/mandos/trunk

#!/usr/bin/python2.7

# -*- mode: python; coding: utf-8 -*-

# 

# Mandos server - give out binary blobs to connecting clients.

# 

# This program is partly derived from an example program for an Avahi

# service publisher, downloaded from

# <http://avahi.org/wiki/PythonPublishExample>.  This includes the

# methods "add", "remove", "server_state_changed",

# "entry_group_state_changed", "cleanup", and "activate" in the

# "AvahiService" class, and some lines in "main".

# 

# Everything else is

# Copyright © 2008-2015 Teddy Hogeborn

# Copyright © 2008-2015 Björn Påhlsson

# 

# This program is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

#     This program is distributed in the hope that it will be useful,

#     but WITHOUT ANY WARRANTY; without even the implied warranty of

#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

#     GNU General Public License for more details.

# 

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see

# <http://www.gnu.org/licenses/>.

# 

# Contact the authors at <mandos@recompile.se>.

# 

from __future__ import (division, absolute_import, print_function,

                        unicode_literals)

from future_builtins import *

try:

    import SocketServer as socketserver

except ImportError:

    import socketserver

import socket

import argparse

import datetime

import errno

try:

    import ConfigParser as configparser

except ImportError:

    import configparser

import sys

import re

import os

import signal

import subprocess

import atexit

import stat

import logging

import logging.handlers

import pwd

import contextlib

import struct

import fcntl

import functools

try:

    import cPickle as pickle

except ImportError:

    import pickle

import multiprocessing

import types

import binascii

import tempfile

import itertools

import collections

import codecs

import dbus

import dbus.service

try:

    import gobject

except ImportError:

    from gi.repository import GObject as gobject

import avahi

from dbus.mainloop.glib import DBusGMainLoop

import ctypes

import ctypes.util

import xml.dom.minidom

import inspect

try:

    SO_BINDTODEVICE = socket.SO_BINDTODEVICE

except AttributeError:

    try:

        from IN import SO_BINDTODEVICE

    except ImportError:

        SO_BINDTODEVICE = None

if sys.version_info.major == 2:

    str = unicode

version = "1.7.1"

stored_state_file = "clients.pickle"

logger = logging.getLogger()

syslogger = None

try:

    if_nametoindex = ctypes.cdll.LoadLibrary(

        ctypes.util.find_library("c")).if_nametoindex

except (OSError, AttributeError):

    def if_nametoindex(interface):

        "Get an interface index the hard way, i.e. using fcntl()"

        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h

        with contextlib.closing(socket.socket()) as s:

            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

                                struct.pack(b"16s16x", interface))

        interface_index = struct.unpack("I", ifreq[16:20])[0]

        return interface_index

def initlogger(debug, level=logging.WARNING):

    """init logger and add loglevel"""

    global syslogger

    syslogger = (logging.handlers.SysLogHandler(

        facility = logging.handlers.SysLogHandler.LOG_DAEMON,

        address = "/dev/log"))

    syslogger.setFormatter(logging.Formatter

                           ('Mandos [%(process)d]: %(levelname)s:'

                            ' %(message)s'))

    logger.addHandler(syslogger)

    if debug:

        console = logging.StreamHandler()

        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

                                               ' [%(process)d]:'

                                               ' %(levelname)s:'

                                               ' %(message)s'))

        logger.addHandler(console)

    logger.setLevel(level)

class PGPError(Exception):

    """Exception if encryption/decryption fails"""

    pass

class PGPEngine(object):

    """A simple class for OpenPGP symmetric encryption & decryption"""

    def __init__(self):

        self.tempdir = tempfile.mkdtemp(prefix="mandos-")

        self.gnupgargs = ['--batch',

                          '--home', self.tempdir,

                          '--force-mdc',

                          '--quiet',

                          '--no-use-agent']

    def __enter__(self):

        return self

    def __exit__(self, exc_type, exc_value, traceback):

        self._cleanup()

        return False

    def __del__(self):

        self._cleanup()

    def _cleanup(self):

        if self.tempdir is not None:

            # Delete contents of tempdir

            for root, dirs, files in os.walk(self.tempdir,

                                             topdown = False):

                for filename in files:

                    os.remove(os.path.join(root, filename))

                for dirname in dirs:

                    os.rmdir(os.path.join(root, dirname))

            # Remove tempdir

            os.rmdir(self.tempdir)

            self.tempdir = None

    def password_encode(self, password):

        # Passphrase can not be empty and can not contain newlines or

        # NUL bytes.  So we prefix it and hex encode it.

        encoded = b"mandos" + binascii.hexlify(password)

        if len(encoded) > 2048:

            # GnuPG can't handle long passwords, so encode differently

            encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

                       .replace(b"\n", b"\\n")

                       .replace(b"\0", b"\\x00"))

        return encoded

    def encrypt(self, data, password):

        passphrase = self.password_encode(password)

        with tempfile.NamedTemporaryFile(

                dir=self.tempdir) as passfile:

            passfile.write(passphrase)

            passfile.flush()

            proc = subprocess.Popen(['gpg', '--symmetric',

                                     '--passphrase-file',

                                     passfile.name]

                                    + self.gnupgargs,

                                    stdin = subprocess.PIPE,

                                    stdout = subprocess.PIPE,

                                    stderr = subprocess.PIPE)

            ciphertext, err = proc.communicate(input = data)

        if proc.returncode != 0:

            raise PGPError(err)

        return ciphertext

    def decrypt(self, data, password):

        passphrase = self.password_encode(password)

        with tempfile.NamedTemporaryFile(

                dir = self.tempdir) as passfile:

            passfile.write(passphrase)

            passfile.flush()

            proc = subprocess.Popen(['gpg', '--decrypt',

                                     '--passphrase-file',

                                     passfile.name]

                                    + self.gnupgargs,

                                    stdin = subprocess.PIPE,

                                    stdout = subprocess.PIPE,

                                    stderr = subprocess.PIPE)

            decrypted_plaintext, err = proc.communicate(input = data)

        if proc.returncode != 0:

            raise PGPError(err)

        return decrypted_plaintext

class AvahiError(Exception):

    def __init__(self, value, *args, **kwargs):

        self.value = value

        return super(AvahiError, self).__init__(value, *args,

                                                **kwargs)

class AvahiServiceError(AvahiError):

    pass

class AvahiGroupError(AvahiError):

    pass

class AvahiService(object):

    """An Avahi (Zeroconf) service.

    Attributes:

    interface: integer; avahi.IF_UNSPEC or an interface index.

               Used to optionally bind to the specified interface.

    name: string; Example: 'Mandos'

    type: string; Example: '_mandos._tcp'.

     See <https://www.iana.org/assignments/service-names-port-numbers>

    port: integer; what port to announce

    TXT: list of strings; TXT record for the service

    domain: string; Domain to publish on, default to .local if empty.

    host: string; Host to publish records for, default is localhost

    max_renames: integer; maximum number of renames

    rename_count: integer; counter so we only rename after collisions

                  a sensible number of times

    group: D-Bus Entry Group

    server: D-Bus Server

    bus: dbus.SystemBus()

    """

    def __init__(self,

                 interface = avahi.IF_UNSPEC,

                 name = None,

                 servicetype = None,

                 port = None,

                 TXT = None,

                 domain = "",

                 host = "",

                 max_renames = 32768,

                 protocol = avahi.PROTO_UNSPEC,

                 bus = None):

        self.interface = interface

        self.name = name

        self.type = servicetype

        self.port = port

        self.TXT = TXT if TXT is not None else []

        self.domain = domain

        self.host = host

        self.rename_count = 0

        self.max_renames = max_renames

        self.protocol = protocol

        self.group = None       # our entry group

        self.server = None

        self.bus = bus

        self.entry_group_state_changed_match = None

    def rename(self, remove=True):

        """Derived from the Avahi example code"""

        if self.rename_count >= self.max_renames:

            logger.critical("No suitable Zeroconf service name found"

                            " after %i retries, exiting.",

                            self.rename_count)

            raise AvahiServiceError("Too many renames")

        self.name = str(

            self.server.GetAlternativeServiceName(self.name))

        self.rename_count += 1

        logger.info("Changing Zeroconf service name to %r ...",

                    self.name)

        if remove:

            self.remove()

        try:

            self.add()

        except dbus.exceptions.DBusException as error:

            if (error.get_dbus_name()

                == "org.freedesktop.Avahi.CollisionError"):

                logger.info("Local Zeroconf service name collision.")

                return self.rename(remove=False)

            else:

                logger.critical("D-Bus Exception", exc_info=error)

                self.cleanup()

                os._exit(1)

    def remove(self):

        """Derived from the Avahi example code"""

        if self.entry_group_state_changed_match is not None:

            self.entry_group_state_changed_match.remove()

            self.entry_group_state_changed_match = None

        if self.group is not None:

            self.group.Reset()

    def add(self):

        """Derived from the Avahi example code"""

        self.remove()

        if self.group is None:

            self.group = dbus.Interface(

                self.bus.get_object(avahi.DBUS_NAME,

                                    self.server.EntryGroupNew()),

                avahi.DBUS_INTERFACE_ENTRY_GROUP)

        self.entry_group_state_changed_match = (

            self.group.connect_to_signal(

                'StateChanged', self.entry_group_state_changed))

        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

                     self.name, self.type)

        self.group.AddService(

            self.interface,

            self.protocol,

            dbus.UInt32(0),     # flags

            self.name, self.type,

            self.domain, self.host,

            dbus.UInt16(self.port),

            avahi.string_array_to_txt_array(self.TXT))

        self.group.Commit()

    def entry_group_state_changed(self, state, error):

        """Derived from the Avahi example code"""

        logger.debug("Avahi entry group state change: %i", state)

        if state == avahi.ENTRY_GROUP_ESTABLISHED:

            logger.debug("Zeroconf service established.")

        elif state == avahi.ENTRY_GROUP_COLLISION:

            logger.info("Zeroconf service name collision.")

            self.rename()

        elif state == avahi.ENTRY_GROUP_FAILURE:

            logger.critical("Avahi: Error in group state changed %s",

                            str(error))

            raise AvahiGroupError("State changed: {!s}".format(error))

    def cleanup(self):

        """Derived from the Avahi example code"""

        if self.group is not None:

            try:

                self.group.Free()

            except (dbus.exceptions.UnknownMethodException,

                    dbus.exceptions.DBusException):

                pass

            self.group = None

        self.remove()

    def server_state_changed(self, state, error=None):

        """Derived from the Avahi example code"""

        logger.debug("Avahi server state change: %i", state)

        bad_states = {

            avahi.SERVER_INVALID: "Zeroconf server invalid",

            avahi.SERVER_REGISTERING: None,

            avahi.SERVER_COLLISION: "Zeroconf server name collision",

            avahi.SERVER_FAILURE: "Zeroconf server failure",

        }

        if state in bad_states:

            if bad_states[state] is not None:

                if error is None:

                    logger.error(bad_states[state])

                else:

                    logger.error(bad_states[state] + ": %r", error)

            self.cleanup()

        elif state == avahi.SERVER_RUNNING:

            try:

                self.add()

            except dbus.exceptions.DBusException as error:

                if (error.get_dbus_name()

                    == "org.freedesktop.Avahi.CollisionError"):

                    logger.info("Local Zeroconf service name"

                                " collision.")

                    return self.rename(remove=False)

                else:

                    logger.critical("D-Bus Exception", exc_info=error)

                    self.cleanup()

                    os._exit(1)

        else:

            if error is None:

                logger.debug("Unknown state: %r", state)

            else:

                logger.debug("Unknown state: %r: %r", state, error)

    def activate(self):

        """Derived from the Avahi example code"""

        if self.server is None:

            self.server = dbus.Interface(

                self.bus.get_object(avahi.DBUS_NAME,

                                    avahi.DBUS_PATH_SERVER,

                                    follow_name_owner_changes=True),

                avahi.DBUS_INTERFACE_SERVER)

        self.server.connect_to_signal("StateChanged",

                                      self.server_state_changed)

        self.server_state_changed(self.server.GetState())

class AvahiServiceToSyslog(AvahiService):

    def rename(self, *args, **kwargs):

        """Add the new name to the syslog messages"""

        ret = AvahiService.rename(self, *args, **kwargs)

        syslogger.setFormatter(logging.Formatter(

            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

            .format(self.name)))

        return ret

# Pretend that we have a GnuTLS module

class GnuTLS(object):

    """This isn't so much a class as it is a module-like namespace.

    It is instantiated once, and simulates having a GnuTLS module."""

    _library = ctypes.cdll.LoadLibrary(

        ctypes.util.find_library("gnutls"))

    _need_version = "3.3.0"

    def __init__(self):

        # Need to use class name "GnuTLS" here, since this method is

        # called before the assignment to the "gnutls" global variable

        # happens.

        if GnuTLS.check_version(self._need_version) is None:

            raise GnuTLS.Error("Needs GnuTLS {} or later"

                               .format(self._need_version))

    # Unless otherwise indicated, the constants and types below are

    # all from the gnutls/gnutls.h C header file.

    # Constants

    E_SUCCESS = 0

    CRT_OPENPGP = 2

    CLIENT = 2

    SHUT_RDWR = 0

    CRD_CERTIFICATE = 1

    E_NO_CERTIFICATE_FOUND = -49

    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h

    # Types

    class session_int(ctypes.Structure):

        _fields_ = []

    session_t = ctypes.POINTER(session_int)

    class certificate_credentials_st(ctypes.Structure):

        _fields_ = []

    certificate_credentials_t = ctypes.POINTER(

        certificate_credentials_st)

    certificate_type_t = ctypes.c_int

    class datum_t(ctypes.Structure):

        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

                    ('size', ctypes.c_uint)]

    class openpgp_crt_int(ctypes.Structure):

        _fields_ = []

    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

    openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

    credentials_type_t = ctypes.c_int # 

    transport_ptr_t = ctypes.c_void_p

    close_request_t = ctypes.c_int

    # Exceptions

    class Error(Exception):

        # We need to use the class name "GnuTLS" here, since this

        # exception might be raised from within GnuTLS.__init__,

        # which is called before the assignment to the "gnutls"

        # global variable happens.

        def __init__(self, message = None, code = None, args=()):

            # Default usage is by a message string, but if a return

            # code is passed, convert it to a string with

            # gnutls.strerror()

            if message is None and code is not None:

                message = GnuTLS.strerror(code)

            return super(GnuTLS.Error, self).__init__(

                message, *args)

    class CertificateSecurityError(Error):

        pass

    # Classes

    class Credentials(object):

        def __init__(self):

            self._c_object = gnutls.certificate_credentials_t()

            gnutls.certificate_allocate_credentials(

                ctypes.byref(self._c_object))

            self.type = gnutls.CRD_CERTIFICATE

        def __del__(self):

            gnutls.certificate_free_credentials(self._c_object)

    class ClientSession(object):

        def __init__(self, socket, credentials = None):

            self._c_object = gnutls.session_t()

            gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

            gnutls.set_default_priority(self._c_object)

            gnutls.transport_set_ptr(self._c_object, socket.fileno())

            gnutls.handshake_set_private_extensions(self._c_object,

                                                    True)

            self.socket = socket

            if credentials is None:

                credentials = gnutls.Credentials()

            gnutls.credentials_set(self._c_object, credentials.type,

                                   ctypes.cast(credentials._c_object,

                                               ctypes.c_void_p))

            self.credentials = credentials

        def __del__(self):

            gnutls.deinit(self._c_object)

        def handshake(self):

            return gnutls.handshake(self._c_object)

        def send(self, data):

            data = bytes(data)

            if not data:

                return 0

            return gnutls.record_send(self._c_object, data, len(data))

        def bye(self):

            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

    # Error handling function

    def _error_code(result):

        """A function to raise exceptions on errors, suitable

        for the 'restype' attribute on ctypes functions"""

        if result >= 0:

            return result

        if result == gnutls.E_NO_CERTIFICATE_FOUND:

            raise gnutls.CertificateSecurityError(code = result)

        raise gnutls.Error(code = result)

    # Unless otherwise indicated, the function declarations below are

    # all from the gnutls/gnutls.h C header file.

    # Functions

    priority_set_direct = _library.gnutls_priority_set_direct

    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

                                    ctypes.POINTER(ctypes.c_char_p)]

    priority_set_direct.restype = _error_code

    init = _library.gnutls_init

    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

    init.restype = _error_code

    set_default_priority = _library.gnutls_set_default_priority

    set_default_priority.argtypes = [session_t]

    set_default_priority.restype = _error_code

    record_send = _library.gnutls_record_send

    record_send.argtypes = [session_t, ctypes.c_void_p,

                            ctypes.c_size_t]

    record_send.restype = ctypes.c_ssize_t

    certificate_allocate_credentials = (

        _library.gnutls_certificate_allocate_credentials)

    certificate_allocate_credentials.argtypes = [

        ctypes.POINTER(certificate_credentials_t)]

    certificate_allocate_credentials.restype = _error_code

    certificate_free_credentials = (

        _library.gnutls_certificate_free_credentials)

    certificate_free_credentials.argtypes = [certificate_credentials_t]

    certificate_free_credentials.restype = None

    handshake_set_private_extensions = (

        _library.gnutls_handshake_set_private_extensions)

    handshake_set_private_extensions.argtypes = [session_t,

                                                 ctypes.c_int]

    handshake_set_private_extensions.restype = None

    credentials_set = _library.gnutls_credentials_set

    credentials_set.argtypes = [session_t, credentials_type_t,

                                ctypes.c_void_p]

    credentials_set.restype = _error_code

    strerror = _library.gnutls_strerror

    strerror.argtypes = [ctypes.c_int]

    strerror.restype = ctypes.c_char_p

    certificate_type_get = _library.gnutls_certificate_type_get

    certificate_type_get.argtypes = [session_t]

    certificate_type_get.restype = _error_code

    certificate_get_peers = _library.gnutls_certificate_get_peers

    certificate_get_peers.argtypes = [session_t,

                                      ctypes.POINTER(ctypes.c_uint)]

    certificate_get_peers.restype = ctypes.POINTER(datum_t)

    global_set_log_level = _library.gnutls_global_set_log_level

    global_set_log_level.argtypes = [ctypes.c_int]

    global_set_log_level.restype = None

    global_set_log_function = _library.gnutls_global_set_log_function

    global_set_log_function.argtypes = [log_func]

    global_set_log_function.restype = None

    deinit = _library.gnutls_deinit

    deinit.argtypes = [session_t]

    deinit.restype = None

    handshake = _library.gnutls_handshake

    handshake.argtypes = [session_t]

    handshake.restype = _error_code

    transport_set_ptr = _library.gnutls_transport_set_ptr

    transport_set_ptr.argtypes = [session_t, transport_ptr_t]

    transport_set_ptr.restype = None

    bye = _library.gnutls_bye

    bye.argtypes = [session_t, close_request_t]

    bye.restype = _error_code

    check_version = _library.gnutls_check_version

    check_version.argtypes = [ctypes.c_char_p]

    check_version.restype = ctypes.c_char_p

    # All the function declarations below are from gnutls/openpgp.h

    openpgp_crt_init = _library.gnutls_openpgp_crt_init

    openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

    openpgp_crt_init.restype = _error_code

    openpgp_crt_import = _library.gnutls_openpgp_crt_import

    openpgp_crt_import.argtypes = [openpgp_crt_t,

                                   ctypes.POINTER(datum_t),

                                   openpgp_crt_fmt_t]

    openpgp_crt_import.restype = _error_code

    openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

    openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

                                        ctypes.POINTER(ctypes.c_uint)]

    openpgp_crt_verify_self.restype = _error_code

    openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

    openpgp_crt_deinit.argtypes = [openpgp_crt_t]

    openpgp_crt_deinit.restype = None

    openpgp_crt_get_fingerprint = (

        _library.gnutls_openpgp_crt_get_fingerprint)

    openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

                                            ctypes.c_void_p,

                                            ctypes.POINTER(

                                                ctypes.c_size_t)]

    openpgp_crt_get_fingerprint.restype = _error_code

    # Remove non-public function

    del _error_code

# Create the global "gnutls" object, simulating a module

gnutls = GnuTLS()

def call_pipe(connection,       # : multiprocessing.Connection

              func, *args, **kwargs):

    """This function is meant to be called by multiprocessing.Process