395

log.warning("disabling client %s - Client"

3396

" last checker failed with error"

3397

" code %s", client_name,

3398

client["last_checker_status"])

3321

logger.warning(

3322

"disabling client {} - Client last"

3323

" checker failed with error code"

3324

" {}".format(

3325

client_name,

3326

client["last_checker_status"]))

3399

3327

client["enabled"] = False

3400

3328

else:

3401

3329

client["expires"] = (

3402

3330

datetime.datetime.utcnow()

3403

3331

+ client["timeout"])

3404

log.debug("Last checker succeeded, keeping %s"

3405

" enabled", client_name)

3332

logger.debug("Last checker succeeded,"

3333

" keeping {} enabled".format(

3334

client_name))

3406

3335

try:

3407

3336

client["secret"] = pgp.decrypt(

3408

3337

client["encrypted_secret"],

3409

3338

client_settings[client_name]["secret"])

3410

3339

except PGPError:

3411

3340

# If decryption fails, we use secret from new settings

3412

log.debug("Failed to decrypt %s old secret",

3413

client_name)

3341

logger.debug("Failed to decrypt {} old secret".format(

3342

client_name))

3414

3343

client["secret"] = (client_settings[client_name]

3415

3344

["secret"])

3416

3345

3430

3359

server_settings=server_settings)

3431

3360

3432

3361

if not tcp_server.clients:

3433

log.warning("No clients defined")

3362

logger.warning("No clients defined")

3434

3363

3435

3364

if not foreground:

3436

3365

if pidfile is not None:

3439

3368

with pidfile:

3440

3369

print(pid, file=pidfile)

3441

3370

except IOError:

3442

log.error("Could not write to file %r with PID %d",

3443

pidfilename, pid)

3371

logger.error("Could not write to file %r with PID %d",

3372

pidfilename, pid)

3444

3373

del pidfile

3445

3374

del pidfilename

3446

3375

3596

3525

3597

3526

try:

3598

3527

with tempfile.NamedTemporaryFile(

3599

mode="wb",

3528

mode='wb',

3600

3529

suffix=".pickle",

3601

prefix="clients-",

3530

prefix='clients-',

3602

3531

dir=os.path.dirname(stored_state_path),

3603

3532

delete=False) as stored_state:

3604

3533

pickle.dump((clients, client_settings), stored_state,

3612

3541

except NameError:

3613

3542

pass

3614

3543

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3615

log.warning("Could not save persistent state: %s",

3616

os.strerror(e.errno))

3544

logger.warning("Could not save persistent state: {}"

3545

.format(os.strerror(e.errno)))

3617

3546

else:

3618

log.warning("Could not save persistent state:",

3619

exc_info=e)

3547

logger.warning("Could not save persistent state:",

3548

exc_info=e)

3620

3549

raise

3621

3550

3622

3551

# Delete all clients, and settings from config

3639

3568

mandos_dbus_service.client_added_signal(client)

3640

3569

# Need to initiate checking of clients

3641

3570

if client.enabled:

3642

client.init_checker(randomize_start=True)

3571

client.init_checker()

3643

3572

3644

3573

tcp_server.enable()

3645

3574

tcp_server.server_activate()

3648

3577

if zeroconf:

3649

3578

service.port = tcp_server.socket.getsockname()[1]

3650

3579

if use_ipv6:

3651

log.info("Now listening on address %r, port %d, flowinfo %d,"

3652

" scope_id %d", *tcp_server.socket.getsockname())

3580

logger.info("Now listening on address %r, port %d,"

3581

" flowinfo %d, scope_id %d",

3582

*tcp_server.socket.getsockname())

3653

3583

else: # IPv4

3654

log.info("Now listening on address %r, port %d",

3655

*tcp_server.socket.getsockname())

3584

logger.info("Now listening on address %r, port %d",

3585

*tcp_server.socket.getsockname())

3656

3586

3657

3587

# service.interface = tcp_server.socket.getsockname()[3]

3658

3588

3662

3592

try:

3663

3593

service.activate()

3664

3594

except dbus.exceptions.DBusException as error:

3665

log.critical("D-Bus Exception", exc_info=error)

3595

logger.critical("D-Bus Exception", exc_info=error)

3666

3596

cleanup()

3667

3597

sys.exit(1)

3668

3598

# End of Avahi example code

3669

3599

3670

GLib.io_add_watch(

3671

GLib.IOChannel.unix_new(tcp_server.fileno()),

3672

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3673

lambda *args, **kwargs: (tcp_server.handle_request

3674

(*args[2:], **kwargs) or True))

3600

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3601

lambda *args, **kwargs:

3602

(tcp_server.handle_request

3603

(*args[2:], **kwargs) or True))

3675

3604

3676

log.debug("Starting main loop")

3605

logger.debug("Starting main loop")

3677

3606

main_loop.run()

3678

3607

except AvahiError as error:

3679

log.critical("Avahi Error", exc_info=error)

3608

logger.critical("Avahi Error", exc_info=error)

3680

3609

cleanup()

3681

3610

sys.exit(1)

3682

3611

except KeyboardInterrupt:

3683

3612

if debug:

3684

3613

print("", file=sys.stderr)

3685

log.debug("Server received KeyboardInterrupt")

3686

log.debug("Server exiting")

3614

logger.debug("Server received KeyboardInterrupt")

3615

logger.debug("Server exiting")

3687

3616

# Must run before the D-Bus bus name gets deregistered

3688

3617

cleanup()

3689

3618

3690

3691

def parse_test_args():

3692

# type: () -> argparse.Namespace

3693

parser = argparse.ArgumentParser(add_help=False)

3694

parser.add_argument("--check", action="store_true")

3695

parser.add_argument("--prefix", )

3696

args, unknown_args = parser.parse_known_args()

3697

if args.check:

3698

# Remove test options from sys.argv

3699

sys.argv[1:] = unknown_args

3700

return args

3701

3702

# Add all tests from doctest strings

3703

def load_tests(loader, tests, none):

3704

import doctest

3705

tests.addTests(doctest.DocTestSuite())

3706

return tests

3707

3708

if __name__ == "__main__":

3709

options = parse_test_args()

3710

try:

3711

if options.check:

3712

extra_test_prefix = options.prefix

3713

if extra_test_prefix is not None:

3714

if not (unittest.main(argv=[""], exit=False)

3715

.result.wasSuccessful()):

3716

sys.exit(1)

3717

class ExtraTestLoader(unittest.TestLoader):

3718

testMethodPrefix = extra_test_prefix

3719

# Call using ./scriptname --test [--verbose]

3720

unittest.main(argv=[""], testLoader=ExtraTestLoader())

3721

else:

3722

unittest.main(argv=[""])

3723

else:

3724

main()

3725

finally:

3726

logging.shutdown()

3727

3728

# Local Variables:

3729

# run-tests:

3730

# (lambda (&optional extra)

3731

# (if (not (funcall run-tests-in-test-buffer default-directory

3732

# extra))

3733

# (funcall show-test-buffer-in-test-window)

3734

# (funcall remove-test-window)

3735

# (if extra (message "Extra tests run successfully!"))))

3736

# run-tests-in-test-buffer:

3737

# (lambda (dir &optional extra)

3738

# (with-current-buffer (get-buffer-create "*Test*")

3739

# (setq buffer-read-only nil

3740

# default-directory dir)

3741

# (erase-buffer)

3742

# (compilation-mode))

3743

# (let ((process-result

3744

# (let ((inhibit-read-only t))

3745

# (process-file-shell-command

3746

# (funcall get-command-line extra) nil "*Test*"))))

3747

# (and (numberp process-result)

3748

# (= process-result 0))))

3749

# get-command-line:

3750

# (lambda (&optional extra)

3751

# (let ((quoted-script

3752

# (shell-quote-argument (funcall get-script-name))))

3753

# (format

3754

# (concat "%s --check" (if extra " --prefix=atest" ""))

3755

# quoted-script)))

3756

# get-script-name:

3757

# (lambda ()

3758

# (if (fboundp 'file-local-name)

3759

# (file-local-name (buffer-file-name))

3760

# (or (file-remote-p (buffer-file-name) 'localname)

3761

# (buffer-file-name))))

3762

# remove-test-window:

3763

# (lambda ()

3764

# (let ((test-window (get-buffer-window "*Test*")))

3765

# (if test-window (delete-window test-window))))

3766

# show-test-buffer-in-test-window:

3767

# (lambda ()

3768

# (when (not (get-buffer-window-list "*Test*"))

3769

# (setq next-error-last-buffer (get-buffer "*Test*"))

3770

# (let* ((side (if (>= (window-width) 146) 'right 'bottom))

3771

# (display-buffer-overriding-action

3772

# `((display-buffer-in-side-window) (side . ,side)

3773

# (window-height . fit-window-to-buffer)

3774

# (window-width . fit-window-to-buffer))))

3775

# (display-buffer "*Test*"))))

3776

# eval:

3777

# (progn

3778

# (let* ((run-extra-tests (lambda () (interactive)

3779

# (funcall run-tests t)))

3780

# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t

3781

# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c

3782

# (setq minor-mode-overriding-map-alist

3783

# (cons `(run-tests . ,outer-keymap)

3784

# minor-mode-overriding-map-alist)))

3785

# (add-hook 'after-save-hook run-tests 90 t))

3786

# End:

3619

3620

if __name__ == '__main__':

3621

main()