/mandos/release : revision 353

1

#!/usr/bin/python3 -bI

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

31

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

32

#

77

76

import itertools

78

77

import collections

79

78

import codecs

80

import unittest

81

import random

82

import shlex

83

79

84

80

import dbus

85

81

import dbus.service

86

import gi

87

82

from gi.repository import GLib

88

83

from dbus.mainloop.glib import DBusGMainLoop

89

84

import ctypes

91

86

import xml.dom.minidom

92

87

import inspect

93

88

94

if sys.version_info.major == 2:

95

__metaclass__ = type

96

str = unicode

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Show warnings by default

114

if not sys.warnoptions:

115

import warnings

116

warnings.simplefilter("default")

117

118

89

# Try to find the value of SO_BINDTODEVICE:

119

90

try:

120

91

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

140

111

# No value found

141

112

SO_BINDTODEVICE = None

142

113

143

if sys.version_info < (3, 2):

144

configparser.Configparser = configparser.SafeConfigParser

114

if sys.version_info.major == 2:

115

str = unicode

145

116

146

version = "1.8.14"

117

version = "1.7.12"

147

118

stored_state_file = "clients.pickle"

148

119

149

120

logger = logging.getLogger()

150

logging.captureWarnings(True) # Show warnings via the logging system

151

121

syslogger = None

152

122

153

123

try:

189

159

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

190

160

address="/dev/log"))

191

161

syslogger.setFormatter(logging.Formatter

192

("Mandos [%(process)d]: %(levelname)s:"

193

" %(message)s"))

162

('Mandos [%(process)d]: %(levelname)s:'

163

' %(message)s'))

194

164

logger.addHandler(syslogger)

195

165

196

166

if debug:

197

167

console = logging.StreamHandler()

198

console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

199

" [%(process)d]:"

200

" %(levelname)s:"

201

" %(message)s"))

168

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

169

' [%(process)d]:'

170

' %(levelname)s:'

171

' %(message)s'))

202

172

logger.addHandler(console)

203

173

logger.setLevel(level)

204

174

208

178

pass

209

179

210

180

211

class PGPEngine:

181

class PGPEngine(object):

212

182

"""A simple class for OpenPGP symmetric encryption & decryption"""

213

183

214

184

def __init__(self):

218

188

output = subprocess.check_output(["gpgconf"])

219

189

for line in output.splitlines():

220

190

name, text, path = line.split(b":")

221

if name == b"gpg":

191

if name == "gpg":

222

192

self.gpg = path

223

193

break

224

194

except OSError as e:

225

195

if e.errno != errno.ENOENT:

226

196

raise

227

self.gnupgargs = ["--batch",

228

"--homedir", self.tempdir,

229

"--force-mdc",

230

"--quiet"]

197

self.gnupgargs = ['--batch',

198

'--homedir', self.tempdir,

199

'--force-mdc',

200

'--quiet']

231

201

# Only GPG version 1 has the --no-use-agent option.

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

202

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

233

203

self.gnupgargs.append("--no-use-agent")

234

204

235

205

def __enter__(self):

272

242

dir=self.tempdir) as passfile:

273

243

passfile.write(passphrase)

274

244

passfile.flush()

275

proc = subprocess.Popen([self.gpg, "--symmetric",

276

"--passphrase-file",

245

proc = subprocess.Popen([self.gpg, '--symmetric',

246

'--passphrase-file',

277

247

passfile.name]

278

248

+ self.gnupgargs,

279

249

stdin=subprocess.PIPE,

290

260

dir=self.tempdir) as passfile:

291

261

passfile.write(passphrase)

292

262

passfile.flush()

293

proc = subprocess.Popen([self.gpg, "--decrypt",

294

"--passphrase-file",

263

proc = subprocess.Popen([self.gpg, '--decrypt',

264

'--passphrase-file',

295

265

passfile.name]

296

266

+ self.gnupgargs,

297

267

stdin=subprocess.PIPE,

304

274

305

275

306

276

# Pretend that we have an Avahi module

307

class avahi:

308

"""This isn't so much a class as it is a module-like namespace."""

277

class Avahi(object):

278

"""This isn't so much a class as it is a module-like namespace.

279

It is instantiated once, and simulates having an Avahi module."""

309

280

IF_UNSPEC = -1 # avahi-common/address.h

310

281

PROTO_UNSPEC = -1 # avahi-common/address.h

311

282

PROTO_INET = 0 # avahi-common/address.h

315

286

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

316

287

DBUS_PATH_SERVER = "/"

317

288

318

@staticmethod

319

def string_array_to_txt_array(t):

289

def string_array_to_txt_array(self, t):

320

290

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

321

291

for s in t), signature="ay")

322

292

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

327

297

SERVER_RUNNING = 2 # avahi-common/defs.h

328

298

SERVER_COLLISION = 3 # avahi-common/defs.h

329

299

SERVER_FAILURE = 4 # avahi-common/defs.h

300

avahi = Avahi()

330

301

331

302

332

303

class AvahiError(Exception):

344

315

pass

345

316

346

317

347

class AvahiService:

318

class AvahiService(object):

348

319

"""An Avahi (Zeroconf) service.

349

320

350

321

Attributes:

351

322

interface: integer; avahi.IF_UNSPEC or an interface index.

352

323

Used to optionally bind to the specified interface.

353

name: string; Example: "Mandos"

354

type: string; Example: "_mandos._tcp".

324

name: string; Example: 'Mandos'

325

type: string; Example: '_mandos._tcp'.

355

326

See <https://www.iana.org/assignments/service-names-port-numbers>

356

327

port: integer; what port to announce

357

328

TXT: list of strings; TXT record for the service

435

406

avahi.DBUS_INTERFACE_ENTRY_GROUP)

436

407

self.entry_group_state_changed_match = (

437

408

self.group.connect_to_signal(

438

"StateChanged", self.entry_group_state_changed))

409

'StateChanged', self.entry_group_state_changed))

439

410

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

440

411

self.name, self.type)

441

412

self.group.AddService(

524

495

class AvahiServiceToSyslog(AvahiService):

525

496

def rename(self, *args, **kwargs):

526

497

"""Add the new name to the syslog messages"""

527

ret = super(AvahiServiceToSyslog, self).rename(*args,

528

**kwargs)

498

ret = AvahiService.rename(self, *args, **kwargs)

529

499

syslogger.setFormatter(logging.Formatter(

530

"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

500

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

531

501

.format(self.name)))

532

502

return ret

533

503

534

504

535

505

# Pretend that we have a GnuTLS module

536

class gnutls:

537

"""This isn't so much a class as it is a module-like namespace."""

506

class GnuTLS(object):

507

"""This isn't so much a class as it is a module-like namespace.

508

It is instantiated once, and simulates having a GnuTLS module."""

538

509

539

510

library = ctypes.util.find_library("gnutls")

540

511

if library is None:

541

512

library = ctypes.util.find_library("gnutls-deb0")

542

513

_library = ctypes.cdll.LoadLibrary(library)

543

514

del library

515

_need_version = b"3.3.0"

516

517

def __init__(self):

518

# Need to use class name "GnuTLS" here, since this method is

519

# called before the assignment to the "gnutls" global variable

520

# happens.

521

if GnuTLS.check_version(self._need_version) is None:

522

raise GnuTLS.Error("Needs GnuTLS {} or later"

523

.format(self._need_version))

544

524

545

525

# Unless otherwise indicated, the constants and types below are

546

526

# all from the gnutls/gnutls.h C header file.

550

530

E_INTERRUPTED = -52

551

531

E_AGAIN = -28

552

532

CRT_OPENPGP = 2

553

CRT_RAWPK = 3

554

533

CLIENT = 2

555

534

SHUT_RDWR = 0

556

535

CRD_CERTIFICATE = 1

557

536

E_NO_CERTIFICATE_FOUND = -49

558

X509_FMT_DER = 0

559

NO_TICKETS = 1<<10

560

ENABLE_RAWPK = 1<<18

561

CTYPE_PEERS = 3

562

KEYID_USE_SHA256 = 1 # gnutls/x509.h

563

537

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

564

538

565

539

# Types

566

class _session_int(ctypes.Structure):

540

class session_int(ctypes.Structure):

567

541

_fields_ = []

568

session_t = ctypes.POINTER(_session_int)

542

session_t = ctypes.POINTER(session_int)

569

543

570

544

class certificate_credentials_st(ctypes.Structure):

571

545

_fields_ = []

574

548

certificate_type_t = ctypes.c_int

575

549

576

550

class datum_t(ctypes.Structure):

577

_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

578

("size", ctypes.c_uint)]

551

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

552

('size', ctypes.c_uint)]

579

553

580

class _openpgp_crt_int(ctypes.Structure):

554

class openpgp_crt_int(ctypes.Structure):

581

555

_fields_ = []

582

openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

556

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

583

557

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

584

558

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

585

559

credentials_type_t = ctypes.c_int

588

562

589

563

# Exceptions

590

564

class Error(Exception):

565

# We need to use the class name "GnuTLS" here, since this

566

# exception might be raised from within GnuTLS.__init__,

567

# which is called before the assignment to the "gnutls"

568

# global variable has happened.

591

569

def __init__(self, message=None, code=None, args=()):

592

570

# Default usage is by a message string, but if a return

593

571

# code is passed, convert it to a string with

594

572

# gnutls.strerror()

595

573

self.code = code

596

574

if message is None and code is not None:

597

message = gnutls.strerror(code).decode(

598

"utf-8", errors="replace")

599

return super(gnutls.Error, self).__init__(

575

message = GnuTLS.strerror(code)

576

return super(GnuTLS.Error, self).__init__(

600

577

message, *args)

601

578

602

579

class CertificateSecurityError(Error):

603

580

pass

604

581

605

class PointerTo:

606

def __init__(self, cls):

607

self.cls = cls

608

609

def from_param(self, obj):

610

if not isinstance(obj, self.cls):

611

raise TypeError("Not of type {}: {!r}"

612

.format(self.cls.__name__, obj))

613

return ctypes.byref(obj.from_param(obj))

614

615

class CastToVoidPointer:

616

def __init__(self, cls):

617

self.cls = cls

618

619

def from_param(self, obj):

620

if not isinstance(obj, self.cls):

621

raise TypeError("Not of type {}: {!r}"

622

.format(self.cls.__name__, obj))

623

return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

624

625

class With_from_param:

626

@classmethod

627

def from_param(cls, obj):

628

return obj._as_parameter_

629

630

582

# Classes

631

class Credentials(With_from_param):

583

class Credentials(object):

632

584

def __init__(self):

633

self._as_parameter_ = gnutls.certificate_credentials_t()

634

gnutls.certificate_allocate_credentials(self)

585

self._c_object = gnutls.certificate_credentials_t()

586

gnutls.certificate_allocate_credentials(

587

ctypes.byref(self._c_object))

635

588

self.type = gnutls.CRD_CERTIFICATE

636

589

637

590

def __del__(self):

638

gnutls.certificate_free_credentials(self)

591

gnutls.certificate_free_credentials(self._c_object)

639

592

640

class ClientSession(With_from_param):

593

class ClientSession(object):

641

594

def __init__(self, socket, credentials=None):

642

self._as_parameter_ = gnutls.session_t()

643

gnutls_flags = gnutls.CLIENT

644

if gnutls.check_version(b"3.5.6"):

645

gnutls_flags |= gnutls.NO_TICKETS

646

if gnutls.has_rawpk:

647

gnutls_flags |= gnutls.ENABLE_RAWPK

648

gnutls.init(self, gnutls_flags)

649

del gnutls_flags

650

gnutls.set_default_priority(self)

651

gnutls.transport_set_ptr(self, socket.fileno())

652

gnutls.handshake_set_private_extensions(self, True)

595

self._c_object = gnutls.session_t()

596

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

597

gnutls.set_default_priority(self._c_object)

598

gnutls.transport_set_ptr(self._c_object, socket.fileno())

599

gnutls.handshake_set_private_extensions(self._c_object,

600

True)

653

601

self.socket = socket

654

602

if credentials is None:

655

603

credentials = gnutls.Credentials()

656

gnutls.credentials_set(self, credentials.type,

657

credentials)

604

gnutls.credentials_set(self._c_object, credentials.type,

605

ctypes.cast(credentials._c_object,

606

ctypes.c_void_p))

658

607

self.credentials = credentials

659

608

660

609

def __del__(self):

661

gnutls.deinit(self)

610

gnutls.deinit(self._c_object)

662

611

663

612

def handshake(self):

664

return gnutls.handshake(self)

613

return gnutls.handshake(self._c_object)

665

614

666

615

def send(self, data):

667

616

data = bytes(data)

668

617

data_len = len(data)

669

618

while data_len > 0:

670

data_len -= gnutls.record_send(self, data[-data_len:],

619

data_len -= gnutls.record_send(self._c_object,

620

data[-data_len:],

671

621

data_len)

672

622

673

623

def bye(self):

674

return gnutls.bye(self, gnutls.SHUT_RDWR)

624

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

675

625

676

626

# Error handling functions

677

627

def _error_code(result):

678

628

"""A function to raise exceptions on errors, suitable

679

for the "restype" attribute on ctypes functions"""

680

if result >= gnutls.E_SUCCESS:

629

for the 'restype' attribute on ctypes functions"""

630

if result >= 0:

681

631

return result

682

632

if result == gnutls.E_NO_CERTIFICATE_FOUND:

683

633

raise gnutls.CertificateSecurityError(code=result)

684

634

raise gnutls.Error(code=result)

685

635

686

def _retry_on_error(result, func, arguments,

687

_error_code=_error_code):

636

def _retry_on_error(result, func, arguments):

688

637

"""A function to retry on some errors, suitable

689

for the "errcheck" attribute on ctypes functions"""

690

while result < gnutls.E_SUCCESS:

638

for the 'errcheck' attribute on ctypes functions"""

639

while result < 0:

691

640

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

692

641

return _error_code(result)

693

642

result = func(*arguments)

698

647

699

648

# Functions

700

649

priority_set_direct = _library.gnutls_priority_set_direct

701

priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

650

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

702

651

ctypes.POINTER(ctypes.c_char_p)]

703

652

priority_set_direct.restype = _error_code

704

653

705

654

init = _library.gnutls_init

706

init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

655

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

707

656

init.restype = _error_code

708

657

709

658

set_default_priority = _library.gnutls_set_default_priority

710

set_default_priority.argtypes = [ClientSession]

659

set_default_priority.argtypes = [session_t]

711

660

set_default_priority.restype = _error_code

712

661

713

662

record_send = _library.gnutls_record_send

714

record_send.argtypes = [ClientSession, ctypes.c_void_p,

663

record_send.argtypes = [session_t, ctypes.c_void_p,

715

664

ctypes.c_size_t]

716

665

record_send.restype = ctypes.c_ssize_t

717

666

record_send.errcheck = _retry_on_error

719

668

certificate_allocate_credentials = (

720

669

_library.gnutls_certificate_allocate_credentials)

721

670

certificate_allocate_credentials.argtypes = [

722

PointerTo(Credentials)]

671

ctypes.POINTER(certificate_credentials_t)]

723

672

certificate_allocate_credentials.restype = _error_code

724

673

725

674

certificate_free_credentials = (

726

675

_library.gnutls_certificate_free_credentials)

727

certificate_free_credentials.argtypes = [Credentials]

676

certificate_free_credentials.argtypes = [

677

certificate_credentials_t]

728

678

certificate_free_credentials.restype = None

729

679

730

680

handshake_set_private_extensions = (

731

681

_library.gnutls_handshake_set_private_extensions)

732

handshake_set_private_extensions.argtypes = [ClientSession,

682

handshake_set_private_extensions.argtypes = [session_t,

733

683

ctypes.c_int]

734

684

handshake_set_private_extensions.restype = None

735

685

736

686

credentials_set = _library.gnutls_credentials_set

737

credentials_set.argtypes = [ClientSession, credentials_type_t,

738

CastToVoidPointer(Credentials)]

687

credentials_set.argtypes = [session_t, credentials_type_t,

688

ctypes.c_void_p]

739

689

credentials_set.restype = _error_code

740

690

741

691

strerror = _library.gnutls_strerror

743

693

strerror.restype = ctypes.c_char_p

744

694

745

695

certificate_type_get = _library.gnutls_certificate_type_get

746

certificate_type_get.argtypes = [ClientSession]

696

certificate_type_get.argtypes = [session_t]

747

697

certificate_type_get.restype = _error_code

748

698

749

699

certificate_get_peers = _library.gnutls_certificate_get_peers

750

certificate_get_peers.argtypes = [ClientSession,

700

certificate_get_peers.argtypes = [session_t,

751

701

ctypes.POINTER(ctypes.c_uint)]

752

702

certificate_get_peers.restype = ctypes.POINTER(datum_t)

753

703

760

710

global_set_log_function.restype = None

761

711

762

712

deinit = _library.gnutls_deinit

763

deinit.argtypes = [ClientSession]

713

deinit.argtypes = [session_t]

764

714

deinit.restype = None

765

715

766

716

handshake = _library.gnutls_handshake

767

handshake.argtypes = [ClientSession]

768

handshake.restype = ctypes.c_int

717

handshake.argtypes = [session_t]

718

handshake.restype = _error_code

769

719

handshake.errcheck = _retry_on_error

770

720

771

721

transport_set_ptr = _library.gnutls_transport_set_ptr

772

transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

722

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

773

723

transport_set_ptr.restype = None

774

724

775

725

bye = _library.gnutls_bye

776

bye.argtypes = [ClientSession, close_request_t]

777

bye.restype = ctypes.c_int

726

bye.argtypes = [session_t, close_request_t]

727

bye.restype = _error_code

778

728

bye.errcheck = _retry_on_error

779

729

780

730

check_version = _library.gnutls_check_version

781

731

check_version.argtypes = [ctypes.c_char_p]

782

732

check_version.restype = ctypes.c_char_p

783

733

784

_need_version = b"3.3.0"

785

if check_version(_need_version) is None:

786

raise self.Error("Needs GnuTLS {} or later"

787

.format(_need_version))

788

789

_tls_rawpk_version = b"3.6.6"

790

has_rawpk = bool(check_version(_tls_rawpk_version))

791

792

if has_rawpk:

793

# Types

794

class pubkey_st(ctypes.Structure):

795

_fields = []

796

pubkey_t = ctypes.POINTER(pubkey_st)

797

798

x509_crt_fmt_t = ctypes.c_int

799

800

# All the function declarations below are from

801

# gnutls/abstract.h

802

pubkey_init = _library.gnutls_pubkey_init

803

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

804

pubkey_init.restype = _error_code

805

806

pubkey_import = _library.gnutls_pubkey_import

807

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

808

x509_crt_fmt_t]

809

pubkey_import.restype = _error_code

810

811

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

812

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

813

ctypes.POINTER(ctypes.c_ubyte),

814

ctypes.POINTER(ctypes.c_size_t)]

815

pubkey_get_key_id.restype = _error_code

816

817

pubkey_deinit = _library.gnutls_pubkey_deinit

818

pubkey_deinit.argtypes = [pubkey_t]

819

pubkey_deinit.restype = None

820

else:

821

# All the function declarations below are from

822

# gnutls/openpgp.h

823

824

openpgp_crt_init = _library.gnutls_openpgp_crt_init

825

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

826

openpgp_crt_init.restype = _error_code

827

828

openpgp_crt_import = _library.gnutls_openpgp_crt_import

829

openpgp_crt_import.argtypes = [openpgp_crt_t,

830

ctypes.POINTER(datum_t),

831

openpgp_crt_fmt_t]

832

openpgp_crt_import.restype = _error_code

833

834

openpgp_crt_verify_self = \

835

_library.gnutls_openpgp_crt_verify_self

836

openpgp_crt_verify_self.argtypes = [

837

openpgp_crt_t,

838

ctypes.c_uint,

839

ctypes.POINTER(ctypes.c_uint),

840

]

841

openpgp_crt_verify_self.restype = _error_code

842

843

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

844

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

845

openpgp_crt_deinit.restype = None

846

847

openpgp_crt_get_fingerprint = (

848

_library.gnutls_openpgp_crt_get_fingerprint)

849

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

850

ctypes.c_void_p,

851

ctypes.POINTER(

852

ctypes.c_size_t)]

853

openpgp_crt_get_fingerprint.restype = _error_code

854

855

if check_version(b"3.6.4"):

856

certificate_type_get2 = _library.gnutls_certificate_type_get2

857

certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

858

certificate_type_get2.restype = _error_code

734

# All the function declarations below are from gnutls/openpgp.h

735

736

openpgp_crt_init = _library.gnutls_openpgp_crt_init

737

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

738

openpgp_crt_init.restype = _error_code

739

740

openpgp_crt_import = _library.gnutls_openpgp_crt_import

741

openpgp_crt_import.argtypes = [openpgp_crt_t,

742

ctypes.POINTER(datum_t),

743

openpgp_crt_fmt_t]

744

openpgp_crt_import.restype = _error_code

745

746

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

747

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

748

ctypes.POINTER(ctypes.c_uint)]

749

openpgp_crt_verify_self.restype = _error_code

750

751

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

752

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

753

openpgp_crt_deinit.restype = None

754

755

openpgp_crt_get_fingerprint = (

756

_library.gnutls_openpgp_crt_get_fingerprint)

757

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

758

ctypes.c_void_p,

759

ctypes.POINTER(

760

ctypes.c_size_t)]

761

openpgp_crt_get_fingerprint.restype = _error_code

859

762

860

763

# Remove non-public functions

861

764

del _error_code, _retry_on_error

765

# Create the global "gnutls" object, simulating a module

766

gnutls = GnuTLS()

862

767

863

768

864

769

def call_pipe(connection, # : multiprocessing.Connection

872

777

connection.close()

873

778

874

779

875

class Client:

780

class Client(object):

876

781

"""A representation of a client host served by this server.

877

782

878

783

Attributes:

879

approved: bool(); None if not yet approved/disapproved

784

approved: bool(); 'None' if not yet approved/disapproved

880

785

approval_delay: datetime.timedelta(); Time to wait for approval

881

786

approval_duration: datetime.timedelta(); Duration of one approval

882

checker: multiprocessing.Process(); a running checker process used

883

to see if the client lives. None if no process is

884

running.

787

checker: subprocess.Popen(); a running checker process used

788

to see if the client lives.

789

'None' if no process is running.

885

790

checker_callback_tag: a GLib event source tag, or None

886

791

checker_command: string; External command which is run to check

887

792

if client lives. %() expansions are done at

895

800

disable_initiator_tag: a GLib event source tag, or None

896

801

enabled: bool()

897

802

fingerprint: string (40 or 32 hexadecimal digits); used to

898

uniquely identify an OpenPGP client

899

key_id: string (64 hexadecimal digits); used to uniquely identify

900

a client using raw public keys

803

uniquely identify the client

901

804

host: string; available for use by the checker command

902

805

interval: datetime.timedelta(); How often to start a new checker

903

806

last_approval_request: datetime.datetime(); (UTC) or None

921

824

"""

922

825

923

826

runtime_expansions = ("approval_delay", "approval_duration",

924

"created", "enabled", "expires", "key_id",

827

"created", "enabled", "expires",

925

828

"fingerprint", "host", "interval",

926

829

"last_approval_request", "last_checked_ok",

927

830

"last_enabled", "name", "timeout")

957

860

client["enabled"] = config.getboolean(client_name,

958

861

"enabled")

959

862

960

# Uppercase and remove spaces from key_id and fingerprint

961

# for later comparison purposes with return value from the

962

# key_id() and fingerprint() functions

963

client["key_id"] = (section.get("key_id", "").upper()

964

.replace(" ", ""))

863

# Uppercase and remove spaces from fingerprint for later

864

# comparison purposes with return value from the

865

# fingerprint() function

965

866

client["fingerprint"] = (section["fingerprint"].upper()

966

867

.replace(" ", ""))

967

868

if "secret" in section:

1011

912

self.expires = None

1012

913

1013

914

logger.debug("Creating client %r", self.name)

1014

logger.debug(" Key ID: %s", self.key_id)

1015

915

logger.debug(" Fingerprint: %s", self.fingerprint)

1016

916

self.created = settings.get("created",

1017

917

datetime.datetime.utcnow())

1081

981

if self.checker_initiator_tag is not None:

1082

982

GLib.source_remove(self.checker_initiator_tag)

1083

983

self.checker_initiator_tag = GLib.timeout_add(

1084

random.randrange(int(self.interval.total_seconds() * 1000

1085

+ 1)),

984

int(self.interval.total_seconds() * 1000),

1086

985

self.start_checker)

1087

986

# Schedule a disable() when 'timeout' has passed

1088

987

if self.disable_initiator_tag is not None:

1095

994

def checker_callback(self, source, condition, connection,

1096

995

command):

1097

996

"""The checker has completed, so take appropriate actions."""

997

self.checker_callback_tag = None

998

self.checker = None

1098

999

# Read return code from connection (see call_pipe)

1099

1000

returncode = connection.recv()

1100

1001

connection.close()

1101

if self.checker is not None:

1102

self.checker.join()

1103

self.checker_callback_tag = None

1104

self.checker = None

1105

1002

1106

1003

if returncode >= 0:

1107

1004

self.last_checker_status = returncode

1163

1060

if self.checker is None:

1164

1061

# Escape attributes for the shell

1165

1062

escaped_attrs = {

1166

attr: shlex.quote(str(getattr(self, attr)))

1063

attr: re.escape(str(getattr(self, attr)))

1167

1064

for attr in self.runtime_expansions}

1168

1065

try:

1169

1066

command = self.checker_command % escaped_attrs

1196

1093

kwargs=popen_args)

1197

1094

self.checker.start()

1198

1095

self.checker_callback_tag = GLib.io_add_watch(

1199

GLib.IOChannel.unix_new(pipe[0].fileno()),

1200

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1096

pipe[0].fileno(), GLib.IO_IN,

1201

1097

self.checker_callback, pipe[0], command)

1202

1098

# Re-run this periodically if run by GLib.timeout_add

1203

1099

return True

1242

1138

func._dbus_name = func.__name__

1243

1139

if func._dbus_name.endswith("_dbus_property"):

1244

1140

func._dbus_name = func._dbus_name[:-14]

1245

func._dbus_get_args_options = {"byte_arrays": byte_arrays}

1141

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

1246

1142

return func

1247

1143

1248

1144

return decorator

1337

1233

1338

1234

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1339

1235

out_signature="s",

1340

path_keyword="object_path",

1341

connection_keyword="connection")

1236

path_keyword='object_path',

1237

connection_keyword='connection')

1342

1238

def Introspect(self, object_path, connection):

1343

1239

"""Overloading of standard D-Bus method.

1344

1240

1458

1354

raise ValueError("Byte arrays not supported for non-"

1459

1355

"'ay' signature {!r}"

1460

1356

.format(prop._dbus_signature))

1461

value = dbus.ByteArray(bytes(value))

1357

value = dbus.ByteArray(b''.join(chr(byte)

1358

for byte in value))

1462

1359

prop(value)

1463

1360

1464

1361

@dbus.service.method(dbus.PROPERTIES_IFACE,

1497

1394

1498

1395

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1499

1396

out_signature="s",

1500

path_keyword="object_path",

1501

connection_keyword="connection")

1397

path_keyword='object_path',

1398

connection_keyword='connection')

1502

1399

def Introspect(self, object_path, connection):

1503

1400

"""Overloading of standard D-Bus method.

1504

1401

1564

1461

exc_info=error)

1565

1462

return xmlstring

1566

1463

1567

1568

1464

try:

1569

1465

dbus.OBJECT_MANAGER_IFACE

1570

1466

except AttributeError:

1599

1495

1600

1496

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1601

1497

out_signature="s",

1602

path_keyword="object_path",

1603

connection_keyword="connection")

1498

path_keyword='object_path',

1499

connection_keyword='connection')

1604

1500

def Introspect(self, object_path, connection):

1605

1501

"""Overloading of standard D-Bus method.

1606

1502

2102

1998

def Name_dbus_property(self):

2103

1999

return dbus.String(self.name)

2104

2000

2105

# KeyID - property

2106

@dbus_annotations(

2107

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2108

@dbus_service_property(_interface, signature="s", access="read")

2109

def KeyID_dbus_property(self):

2110

return dbus.String(self.key_id)

2111

2112

2001

# Fingerprint - property

2113

2002

@dbus_annotations(

2114

2003

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2269

2158

del _interface

2270

2159

2271

2160

2272

class ProxyClient:

2273

def __init__(self, child_pipe, key_id, fpr, address):

2161

class ProxyClient(object):

2162

def __init__(self, child_pipe, fpr, address):

2274

2163

self._pipe = child_pipe

2275

self._pipe.send(("init", key_id, fpr, address))

2164

self._pipe.send(('init', fpr, address))

2276

2165

if not self._pipe.recv():

2277

raise KeyError(key_id or fpr)

2166

raise KeyError(fpr)

2278

2167

2279

2168

def __getattribute__(self, name):

2280

if name == "_pipe":

2169

if name == '_pipe':

2281

2170

return super(ProxyClient, self).__getattribute__(name)

2282

self._pipe.send(("getattr", name))

2171

self._pipe.send(('getattr', name))

2283

2172

data = self._pipe.recv()

2284

if data[0] == "data":

2173

if data[0] == 'data':

2285

2174

return data[1]

2286

if data[0] == "function":

2175

if data[0] == 'function':

2287

2176

2288

2177

def func(*args, **kwargs):

2289

self._pipe.send(("funcall", name, args, kwargs))

2178

self._pipe.send(('funcall', name, args, kwargs))

2290

2179

return self._pipe.recv()[1]

2291

2180

2292

2181

return func

2293

2182

2294

2183

def __setattr__(self, name, value):

2295

if name == "_pipe":

2184

if name == '_pipe':

2296

2185

return super(ProxyClient, self).__setattr__(name, value)

2297

self._pipe.send(("setattr", name, value))

2186

self._pipe.send(('setattr', name, value))

2298

2187

2299

2188

2300

2189

class ClientHandler(socketserver.BaseRequestHandler, object):

2312

2201

2313

2202

session = gnutls.ClientSession(self.request)

2314

2203

2315

# priority = ":".join(("NONE", "+VERS-TLS1.1",

2204

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2316

2205

# "+AES-256-CBC", "+SHA1",

2317

2206

# "+COMP-NULL", "+CTYPE-OPENPGP",

2318

2207

# "+DHE-DSS"))

2320

2209

priority = self.server.gnutls_priority

2321

2210

if priority is None:

2322

2211

priority = "NORMAL"

2323

gnutls.priority_set_direct(session,

2324

priority.encode("utf-8"), None)

2212

gnutls.priority_set_direct(session._c_object,

2213

priority.encode("utf-8"),

2214

None)

2325

2215

2326

2216

# Start communication using the Mandos protocol

2327

2217

# Get protocol number

2346

2236

2347

2237

approval_required = False

2348

2238

try:

2349

if gnutls.has_rawpk:

2350

fpr = b""

2351

try:

2352

key_id = self.key_id(

2353

self.peer_certificate(session))

2354

except (TypeError, gnutls.Error) as error:

2355

logger.warning("Bad certificate: %s", error)

2356

return

2357

logger.debug("Key ID: %s",

2358

key_id.decode("utf-8",

2359

errors="replace"))

2360

2361

else:

2362

key_id = b""

2363

try:

2364

fpr = self.fingerprint(

2365

self.peer_certificate(session))

2366

except (TypeError, gnutls.Error) as error:

2367

logger.warning("Bad certificate: %s", error)

2368

return

2369

logger.debug("Fingerprint: %s", fpr)

2370

2371

try:

2372

client = ProxyClient(child_pipe, key_id, fpr,

2239

try:

2240

fpr = self.fingerprint(

2241

self.peer_certificate(session))

2242

except (TypeError, gnutls.Error) as error:

2243

logger.warning("Bad certificate: %s", error)

2244

return

2245

logger.debug("Fingerprint: %s", fpr)

2246

2247

try:

2248

client = ProxyClient(child_pipe, fpr,

2373

2249

self.client_address)

2374

2250

except KeyError:

2375

2251

return

2452

2328

2453

2329

@staticmethod

2454

2330

def peer_certificate(session):

2455

"Return the peer's certificate as a bytestring"

2456

try:

2457

cert_type = gnutls.certificate_type_get2(

2458

session, gnutls.CTYPE_PEERS)

2459

except AttributeError:

2460

cert_type = gnutls.certificate_type_get(session)

2461

if gnutls.has_rawpk:

2462

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2463

else:

2464

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2465

# If not a valid certificate type...

2466

if cert_type not in valid_cert_types:

2467

logger.info("Cert type %r not in %r", cert_type,

2468

valid_cert_types)

2331

"Return the peer's OpenPGP certificate as a bytestring"

2332

# If not an OpenPGP certificate...

2333

if (gnutls.certificate_type_get(session._c_object)

2334

!= gnutls.CRT_OPENPGP):

2469

2335

# ...return invalid data

2470

2336

return b""

2471

2337

list_size = ctypes.c_uint(1)

2472

2338

cert_list = (gnutls.certificate_get_peers

2473

(session, ctypes.byref(list_size)))

2339

(session._c_object, ctypes.byref(list_size)))

2474

2340

if not bool(cert_list) and list_size.value != 0:

2475

2341

raise gnutls.Error("error getting peer certificate")

2476

2342

if list_size.value == 0:

2479

2345

return ctypes.string_at(cert.data, cert.size)

2480

2346

2481

2347

@staticmethod

2482

def key_id(certificate):

2483

"Convert a certificate bytestring to a hexdigit key ID"

2484

# New GnuTLS "datum" with the public key

2485

datum = gnutls.datum_t(

2486

ctypes.cast(ctypes.c_char_p(certificate),

2487

ctypes.POINTER(ctypes.c_ubyte)),

2488

ctypes.c_uint(len(certificate)))

2489

# XXX all these need to be created in the gnutls "module"

2490

# New empty GnuTLS certificate

2491

pubkey = gnutls.pubkey_t()

2492

gnutls.pubkey_init(ctypes.byref(pubkey))

2493

# Import the raw public key into the certificate

2494

gnutls.pubkey_import(pubkey,

2495

ctypes.byref(datum),

2496

gnutls.X509_FMT_DER)

2497

# New buffer for the key ID

2498

buf = ctypes.create_string_buffer(32)

2499

buf_len = ctypes.c_size_t(len(buf))

2500

# Get the key ID from the raw public key into the buffer

2501

gnutls.pubkey_get_key_id(

2502

pubkey,

2503

gnutls.KEYID_USE_SHA256,

2504

ctypes.cast(ctypes.byref(buf),

2505

ctypes.POINTER(ctypes.c_ubyte)),

2506

ctypes.byref(buf_len))

2507

# Deinit the certificate

2508

gnutls.pubkey_deinit(pubkey)

2509

2510

# Convert the buffer to a Python bytestring

2511

key_id = ctypes.string_at(buf, buf_len.value)

2512

# Convert the bytestring to hexadecimal notation

2513

hex_key_id = binascii.hexlify(key_id).upper()

2514

return hex_key_id

2515

2516

@staticmethod

2517

2348

def fingerprint(openpgp):

2518

2349

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2519

2350

# New GnuTLS "datum" with the OpenPGP public key

2533

2364

ctypes.byref(crtverify))

2534

2365

if crtverify.value != 0:

2535

2366

gnutls.openpgp_crt_deinit(crt)

2536

raise gnutls.CertificateSecurityError(code

2537

=crtverify.value)

2367

raise gnutls.CertificateSecurityError("Verify failed")

2538

2368

# New buffer for the fingerprint

2539

2369

buf = ctypes.create_string_buffer(20)

2540

2370

buf_len = ctypes.c_size_t()

2550

2380

return hex_fpr

2551

2381

2552

2382

2553

class MultiprocessingMixIn:

2383

class MultiprocessingMixIn(object):

2554

2384

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2555

2385

2556

2386

def sub_process_main(self, request, address):

2568

2398

return proc

2569

2399

2570

2400

2571

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

2401

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2572

2402

""" adds a pipe to the MixIn """

2573

2403

2574

2404

def process_request(self, request, client_address):

2589

2419

2590

2420

2591

2421

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2592

socketserver.TCPServer):

2593

"""IPv6-capable TCP server. Accepts None as address and/or port

2422

socketserver.TCPServer, object):

2423

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2594

2424

2595

2425

Attributes:

2596

2426

enabled: Boolean; whether this server is activated yet

2668

2498

raise

2669

2499

# Only bind(2) the socket if we really need to.

2670

2500

if self.server_address[0] or self.server_address[1]:

2671

if self.server_address[1]:

2672

self.allow_reuse_address = True

2673

2501

if not self.server_address[0]:

2674

2502

if self.address_family == socket.AF_INET6:

2675

2503

any_address = "::" # in6addr_any

2728

2556

def add_pipe(self, parent_pipe, proc):

2729

2557

# Call "handle_ipc" for both data and EOF events

2730

2558

GLib.io_add_watch(

2731

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2732

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2559

parent_pipe.fileno(),

2560

GLib.IO_IN | GLib.IO_HUP,

2733

2561

functools.partial(self.handle_ipc,

2734

2562

parent_pipe=parent_pipe,

2735

2563

proc=proc))

2748

2576

request = parent_pipe.recv()

2749

2577

command = request[0]

2750

2578

2751

if command == "init":

2752

key_id = request[1].decode("ascii")

2753

fpr = request[2].decode("ascii")

2754

address = request[3]

2579

if command == 'init':

2580

fpr = request[1]

2581

address = request[2]

2755

2582

2756

2583

for c in self.clients.values():

2757

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2758

"27AE41E4649B934CA495991B7852B855"):

2759

continue

2760

if key_id and c.key_id == key_id:

2761

client = c

2762

break

2763

if fpr and c.fingerprint == fpr:

2584

if c.fingerprint == fpr:

2764

2585

client = c

2765

2586

break

2766

2587

else:

2767

logger.info("Client not found for key ID: %s, address"

2768

": %s", key_id or fpr, address)

2588

logger.info("Client not found for fingerprint: %s, ad"

2589

"dress: %s", fpr, address)

2769

2590

if self.use_dbus:

2770

2591

# Emit D-Bus signal

2771

mandos_dbus_service.ClientNotFound(key_id or fpr,

2592

mandos_dbus_service.ClientNotFound(fpr,

2772

2593

address[0])

2773

2594

parent_pipe.send(False)

2774

2595

return False

2775

2596

2776

2597

GLib.io_add_watch(

2777

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2778

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2598

parent_pipe.fileno(),

2599

GLib.IO_IN | GLib.IO_HUP,

2779

2600

functools.partial(self.handle_ipc,

2780

2601

parent_pipe=parent_pipe,

2781

2602

proc=proc,

2784

2605

# remove the old hook in favor of the new above hook on

2785

2606

# same fileno

2786

2607

return False

2787

if command == "funcall":

2608

if command == 'funcall':

2788

2609

funcname = request[1]

2789

2610

args = request[2]

2790

2611

kwargs = request[3]

2791

2612

2792

parent_pipe.send(("data", getattr(client_object,

2613

parent_pipe.send(('data', getattr(client_object,

2793

2614

funcname)(*args,

2794

2615

**kwargs)))

2795

2616

2796

if command == "getattr":

2617

if command == 'getattr':

2797

2618

attrname = request[1]

2798

2619

if isinstance(client_object.__getattribute__(attrname),

2799

collections.abc.Callable):

2800

parent_pipe.send(("function", ))

2620

collections.Callable):

2621

parent_pipe.send(('function', ))

2801

2622

else:

2802

2623

parent_pipe.send((

2803

"data", client_object.__getattribute__(attrname)))

2624

'data', client_object.__getattribute__(attrname)))

2804

2625

2805

if command == "setattr":

2626

if command == 'setattr':

2806

2627

attrname = request[1]

2807

2628

value = request[2]

2808

2629

setattr(client_object, attrname, value)

2813

2634

def rfc3339_duration_to_delta(duration):

2814

2635

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2815

2636

2816

>>> timedelta = datetime.timedelta

2817

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2818

True

2819

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2820

True

2821

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2822

True

2823

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2824

True

2825

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2826

True

2827

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2828

True

2829

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2830

True

2831

>>> del timedelta

2637

>>> rfc3339_duration_to_delta("P7D")

2638

datetime.timedelta(7)

2639

>>> rfc3339_duration_to_delta("PT60S")

2640

datetime.timedelta(0, 60)

2641

>>> rfc3339_duration_to_delta("PT60M")

2642

datetime.timedelta(0, 3600)

2643

>>> rfc3339_duration_to_delta("PT24H")

2644

datetime.timedelta(1)

2645

>>> rfc3339_duration_to_delta("P1W")

2646

datetime.timedelta(7)

2647

>>> rfc3339_duration_to_delta("PT5M30S")

2648

datetime.timedelta(0, 330)

2649

>>> rfc3339_duration_to_delta("P1DT3M20S")

2650

datetime.timedelta(1, 200)

2832

2651

"""

2833

2652

2834

2653

# Parsing an RFC 3339 duration with regular expressions is not

2914

2733

def string_to_delta(interval):

2915

2734

"""Parse a string and return a datetime.timedelta

2916

2735

2917

>>> string_to_delta("7d") == datetime.timedelta(7)

2918

True

2919

>>> string_to_delta("60s") == datetime.timedelta(0, 60)

2920

True

2921

>>> string_to_delta("60m") == datetime.timedelta(0, 3600)

2922

True

2923

>>> string_to_delta("24h") == datetime.timedelta(1)

2924

True

2925

>>> string_to_delta("1w") == datetime.timedelta(7)

2926

True

2927

>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

2928

True

2736

>>> string_to_delta('7d')

2737

datetime.timedelta(7)

2738

>>> string_to_delta('60s')

2739

datetime.timedelta(0, 60)

2740

>>> string_to_delta('60m')

2741

datetime.timedelta(0, 3600)

2742

>>> string_to_delta('24h')

2743

datetime.timedelta(1)

2744

>>> string_to_delta('1w')

2745

datetime.timedelta(7)

2746

>>> string_to_delta('5m 30s')

2747

datetime.timedelta(0, 330)

2929

2748

"""

2930

2749

2931

2750

try:

3033

2852

3034

2853

options = parser.parse_args()

3035

2854

2855

if options.check:

2856

import doctest

2857

fail_count, test_count = doctest.testmod()

2858

sys.exit(os.EX_OK if fail_count == 0 else 1)

2859

3036

2860

# Default values for config file for server-global settings

3037

if gnutls.has_rawpk:

3038

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3039

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

3040

else:

3041

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

3042

":+SIGN-DSA-SHA256")

3043

2861

server_defaults = {"interface": "",

3044

2862

"address": "",

3045

2863

"port": "",

3046

2864

"debug": "False",

3047

"priority": priority,

2865

"priority":

2866

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2867

":+SIGN-DSA-SHA256",

3048

2868

"servicename": "Mandos",

3049

2869

"use_dbus": "True",

3050

2870

"use_ipv6": "True",

3055

2875

"foreground": "False",

3056

2876

"zeroconf": "True",

3057

2877

}

3058

del priority

3059

2878

3060

2879

# Parse config file for server-global settings

3061

server_config = configparser.ConfigParser(server_defaults)

2880

server_config = configparser.SafeConfigParser(server_defaults)

3062

2881

del server_defaults

3063

2882

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3064

# Convert the ConfigParser object to a dict

2883

# Convert the SafeConfigParser object to a dict

3065

2884

server_settings = server_config.defaults()

3066

2885

# Use the appropriate methods on the non-string config options

3067

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3068

"foreground", "zeroconf"):

2886

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3069

2887

server_settings[option] = server_config.getboolean("DEFAULT",

3070

2888

option)

3071

2889

if server_settings["port"]:

3134

2952

3135

2953

if server_settings["servicename"] != "Mandos":

3136

2954

syslogger.setFormatter(

3137

logging.Formatter("Mandos ({}) [%(process)d]:"

3138

" %(levelname)s: %(message)s".format(

2955

logging.Formatter('Mandos ({}) [%(process)d]:'

2956

' %(levelname)s: %(message)s'.format(

3139

2957

server_settings["servicename"])))

3140

2958

3141

2959

# Parse config file with clients

3142

client_config = configparser.ConfigParser(Client.client_defaults)

2960

client_config = configparser.SafeConfigParser(Client

2961

.client_defaults)

3143

2962

client_config.read(os.path.join(server_settings["configdir"],

3144

2963

"clients.conf"))

3145

2964

3201

3020

3202

3021

@gnutls.log_func

3203

3022

def debug_gnutls(level, string):

3204

logger.debug("GnuTLS: %s",

3205

string[:-1].decode("utf-8",

3206

errors="replace"))

3023

logger.debug("GnuTLS: %s", string[:-1])

3207

3024

3208

3025

gnutls.global_set_log_function(debug_gnutls)

3209

3026

3218

3035

# Close all input and output, do double fork, etc.

3219

3036

daemon()

3220

3037

3221

if gi.version_info < (3, 10, 2):

3222

# multiprocessing will use threads, so before we use GLib we

3223

# need to inform GLib that threads will be used.

3224

GLib.threads_init()

3038

# multiprocessing will use threads, so before we use GLib we need

3039

# to inform GLib that threads will be used.

3040

GLib.threads_init()

3225

3041

3226

3042

global main_loop

3227

3043

# From the Avahi example code

3303

3119

if isinstance(s, bytes)

3304

3120

else s) for s in

3305

3121

value["client_structure"]]

3306

# .name, .host, and .checker_command

3307

for k in ("name", "host", "checker_command"):

3122

# .name & .host

3123

for k in ("name", "host"):

3308

3124

if isinstance(value[k], bytes):

3309

3125

value[k] = value[k].decode("utf-8")

3310

if "key_id" not in value:

3311

value["key_id"] = ""

3312

elif "fingerprint" not in value:

3313

value["fingerprint"] = ""

3314

3126

# old_client_settings

3315

3127

# .keys()

3316

3128

old_client_settings = {

3320

3132

for key, value in

3321

3133

bytes_old_client_settings.items()}

3322

3134

del bytes_old_client_settings

3323

# .host and .checker_command

3135

# .host

3324

3136

for value in old_client_settings.values():

3325

for attribute in ("host", "checker_command"):

3326

if isinstance(value[attribute], bytes):

3327

value[attribute] = (value[attribute]

3328

.decode("utf-8"))

3137

if isinstance(value["host"], bytes):

3138

value["host"] = (value["host"]

3139

.decode("utf-8"))

3329

3140

os.remove(stored_state_path)

3330

3141

except IOError as e:

3331

3142

if e.errno == errno.ENOENT:

3454

3265

pass

3455

3266

3456

3267

@dbus.service.signal(_interface, signature="ss")

3457

def ClientNotFound(self, key_id, address):

3268

def ClientNotFound(self, fingerprint, address):

3458

3269

"D-Bus signal"

3459

3270

pass

3460

3271

3584

3395

3585

3396

try:

3586

3397

with tempfile.NamedTemporaryFile(

3587

mode="wb",

3398

mode='wb',

3588

3399

suffix=".pickle",

3589

prefix="clients-",

3400

prefix='clients-',

3590

3401

dir=os.path.dirname(stored_state_path),

3591

3402

delete=False) as stored_state:

3592

3403

pickle.dump((clients, client_settings), stored_state,

3656

3467

sys.exit(1)

3657

3468

# End of Avahi example code

3658

3469

3659

GLib.io_add_watch(

3660

GLib.IOChannel.unix_new(tcp_server.fileno()),

3661

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3662

lambda *args, **kwargs: (tcp_server.handle_request

3663

(*args[2:], **kwargs) or True))

3470

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3471

lambda *args, **kwargs:

3472

(tcp_server.handle_request

3473

(*args[2:], **kwargs) or True))

3664

3474

3665

3475

logger.debug("Starting main loop")

3666

3476

main_loop.run()

3676

3486

# Must run before the D-Bus bus name gets deregistered

3677

3487

cleanup()

3678

3488

3679

3680

def should_only_run_tests():

3681

parser = argparse.ArgumentParser(add_help=False)

3682

parser.add_argument("--check", action="store_true")

3683

args, unknown_args = parser.parse_known_args()

3684

run_tests = args.check

3685

if run_tests:

3686

# Remove --check argument from sys.argv

3687

sys.argv[1:] = unknown_args

3688

return run_tests

3689

3690

# Add all tests from doctest strings

3691

def load_tests(loader, tests, none):

3692

import doctest

3693

tests.addTests(doctest.DocTestSuite())

3694

return tests

3695

3696

if __name__ == "__main__":

3697

try:

3698

if should_only_run_tests():

3699

# Call using ./mandos --check [--verbose]

3700

unittest.main()

3701

else:

3702

main()

3703

finally:

3704

logging.shutdown()

3489

3490

if __name__ == '__main__':

3491

main()