/mandos/trunk : revision 1147

1

#!/usr/bin/python3 -bI

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

77

import itertools

78

import collections

79

import codecs

80

import unittest

81

80

82

81

import dbus

83

82

import dbus.service

89

88

import xml.dom.minidom

90

89

import inspect

91

90

92

if sys.version_info.major == 2:

93

__metaclass__ = type

94

95

# Show warnings by default

96

if not sys.warnoptions:

97

import warnings

98

warnings.simplefilter("default")

99

100

91

# Try to find the value of SO_BINDTODEVICE:

101

92

try:

102

93

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

128

119

if sys.version_info < (3, 2):

129

120

configparser.Configparser = configparser.SafeConfigParser

130

121

131

version = "1.8.9"

122

version = "1.8.6"

132

123

stored_state_file = "clients.pickle"

133

124

134

125

logger = logging.getLogger()

135

logging.captureWarnings(True) # Show warnings via the logging system

136

126

syslogger = None

137

127

138

128

try:

193

183

pass

194

184

195

185

196

class PGPEngine:

186

class PGPEngine(object):

197

187

"""A simple class for OpenPGP symmetric encryption & decryption"""

198

188

199

189

def __init__(self):

203

193

output = subprocess.check_output(["gpgconf"])

204

194

for line in output.splitlines():

205

195

name, text, path = line.split(b":")

206

if name == b"gpg":

196

if name == "gpg":

207

197

self.gpg = path

208

198

break

209

199

except OSError as e:

214

204

'--force-mdc',

215

205

'--quiet']

216

206

# Only GPG version 1 has the --no-use-agent option.

217

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

207

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

218

208

self.gnupgargs.append("--no-use-agent")

219

209

220

210

def __enter__(self):

289

279

290

280

291

281

# Pretend that we have an Avahi module

292

class avahi:

282

class avahi(object):

293

283

"""This isn't so much a class as it is a module-like namespace."""

294

284

IF_UNSPEC = -1 # avahi-common/address.h

295

285

PROTO_UNSPEC = -1 # avahi-common/address.h

329

319

pass

330

320

331

321

332

class AvahiService:

322

class AvahiService(object):

333

323

"""An Avahi (Zeroconf) service.

334

324

335

325

Attributes:

517

507

518

508

519

509

# Pretend that we have a GnuTLS module

520

class gnutls:

510

class gnutls(object):

521

511

"""This isn't so much a class as it is a module-like namespace."""

522

512

523

513

library = ctypes.util.find_library("gnutls")

586

576

pass

587

577

588

578

# Classes

589

class Credentials:

579

class Credentials(object):

590

580

def __init__(self):

591

581

self._c_object = gnutls.certificate_credentials_t()

592

582

gnutls.certificate_allocate_credentials(

596

586

def __del__(self):

597

587

gnutls.certificate_free_credentials(self._c_object)

598

588

599

class ClientSession:

589

class ClientSession(object):

600

590

def __init__(self, socket, credentials=None):

601

591

self._c_object = gnutls.session_t()

602

592

gnutls_flags = gnutls.CLIENT

828

818

connection.close()

829

819

830

820

831

class Client:

821

class Client(object):

832

822

"""A representation of a client host served by this server.

833

823

834

824

Attributes:

1053

1043

# Read return code from connection (see call_pipe)

1054

1044

returncode = connection.recv()

1055

1045

connection.close()

1056

if self.checker is not None:

1057

self.checker.join()

1046

self.checker.join()

1058

1047

self.checker_callback_tag = None

1059

1048

self.checker = None

1060

1049

1151

1140

kwargs=popen_args)

1152

1141

self.checker.start()

1153

1142

self.checker_callback_tag = GLib.io_add_watch(

1154

GLib.IOChannel.unix_new(pipe[0].fileno()),

1155

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1143

pipe[0].fileno(), GLib.IO_IN,

1156

1144

self.checker_callback, pipe[0], command)

1157

1145

# Re-run this periodically if run by GLib.timeout_add

1158

1146

return True

2225

2213

del _interface

2226

2214

2227

2215

2228

class ProxyClient:

2216

class ProxyClient(object):

2229

2217

def __init__(self, child_pipe, key_id, fpr, address):

2230

2218

self._pipe = child_pipe

2231

2219

self._pipe.send(('init', key_id, fpr, address))

2504

2492

return hex_fpr

2505

2493

2506

2494

2507

class MultiprocessingMixIn:

2495

class MultiprocessingMixIn(object):

2508

2496

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2509

2497

2510

2498

def sub_process_main(self, request, address):

2522

2510

return proc

2523

2511

2524

2512

2525

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

2513

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2526

2514

""" adds a pipe to the MixIn """

2527

2515

2528

2516

def process_request(self, request, client_address):

2543

2531

2544

2532

2545

2533

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2546

socketserver.TCPServer):

2534

socketserver.TCPServer, object):

2547

2535

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2548

2536

2549

2537

Attributes:

2682

2670

def add_pipe(self, parent_pipe, proc):

2683

2671

# Call "handle_ipc" for both data and EOF events

2684

2672

GLib.io_add_watch(

2685

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2686

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2673

parent_pipe.fileno(),

2674

GLib.IO_IN | GLib.IO_HUP,

2687

2675

functools.partial(self.handle_ipc,

2688

2676

parent_pipe=parent_pipe,

2689

2677

proc=proc))

2727

2715

return False

2728

2716

2729

2717

GLib.io_add_watch(

2730

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2731

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2718

parent_pipe.fileno(),

2719

GLib.IO_IN | GLib.IO_HUP,

2732

2720

functools.partial(self.handle_ipc,

2733

2721

parent_pipe=parent_pipe,

2734

2722

proc=proc,

2766

2754

def rfc3339_duration_to_delta(duration):

2767

2755

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2768

2756

2769

>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)

2770

True

2771

>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)

2772

True

2773

>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)

2774

True

2775

>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)

2776

True

2777

>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)

2778

True

2779

>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)

2780

True

2781

>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)

2782

True

2757

>>> rfc3339_duration_to_delta("P7D")

2758

datetime.timedelta(7)

2759

>>> rfc3339_duration_to_delta("PT60S")

2760

datetime.timedelta(0, 60)

2761

>>> rfc3339_duration_to_delta("PT60M")

2762

datetime.timedelta(0, 3600)

2763

>>> rfc3339_duration_to_delta("PT24H")

2764

datetime.timedelta(1)

2765

>>> rfc3339_duration_to_delta("P1W")

2766

datetime.timedelta(7)

2767

>>> rfc3339_duration_to_delta("PT5M30S")

2768

datetime.timedelta(0, 330)

2769

>>> rfc3339_duration_to_delta("P1DT3M20S")

2770

datetime.timedelta(1, 200)

2783

2771

"""

2784

2772

2785

2773

# Parsing an RFC 3339 duration with regular expressions is not

2865

2853

def string_to_delta(interval):

2866

2854

"""Parse a string and return a datetime.timedelta

2867

2855

2868

>>> string_to_delta('7d') == datetime.timedelta(7)

2869

True

2870

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2871

True

2872

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2873

True

2874

>>> string_to_delta('24h') == datetime.timedelta(1)

2875

True

2876

>>> string_to_delta('1w') == datetime.timedelta(7)

2877

True

2878

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2879

True

2856

>>> string_to_delta('7d')

2857

datetime.timedelta(7)

2858

>>> string_to_delta('60s')

2859

datetime.timedelta(0, 60)

2860

>>> string_to_delta('60m')

2861

datetime.timedelta(0, 3600)

2862

>>> string_to_delta('24h')

2863

datetime.timedelta(1)

2864

>>> string_to_delta('1w')

2865

datetime.timedelta(7)

2866

>>> string_to_delta('5m 30s')

2867

datetime.timedelta(0, 330)

2880

2868

"""

2881

2869

2882

2870

try:

2984

2972

2985

2973

options = parser.parse_args()

2986

2974

2975

if options.check:

2976

import doctest

2977

fail_count, test_count = doctest.testmod()

2978

sys.exit(os.EX_OK if fail_count == 0 else 1)

2979

2987

2980

# Default values for config file for server-global settings

2988

2981

if gnutls.has_rawpk:

2989

2982

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3252

3245

if isinstance(s, bytes)

3253

3246

else s) for s in

3254

3247

value["client_structure"]]

3255

# .name, .host, and .checker_command

3256

for k in ("name", "host", "checker_command"):

3248

# .name & .host

3249

for k in ("name", "host"):

3257

3250

if isinstance(value[k], bytes):

3258

3251

value[k] = value[k].decode("utf-8")

3259

3252

if "key_id" not in value:

3269

3262

for key, value in

3270

3263

bytes_old_client_settings.items()}

3271

3264

del bytes_old_client_settings

3272

# .host and .checker_command

3265

# .host

3273

3266

for value in old_client_settings.values():

3274

for attribute in ("host", "checker_command"):

3275

if isinstance(value[attribute], bytes):

3276

value[attribute] = (value[attribute]

3277

.decode("utf-8"))

3267

if isinstance(value["host"], bytes):

3268

value["host"] = (value["host"]

3269

.decode("utf-8"))

3278

3270

os.remove(stored_state_path)

3279

3271

except IOError as e:

3280

3272

if e.errno == errno.ENOENT:

3605

3597

sys.exit(1)

3606

3598

# End of Avahi example code

3607

3599

3608

GLib.io_add_watch(

3609

GLib.IOChannel.unix_new(tcp_server.fileno()),

3610

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3611

lambda *args, **kwargs: (tcp_server.handle_request

3612

(*args[2:], **kwargs) or True))

3600

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3601

lambda *args, **kwargs:

3602

(tcp_server.handle_request

3603

(*args[2:], **kwargs) or True))

3613

3604

3614

3605

logger.debug("Starting main loop")

3615

3606

main_loop.run()

3625

3616

# Must run before the D-Bus bus name gets deregistered

3626

3617

cleanup()

3627

3618

3628

3629

def should_only_run_tests():

3630

parser = argparse.ArgumentParser(add_help=False)

3631

parser.add_argument("--check", action='store_true')

3632

args, unknown_args = parser.parse_known_args()

3633

run_tests = args.check

3634

if run_tests:

3635

# Remove --check argument from sys.argv

3636

sys.argv[1:] = unknown_args

3637

return run_tests

3638

3639

# Add all tests from doctest strings

3640

def load_tests(loader, tests, none):

3641

import doctest

3642

tests.addTests(doctest.DocTestSuite())

3643

return tests

3644

3619

3645

3620

if __name__ == '__main__':

3646

try:

3647

if should_only_run_tests():

3648

# Call using ./mandos --check [--verbose]

3649

unittest.main()

3650

else:

3651

main()

3652

finally:

3653

logging.shutdown()

3621

main()