/mandos/trunk : revision 1151

1

#!/usr/bin/python3 -bI

2

# -*- coding: utf-8; lexical-binding: t -*-

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This file is part of Mandos.

18

#

31

#

32

# Contact the authors at <mandos@recompile.se>.

33

#

34

35

from __future__ import (division, absolute_import, print_function,

35

36

unicode_literals)

36

37

39

40

except ImportError:

40

41

pass

41

42

import sys

43

import unittest

44

import argparse

45

import logging

46

import os

47

43

try:

48

44

import SocketServer as socketserver

49

45

except ImportError:

50

46

import socketserver

51

47

import socket

48

import argparse

52

49

import datetime

53

50

import errno

54

51

try:

55

52

import ConfigParser as configparser

56

53

except ImportError:

57

54

import configparser

55

import sys

58

56

import re

57

import os

59

58

import signal

60

59

import subprocess

61

60

import atexit

62

61

import stat

62

import logging

63

import logging.handlers

64

import pwd

65

import contextlib

77

import itertools

78

import collections

79

import codecs

80

import random

81

import shlex

82

80

83

81

import dbus

84

82

import dbus.service

90

88

import xml.dom.minidom

91

89

import inspect

92

90

93

if sys.version_info.major == 2:

94

__metaclass__ = type

95

str = unicode

96

input = raw_input

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Add os.set_inheritable if it does not exist

114

try:

115

os.set_inheritable

116

except AttributeError:

117

def set_inheritable(fd, inheritable):

118

flags = fcntl.fcntl(fd, fcntl.F_GETFD)

119

if inheritable and ((flags & fcntl.FD_CLOEXEC) != 0):

120

fcntl.fcntl(fd, fcntl.F_SETFL, flags & ~fcntl.FD_CLOEXEC)

121

elif (not inheritable) and ((flags & fcntl.FD_CLOEXEC) == 0):

122

fcntl.fcntl(fd, fcntl.F_SETFL, flags | fcntl.FD_CLOEXEC)

123

os.set_inheritable = set_inheritable

124

del set_inheritable

125

126

# Show warnings by default

127

if not sys.warnoptions:

128

import warnings

129

warnings.simplefilter("default")

130

131

91

# Try to find the value of SO_BINDTODEVICE:

132

92

try:

133

93

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

153

113

# No value found

154

114

SO_BINDTODEVICE = None

155

115

116

if sys.version_info.major == 2:

117

str = unicode

118

156

119

if sys.version_info < (3, 2):

157

120

configparser.Configparser = configparser.SafeConfigParser

158

121

159

version = "1.8.18"

122

version = "1.8.6"

160

123

stored_state_file = "clients.pickle"

161

124

162

log = logging.getLogger(os.path.basename(sys.argv[0]))

163

logging.captureWarnings(True) # Show warnings via the logging system

125

logger = logging.getLogger()

164

126

syslogger = None

165

127

166

128

try:

202

164

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

203

165

address="/dev/log"))

204

166

syslogger.setFormatter(logging.Formatter

205

("Mandos [%(process)d]: %(levelname)s:"

206

" %(message)s"))

207

log.addHandler(syslogger)

167

('Mandos [%(process)d]: %(levelname)s:'

168

' %(message)s'))

169

logger.addHandler(syslogger)

208

170

209

171

if debug:

210

172

console = logging.StreamHandler()

211

console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

212

" [%(process)d]:"

213

" %(levelname)s:"

214

" %(message)s"))

215

log.addHandler(console)

216

log.setLevel(level)

173

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

174

' [%(process)d]:'

175

' %(levelname)s:'

176

' %(message)s'))

177

logger.addHandler(console)

178

logger.setLevel(level)

217

179

218

180

219

181

class PGPError(Exception):

221

183

pass

222

184

223

185

224

class PGPEngine:

186

class PGPEngine(object):

225

187

"""A simple class for OpenPGP symmetric encryption & decryption"""

226

188

227

189

def __init__(self):

231

193

output = subprocess.check_output(["gpgconf"])

232

194

for line in output.splitlines():

233

195

name, text, path = line.split(b":")

234

if name == b"gpg":

196

if name == "gpg":

235

197

self.gpg = path

236

198

break

237

199

except OSError as e:

238

200

if e.errno != errno.ENOENT:

239

201

raise

240

self.gnupgargs = ["--batch",

241

"--homedir", self.tempdir,

242

"--force-mdc",

243

"--quiet"]

202

self.gnupgargs = ['--batch',

203

'--homedir', self.tempdir,

204

'--force-mdc',

205

'--quiet']

244

206

# Only GPG version 1 has the --no-use-agent option.

245

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

207

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

246

208

self.gnupgargs.append("--no-use-agent")

247

209

248

210

def __enter__(self):

285

247

dir=self.tempdir) as passfile:

286

248

passfile.write(passphrase)

287

249

passfile.flush()

288

proc = subprocess.Popen([self.gpg, "--symmetric",

289

"--passphrase-file",

250

proc = subprocess.Popen([self.gpg, '--symmetric',

251

'--passphrase-file',

290

252

passfile.name]

291

253

+ self.gnupgargs,

292

254

stdin=subprocess.PIPE,

303

265

dir=self.tempdir) as passfile:

304

266

passfile.write(passphrase)

305

267

passfile.flush()

306

proc = subprocess.Popen([self.gpg, "--decrypt",

307

"--passphrase-file",

268

proc = subprocess.Popen([self.gpg, '--decrypt',

269

'--passphrase-file',

308

270

passfile.name]

309

271

+ self.gnupgargs,

310

272

stdin=subprocess.PIPE,

317

279

318

280

319

281

# Pretend that we have an Avahi module

320

class avahi:

282

class avahi(object):

321

283

"""This isn't so much a class as it is a module-like namespace."""

322

284

IF_UNSPEC = -1 # avahi-common/address.h

323

285

PROTO_UNSPEC = -1 # avahi-common/address.h

357

319

pass

358

320

359

321

360

class AvahiService:

322

class AvahiService(object):

361

323

"""An Avahi (Zeroconf) service.

362

324

363

325

Attributes:

364

326

interface: integer; avahi.IF_UNSPEC or an interface index.

365

327

Used to optionally bind to the specified interface.

366

name: string; Example: "Mandos"

367

type: string; Example: "_mandos._tcp".

328

name: string; Example: 'Mandos'

329

type: string; Example: '_mandos._tcp'.

368

330

See <https://www.iana.org/assignments/service-names-port-numbers>

369

331

port: integer; what port to announce

370

332

TXT: list of strings; TXT record for the service

407

369

def rename(self, remove=True):

408

370

"""Derived from the Avahi example code"""

409

371

if self.rename_count >= self.max_renames:

410

log.critical("No suitable Zeroconf service name found"

411

" after %i retries, exiting.",

412

self.rename_count)

372

logger.critical("No suitable Zeroconf service name found"

373

" after %i retries, exiting.",

374

self.rename_count)

413

375

raise AvahiServiceError("Too many renames")

414

376

self.name = str(

415

377

self.server.GetAlternativeServiceName(self.name))

416

378

self.rename_count += 1

417

log.info("Changing Zeroconf service name to %r ...",

418

self.name)

379

logger.info("Changing Zeroconf service name to %r ...",

380

self.name)

419

381

if remove:

420

382

self.remove()

421

383

try:

423

385

except dbus.exceptions.DBusException as error:

424

386

if (error.get_dbus_name()

425

387

== "org.freedesktop.Avahi.CollisionError"):

426

log.info("Local Zeroconf service name collision.")

388

logger.info("Local Zeroconf service name collision.")

427

389

return self.rename(remove=False)

428

390

else:

429

log.critical("D-Bus Exception", exc_info=error)

391

logger.critical("D-Bus Exception", exc_info=error)

430

392

self.cleanup()

431

393

os._exit(1)

432

394

448

410

avahi.DBUS_INTERFACE_ENTRY_GROUP)

449

411

self.entry_group_state_changed_match = (

450

412

self.group.connect_to_signal(

451

"StateChanged", self.entry_group_state_changed))

452

log.debug("Adding Zeroconf service '%s' of type '%s' ...",

453

self.name, self.type)

413

'StateChanged', self.entry_group_state_changed))

414

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

415

self.name, self.type)

454

416

self.group.AddService(

455

417

self.interface,

456

418

self.protocol,

463

425

464

426

def entry_group_state_changed(self, state, error):

465

427

"""Derived from the Avahi example code"""

466

log.debug("Avahi entry group state change: %i", state)

428

logger.debug("Avahi entry group state change: %i", state)

467

429

468

430

if state == avahi.ENTRY_GROUP_ESTABLISHED:

469

log.debug("Zeroconf service established.")

431

logger.debug("Zeroconf service established.")

470

432

elif state == avahi.ENTRY_GROUP_COLLISION:

471

log.info("Zeroconf service name collision.")

433

logger.info("Zeroconf service name collision.")

472

434

self.rename()

473

435

elif state == avahi.ENTRY_GROUP_FAILURE:

474

log.critical("Avahi: Error in group state changed %s",

475

str(error))

436

logger.critical("Avahi: Error in group state changed %s",

437

str(error))

476

438

raise AvahiGroupError("State changed: {!s}".format(error))

477

439

478

440

def cleanup(self):

488

450

489

451

def server_state_changed(self, state, error=None):

490

452

"""Derived from the Avahi example code"""

491

log.debug("Avahi server state change: %i", state)

453

logger.debug("Avahi server state change: %i", state)

492

454

bad_states = {

493

455

avahi.SERVER_INVALID: "Zeroconf server invalid",

494

456

avahi.SERVER_REGISTERING: None,

498

460

if state in bad_states:

499

461

if bad_states[state] is not None:

500

462

if error is None:

501

log.error(bad_states[state])

463

logger.error(bad_states[state])

502

464

else:

503

log.error(bad_states[state] + ": %r", error)

465

logger.error(bad_states[state] + ": %r", error)

504

466

self.cleanup()

505

467

elif state == avahi.SERVER_RUNNING:

506

468

try:

508

470

except dbus.exceptions.DBusException as error:

509

471

if (error.get_dbus_name()

510

472

== "org.freedesktop.Avahi.CollisionError"):

511

log.info("Local Zeroconf service name collision.")

473

logger.info("Local Zeroconf service name"

474

" collision.")

512

475

return self.rename(remove=False)

513

476

else:

514

log.critical("D-Bus Exception", exc_info=error)

477

logger.critical("D-Bus Exception", exc_info=error)

515

478

self.cleanup()

516

479

os._exit(1)

517

480

else:

518

481

if error is None:

519

log.debug("Unknown state: %r", state)

482

logger.debug("Unknown state: %r", state)

520

483

else:

521

log.debug("Unknown state: %r: %r", state, error)

484

logger.debug("Unknown state: %r: %r", state, error)

522

485

523

486

def activate(self):

524

487

"""Derived from the Avahi example code"""

536

499

class AvahiServiceToSyslog(AvahiService):

537

500

def rename(self, *args, **kwargs):

538

501

"""Add the new name to the syslog messages"""

539

ret = super(AvahiServiceToSyslog, self).rename(*args,

540

**kwargs)

502

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

541

503

syslogger.setFormatter(logging.Formatter(

542

"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

504

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

543

505

.format(self.name)))

544

506

return ret

545

507

546

508

547

509

# Pretend that we have a GnuTLS module

548

class gnutls:

510

class gnutls(object):

549

511

"""This isn't so much a class as it is a module-like namespace."""

550

512

551

513

library = ctypes.util.find_library("gnutls")

575

537

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

576

538

577

539

# Types

578

class _session_int(ctypes.Structure):

540

class session_int(ctypes.Structure):

579

541

_fields_ = []

580

session_t = ctypes.POINTER(_session_int)

542

session_t = ctypes.POINTER(session_int)

581

543

582

544

class certificate_credentials_st(ctypes.Structure):

583

545

_fields_ = []

586

548

certificate_type_t = ctypes.c_int

587

549

588

550

class datum_t(ctypes.Structure):

589

_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

590

("size", ctypes.c_uint)]

551

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

552

('size', ctypes.c_uint)]

591

553

592

class _openpgp_crt_int(ctypes.Structure):

554

class openpgp_crt_int(ctypes.Structure):

593

555

_fields_ = []

594

openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

556

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

595

557

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

596

558

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

597

559

credentials_type_t = ctypes.c_int

606

568

# gnutls.strerror()

607

569

self.code = code

608

570

if message is None and code is not None:

609

message = gnutls.strerror(code).decode(

610

"utf-8", errors="replace")

571

message = gnutls.strerror(code)

611

572

return super(gnutls.Error, self).__init__(

612

573

message, *args)

613

574

614

575

class CertificateSecurityError(Error):

615

576

pass

616

577

617

class PointerTo:

618

def __init__(self, cls):

619

self.cls = cls

620

621

def from_param(self, obj):

622

if not isinstance(obj, self.cls):

623

raise TypeError("Not of type {}: {!r}"

624

.format(self.cls.__name__, obj))

625

return ctypes.byref(obj.from_param(obj))

626

627

class CastToVoidPointer:

628

def __init__(self, cls):

629

self.cls = cls

630

631

def from_param(self, obj):

632

if not isinstance(obj, self.cls):

633

raise TypeError("Not of type {}: {!r}"

634

.format(self.cls.__name__, obj))

635

return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

636

637

class With_from_param:

638

@classmethod

639

def from_param(cls, obj):

640

return obj._as_parameter_

641

642

578

# Classes

643

class Credentials(With_from_param):

579

class Credentials(object):

644

580

def __init__(self):

645

self._as_parameter_ = gnutls.certificate_credentials_t()

646

gnutls.certificate_allocate_credentials(self)

581

self._c_object = gnutls.certificate_credentials_t()

582

gnutls.certificate_allocate_credentials(

583

ctypes.byref(self._c_object))

647

584

self.type = gnutls.CRD_CERTIFICATE

648

585

649

586

def __del__(self):

650

gnutls.certificate_free_credentials(self)

587

gnutls.certificate_free_credentials(self._c_object)

651

588

652

class ClientSession(With_from_param):

589

class ClientSession(object):

653

590

def __init__(self, socket, credentials=None):

654

self._as_parameter_ = gnutls.session_t()

591

self._c_object = gnutls.session_t()

655

592

gnutls_flags = gnutls.CLIENT

656

593

if gnutls.check_version(b"3.5.6"):

657

594

gnutls_flags |= gnutls.NO_TICKETS

658

595

if gnutls.has_rawpk:

659

596

gnutls_flags |= gnutls.ENABLE_RAWPK

660

gnutls.init(self, gnutls_flags)

597

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

661

598

del gnutls_flags

662

gnutls.set_default_priority(self)

663

gnutls.transport_set_ptr(self, socket.fileno())

664

gnutls.handshake_set_private_extensions(self, True)

599

gnutls.set_default_priority(self._c_object)

600

gnutls.transport_set_ptr(self._c_object, socket.fileno())

601

gnutls.handshake_set_private_extensions(self._c_object,

602

True)

665

603

self.socket = socket

666

604

if credentials is None:

667

605

credentials = gnutls.Credentials()

668

gnutls.credentials_set(self, credentials.type,

669

credentials)

606

gnutls.credentials_set(self._c_object, credentials.type,

607

ctypes.cast(credentials._c_object,

608

ctypes.c_void_p))

670

609

self.credentials = credentials

671

610

672

611

def __del__(self):

673

gnutls.deinit(self)

612

gnutls.deinit(self._c_object)

674

613

675

614

def handshake(self):

676

return gnutls.handshake(self)

615

return gnutls.handshake(self._c_object)

677

616

678

617

def send(self, data):

679

618

data = bytes(data)

680

619

data_len = len(data)

681

620

while data_len > 0:

682

data_len -= gnutls.record_send(self, data[-data_len:],

621

data_len -= gnutls.record_send(self._c_object,

622

data[-data_len:],

683

623

data_len)

684

624

685

625

def bye(self):

686

return gnutls.bye(self, gnutls.SHUT_RDWR)

626

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

687

627

688

628

# Error handling functions

689

629

def _error_code(result):

690

630

"""A function to raise exceptions on errors, suitable

691

for the "restype" attribute on ctypes functions"""

692

if result >= gnutls.E_SUCCESS:

631

for the 'restype' attribute on ctypes functions"""

632

if result >= 0:

693

633

return result

694

634

if result == gnutls.E_NO_CERTIFICATE_FOUND:

695

635

raise gnutls.CertificateSecurityError(code=result)

696

636

raise gnutls.Error(code=result)

697

637

698

def _retry_on_error(result, func, arguments,

699

_error_code=_error_code):

638

def _retry_on_error(result, func, arguments):

700

639

"""A function to retry on some errors, suitable

701

for the "errcheck" attribute on ctypes functions"""

702

while result < gnutls.E_SUCCESS:

640

for the 'errcheck' attribute on ctypes functions"""

641

while result < 0:

703

642

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

704

643

return _error_code(result)

705

644

result = func(*arguments)

710

649

711

650

# Functions

712

651

priority_set_direct = _library.gnutls_priority_set_direct

713

priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

652

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

714

653

ctypes.POINTER(ctypes.c_char_p)]

715

654

priority_set_direct.restype = _error_code

716

655

717

656

init = _library.gnutls_init

718

init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

657

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

719

658

init.restype = _error_code

720

659

721

660

set_default_priority = _library.gnutls_set_default_priority

722

set_default_priority.argtypes = [ClientSession]

661

set_default_priority.argtypes = [session_t]

723

662

set_default_priority.restype = _error_code

724

663

725

664

record_send = _library.gnutls_record_send

726

record_send.argtypes = [ClientSession, ctypes.c_void_p,

665

record_send.argtypes = [session_t, ctypes.c_void_p,

727

666

ctypes.c_size_t]

728

667

record_send.restype = ctypes.c_ssize_t

729

668

record_send.errcheck = _retry_on_error

731

670

certificate_allocate_credentials = (

732

671

_library.gnutls_certificate_allocate_credentials)

733

672

certificate_allocate_credentials.argtypes = [

734

PointerTo(Credentials)]

673

ctypes.POINTER(certificate_credentials_t)]

735

674

certificate_allocate_credentials.restype = _error_code

736

675

737

676

certificate_free_credentials = (

738

677

_library.gnutls_certificate_free_credentials)

739

certificate_free_credentials.argtypes = [Credentials]

678

certificate_free_credentials.argtypes = [

679

certificate_credentials_t]

740

680

certificate_free_credentials.restype = None

741

681

742

682

handshake_set_private_extensions = (

743

683

_library.gnutls_handshake_set_private_extensions)

744

handshake_set_private_extensions.argtypes = [ClientSession,

684

handshake_set_private_extensions.argtypes = [session_t,

745

685

ctypes.c_int]

746

686

handshake_set_private_extensions.restype = None

747

687

748

688

credentials_set = _library.gnutls_credentials_set

749

credentials_set.argtypes = [ClientSession, credentials_type_t,

750

CastToVoidPointer(Credentials)]

689

credentials_set.argtypes = [session_t, credentials_type_t,

690

ctypes.c_void_p]

751

691

credentials_set.restype = _error_code

752

692

753

693

strerror = _library.gnutls_strerror

755

695

strerror.restype = ctypes.c_char_p

756

696

757

697

certificate_type_get = _library.gnutls_certificate_type_get

758

certificate_type_get.argtypes = [ClientSession]

698

certificate_type_get.argtypes = [session_t]

759

699

certificate_type_get.restype = _error_code

760

700

761

701

certificate_get_peers = _library.gnutls_certificate_get_peers

762

certificate_get_peers.argtypes = [ClientSession,

702

certificate_get_peers.argtypes = [session_t,

763

703

ctypes.POINTER(ctypes.c_uint)]

764

704

certificate_get_peers.restype = ctypes.POINTER(datum_t)

765

705

772

712

global_set_log_function.restype = None

773

713

774

714

deinit = _library.gnutls_deinit

775

deinit.argtypes = [ClientSession]

715

deinit.argtypes = [session_t]

776

716

deinit.restype = None

777

717

778

718

handshake = _library.gnutls_handshake

779

handshake.argtypes = [ClientSession]

780

handshake.restype = ctypes.c_int

719

handshake.argtypes = [session_t]

720

handshake.restype = _error_code

781

721

handshake.errcheck = _retry_on_error

782

722

783

723

transport_set_ptr = _library.gnutls_transport_set_ptr

784

transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

724

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

785

725

transport_set_ptr.restype = None

786

726

787

727

bye = _library.gnutls_bye

788

bye.argtypes = [ClientSession, close_request_t]

789

bye.restype = ctypes.c_int

728

bye.argtypes = [session_t, close_request_t]

729

bye.restype = _error_code

790

730

bye.errcheck = _retry_on_error

791

731

792

732

check_version = _library.gnutls_check_version

809

749

810

750

x509_crt_fmt_t = ctypes.c_int

811

751

812

# All the function declarations below are from

813

# gnutls/abstract.h

752

# All the function declarations below are from gnutls/abstract.h

814

753

pubkey_init = _library.gnutls_pubkey_init

815

754

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

816

755

pubkey_init.restype = _error_code

830

769

pubkey_deinit.argtypes = [pubkey_t]

831

770

pubkey_deinit.restype = None

832

771

else:

833

# All the function declarations below are from

834

# gnutls/openpgp.h

772

# All the function declarations below are from gnutls/openpgp.h

835

773

836

774

openpgp_crt_init = _library.gnutls_openpgp_crt_init

837

775

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

843

781

openpgp_crt_fmt_t]

844

782

openpgp_crt_import.restype = _error_code

845

783

846

openpgp_crt_verify_self = \

847

_library.gnutls_openpgp_crt_verify_self

848

openpgp_crt_verify_self.argtypes = [

849

openpgp_crt_t,

850

ctypes.c_uint,

851

ctypes.POINTER(ctypes.c_uint),

852

]

784

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

785

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

786

ctypes.POINTER(ctypes.c_uint)]

853

787

openpgp_crt_verify_self.restype = _error_code

854

788

855

789

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

866

800

867

801

if check_version(b"3.6.4"):

868

802

certificate_type_get2 = _library.gnutls_certificate_type_get2

869

certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

803

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

870

804

certificate_type_get2.restype = _error_code

871

805

872

806

# Remove non-public functions

884

818

connection.close()

885

819

886

820

887

class Client:

821

class Client(object):

888

822

"""A representation of a client host served by this server.

889

823

890

824

Attributes:

891

approved: bool(); None if not yet approved/disapproved

825

approved: bool(); 'None' if not yet approved/disapproved

892

826

approval_delay: datetime.timedelta(); Time to wait for approval

893

827

approval_duration: datetime.timedelta(); Duration of one approval

894

828

checker: multiprocessing.Process(); a running checker process used

895

to see if the client lives. None if no process is

829

to see if the client lives. 'None' if no process is

896

830

running.

897

831

checker_callback_tag: a GLib event source tag, or None

898

832

checker_command: string; External command which is run to check

974

908

# key_id() and fingerprint() functions

975

909

client["key_id"] = (section.get("key_id", "").upper()

976

910

.replace(" ", ""))

977

client["fingerprint"] = (section.get("fingerprint",

978

"").upper()

911

client["fingerprint"] = (section["fingerprint"].upper()

979

912

.replace(" ", ""))

980

if not (client["key_id"] or client["fingerprint"]):

981

log.error("Skipping client %s without key_id or"

982

" fingerprint", client_name)

983

del settings[client_name]

984

continue

985

913

if "secret" in section:

986

914

client["secret"] = codecs.decode(section["secret"]

987

915

.encode("utf-8"),

1028

956

self.last_enabled = None

1029

957

self.expires = None

1030

958

1031

log.debug("Creating client %r", self.name)

1032

log.debug(" Key ID: %s", self.key_id)

1033

log.debug(" Fingerprint: %s", self.fingerprint)

959

logger.debug("Creating client %r", self.name)

960

logger.debug(" Key ID: %s", self.key_id)

961

logger.debug(" Fingerprint: %s", self.fingerprint)

1034

962

self.created = settings.get("created",

1035

963

datetime.datetime.utcnow())

1036

964

1064

992

if getattr(self, "enabled", False):

1065

993

# Already enabled

1066

994

return

995

self.expires = datetime.datetime.utcnow() + self.timeout

1067

996

self.enabled = True

1068

997

self.last_enabled = datetime.datetime.utcnow()

1069

998

self.init_checker()

1074

1003

if not getattr(self, "enabled", False):

1075

1004

return False

1076

1005

if not quiet:

1077

log.info("Disabling client %s", self.name)

1006

logger.info("Disabling client %s", self.name)

1078

1007

if getattr(self, "disable_initiator_tag", None) is not None:

1079

1008

GLib.source_remove(self.disable_initiator_tag)

1080

1009

self.disable_initiator_tag = None

1092

1021

def __del__(self):

1093

1022

self.disable()

1094

1023

1095

def init_checker(self, randomize_start=False):

1096

# Schedule a new checker to be started a randomly selected

1097

# time (a fraction of 'interval') from now. This spreads out

1098

# the startup of checkers over time when the server is

1099

# started.

1024

def init_checker(self):

1025

# Schedule a new checker to be started an 'interval' from now,

1026

# and every interval from then on.

1100

1027

if self.checker_initiator_tag is not None:

1101

1028

GLib.source_remove(self.checker_initiator_tag)

1102

interval_milliseconds = int(self.interval.total_seconds()

1103

* 1000)

1104

if randomize_start:

1105

delay_milliseconds = random.randrange(

1106

interval_milliseconds + 1)

1107

else:

1108

delay_milliseconds = interval_milliseconds

1109

1029

self.checker_initiator_tag = GLib.timeout_add(

1110

delay_milliseconds, self.start_checker, randomize_start)

1111

delay = datetime.timedelta(0, 0, 0, delay_milliseconds)

1112

# A checker might take up to an 'interval' of time, so we can

1113

# expire at the soonest one interval after a checker was

1114

# started. Since the initial checker is delayed, the expire

1115

# time might have to be extended.

1116

now = datetime.datetime.utcnow()

1117

self.expires = now + delay + self.interval

1118

# Schedule a disable() at expire time

1030

int(self.interval.total_seconds() * 1000),

1031

self.start_checker)

1032

# Schedule a disable() when 'timeout' has passed

1119

1033

if self.disable_initiator_tag is not None:

1120

1034

GLib.source_remove(self.disable_initiator_tag)

1121

1035

self.disable_initiator_tag = GLib.timeout_add(

1122

int((self.expires - now).total_seconds() * 1000),

1123

self.disable)

1036

int(self.timeout.total_seconds() * 1000), self.disable)

1037

# Also start a new checker *right now*.

1038

self.start_checker()

1124

1039

1125

1040

def checker_callback(self, source, condition, connection,

1126

1041

command):

1128

1043

# Read return code from connection (see call_pipe)

1129

1044

returncode = connection.recv()

1130

1045

connection.close()

1131

if self.checker is not None:

1132

self.checker.join()

1046

self.checker.join()

1133

1047

self.checker_callback_tag = None

1134

1048

self.checker = None

1135

1049

1137

1051

self.last_checker_status = returncode

1138

1052

self.last_checker_signal = None

1139

1053

if self.last_checker_status == 0:

1140

log.info("Checker for %(name)s succeeded", vars(self))

1054

logger.info("Checker for %(name)s succeeded",

1055

vars(self))

1141

1056

self.checked_ok()

1142

1057

else:

1143

log.info("Checker for %(name)s failed", vars(self))

1058

logger.info("Checker for %(name)s failed", vars(self))

1144

1059

else:

1145

1060

self.last_checker_status = -1

1146

1061

self.last_checker_signal = -returncode

1147

log.warning("Checker for %(name)s crashed?", vars(self))

1062

logger.warning("Checker for %(name)s crashed?",

1063

vars(self))

1148

1064

return False

1149

1065

1150

1066

def checked_ok(self):

1169

1085

def need_approval(self):

1170

1086

self.last_approval_request = datetime.datetime.utcnow()

1171

1087

1172

def start_checker(self, start_was_randomized=False):

1088

def start_checker(self):

1173

1089

"""Start a new checker subprocess if one is not running.

1174

1090

1175

1091

If a checker already exists, leave it running and do

1184

1100

# should be.

1185

1101

1186

1102

if self.checker is not None and not self.checker.is_alive():

1187

log.warning("Checker was not alive; joining")

1103

logger.warning("Checker was not alive; joining")

1188

1104

self.checker.join()

1189

1105

self.checker = None

1190

1106

# Start a new checker if needed

1191

1107

if self.checker is None:

1192

1108

# Escape attributes for the shell

1193

1109

escaped_attrs = {

1194

attr: shlex.quote(str(getattr(self, attr)))

1110

attr: re.escape(str(getattr(self, attr)))

1195

1111

for attr in self.runtime_expansions}

1196

1112

try:

1197

1113

command = self.checker_command % escaped_attrs

1198

1114

except TypeError as error:

1199

log.error('Could not format string "%s"',

1200

self.checker_command, exc_info=error)

1115

logger.error('Could not format string "%s"',

1116

self.checker_command,

1117

exc_info=error)

1201

1118

return True # Try again later

1202

1119

self.current_checker_command = command

1203

log.info("Starting checker %r for %s", command, self.name)

1120

logger.info("Starting checker %r for %s", command,

1121

self.name)

1204

1122

# We don't need to redirect stdout and stderr, since

1205

1123

# in normal mode, that is already done by daemon(),

1206

1124

# and in debug mode we don't want to. (Stdin is

1222

1140

kwargs=popen_args)

1223

1141

self.checker.start()

1224

1142

self.checker_callback_tag = GLib.io_add_watch(

1225

GLib.IOChannel.unix_new(pipe[0].fileno()),

1226

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1143

pipe[0].fileno(), GLib.IO_IN,

1227

1144

self.checker_callback, pipe[0], command)

1228

if start_was_randomized:

1229

# We were started after a random delay; Schedule a new

1230

# checker to be started an 'interval' from now, and every

1231

# interval from then on.

1232

now = datetime.datetime.utcnow()

1233

self.checker_initiator_tag = GLib.timeout_add(

1234

int(self.interval.total_seconds() * 1000),

1235

self.start_checker)

1236

self.expires = max(self.expires, now + self.interval)

1237

# Don't start a new checker again after same random delay

1238

return False

1239

1145

# Re-run this periodically if run by GLib.timeout_add

1240

1146

return True

1241

1147

1246

1152

self.checker_callback_tag = None

1247

1153

if getattr(self, "checker", None) is None:

1248

1154

return

1249

log.debug("Stopping checker for %(name)s", vars(self))

1155

logger.debug("Stopping checker for %(name)s", vars(self))

1250

1156

self.checker.terminate()

1251

1157

self.checker = None

1252

1158

1279

1185

func._dbus_name = func.__name__

1280

1186

if func._dbus_name.endswith("_dbus_property"):

1281

1187

func._dbus_name = func._dbus_name[:-14]

1282

func._dbus_get_args_options = {"byte_arrays": byte_arrays}

1188

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

1283

1189

return func

1284

1190

1285

1191

return decorator

1374

1280

1375

1281

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1376

1282

out_signature="s",

1377

path_keyword="object_path",

1378

connection_keyword="connection")

1283

path_keyword='object_path',

1284

connection_keyword='connection')

1379

1285

def Introspect(self, object_path, connection):

1380

1286

"""Overloading of standard D-Bus method.

1381

1287

1430

1336

document.unlink()

1431

1337

except (AttributeError, xml.dom.DOMException,

1432

1338

xml.parsers.expat.ExpatError) as error:

1433

log.error("Failed to override Introspection method",

1434

exc_info=error)

1339

logger.error("Failed to override Introspection method",

1340

exc_info=error)

1435

1341

return xmlstring

1436

1342

1437

1343

1495

1401

raise ValueError("Byte arrays not supported for non-"

1496

1402

"'ay' signature {!r}"

1497

1403

.format(prop._dbus_signature))

1498

value = dbus.ByteArray(bytes(value))

1404

value = dbus.ByteArray(b''.join(chr(byte)

1405

for byte in value))

1499

1406

prop(value)

1500

1407

1501

1408

@dbus.service.method(dbus.PROPERTIES_IFACE,

1534

1441

1535

1442

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1536

1443

out_signature="s",

1537

path_keyword="object_path",

1538

connection_keyword="connection")

1444

path_keyword='object_path',

1445

connection_keyword='connection')

1539

1446

def Introspect(self, object_path, connection):

1540

1447

"""Overloading of standard D-Bus method.

1541

1448

1597

1504

document.unlink()

1598

1505

except (AttributeError, xml.dom.DOMException,

1599

1506

xml.parsers.expat.ExpatError) as error:

1600

log.error("Failed to override Introspection method",

1601

exc_info=error)

1507

logger.error("Failed to override Introspection method",

1508

exc_info=error)

1602

1509

return xmlstring

1603

1510

1604

1511

1636

1543

1637

1544

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1638

1545

out_signature="s",

1639

path_keyword="object_path",

1640

connection_keyword="connection")

1546

path_keyword='object_path',

1547

connection_keyword='connection')

1641

1548

def Introspect(self, object_path, connection):

1642

1549

"""Overloading of standard D-Bus method.

1643

1550

1668

1575

document.unlink()

1669

1576

except (AttributeError, xml.dom.DOMException,

1670

1577

xml.parsers.expat.ExpatError) as error:

1671

log.error("Failed to override Introspection method",

1672

exc_info=error)

1578

logger.error("Failed to override Introspection method",

1579

exc_info=error)

1673

1580

return xmlstring

1674

1581

1675

1582

2306

2213

del _interface

2307

2214

2308

2215

2309

class ProxyClient:

2216

class ProxyClient(object):

2310

2217

def __init__(self, child_pipe, key_id, fpr, address):

2311

2218

self._pipe = child_pipe

2312

self._pipe.send(("init", key_id, fpr, address))

2219

self._pipe.send(('init', key_id, fpr, address))

2313

2220

if not self._pipe.recv():

2314

2221

raise KeyError(key_id or fpr)

2315

2222

2316

2223

def __getattribute__(self, name):

2317

if name == "_pipe":

2224

if name == '_pipe':

2318

2225

return super(ProxyClient, self).__getattribute__(name)

2319

self._pipe.send(("getattr", name))

2226

self._pipe.send(('getattr', name))

2320

2227

data = self._pipe.recv()

2321

if data[0] == "data":

2228

if data[0] == 'data':

2322

2229

return data[1]

2323

if data[0] == "function":

2230

if data[0] == 'function':

2324

2231

2325

2232

def func(*args, **kwargs):

2326

self._pipe.send(("funcall", name, args, kwargs))

2233

self._pipe.send(('funcall', name, args, kwargs))

2327

2234

return self._pipe.recv()[1]

2328

2235

2329

2236

return func

2330

2237

2331

2238

def __setattr__(self, name, value):

2332

if name == "_pipe":

2239

if name == '_pipe':

2333

2240

return super(ProxyClient, self).__setattr__(name, value)

2334

self._pipe.send(("setattr", name, value))

2241

self._pipe.send(('setattr', name, value))

2335

2242

2336

2243

2337

2244

class ClientHandler(socketserver.BaseRequestHandler, object):

2342

2249

2343

2250

def handle(self):

2344

2251

with contextlib.closing(self.server.child_pipe) as child_pipe:

2345

log.info("TCP connection from: %s",

2346

str(self.client_address))

2347

log.debug("Pipe FD: %d", self.server.child_pipe.fileno())

2252

logger.info("TCP connection from: %s",

2253

str(self.client_address))

2254

logger.debug("Pipe FD: %d",

2255

self.server.child_pipe.fileno())

2348

2256

2349

2257

session = gnutls.ClientSession(self.request)

2350

2258

2351

# priority = ":".join(("NONE", "+VERS-TLS1.1",

2259

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2352

2260

# "+AES-256-CBC", "+SHA1",

2353

2261

# "+COMP-NULL", "+CTYPE-OPENPGP",

2354

2262

# "+DHE-DSS"))

2356

2264

priority = self.server.gnutls_priority

2357

2265

if priority is None:

2358

2266

priority = "NORMAL"

2359

gnutls.priority_set_direct(session,

2360

priority.encode("utf-8"), None)

2267

gnutls.priority_set_direct(session._c_object,

2268

priority.encode("utf-8"),

2269

None)

2361

2270

2362

2271

# Start communication using the Mandos protocol

2363

2272

# Get protocol number

2364

2273

line = self.request.makefile().readline()

2365

log.debug("Protocol version: %r", line)

2274

logger.debug("Protocol version: %r", line)

2366

2275

try:

2367

2276

if int(line.strip().split()[0]) > 1:

2368

2277

raise RuntimeError(line)

2369

2278

except (ValueError, IndexError, RuntimeError) as error:

2370

log.error("Unknown protocol version: %s", error)

2279

logger.error("Unknown protocol version: %s", error)

2371

2280

return

2372

2281

2373

2282

# Start GnuTLS connection

2374

2283

try:

2375

2284

session.handshake()

2376

2285

except gnutls.Error as error:

2377

log.warning("Handshake failed: %s", error)

2286

logger.warning("Handshake failed: %s", error)

2378

2287

# Do not run session.bye() here: the session is not

2379

2288

# established. Just abandon the request.

2380

2289

return

2381

log.debug("Handshake succeeded")

2290

logger.debug("Handshake succeeded")

2382

2291

2383

2292

approval_required = False

2384

2293

try:

2388

2297

key_id = self.key_id(

2389

2298

self.peer_certificate(session))

2390

2299

except (TypeError, gnutls.Error) as error:

2391

log.warning("Bad certificate: %s", error)

2300

logger.warning("Bad certificate: %s", error)

2392

2301

return

2393

log.debug("Key ID: %s",

2394

key_id.decode("utf-8",

2395

errors="replace"))

2302

logger.debug("Key ID: %s", key_id)

2396

2303

2397

2304

else:

2398

2305

key_id = b""

2400

2307

fpr = self.fingerprint(

2401

2308

self.peer_certificate(session))

2402

2309

except (TypeError, gnutls.Error) as error:

2403

log.warning("Bad certificate: %s", error)

2310

logger.warning("Bad certificate: %s", error)

2404

2311

return

2405

log.debug("Fingerprint: %s", fpr)

2312

logger.debug("Fingerprint: %s", fpr)

2406

2313

2407

2314

try:

2408

2315

client = ProxyClient(child_pipe, key_id, fpr,

2417

2324

2418

2325

while True:

2419

2326

if not client.enabled:

2420

log.info("Client %s is disabled", client.name)

2327

logger.info("Client %s is disabled",

2328

client.name)

2421

2329

if self.server.use_dbus:

2422

2330

# Emit D-Bus signal

2423

2331

client.Rejected("Disabled")

2427

2335

# We are approved or approval is disabled

2428

2336

break

2429

2337

elif client.approved is None:

2430

log.info("Client %s needs approval",

2431

client.name)

2338

logger.info("Client %s needs approval",

2339

client.name)

2432

2340

if self.server.use_dbus:

2433

2341

# Emit D-Bus signal

2434

2342

client.NeedApproval(

2435

2343

client.approval_delay.total_seconds()

2436

2344

* 1000, client.approved_by_default)

2437

2345

else:

2438

log.warning("Client %s was not approved",

2439

client.name)

2346

logger.warning("Client %s was not approved",

2347

client.name)

2440

2348

if self.server.use_dbus:

2441

2349

# Emit D-Bus signal

2442

2350

client.Rejected("Denied")

2450

2358

time2 = datetime.datetime.now()

2451

2359

if (time2 - time) >= delay:

2452

2360

if not client.approved_by_default:

2453

log.warning("Client %s timed out while"

2454

" waiting for approval",

2455

client.name)

2361

logger.warning("Client %s timed out while"

2362

" waiting for approval",

2363

client.name)

2456

2364

if self.server.use_dbus:

2457

2365

# Emit D-Bus signal

2458

2366

client.Rejected("Approval timed out")

2465

2373

try:

2466

2374

session.send(client.secret)

2467

2375

except gnutls.Error as error:

2468

log.warning("gnutls send failed", exc_info=error)

2376

logger.warning("gnutls send failed",

2377

exc_info=error)

2469

2378

return

2470

2379

2471

log.info("Sending secret to %s", client.name)

2380

logger.info("Sending secret to %s", client.name)

2472

2381

# bump the timeout using extended_timeout

2473

2382

client.bump_timeout(client.extended_timeout)

2474

2383

if self.server.use_dbus:

2481

2390

try:

2482

2391

session.bye()

2483

2392

except gnutls.Error as error:

2484

log.warning("GnuTLS bye failed", exc_info=error)

2393

logger.warning("GnuTLS bye failed",

2394

exc_info=error)

2485

2395

2486

2396

@staticmethod

2487

2397

def peer_certificate(session):

2488

2398

"Return the peer's certificate as a bytestring"

2489

2399

try:

2490

cert_type = gnutls.certificate_type_get2(

2491

session, gnutls.CTYPE_PEERS)

2400

cert_type = gnutls.certificate_type_get2(session._c_object,

2401

gnutls.CTYPE_PEERS)

2492

2402

except AttributeError:

2493

cert_type = gnutls.certificate_type_get(session)

2403

cert_type = gnutls.certificate_type_get(session._c_object)

2494

2404

if gnutls.has_rawpk:

2495

2405

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2496

2406

else:

2497

2407

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2498

2408

# If not a valid certificate type...

2499

2409

if cert_type not in valid_cert_types:

2500

log.info("Cert type %r not in %r", cert_type,

2501

valid_cert_types)

2410

logger.info("Cert type %r not in %r", cert_type,

2411

valid_cert_types)

2502

2412

# ...return invalid data

2503

2413

return b""

2504

2414

list_size = ctypes.c_uint(1)

2505

2415

cert_list = (gnutls.certificate_get_peers

2506

(session, ctypes.byref(list_size)))

2416

(session._c_object, ctypes.byref(list_size)))

2507

2417

if not bool(cert_list) and list_size.value != 0:

2508

2418

raise gnutls.Error("error getting peer certificate")

2509

2419

if list_size.value == 0:

2531

2441

buf = ctypes.create_string_buffer(32)

2532

2442

buf_len = ctypes.c_size_t(len(buf))

2533

2443

# Get the key ID from the raw public key into the buffer

2534

gnutls.pubkey_get_key_id(

2535

pubkey,

2536

gnutls.KEYID_USE_SHA256,

2537

ctypes.cast(ctypes.byref(buf),

2538

ctypes.POINTER(ctypes.c_ubyte)),

2539

ctypes.byref(buf_len))

2444

gnutls.pubkey_get_key_id(pubkey,

2445

gnutls.KEYID_USE_SHA256,

2446

ctypes.cast(ctypes.byref(buf),

2447

ctypes.POINTER(ctypes.c_ubyte)),

2448

ctypes.byref(buf_len))

2540

2449

# Deinit the certificate

2541

2450

gnutls.pubkey_deinit(pubkey)

2542

2451

2583

2492

return hex_fpr

2584

2493

2585

2494

2586

class MultiprocessingMixIn:

2495

class MultiprocessingMixIn(object):

2587

2496

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2588

2497

2589

2498

def sub_process_main(self, request, address):

2601

2510

return proc

2602

2511

2603

2512

2604

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

2513

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2605

2514

""" adds a pipe to the MixIn """

2606

2515

2607

2516

def process_request(self, request, client_address):

2622

2531

2623

2532

2624

2533

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2625

socketserver.TCPServer):

2626

"""IPv6-capable TCP server. Accepts None as address and/or port

2534

socketserver.TCPServer, object):

2535

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2627

2536

2628

2537

Attributes:

2629

2538

enabled: Boolean; whether this server is activated yet

2680

2589

if SO_BINDTODEVICE is None:

2681

2590

# Fall back to a hard-coded value which seems to be

2682

2591

# common enough.

2683

log.warning("SO_BINDTODEVICE not found, trying 25")

2592

logger.warning("SO_BINDTODEVICE not found, trying 25")

2684

2593

SO_BINDTODEVICE = 25

2685

2594

try:

2686

2595

self.socket.setsockopt(

2688

2597

(self.interface + "\0").encode("utf-8"))

2689

2598

except socket.error as error:

2690

2599

if error.errno == errno.EPERM:

2691

log.error("No permission to bind to interface %s",

2692

self.interface)

2600

logger.error("No permission to bind to"

2601

" interface %s", self.interface)

2693

2602

elif error.errno == errno.ENOPROTOOPT:

2694

log.error("SO_BINDTODEVICE not available; cannot"

2695

" bind to interface %s", self.interface)

2603

logger.error("SO_BINDTODEVICE not available;"

2604

" cannot bind to interface %s",

2605

self.interface)

2696

2606

elif error.errno == errno.ENODEV:

2697

log.error("Interface %s does not exist, cannot"

2698

" bind", self.interface)

2607

logger.error("Interface %s does not exist,"

2608

" cannot bind", self.interface)

2699

2609

else:

2700

2610

raise

2701

2611

# Only bind(2) the socket if we really need to.

2760

2670

def add_pipe(self, parent_pipe, proc):

2761

2671

# Call "handle_ipc" for both data and EOF events

2762

2672

GLib.io_add_watch(

2763

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2764

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2673

parent_pipe.fileno(),

2674

GLib.IO_IN | GLib.IO_HUP,

2765

2675

functools.partial(self.handle_ipc,

2766

2676

parent_pipe=parent_pipe,

2767

2677

proc=proc))

2780

2690

request = parent_pipe.recv()

2781

2691

command = request[0]

2782

2692

2783

if command == "init":

2693

if command == 'init':

2784

2694

key_id = request[1].decode("ascii")

2785

2695

fpr = request[2].decode("ascii")

2786

2696

address = request[3]

2787

2697

2788

2698

for c in self.clients.values():

2789

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2790

"27AE41E4649B934CA495991B7852B855"):

2699

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2791

2700

continue

2792

2701

if key_id and c.key_id == key_id:

2793

2702

client = c

2796

2705

client = c

2797

2706

break

2798

2707

else:

2799

log.info("Client not found for key ID: %s, address:"

2800

" %s", key_id or fpr, address)

2708

logger.info("Client not found for key ID: %s, address"

2709

": %s", key_id or fpr, address)

2801

2710

if self.use_dbus:

2802

2711

# Emit D-Bus signal

2803

2712

mandos_dbus_service.ClientNotFound(key_id or fpr,

2806

2715

return False

2807

2716

2808

2717

GLib.io_add_watch(

2809

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2810

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2718

parent_pipe.fileno(),

2719

GLib.IO_IN | GLib.IO_HUP,

2811

2720

functools.partial(self.handle_ipc,

2812

2721

parent_pipe=parent_pipe,

2813

2722

proc=proc,

2816

2725

# remove the old hook in favor of the new above hook on

2817

2726

# same fileno

2818

2727

return False

2819

if command == "funcall":

2728

if command == 'funcall':

2820

2729

funcname = request[1]

2821

2730

args = request[2]

2822

2731

kwargs = request[3]

2823

2732

2824

parent_pipe.send(("data", getattr(client_object,

2733

parent_pipe.send(('data', getattr(client_object,

2825

2734

funcname)(*args,

2826

2735

**kwargs)))

2827

2736

2828

if command == "getattr":

2737

if command == 'getattr':

2829

2738

attrname = request[1]

2830

2739

if isinstance(client_object.__getattribute__(attrname),

2831

collections.abc.Callable):

2832

parent_pipe.send(("function", ))

2740

collections.Callable):

2741

parent_pipe.send(('function', ))

2833

2742

else:

2834

2743

parent_pipe.send((

2835

"data", client_object.__getattribute__(attrname)))

2744

'data', client_object.__getattribute__(attrname)))

2836

2745

2837

if command == "setattr":

2746

if command == 'setattr':

2838

2747

attrname = request[1]

2839

2748

value = request[2]

2840

2749

setattr(client_object, attrname, value)

2845

2754

def rfc3339_duration_to_delta(duration):

2846

2755

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2847

2756

2848

>>> timedelta = datetime.timedelta

2849

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2850

True

2851

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2852

True

2853

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2854

True

2855

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2856

True

2857

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2858

True

2859

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2860

True

2861

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2862

True

2863

>>> del timedelta

2757

>>> rfc3339_duration_to_delta("P7D")

2758

datetime.timedelta(7)

2759

>>> rfc3339_duration_to_delta("PT60S")

2760

datetime.timedelta(0, 60)

2761

>>> rfc3339_duration_to_delta("PT60M")

2762

datetime.timedelta(0, 3600)

2763

>>> rfc3339_duration_to_delta("PT24H")

2764

datetime.timedelta(1)

2765

>>> rfc3339_duration_to_delta("P1W")

2766

datetime.timedelta(7)

2767

>>> rfc3339_duration_to_delta("PT5M30S")

2768

datetime.timedelta(0, 330)

2769

>>> rfc3339_duration_to_delta("P1DT3M20S")

2770

datetime.timedelta(1, 200)

2864

2771

"""

2865

2772

2866

2773

# Parsing an RFC 3339 duration with regular expressions is not

2946

2853

def string_to_delta(interval):

2947

2854

"""Parse a string and return a datetime.timedelta

2948

2855

2949

>>> string_to_delta("7d") == datetime.timedelta(7)

2950

True

2951

>>> string_to_delta("60s") == datetime.timedelta(0, 60)

2952

True

2953

>>> string_to_delta("60m") == datetime.timedelta(0, 3600)

2954

True

2955

>>> string_to_delta("24h") == datetime.timedelta(1)

2956

True

2957

>>> string_to_delta("1w") == datetime.timedelta(7)

2958

True

2959

>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

2960

True

2856

>>> string_to_delta('7d')

2857

datetime.timedelta(7)

2858

>>> string_to_delta('60s')

2859

datetime.timedelta(0, 60)

2860

>>> string_to_delta('60m')

2861

datetime.timedelta(0, 3600)

2862

>>> string_to_delta('24h')

2863

datetime.timedelta(1)

2864

>>> string_to_delta('1w')

2865

datetime.timedelta(7)

2866

>>> string_to_delta('5m 30s')

2867

datetime.timedelta(0, 330)

2961

2868

"""

2962

2869

2963

2870

try:

3065

2972

3066

2973

options = parser.parse_args()

3067

2974

2975

if options.check:

2976

import doctest

2977

fail_count, test_count = doctest.testmod()

2978

sys.exit(os.EX_OK if fail_count == 0 else 1)

2979

3068

2980

# Default values for config file for server-global settings

3069

2981

if gnutls.has_rawpk:

3070

2982

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3109

3021

# Later, stdin will, and stdout and stderr might, be dup'ed

3110

3022

# over with an opened os.devnull. But we don't want this to

3111

3023

# happen with a supplied network socket.

3112

while 0 <= server_settings["socket"] <= 2:

3024

if 0 <= server_settings["socket"] <= 2:

3113

3025

server_settings["socket"] = os.dup(server_settings

3114

3026

["socket"])

3115

os.set_inheritable(server_settings["socket"], False)

3116

3027

del server_config

3117

3028

3118

3029

# Override the settings from the config file with command line

3167

3078

3168

3079

if server_settings["servicename"] != "Mandos":

3169

3080

syslogger.setFormatter(

3170

logging.Formatter("Mandos ({}) [%(process)d]:"

3171

" %(levelname)s: %(message)s".format(

3081

logging.Formatter('Mandos ({}) [%(process)d]:'

3082

' %(levelname)s: %(message)s'.format(

3172

3083

server_settings["servicename"])))

3173

3084

3174

3085

# Parse config file with clients

3198

3109

try:

3199

3110

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

3200

3111

except IOError as e:

3201

log.error("Could not open file %r", pidfilename,

3202

exc_info=e)

3112

logger.error("Could not open file %r", pidfilename,

3113

exc_info=e)

3203

3114

3204

3115

for name, group in (("_mandos", "_mandos"),

3205

3116

("mandos", "mandos"),

3216

3127

try:

3217

3128

os.setgid(gid)

3218

3129

os.setuid(uid)

3219

log.debug("Did setuid/setgid to %s:%s", uid, gid)

3130

if debug:

3131

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3132

gid))

3220

3133

except OSError as error:

3221

log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,

3222

os.strerror(error.errno))

3134

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3135

.format(uid, gid, os.strerror(error.errno)))

3223

3136

if error.errno != errno.EPERM:

3224

3137

raise

3225

3138

3232

3145

3233

3146

@gnutls.log_func

3234

3147

def debug_gnutls(level, string):

3235

log.debug("GnuTLS: %s",

3236

string[:-1].decode("utf-8", errors="replace"))

3148

logger.debug("GnuTLS: %s", string[:-1])

3237

3149

3238

3150

gnutls.global_set_log_function(debug_gnutls)

3239

3151

3257

3169

# From the Avahi example code

3258

3170

DBusGMainLoop(set_as_default=True)

3259

3171

main_loop = GLib.MainLoop()

3260

if use_dbus or zeroconf:

3261

bus = dbus.SystemBus()

3172

bus = dbus.SystemBus()

3262

3173

# End of Avahi example code

3263

3174

if use_dbus:

3264

3175

try:

3269

3180

"se.bsnet.fukt.Mandos", bus,

3270

3181

do_not_queue=True)

3271

3182

except dbus.exceptions.DBusException as e:

3272

log.error("Disabling D-Bus:", exc_info=e)

3183

logger.error("Disabling D-Bus:", exc_info=e)

3273

3184

use_dbus = False

3274

3185

server_settings["use_dbus"] = False

3275

3186

tcp_server.use_dbus = False

3334

3245

if isinstance(s, bytes)

3335

3246

else s) for s in

3336

3247

value["client_structure"]]

3337

# .name, .host, and .checker_command

3338

for k in ("name", "host", "checker_command"):

3248

# .name & .host

3249

for k in ("name", "host"):

3339

3250

if isinstance(value[k], bytes):

3340

3251

value[k] = value[k].decode("utf-8")

3341

3252

if "key_id" not in value:

3351

3262

for key, value in

3352

3263

bytes_old_client_settings.items()}

3353

3264

del bytes_old_client_settings

3354

# .host and .checker_command

3265

# .host

3355

3266

for value in old_client_settings.values():

3356

for attribute in ("host", "checker_command"):

3357

if isinstance(value[attribute], bytes):

3358

value[attribute] = (value[attribute]

3359

.decode("utf-8"))

3267

if isinstance(value["host"], bytes):

3268

value["host"] = (value["host"]

3269

.decode("utf-8"))

3360

3270

os.remove(stored_state_path)

3361

3271

except IOError as e:

3362

3272

if e.errno == errno.ENOENT:

3363

log.warning("Could not load persistent state:"

3364

" %s", os.strerror(e.errno))

3273

logger.warning("Could not load persistent state:"

3274

" {}".format(os.strerror(e.errno)))

3365

3275

else:

3366

log.critical("Could not load persistent state:",

3367

exc_info=e)

3276

logger.critical("Could not load persistent state:",

3277

exc_info=e)

3368

3278

raise

3369

3279

except EOFError as e:

3370

log.warning("Could not load persistent state: EOFError:",

3371

exc_info=e)

3280

logger.warning("Could not load persistent state: "

3281

"EOFError:",

3282

exc_info=e)

3372

3283

3373

3284

with PGPEngine() as pgp:

3374

3285

for client_name, client in clients_data.items():

3401

3312

if client["enabled"]:

3402

3313

if datetime.datetime.utcnow() >= client["expires"]:

3403

3314

if not client["last_checked_ok"]:

3404

log.warning("disabling client %s - Client"

3405

" never performed a successful"

3406

" checker", client_name)

3315

logger.warning(

3316

"disabling client {} - Client never "

3317

"performed a successful checker".format(

3318

client_name))

3407

3319

client["enabled"] = False

3408

3320

elif client["last_checker_status"] != 0:

3409

log.warning("disabling client %s - Client"

3410

" last checker failed with error"

3411

" code %s", client_name,

3412

client["last_checker_status"])

3321

logger.warning(

3322

"disabling client {} - Client last"

3323

" checker failed with error code"

3324

" {}".format(

3325

client_name,

3326

client["last_checker_status"]))

3413

3327

client["enabled"] = False

3414

3328

else:

3415

3329

client["expires"] = (

3416

3330

datetime.datetime.utcnow()

3417

3331

+ client["timeout"])

3418

log.debug("Last checker succeeded, keeping %s"

3419

" enabled", client_name)

3332

logger.debug("Last checker succeeded,"

3333

" keeping {} enabled".format(

3334

client_name))

3420

3335

try:

3421

3336

client["secret"] = pgp.decrypt(

3422

3337

client["encrypted_secret"],

3423

3338

client_settings[client_name]["secret"])

3424

3339

except PGPError:

3425

3340

# If decryption fails, we use secret from new settings

3426

log.debug("Failed to decrypt %s old secret",

3427

client_name)

3341

logger.debug("Failed to decrypt {} old secret".format(

3342

client_name))

3428

3343

client["secret"] = (client_settings[client_name]

3429

3344

["secret"])

3430

3345

3444

3359

server_settings=server_settings)

3445

3360

3446

3361

if not tcp_server.clients:

3447

log.warning("No clients defined")

3362

logger.warning("No clients defined")

3448

3363

3449

3364

if not foreground:

3450

3365

if pidfile is not None:

3453

3368

with pidfile:

3454

3369

print(pid, file=pidfile)

3455

3370

except IOError:

3456

log.error("Could not write to file %r with PID %d",

3457

pidfilename, pid)

3371

logger.error("Could not write to file %r with PID %d",

3372

pidfilename, pid)

3458

3373

del pidfile

3459

3374

del pidfilename

3460

3375

3610

3525

3611

3526

try:

3612

3527

with tempfile.NamedTemporaryFile(

3613

mode="wb",

3528

mode='wb',

3614

3529

suffix=".pickle",

3615

prefix="clients-",

3530

prefix='clients-',

3616

3531

dir=os.path.dirname(stored_state_path),

3617

3532

delete=False) as stored_state:

3618

3533

pickle.dump((clients, client_settings), stored_state,

3626

3541

except NameError:

3627

3542

pass

3628

3543

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3629

log.warning("Could not save persistent state: %s",

3630

os.strerror(e.errno))

3544

logger.warning("Could not save persistent state: {}"

3545

.format(os.strerror(e.errno)))

3631

3546

else:

3632

log.warning("Could not save persistent state:",

3633

exc_info=e)

3547

logger.warning("Could not save persistent state:",

3548

exc_info=e)

3634

3549

raise

3635

3550

3636

3551

# Delete all clients, and settings from config

3653

3568

mandos_dbus_service.client_added_signal(client)

3654

3569

# Need to initiate checking of clients

3655

3570

if client.enabled:

3656

client.init_checker(randomize_start=True)

3571

client.init_checker()

3657

3572

3658

3573

tcp_server.enable()

3659

3574

tcp_server.server_activate()

3662

3577

if zeroconf:

3663

3578

service.port = tcp_server.socket.getsockname()[1]

3664

3579

if use_ipv6:

3665

log.info("Now listening on address %r, port %d, flowinfo %d,"

3666

" scope_id %d", *tcp_server.socket.getsockname())

3580

logger.info("Now listening on address %r, port %d,"

3581

" flowinfo %d, scope_id %d",

3582

*tcp_server.socket.getsockname())

3667

3583

else: # IPv4

3668

log.info("Now listening on address %r, port %d",

3669

*tcp_server.socket.getsockname())

3584

logger.info("Now listening on address %r, port %d",

3585

*tcp_server.socket.getsockname())

3670

3586

3671

3587

# service.interface = tcp_server.socket.getsockname()[3]

3672

3588

3676

3592

try:

3677

3593

service.activate()

3678

3594

except dbus.exceptions.DBusException as error:

3679

log.critical("D-Bus Exception", exc_info=error)

3595

logger.critical("D-Bus Exception", exc_info=error)

3680

3596

cleanup()

3681

3597

sys.exit(1)

3682

3598

# End of Avahi example code

3683

3599

3684

GLib.io_add_watch(

3685

GLib.IOChannel.unix_new(tcp_server.fileno()),

3686

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3687

lambda *args, **kwargs: (tcp_server.handle_request

3688

(*args[2:], **kwargs) or True))

3600

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3601

lambda *args, **kwargs:

3602

(tcp_server.handle_request

3603

(*args[2:], **kwargs) or True))

3689

3604

3690

log.debug("Starting main loop")

3605

logger.debug("Starting main loop")

3691

3606

main_loop.run()

3692

3607

except AvahiError as error:

3693

log.critical("Avahi Error", exc_info=error)

3608

logger.critical("Avahi Error", exc_info=error)

3694

3609

cleanup()

3695

3610

sys.exit(1)

3696

3611

except KeyboardInterrupt:

3697

3612

if debug:

3698

3613

print("", file=sys.stderr)

3699

log.debug("Server received KeyboardInterrupt")

3700

log.debug("Server exiting")

3614

logger.debug("Server received KeyboardInterrupt")

3615

logger.debug("Server exiting")

3701

3616

# Must run before the D-Bus bus name gets deregistered

3702

3617

cleanup()

3703

3618

3704

3705

def parse_test_args():

3706

# type: () -> argparse.Namespace

3707

parser = argparse.ArgumentParser(add_help=False)

3708

parser.add_argument("--check", action="store_true")

3709

parser.add_argument("--prefix", )

3710

args, unknown_args = parser.parse_known_args()

3711

if args.check:

3712

# Remove test options from sys.argv

3713

sys.argv[1:] = unknown_args

3714

return args

3715

3716

# Add all tests from doctest strings

3717

def load_tests(loader, tests, none):

3718

import doctest

3719

tests.addTests(doctest.DocTestSuite())

3720

return tests

3721

3722

if __name__ == "__main__":

3723

options = parse_test_args()

3724

try:

3725

if options.check:

3726

extra_test_prefix = options.prefix

3727

if extra_test_prefix is not None:

3728

if not (unittest.main(argv=[""], exit=False)

3729

.result.wasSuccessful()):

3730

sys.exit(1)

3731

class ExtraTestLoader(unittest.TestLoader):

3732

testMethodPrefix = extra_test_prefix

3733

# Call using ./scriptname --test [--verbose]

3734

unittest.main(argv=[""], testLoader=ExtraTestLoader())

3735

else:

3736

unittest.main(argv=[""])

3737

else:

3738

main()

3739

finally:

3740

logging.shutdown()

3741

3742

# Local Variables:

3743

# run-tests:

3744

# (lambda (&optional extra)

3745

# (if (not (funcall run-tests-in-test-buffer default-directory

3746

# extra))

3747

# (funcall show-test-buffer-in-test-window)

3748

# (funcall remove-test-window)

3749

# (if extra (message "Extra tests run successfully!"))))

3750

# run-tests-in-test-buffer:

3751

# (lambda (dir &optional extra)

3752

# (with-current-buffer (get-buffer-create "*Test*")

3753

# (setq buffer-read-only nil

3754

# default-directory dir)

3755

# (erase-buffer)

3756

# (compilation-mode))

3757

# (let ((process-result

3758

# (let ((inhibit-read-only t))

3759

# (process-file-shell-command

3760

# (funcall get-command-line extra) nil "*Test*"))))

3761

# (and (numberp process-result)

3762

# (= process-result 0))))

3763

# get-command-line:

3764

# (lambda (&optional extra)

3765

# (let ((quoted-script

3766

# (shell-quote-argument (funcall get-script-name))))

3767

# (format

3768

# (concat "%s --check" (if extra " --prefix=atest" ""))

3769

# quoted-script)))

3770

# get-script-name:

3771

# (lambda ()

3772

# (if (fboundp 'file-local-name)

3773

# (file-local-name (buffer-file-name))

3774

# (or (file-remote-p (buffer-file-name) 'localname)

3775

# (buffer-file-name))))

3776

# remove-test-window:

3777

# (lambda ()

3778

# (let ((test-window (get-buffer-window "*Test*")))

3779

# (if test-window (delete-window test-window))))

3780

# show-test-buffer-in-test-window:

3781

# (lambda ()

3782

# (when (not (get-buffer-window-list "*Test*"))

3783

# (setq next-error-last-buffer (get-buffer "*Test*"))

3784

# (let* ((side (if (>= (window-width) 146) 'right 'bottom))

3785

# (display-buffer-overriding-action

3786

# `((display-buffer-in-side-window) (side . ,side)

3787

# (window-height . fit-window-to-buffer)

3788

# (window-width . fit-window-to-buffer))))

3789

# (display-buffer "*Test*"))))

3790

# eval:

3791

# (progn

3792

# (let* ((run-extra-tests (lambda () (interactive)

3793

# (funcall run-tests t)))

3794

# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t

3795

# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c

3796

# (setq minor-mode-overriding-map-alist

3797

# (cons `(run-tests . ,outer-keymap)

3798

# minor-mode-overriding-map-alist)))

3799

# (add-hook 'after-save-hook run-tests 90 t))

3800

# End:

3619

3620

if __name__ == '__main__':

3621

main()