/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2019-08-05 21:40:46 UTC
  • mfrom: (389 release)
  • mto: This revision was merged to the branch mainline in revision 390.
  • Revision ID: teddy@recompile.se-20190805214046-qaj0w91ltbp92z2q
Merge from release branch

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
1
 
#!/usr/bin/python3 -b
2
 
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
 
1
#!/usr/bin/python
 
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
77
77
import itertools
78
78
import collections
79
79
import codecs
80
 
import unittest
81
80
 
82
81
import dbus
83
82
import dbus.service
89
88
import xml.dom.minidom
90
89
import inspect
91
90
 
92
 
if sys.version_info.major == 2:
93
 
    __metaclass__ = type
94
 
 
95
 
# Show warnings by default
96
 
if not sys.warnoptions:
97
 
    import warnings
98
 
    warnings.simplefilter("default")
99
 
 
100
91
# Try to find the value of SO_BINDTODEVICE:
101
92
try:
102
93
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
128
119
if sys.version_info < (3, 2):
129
120
    configparser.Configparser = configparser.SafeConfigParser
130
121
 
131
 
version = "1.8.9"
 
122
version = "1.8.7"
132
123
stored_state_file = "clients.pickle"
133
124
 
134
125
logger = logging.getLogger()
135
 
logging.captureWarnings(True)   # Show warnings via the logging system
136
126
syslogger = None
137
127
 
138
128
try:
193
183
    pass
194
184
 
195
185
 
196
 
class PGPEngine:
 
186
class PGPEngine(object):
197
187
    """A simple class for OpenPGP symmetric encryption & decryption"""
198
188
 
199
189
    def __init__(self):
203
193
            output = subprocess.check_output(["gpgconf"])
204
194
            for line in output.splitlines():
205
195
                name, text, path = line.split(b":")
206
 
                if name == b"gpg":
 
196
                if name == "gpg":
207
197
                    self.gpg = path
208
198
                    break
209
199
        except OSError as e:
214
204
                          '--force-mdc',
215
205
                          '--quiet']
216
206
        # Only GPG version 1 has the --no-use-agent option.
217
 
        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
 
207
        if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
218
208
            self.gnupgargs.append("--no-use-agent")
219
209
 
220
210
    def __enter__(self):
289
279
 
290
280
 
291
281
# Pretend that we have an Avahi module
292
 
class avahi:
 
282
class avahi(object):
293
283
    """This isn't so much a class as it is a module-like namespace."""
294
284
    IF_UNSPEC = -1               # avahi-common/address.h
295
285
    PROTO_UNSPEC = -1            # avahi-common/address.h
329
319
    pass
330
320
 
331
321
 
332
 
class AvahiService:
 
322
class AvahiService(object):
333
323
    """An Avahi (Zeroconf) service.
334
324
 
335
325
    Attributes:
517
507
 
518
508
 
519
509
# Pretend that we have a GnuTLS module
520
 
class gnutls:
 
510
class gnutls(object):
521
511
    """This isn't so much a class as it is a module-like namespace."""
522
512
 
523
513
    library = ctypes.util.find_library("gnutls")
586
576
        pass
587
577
 
588
578
    # Classes
589
 
    class Credentials:
 
579
    class Credentials(object):
590
580
        def __init__(self):
591
581
            self._c_object = gnutls.certificate_credentials_t()
592
582
            gnutls.certificate_allocate_credentials(
596
586
        def __del__(self):
597
587
            gnutls.certificate_free_credentials(self._c_object)
598
588
 
599
 
    class ClientSession:
 
589
    class ClientSession(object):
600
590
        def __init__(self, socket, credentials=None):
601
591
            self._c_object = gnutls.session_t()
602
592
            gnutls_flags = gnutls.CLIENT
828
818
    connection.close()
829
819
 
830
820
 
831
 
class Client:
 
821
class Client(object):
832
822
    """A representation of a client host served by this server.
833
823
 
834
824
    Attributes:
1053
1043
        # Read return code from connection (see call_pipe)
1054
1044
        returncode = connection.recv()
1055
1045
        connection.close()
1056
 
        if self.checker is not None:
1057
 
            self.checker.join()
 
1046
        self.checker.join()
1058
1047
        self.checker_callback_tag = None
1059
1048
        self.checker = None
1060
1049
 
1151
1140
                kwargs=popen_args)
1152
1141
            self.checker.start()
1153
1142
            self.checker_callback_tag = GLib.io_add_watch(
1154
 
                GLib.IOChannel.unix_new(pipe[0].fileno()),
1155
 
                GLib.PRIORITY_DEFAULT, GLib.IO_IN,
 
1143
                pipe[0].fileno(), GLib.IO_IN,
1156
1144
                self.checker_callback, pipe[0], command)
1157
1145
        # Re-run this periodically if run by GLib.timeout_add
1158
1146
        return True
2225
2213
    del _interface
2226
2214
 
2227
2215
 
2228
 
class ProxyClient:
 
2216
class ProxyClient(object):
2229
2217
    def __init__(self, child_pipe, key_id, fpr, address):
2230
2218
        self._pipe = child_pipe
2231
2219
        self._pipe.send(('init', key_id, fpr, address))
2504
2492
        return hex_fpr
2505
2493
 
2506
2494
 
2507
 
class MultiprocessingMixIn:
 
2495
class MultiprocessingMixIn(object):
2508
2496
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
2509
2497
 
2510
2498
    def sub_process_main(self, request, address):
2522
2510
        return proc
2523
2511
 
2524
2512
 
2525
 
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
 
2513
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2526
2514
    """ adds a pipe to the MixIn """
2527
2515
 
2528
2516
    def process_request(self, request, client_address):
2543
2531
 
2544
2532
 
2545
2533
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2546
 
                     socketserver.TCPServer):
 
2534
                     socketserver.TCPServer, object):
2547
2535
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
2548
2536
 
2549
2537
    Attributes:
2682
2670
    def add_pipe(self, parent_pipe, proc):
2683
2671
        # Call "handle_ipc" for both data and EOF events
2684
2672
        GLib.io_add_watch(
2685
 
            GLib.IOChannel.unix_new(parent_pipe.fileno()),
2686
 
            GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
 
2673
            parent_pipe.fileno(),
 
2674
            GLib.IO_IN | GLib.IO_HUP,
2687
2675
            functools.partial(self.handle_ipc,
2688
2676
                              parent_pipe=parent_pipe,
2689
2677
                              proc=proc))
2727
2715
                return False
2728
2716
 
2729
2717
            GLib.io_add_watch(
2730
 
                GLib.IOChannel.unix_new(parent_pipe.fileno()),
2731
 
                GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
 
2718
                parent_pipe.fileno(),
 
2719
                GLib.IO_IN | GLib.IO_HUP,
2732
2720
                functools.partial(self.handle_ipc,
2733
2721
                                  parent_pipe=parent_pipe,
2734
2722
                                  proc=proc,
2766
2754
def rfc3339_duration_to_delta(duration):
2767
2755
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2768
2756
 
2769
 
    >>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2770
 
    True
2771
 
    >>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2772
 
    True
2773
 
    >>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2774
 
    True
2775
 
    >>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2776
 
    True
2777
 
    >>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2778
 
    True
2779
 
    >>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2780
 
    True
2781
 
    >>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2782
 
    True
 
2757
    >>> rfc3339_duration_to_delta("P7D")
 
2758
    datetime.timedelta(7)
 
2759
    >>> rfc3339_duration_to_delta("PT60S")
 
2760
    datetime.timedelta(0, 60)
 
2761
    >>> rfc3339_duration_to_delta("PT60M")
 
2762
    datetime.timedelta(0, 3600)
 
2763
    >>> rfc3339_duration_to_delta("PT24H")
 
2764
    datetime.timedelta(1)
 
2765
    >>> rfc3339_duration_to_delta("P1W")
 
2766
    datetime.timedelta(7)
 
2767
    >>> rfc3339_duration_to_delta("PT5M30S")
 
2768
    datetime.timedelta(0, 330)
 
2769
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
2770
    datetime.timedelta(1, 200)
2783
2771
    """
2784
2772
 
2785
2773
    # Parsing an RFC 3339 duration with regular expressions is not
2865
2853
def string_to_delta(interval):
2866
2854
    """Parse a string and return a datetime.timedelta
2867
2855
 
2868
 
    >>> string_to_delta('7d') == datetime.timedelta(7)
2869
 
    True
2870
 
    >>> string_to_delta('60s') == datetime.timedelta(0, 60)
2871
 
    True
2872
 
    >>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2873
 
    True
2874
 
    >>> string_to_delta('24h') == datetime.timedelta(1)
2875
 
    True
2876
 
    >>> string_to_delta('1w') == datetime.timedelta(7)
2877
 
    True
2878
 
    >>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2879
 
    True
 
2856
    >>> string_to_delta('7d')
 
2857
    datetime.timedelta(7)
 
2858
    >>> string_to_delta('60s')
 
2859
    datetime.timedelta(0, 60)
 
2860
    >>> string_to_delta('60m')
 
2861
    datetime.timedelta(0, 3600)
 
2862
    >>> string_to_delta('24h')
 
2863
    datetime.timedelta(1)
 
2864
    >>> string_to_delta('1w')
 
2865
    datetime.timedelta(7)
 
2866
    >>> string_to_delta('5m 30s')
 
2867
    datetime.timedelta(0, 330)
2880
2868
    """
2881
2869
 
2882
2870
    try:
2984
2972
 
2985
2973
    options = parser.parse_args()
2986
2974
 
 
2975
    if options.check:
 
2976
        import doctest
 
2977
        fail_count, test_count = doctest.testmod()
 
2978
        sys.exit(os.EX_OK if fail_count == 0 else 1)
 
2979
 
2987
2980
    # Default values for config file for server-global settings
2988
2981
    if gnutls.has_rawpk:
2989
2982
        priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3252
3245
                             if isinstance(s, bytes)
3253
3246
                             else s) for s in
3254
3247
                            value["client_structure"]]
3255
 
                        # .name, .host, and .checker_command
3256
 
                        for k in ("name", "host", "checker_command"):
 
3248
                        # .name & .host
 
3249
                        for k in ("name", "host"):
3257
3250
                            if isinstance(value[k], bytes):
3258
3251
                                value[k] = value[k].decode("utf-8")
3259
3252
                        if "key_id" not in value:
3269
3262
                        for key, value in
3270
3263
                        bytes_old_client_settings.items()}
3271
3264
                    del bytes_old_client_settings
3272
 
                    # .host and .checker_command
 
3265
                    # .host
3273
3266
                    for value in old_client_settings.values():
3274
 
                        for attribute in ("host", "checker_command"):
3275
 
                            if isinstance(value[attribute], bytes):
3276
 
                                value[attribute] = (value[attribute]
3277
 
                                                    .decode("utf-8"))
 
3267
                        if isinstance(value["host"], bytes):
 
3268
                            value["host"] = (value["host"]
 
3269
                                             .decode("utf-8"))
3278
3270
            os.remove(stored_state_path)
3279
3271
        except IOError as e:
3280
3272
            if e.errno == errno.ENOENT:
3605
3597
                sys.exit(1)
3606
3598
            # End of Avahi example code
3607
3599
 
3608
 
        GLib.io_add_watch(
3609
 
            GLib.IOChannel.unix_new(tcp_server.fileno()),
3610
 
            GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3611
 
            lambda *args, **kwargs: (tcp_server.handle_request
3612
 
                                     (*args[2:], **kwargs) or True))
 
3600
        GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
 
3601
                          lambda *args, **kwargs:
 
3602
                          (tcp_server.handle_request
 
3603
                           (*args[2:], **kwargs) or True))
3613
3604
 
3614
3605
        logger.debug("Starting main loop")
3615
3606
        main_loop.run()
3625
3616
    # Must run before the D-Bus bus name gets deregistered
3626
3617
    cleanup()
3627
3618
 
3628
 
 
3629
 
def should_only_run_tests():
3630
 
    parser = argparse.ArgumentParser(add_help=False)
3631
 
    parser.add_argument("--check", action='store_true')
3632
 
    args, unknown_args = parser.parse_known_args()
3633
 
    run_tests = args.check
3634
 
    if run_tests:
3635
 
        # Remove --check argument from sys.argv
3636
 
        sys.argv[1:] = unknown_args
3637
 
    return run_tests
3638
 
 
3639
 
# Add all tests from doctest strings
3640
 
def load_tests(loader, tests, none):
3641
 
    import doctest
3642
 
    tests.addTests(doctest.DocTestSuite())
3643
 
    return tests
3644
3619
 
3645
3620
if __name__ == '__main__':
3646
 
    try:
3647
 
        if should_only_run_tests():
3648
 
            # Call using ./mandos --check [--verbose]
3649
 
            unittest.main()
3650
 
        else:
3651
 
            main()
3652
 
    finally:
3653
 
        logging.shutdown()
 
3621
    main()