/mandos/trunk

#!/usr/bin/python3 -bI

# -*- coding: utf-8; lexical-binding: t -*-

#

# Mandos server - give out binary blobs to connecting clients.

#

# This program is partly derived from an example program for an Avahi

# service publisher, downloaded from

# <http://avahi.org/wiki/PythonPublishExample>.  This includes the

# methods "add", "remove", "server_state_changed",

# "entry_group_state_changed", "cleanup", and "activate" in the

# "AvahiService" class, and some lines in "main".

#

# Everything else is

# Copyright © 2008-2020 Teddy Hogeborn

# Copyright © 2008-2020 Björn Påhlsson

#

# This file is part of Mandos.

#

# Mandos is free software: you can redistribute it and/or modify it

# under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

#     Mandos is distributed in the hope that it will be useful, but

#     WITHOUT ANY WARRANTY; without even the implied warranty of

#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

#     GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.

#

# Contact the authors at <mandos@recompile.se>.

#

from __future__ import (division, absolute_import, print_function,

                        unicode_literals)

try:

    from future_builtins import *

except ImportError:

    pass

import sys

import unittest

import argparse

import logging

import os

try:

    import SocketServer as socketserver

except ImportError:

    import socketserver

import socket

import datetime

import errno

try:

    import ConfigParser as configparser

except ImportError:

    import configparser

import re

import signal

import subprocess

import atexit

import stat

import logging.handlers

import pwd

import contextlib

import struct

import fcntl

import functools

try:

    import cPickle as pickle

except ImportError:

    import pickle

import multiprocessing

import types

import binascii

import tempfile

import itertools

import collections

import codecs

import random

import shlex

import dbus

import dbus.service

import gi

from gi.repository import GLib

from dbus.mainloop.glib import DBusGMainLoop

import ctypes

import ctypes.util

import xml.dom.minidom

import inspect

if sys.version_info.major == 2:

    __metaclass__ = type

    str = unicode

    input = raw_input

# Add collections.abc.Callable if it does not exist

try:

    collections.abc.Callable

except AttributeError:

    class abc:

        Callable = collections.Callable

    collections.abc = abc

    del abc

# Add shlex.quote if it does not exist

try:

    shlex.quote

except AttributeError:

    shlex.quote = re.escape

# Show warnings by default

if not sys.warnoptions:

    import warnings

    warnings.simplefilter("default")

# Try to find the value of SO_BINDTODEVICE:

try:

    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

    # newer, and it is also the most natural place for it:

    SO_BINDTODEVICE = socket.SO_BINDTODEVICE

except AttributeError:

    try:

        # This is where SO_BINDTODEVICE was up to and including Python

        # 2.6, and also 3.2:

        from IN import SO_BINDTODEVICE

    except ImportError:

        # In Python 2.7 it seems to have been removed entirely.

        # Try running the C preprocessor:

        try:

            cc = subprocess.Popen(["cc", "--language=c", "-E",

                                   "/dev/stdin"],

                                  stdin=subprocess.PIPE,

                                  stdout=subprocess.PIPE)

            stdout = cc.communicate(

                "#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

            SO_BINDTODEVICE = int(stdout.splitlines()[-1])

        except (OSError, ValueError, IndexError):

            # No value found

            SO_BINDTODEVICE = None

if sys.version_info < (3, 2):

    configparser.Configparser = configparser.SafeConfigParser

version = "1.8.14"

stored_state_file = "clients.pickle"

log = logging.getLogger(os.path.basename(sys.argv[0]))

logging.captureWarnings(True)   # Show warnings via the logging system

syslogger = None

try:

    if_nametoindex = ctypes.cdll.LoadLibrary(

        ctypes.util.find_library("c")).if_nametoindex

except (OSError, AttributeError):

    def if_nametoindex(interface):

        "Get an interface index the hard way, i.e. using fcntl()"

        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h

        with contextlib.closing(socket.socket()) as s:

            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

                                struct.pack(b"16s16x", interface))

        interface_index = struct.unpack("I", ifreq[16:20])[0]

        return interface_index

def copy_function(func):

    """Make a copy of a function"""

    if sys.version_info.major == 2:

        return types.FunctionType(func.func_code,

                                  func.func_globals,

                                  func.func_name,

                                  func.func_defaults,

                                  func.func_closure)

    else:

        return types.FunctionType(func.__code__,

                                  func.__globals__,

                                  func.__name__,

                                  func.__defaults__,

                                  func.__closure__)

def initlogger(debug, level=logging.WARNING):

    """init logger and add loglevel"""

    global syslogger

    syslogger = (logging.handlers.SysLogHandler(

        facility=logging.handlers.SysLogHandler.LOG_DAEMON,

        address="/dev/log"))

    syslogger.setFormatter(logging.Formatter

                           ("Mandos [%(process)d]: %(levelname)s:"

                            " %(message)s"))

    log.addHandler(syslogger)

    if debug:

        console = logging.StreamHandler()

        console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

                                               " [%(process)d]:"

                                               " %(levelname)s:"

                                               " %(message)s"))

        log.addHandler(console)

    log.setLevel(level)

class PGPError(Exception):

    """Exception if encryption/decryption fails"""

    pass

class PGPEngine:

    """A simple class for OpenPGP symmetric encryption & decryption"""

    def __init__(self):

        self.tempdir = tempfile.mkdtemp(prefix="mandos-")

        self.gpg = "gpg"

        try:

            output = subprocess.check_output(["gpgconf"])

            for line in output.splitlines():

                name, text, path = line.split(b":")

                if name == b"gpg":

                    self.gpg = path

                    break

        except OSError as e:

            if e.errno != errno.ENOENT:

                raise

        self.gnupgargs = ["--batch",

                          "--homedir", self.tempdir,

                          "--force-mdc",

                          "--quiet"]

        # Only GPG version 1 has the --no-use-agent option.

        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

            self.gnupgargs.append("--no-use-agent")

    def __enter__(self):

        return self

    def __exit__(self, exc_type, exc_value, traceback):

        self._cleanup()

        return False

    def __del__(self):

        self._cleanup()

    def _cleanup(self):

        if self.tempdir is not None:

            # Delete contents of tempdir

            for root, dirs, files in os.walk(self.tempdir,

                                             topdown=False):

                for filename in files:

                    os.remove(os.path.join(root, filename))

                for dirname in dirs:

                    os.rmdir(os.path.join(root, dirname))

            # Remove tempdir

            os.rmdir(self.tempdir)

            self.tempdir = None

    def password_encode(self, password):

        # Passphrase can not be empty and can not contain newlines or

        # NUL bytes.  So we prefix it and hex encode it.

        encoded = b"mandos" + binascii.hexlify(password)

        if len(encoded) > 2048:

            # GnuPG can't handle long passwords, so encode differently

            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

                       .replace(b"\n", b"\\n")

                       .replace(b"\0", b"\\x00"))

        return encoded

    def encrypt(self, data, password):

        passphrase = self.password_encode(password)

        with tempfile.NamedTemporaryFile(

                dir=self.tempdir) as passfile:

            passfile.write(passphrase)

            passfile.flush()

            proc = subprocess.Popen([self.gpg, "--symmetric",

                                     "--passphrase-file",

                                     passfile.name]

                                    + self.gnupgargs,

                                    stdin=subprocess.PIPE,

                                    stdout=subprocess.PIPE,

                                    stderr=subprocess.PIPE)

            ciphertext, err = proc.communicate(input=data)

        if proc.returncode != 0:

            raise PGPError(err)

        return ciphertext

    def decrypt(self, data, password):

        passphrase = self.password_encode(password)

        with tempfile.NamedTemporaryFile(

                dir=self.tempdir) as passfile:

            passfile.write(passphrase)

            passfile.flush()

            proc = subprocess.Popen([self.gpg, "--decrypt",

                                     "--passphrase-file",

                                     passfile.name]

                                    + self.gnupgargs,

                                    stdin=subprocess.PIPE,

                                    stdout=subprocess.PIPE,

                                    stderr=subprocess.PIPE)

            decrypted_plaintext, err = proc.communicate(input=data)

        if proc.returncode != 0:

            raise PGPError(err)

        return decrypted_plaintext

# Pretend that we have an Avahi module

class avahi:

    """This isn't so much a class as it is a module-like namespace."""

    IF_UNSPEC = -1               # avahi-common/address.h

    PROTO_UNSPEC = -1            # avahi-common/address.h

    PROTO_INET = 0               # avahi-common/address.h

    PROTO_INET6 = 1              # avahi-common/address.h

    DBUS_NAME = "org.freedesktop.Avahi"

    DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

    DBUS_PATH_SERVER = "/"

    @staticmethod

    def string_array_to_txt_array(t):

        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

                           for s in t), signature="ay")

    ENTRY_GROUP_ESTABLISHED = 2  # avahi-common/defs.h

    ENTRY_GROUP_COLLISION = 3    # avahi-common/defs.h

    ENTRY_GROUP_FAILURE = 4      # avahi-common/defs.h

    SERVER_INVALID = 0           # avahi-common/defs.h

    SERVER_REGISTERING = 1       # avahi-common/defs.h

    SERVER_RUNNING = 2           # avahi-common/defs.h

    SERVER_COLLISION = 3         # avahi-common/defs.h

    SERVER_FAILURE = 4           # avahi-common/defs.h

class AvahiError(Exception):

    def __init__(self, value, *args, **kwargs):

        self.value = value

        return super(AvahiError, self).__init__(value, *args,

                                                **kwargs)

class AvahiServiceError(AvahiError):

    pass

class AvahiGroupError(AvahiError):

    pass

class AvahiService:

    """An Avahi (Zeroconf) service.

    Attributes:

    interface: integer; avahi.IF_UNSPEC or an interface index.

               Used to optionally bind to the specified interface.

    name: string; Example: "Mandos"

    type: string; Example: "_mandos._tcp".

     See <https://www.iana.org/assignments/service-names-port-numbers>

    port: integer; what port to announce

    TXT: list of strings; TXT record for the service

    domain: string; Domain to publish on, default to .local if empty.

    host: string; Host to publish records for, default is localhost

    max_renames: integer; maximum number of renames

    rename_count: integer; counter so we only rename after collisions

                  a sensible number of times

    group: D-Bus Entry Group

    server: D-Bus Server

    bus: dbus.SystemBus()

    """

    def __init__(self,

                 interface=avahi.IF_UNSPEC,

                 name=None,

                 servicetype=None,

                 port=None,

                 TXT=None,

                 domain="",

                 host="",

                 max_renames=32768,

                 protocol=avahi.PROTO_UNSPEC,

                 bus=None):

        self.interface = interface

        self.name = name

        self.type = servicetype

        self.port = port

        self.TXT = TXT if TXT is not None else []

        self.domain = domain

        self.host = host

        self.rename_count = 0

        self.max_renames = max_renames

        self.protocol = protocol

        self.group = None       # our entry group

        self.server = None

        self.bus = bus

        self.entry_group_state_changed_match = None

    def rename(self, remove=True):

        """Derived from the Avahi example code"""

        if self.rename_count >= self.max_renames:

            log.critical("No suitable Zeroconf service name found"

                         " after %i retries, exiting.",

                         self.rename_count)

            raise AvahiServiceError("Too many renames")

        self.name = str(

            self.server.GetAlternativeServiceName(self.name))

        self.rename_count += 1

        log.info("Changing Zeroconf service name to %r ...",

                 self.name)

        if remove:

            self.remove()

        try:

            self.add()

        except dbus.exceptions.DBusException as error:

            if (error.get_dbus_name()

                == "org.freedesktop.Avahi.CollisionError"):

                log.info("Local Zeroconf service name collision.")

                return self.rename(remove=False)

            else:

                log.critical("D-Bus Exception", exc_info=error)

                self.cleanup()

                os._exit(1)

    def remove(self):

        """Derived from the Avahi example code"""

        if self.entry_group_state_changed_match is not None:

            self.entry_group_state_changed_match.remove()

            self.entry_group_state_changed_match = None

        if self.group is not None:

            self.group.Reset()

    def add(self):

        """Derived from the Avahi example code"""

        self.remove()

        if self.group is None:

            self.group = dbus.Interface(

                self.bus.get_object(avahi.DBUS_NAME,

                                    self.server.EntryGroupNew()),

                avahi.DBUS_INTERFACE_ENTRY_GROUP)

        self.entry_group_state_changed_match = (

            self.group.connect_to_signal(

                "StateChanged", self.entry_group_state_changed))

        log.debug("Adding Zeroconf service '%s' of type '%s' ...",

                  self.name, self.type)

        self.group.AddService(

            self.interface,

            self.protocol,

            dbus.UInt32(0),     # flags

            self.name, self.type,

            self.domain, self.host,

            dbus.UInt16(self.port),

            avahi.string_array_to_txt_array(self.TXT))

        self.group.Commit()

    def entry_group_state_changed(self, state, error):

        """Derived from the Avahi example code"""

        log.debug("Avahi entry group state change: %i", state)

        if state == avahi.ENTRY_GROUP_ESTABLISHED:

            log.debug("Zeroconf service established.")

        elif state == avahi.ENTRY_GROUP_COLLISION:

            log.info("Zeroconf service name collision.")

            self.rename()

        elif state == avahi.ENTRY_GROUP_FAILURE:

            log.critical("Avahi: Error in group state changed %s",

                         str(error))

            raise AvahiGroupError("State changed: {!s}".format(error))

    def cleanup(self):

        """Derived from the Avahi example code"""

        if self.group is not None:

            try:

                self.group.Free()

            except (dbus.exceptions.UnknownMethodException,

                    dbus.exceptions.DBusException):

                pass

            self.group = None

        self.remove()

    def server_state_changed(self, state, error=None):

        """Derived from the Avahi example code"""

        log.debug("Avahi server state change: %i", state)

        bad_states = {

            avahi.SERVER_INVALID: "Zeroconf server invalid",

            avahi.SERVER_REGISTERING: None,

            avahi.SERVER_COLLISION: "Zeroconf server name collision",

            avahi.SERVER_FAILURE: "Zeroconf server failure",

        }

        if state in bad_states:

            if bad_states[state] is not None:

                if error is None:

                    log.error(bad_states[state])

                else:

                    log.error(bad_states[state] + ": %r", error)

            self.cleanup()

        elif state == avahi.SERVER_RUNNING:

            try:

                self.add()

            except dbus.exceptions.DBusException as error:

                if (error.get_dbus_name()

                    == "org.freedesktop.Avahi.CollisionError"):

                    log.info("Local Zeroconf service name collision.")

                    return self.rename(remove=False)

                else:

                    log.critical("D-Bus Exception", exc_info=error)

                    self.cleanup()

                    os._exit(1)

        else:

            if error is None:

                log.debug("Unknown state: %r", state)

            else:

                log.debug("Unknown state: %r: %r", state, error)

    def activate(self):

        """Derived from the Avahi example code"""

        if self.server is None:

            self.server = dbus.Interface(

                self.bus.get_object(avahi.DBUS_NAME,

                                    avahi.DBUS_PATH_SERVER,

                                    follow_name_owner_changes=True),

                avahi.DBUS_INTERFACE_SERVER)

        self.server.connect_to_signal("StateChanged",

                                      self.server_state_changed)

        self.server_state_changed(self.server.GetState())

class AvahiServiceToSyslog(AvahiService):

    def rename(self, *args, **kwargs):

        """Add the new name to the syslog messages"""

        ret = super(AvahiServiceToSyslog, self).rename(*args,

                                                       **kwargs)

        syslogger.setFormatter(logging.Formatter(

            "Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

            .format(self.name)))

        return ret

# Pretend that we have a GnuTLS module

class gnutls:

    """This isn't so much a class as it is a module-like namespace."""

    library = ctypes.util.find_library("gnutls")

    if library is None:

        library = ctypes.util.find_library("gnutls-deb0")

    _library = ctypes.cdll.LoadLibrary(library)

    del library

    # Unless otherwise indicated, the constants and types below are

    # all from the gnutls/gnutls.h C header file.

    # Constants

    E_SUCCESS = 0

    E_INTERRUPTED = -52

    E_AGAIN = -28

    CRT_OPENPGP = 2

    CRT_RAWPK = 3

    CLIENT = 2

    SHUT_RDWR = 0

    CRD_CERTIFICATE = 1

    E_NO_CERTIFICATE_FOUND = -49

    X509_FMT_DER = 0

    NO_TICKETS = 1<<10

    ENABLE_RAWPK = 1<<18

    CTYPE_PEERS = 3

    KEYID_USE_SHA256 = 1        # gnutls/x509.h

    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h

    # Types

    class _session_int(ctypes.Structure):

        _fields_ = []

    session_t = ctypes.POINTER(_session_int)

    class certificate_credentials_st(ctypes.Structure):

        _fields_ = []

    certificate_credentials_t = ctypes.POINTER(

        certificate_credentials_st)

    certificate_type_t = ctypes.c_int

    class datum_t(ctypes.Structure):

        _fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

                    ("size", ctypes.c_uint)]

    class _openpgp_crt_int(ctypes.Structure):

        _fields_ = []

    openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h

    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

    credentials_type_t = ctypes.c_int

    transport_ptr_t = ctypes.c_void_p

    close_request_t = ctypes.c_int

    # Exceptions

    class Error(Exception):

        def __init__(self, message=None, code=None, args=()):

            # Default usage is by a message string, but if a return

            # code is passed, convert it to a string with

            # gnutls.strerror()

            self.code = code

            if message is None and code is not None:

                message = gnutls.strerror(code).decode(

                    "utf-8", errors="replace")

            return super(gnutls.Error, self).__init__(

                message, *args)

    class CertificateSecurityError(Error):

        pass

    class PointerTo:

        def __init__(self, cls):

            self.cls = cls

        def from_param(self, obj):

            if not isinstance(obj, self.cls):

                raise TypeError("Not of type {}: {!r}"

                                .format(self.cls.__name__, obj))

            return ctypes.byref(obj.from_param(obj))

    class CastToVoidPointer: