/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2022-04-23 20:39:28 UTC
  • mto: This revision was merged to the branch mainline in revision 406.
  • Revision ID: teddy@recompile.se-20220423203928-q2ngppp3pt7cfv4x
Makefile: Add comment about phase out of -lpthread

* Makefile (dracut-module/password-agent): Add comment about -lpthread
  being unnecessary in GNU C library 2.34 and later.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
 
# Copyright © 2008-2019 Teddy Hogeborn
15
 
# Copyright © 2008-2019 Björn Påhlsson
 
14
# Copyright © 2008-2020 Teddy Hogeborn
 
15
# Copyright © 2008-2020 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
78
78
import collections
79
79
import codecs
80
80
import unittest
 
81
import random
 
82
import shlex
81
83
 
82
84
import dbus
83
85
import dbus.service
93
95
    __metaclass__ = type
94
96
    str = unicode
95
97
 
 
98
# Add collections.abc.Callable if it does not exist
 
99
try:
 
100
    collections.abc.Callable
 
101
except AttributeError:
 
102
    class abc:
 
103
        Callable = collections.Callable
 
104
    collections.abc = abc
 
105
    del abc
 
106
 
 
107
# Add shlex.quote if it does not exist
 
108
try:
 
109
    shlex.quote
 
110
except AttributeError:
 
111
    shlex.quote = re.escape
 
112
 
96
113
# Show warnings by default
97
114
if not sys.warnoptions:
98
115
    import warnings
126
143
if sys.version_info < (3, 2):
127
144
    configparser.Configparser = configparser.SafeConfigParser
128
145
 
129
 
version = "1.8.9"
 
146
version = "1.8.14"
130
147
stored_state_file = "clients.pickle"
131
148
 
132
149
logger = logging.getLogger()
507
524
class AvahiServiceToSyslog(AvahiService):
508
525
    def rename(self, *args, **kwargs):
509
526
        """Add the new name to the syslog messages"""
510
 
        ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
 
527
        ret = super(AvahiServiceToSyslog, self).rename(*args,
 
528
                                                       **kwargs)
511
529
        syslogger.setFormatter(logging.Formatter(
512
530
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
513
531
            .format(self.name)))
545
563
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
546
564
 
547
565
    # Types
548
 
    class session_int(ctypes.Structure):
 
566
    class _session_int(ctypes.Structure):
549
567
        _fields_ = []
550
 
    session_t = ctypes.POINTER(session_int)
 
568
    session_t = ctypes.POINTER(_session_int)
551
569
 
552
570
    class certificate_credentials_st(ctypes.Structure):
553
571
        _fields_ = []
559
577
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
560
578
                    ('size', ctypes.c_uint)]
561
579
 
562
 
    class openpgp_crt_int(ctypes.Structure):
 
580
    class _openpgp_crt_int(ctypes.Structure):
563
581
        _fields_ = []
564
 
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
 
582
    openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
565
583
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
566
584
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
567
585
    credentials_type_t = ctypes.c_int
576
594
            # gnutls.strerror()
577
595
            self.code = code
578
596
            if message is None and code is not None:
579
 
                message = gnutls.strerror(code)
 
597
                message = gnutls.strerror(code).decode(
 
598
                    "utf-8", errors="replace")
580
599
            return super(gnutls.Error, self).__init__(
581
600
                message, *args)
582
601
 
583
602
    class CertificateSecurityError(Error):
584
603
        pass
585
604
 
 
605
    class PointerTo:
 
606
        def __init__(self, cls):
 
607
            self.cls = cls
 
608
 
 
609
        def from_param(self, obj):
 
610
            if not isinstance(obj, self.cls):
 
611
                raise TypeError("Not of type {}: {!r}"
 
612
                                .format(self.cls.__name__, obj))
 
613
            return ctypes.byref(obj.from_param(obj))
 
614
 
 
615
    class CastToVoidPointer:
 
616
        def __init__(self, cls):
 
617
            self.cls = cls
 
618
 
 
619
        def from_param(self, obj):
 
620
            if not isinstance(obj, self.cls):
 
621
                raise TypeError("Not of type {}: {!r}"
 
622
                                .format(self.cls.__name__, obj))
 
623
            return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
 
624
 
 
625
    class With_from_param:
 
626
        @classmethod
 
627
        def from_param(cls, obj):
 
628
            return obj._as_parameter_
 
629
 
586
630
    # Classes
587
 
    class Credentials:
 
631
    class Credentials(With_from_param):
588
632
        def __init__(self):
589
 
            self._c_object = gnutls.certificate_credentials_t()
590
 
            gnutls.certificate_allocate_credentials(
591
 
                ctypes.byref(self._c_object))
 
633
            self._as_parameter_ = gnutls.certificate_credentials_t()
 
634
            gnutls.certificate_allocate_credentials(self)
592
635
            self.type = gnutls.CRD_CERTIFICATE
593
636
 
594
637
        def __del__(self):
595
 
            gnutls.certificate_free_credentials(self._c_object)
 
638
            gnutls.certificate_free_credentials(self)
596
639
 
597
 
    class ClientSession:
 
640
    class ClientSession(With_from_param):
598
641
        def __init__(self, socket, credentials=None):
599
 
            self._c_object = gnutls.session_t()
 
642
            self._as_parameter_ = gnutls.session_t()
600
643
            gnutls_flags = gnutls.CLIENT
601
644
            if gnutls.check_version(b"3.5.6"):
602
645
                gnutls_flags |= gnutls.NO_TICKETS
603
646
            if gnutls.has_rawpk:
604
647
                gnutls_flags |= gnutls.ENABLE_RAWPK
605
 
            gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
 
648
            gnutls.init(self, gnutls_flags)
606
649
            del gnutls_flags
607
 
            gnutls.set_default_priority(self._c_object)
608
 
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
609
 
            gnutls.handshake_set_private_extensions(self._c_object,
610
 
                                                    True)
 
650
            gnutls.set_default_priority(self)
 
651
            gnutls.transport_set_ptr(self, socket.fileno())
 
652
            gnutls.handshake_set_private_extensions(self, True)
611
653
            self.socket = socket
612
654
            if credentials is None:
613
655
                credentials = gnutls.Credentials()
614
 
            gnutls.credentials_set(self._c_object, credentials.type,
615
 
                                   ctypes.cast(credentials._c_object,
616
 
                                               ctypes.c_void_p))
 
656
            gnutls.credentials_set(self, credentials.type,
 
657
                                   credentials)
617
658
            self.credentials = credentials
618
659
 
619
660
        def __del__(self):
620
 
            gnutls.deinit(self._c_object)
 
661
            gnutls.deinit(self)
621
662
 
622
663
        def handshake(self):
623
 
            return gnutls.handshake(self._c_object)
 
664
            return gnutls.handshake(self)
624
665
 
625
666
        def send(self, data):
626
667
            data = bytes(data)
627
668
            data_len = len(data)
628
669
            while data_len > 0:
629
 
                data_len -= gnutls.record_send(self._c_object,
630
 
                                               data[-data_len:],
 
670
                data_len -= gnutls.record_send(self, data[-data_len:],
631
671
                                               data_len)
632
672
 
633
673
        def bye(self):
634
 
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
 
674
            return gnutls.bye(self, gnutls.SHUT_RDWR)
635
675
 
636
676
    # Error handling functions
637
677
    def _error_code(result):
638
678
        """A function to raise exceptions on errors, suitable
639
679
        for the 'restype' attribute on ctypes functions"""
640
 
        if result >= 0:
 
680
        if result >= gnutls.E_SUCCESS:
641
681
            return result
642
682
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
643
683
            raise gnutls.CertificateSecurityError(code=result)
644
684
        raise gnutls.Error(code=result)
645
685
 
646
 
    def _retry_on_error(result, func, arguments):
 
686
    def _retry_on_error(result, func, arguments,
 
687
                        _error_code=_error_code):
647
688
        """A function to retry on some errors, suitable
648
689
        for the 'errcheck' attribute on ctypes functions"""
649
 
        while result < 0:
 
690
        while result < gnutls.E_SUCCESS:
650
691
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
651
692
                return _error_code(result)
652
693
            result = func(*arguments)
657
698
 
658
699
    # Functions
659
700
    priority_set_direct = _library.gnutls_priority_set_direct
660
 
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
 
701
    priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
661
702
                                    ctypes.POINTER(ctypes.c_char_p)]
662
703
    priority_set_direct.restype = _error_code
663
704
 
664
705
    init = _library.gnutls_init
665
 
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
 
706
    init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
666
707
    init.restype = _error_code
667
708
 
668
709
    set_default_priority = _library.gnutls_set_default_priority
669
 
    set_default_priority.argtypes = [session_t]
 
710
    set_default_priority.argtypes = [ClientSession]
670
711
    set_default_priority.restype = _error_code
671
712
 
672
713
    record_send = _library.gnutls_record_send
673
 
    record_send.argtypes = [session_t, ctypes.c_void_p,
 
714
    record_send.argtypes = [ClientSession, ctypes.c_void_p,
674
715
                            ctypes.c_size_t]
675
716
    record_send.restype = ctypes.c_ssize_t
676
717
    record_send.errcheck = _retry_on_error
678
719
    certificate_allocate_credentials = (
679
720
        _library.gnutls_certificate_allocate_credentials)
680
721
    certificate_allocate_credentials.argtypes = [
681
 
        ctypes.POINTER(certificate_credentials_t)]
 
722
        PointerTo(Credentials)]
682
723
    certificate_allocate_credentials.restype = _error_code
683
724
 
684
725
    certificate_free_credentials = (
685
726
        _library.gnutls_certificate_free_credentials)
686
 
    certificate_free_credentials.argtypes = [
687
 
        certificate_credentials_t]
 
727
    certificate_free_credentials.argtypes = [Credentials]
688
728
    certificate_free_credentials.restype = None
689
729
 
690
730
    handshake_set_private_extensions = (
691
731
        _library.gnutls_handshake_set_private_extensions)
692
 
    handshake_set_private_extensions.argtypes = [session_t,
 
732
    handshake_set_private_extensions.argtypes = [ClientSession,
693
733
                                                 ctypes.c_int]
694
734
    handshake_set_private_extensions.restype = None
695
735
 
696
736
    credentials_set = _library.gnutls_credentials_set
697
 
    credentials_set.argtypes = [session_t, credentials_type_t,
698
 
                                ctypes.c_void_p]
 
737
    credentials_set.argtypes = [ClientSession, credentials_type_t,
 
738
                                CastToVoidPointer(Credentials)]
699
739
    credentials_set.restype = _error_code
700
740
 
701
741
    strerror = _library.gnutls_strerror
703
743
    strerror.restype = ctypes.c_char_p
704
744
 
705
745
    certificate_type_get = _library.gnutls_certificate_type_get
706
 
    certificate_type_get.argtypes = [session_t]
 
746
    certificate_type_get.argtypes = [ClientSession]
707
747
    certificate_type_get.restype = _error_code
708
748
 
709
749
    certificate_get_peers = _library.gnutls_certificate_get_peers
710
 
    certificate_get_peers.argtypes = [session_t,
 
750
    certificate_get_peers.argtypes = [ClientSession,
711
751
                                      ctypes.POINTER(ctypes.c_uint)]
712
752
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
713
753
 
720
760
    global_set_log_function.restype = None
721
761
 
722
762
    deinit = _library.gnutls_deinit
723
 
    deinit.argtypes = [session_t]
 
763
    deinit.argtypes = [ClientSession]
724
764
    deinit.restype = None
725
765
 
726
766
    handshake = _library.gnutls_handshake
727
 
    handshake.argtypes = [session_t]
728
 
    handshake.restype = _error_code
 
767
    handshake.argtypes = [ClientSession]
 
768
    handshake.restype = ctypes.c_int
729
769
    handshake.errcheck = _retry_on_error
730
770
 
731
771
    transport_set_ptr = _library.gnutls_transport_set_ptr
732
 
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
 
772
    transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
733
773
    transport_set_ptr.restype = None
734
774
 
735
775
    bye = _library.gnutls_bye
736
 
    bye.argtypes = [session_t, close_request_t]
737
 
    bye.restype = _error_code
 
776
    bye.argtypes = [ClientSession, close_request_t]
 
777
    bye.restype = ctypes.c_int
738
778
    bye.errcheck = _retry_on_error
739
779
 
740
780
    check_version = _library.gnutls_check_version
757
797
 
758
798
        x509_crt_fmt_t = ctypes.c_int
759
799
 
760
 
        # All the function declarations below are from gnutls/abstract.h
 
800
        # All the function declarations below are from
 
801
        # gnutls/abstract.h
761
802
        pubkey_init = _library.gnutls_pubkey_init
762
803
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
763
804
        pubkey_init.restype = _error_code
777
818
        pubkey_deinit.argtypes = [pubkey_t]
778
819
        pubkey_deinit.restype = None
779
820
    else:
780
 
        # All the function declarations below are from gnutls/openpgp.h
 
821
        # All the function declarations below are from
 
822
        # gnutls/openpgp.h
781
823
 
782
824
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
783
825
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
789
831
                                       openpgp_crt_fmt_t]
790
832
        openpgp_crt_import.restype = _error_code
791
833
 
792
 
        openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
793
 
        openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
794
 
                                            ctypes.POINTER(ctypes.c_uint)]
 
834
        openpgp_crt_verify_self = \
 
835
            _library.gnutls_openpgp_crt_verify_self
 
836
        openpgp_crt_verify_self.argtypes = [
 
837
            openpgp_crt_t,
 
838
            ctypes.c_uint,
 
839
            ctypes.POINTER(ctypes.c_uint),
 
840
        ]
795
841
        openpgp_crt_verify_self.restype = _error_code
796
842
 
797
843
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
808
854
 
809
855
    if check_version(b"3.6.4"):
810
856
        certificate_type_get2 = _library.gnutls_certificate_type_get2
811
 
        certificate_type_get2.argtypes = [session_t, ctypes.c_int]
 
857
        certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
812
858
        certificate_type_get2.restype = _error_code
813
859
 
814
860
    # Remove non-public functions
1035
1081
        if self.checker_initiator_tag is not None:
1036
1082
            GLib.source_remove(self.checker_initiator_tag)
1037
1083
        self.checker_initiator_tag = GLib.timeout_add(
1038
 
            int(self.interval.total_seconds() * 1000),
 
1084
            random.randrange(int(self.interval.total_seconds() * 1000
 
1085
                                 + 1)),
1039
1086
            self.start_checker)
1040
1087
        # Schedule a disable() when 'timeout' has passed
1041
1088
        if self.disable_initiator_tag is not None:
1116
1163
        if self.checker is None:
1117
1164
            # Escape attributes for the shell
1118
1165
            escaped_attrs = {
1119
 
                attr: re.escape(str(getattr(self, attr)))
 
1166
                attr: shlex.quote(str(getattr(self, attr)))
1120
1167
                for attr in self.runtime_expansions}
1121
1168
            try:
1122
1169
                command = self.checker_command % escaped_attrs
2273
2320
            priority = self.server.gnutls_priority
2274
2321
            if priority is None:
2275
2322
                priority = "NORMAL"
2276
 
            gnutls.priority_set_direct(session._c_object,
2277
 
                                       priority.encode("utf-8"),
2278
 
                                       None)
 
2323
            gnutls.priority_set_direct(session,
 
2324
                                       priority.encode("utf-8"), None)
2279
2325
 
2280
2326
            # Start communication using the Mandos protocol
2281
2327
            # Get protocol number
2308
2354
                    except (TypeError, gnutls.Error) as error:
2309
2355
                        logger.warning("Bad certificate: %s", error)
2310
2356
                        return
2311
 
                    logger.debug("Key ID: %s", key_id)
 
2357
                    logger.debug("Key ID: %s",
 
2358
                                 key_id.decode("utf-8",
 
2359
                                               errors="replace"))
2312
2360
 
2313
2361
                else:
2314
2362
                    key_id = b""
2406
2454
    def peer_certificate(session):
2407
2455
        "Return the peer's certificate as a bytestring"
2408
2456
        try:
2409
 
            cert_type = gnutls.certificate_type_get2(session._c_object,
2410
 
                                                     gnutls.CTYPE_PEERS)
 
2457
            cert_type = gnutls.certificate_type_get2(
 
2458
                session, gnutls.CTYPE_PEERS)
2411
2459
        except AttributeError:
2412
 
            cert_type = gnutls.certificate_type_get(session._c_object)
 
2460
            cert_type = gnutls.certificate_type_get(session)
2413
2461
        if gnutls.has_rawpk:
2414
2462
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2415
2463
        else:
2422
2470
            return b""
2423
2471
        list_size = ctypes.c_uint(1)
2424
2472
        cert_list = (gnutls.certificate_get_peers
2425
 
                     (session._c_object, ctypes.byref(list_size)))
 
2473
                     (session, ctypes.byref(list_size)))
2426
2474
        if not bool(cert_list) and list_size.value != 0:
2427
2475
            raise gnutls.Error("error getting peer certificate")
2428
2476
        if list_size.value == 0:
2450
2498
        buf = ctypes.create_string_buffer(32)
2451
2499
        buf_len = ctypes.c_size_t(len(buf))
2452
2500
        # Get the key ID from the raw public key into the buffer
2453
 
        gnutls.pubkey_get_key_id(pubkey,
2454
 
                                 gnutls.KEYID_USE_SHA256,
2455
 
                                 ctypes.cast(ctypes.byref(buf),
2456
 
                                             ctypes.POINTER(ctypes.c_ubyte)),
2457
 
                                 ctypes.byref(buf_len))
 
2501
        gnutls.pubkey_get_key_id(
 
2502
            pubkey,
 
2503
            gnutls.KEYID_USE_SHA256,
 
2504
            ctypes.cast(ctypes.byref(buf),
 
2505
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2506
            ctypes.byref(buf_len))
2458
2507
        # Deinit the certificate
2459
2508
        gnutls.pubkey_deinit(pubkey)
2460
2509
 
2705
2754
            address = request[3]
2706
2755
 
2707
2756
            for c in self.clients.values():
2708
 
                if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
 
2757
                if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
 
2758
                              "27AE41E4649B934CA495991B7852B855"):
2709
2759
                    continue
2710
2760
                if key_id and c.key_id == key_id:
2711
2761
                    client = c
2746
2796
        if command == 'getattr':
2747
2797
            attrname = request[1]
2748
2798
            if isinstance(client_object.__getattribute__(attrname),
2749
 
                          collections.Callable):
 
2799
                          collections.abc.Callable):
2750
2800
                parent_pipe.send(('function', ))
2751
2801
            else:
2752
2802
                parent_pipe.send((
2763
2813
def rfc3339_duration_to_delta(duration):
2764
2814
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2765
2815
 
2766
 
    >>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2767
 
    True
2768
 
    >>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2769
 
    True
2770
 
    >>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2771
 
    True
2772
 
    >>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2773
 
    True
2774
 
    >>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2775
 
    True
2776
 
    >>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2777
 
    True
2778
 
    >>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2779
 
    True
 
2816
    >>> timedelta = datetime.timedelta
 
2817
    >>> rfc3339_duration_to_delta("P7D") == timedelta(7)
 
2818
    True
 
2819
    >>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
 
2820
    True
 
2821
    >>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
 
2822
    True
 
2823
    >>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
 
2824
    True
 
2825
    >>> rfc3339_duration_to_delta("P1W") == timedelta(7)
 
2826
    True
 
2827
    >>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
 
2828
    True
 
2829
    >>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
 
2830
    True
 
2831
    >>> del timedelta
2780
2832
    """
2781
2833
 
2782
2834
    # Parsing an RFC 3339 duration with regular expressions is not
3149
3201
 
3150
3202
        @gnutls.log_func
3151
3203
        def debug_gnutls(level, string):
3152
 
            logger.debug("GnuTLS: %s", string[:-1])
 
3204
            logger.debug("GnuTLS: %s",
 
3205
                         string[:-1].decode("utf-8",
 
3206
                                            errors="replace"))
3153
3207
 
3154
3208
        gnutls.global_set_log_function(debug_gnutls)
3155
3209