/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2019-08-05 21:40:46 UTC
  • mfrom: (237.4.120 release)
  • Revision ID: teddy@recompile.se-20190805214046-qaj0w91ltbp92z2q
Merge from release branch

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
1
 
#!/usr/bin/python3 -b
2
 
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
 
1
#!/usr/bin/python
 
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
77
77
import itertools
78
78
import collections
79
79
import codecs
80
 
import unittest
81
80
 
82
81
import dbus
83
82
import dbus.service
89
88
import xml.dom.minidom
90
89
import inspect
91
90
 
92
 
if sys.version_info.major == 2:
93
 
    __metaclass__ = type
94
 
 
95
 
# Show warnings by default
96
 
if not sys.warnoptions:
97
 
    import warnings
98
 
    warnings.simplefilter("default")
99
 
 
100
91
# Try to find the value of SO_BINDTODEVICE:
101
92
try:
102
93
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
128
119
if sys.version_info < (3, 2):
129
120
    configparser.Configparser = configparser.SafeConfigParser
130
121
 
131
 
version = "1.8.8"
 
122
version = "1.8.7"
132
123
stored_state_file = "clients.pickle"
133
124
 
134
125
logger = logging.getLogger()
135
 
logging.captureWarnings(True)   # Show warnings via the logging system
136
126
syslogger = None
137
127
 
138
128
try:
193
183
    pass
194
184
 
195
185
 
196
 
class PGPEngine:
 
186
class PGPEngine(object):
197
187
    """A simple class for OpenPGP symmetric encryption & decryption"""
198
188
 
199
189
    def __init__(self):
289
279
 
290
280
 
291
281
# Pretend that we have an Avahi module
292
 
class avahi:
 
282
class avahi(object):
293
283
    """This isn't so much a class as it is a module-like namespace."""
294
284
    IF_UNSPEC = -1               # avahi-common/address.h
295
285
    PROTO_UNSPEC = -1            # avahi-common/address.h
329
319
    pass
330
320
 
331
321
 
332
 
class AvahiService:
 
322
class AvahiService(object):
333
323
    """An Avahi (Zeroconf) service.
334
324
 
335
325
    Attributes:
517
507
 
518
508
 
519
509
# Pretend that we have a GnuTLS module
520
 
class gnutls:
 
510
class gnutls(object):
521
511
    """This isn't so much a class as it is a module-like namespace."""
522
512
 
523
513
    library = ctypes.util.find_library("gnutls")
586
576
        pass
587
577
 
588
578
    # Classes
589
 
    class Credentials:
 
579
    class Credentials(object):
590
580
        def __init__(self):
591
581
            self._c_object = gnutls.certificate_credentials_t()
592
582
            gnutls.certificate_allocate_credentials(
596
586
        def __del__(self):
597
587
            gnutls.certificate_free_credentials(self._c_object)
598
588
 
599
 
    class ClientSession:
 
589
    class ClientSession(object):
600
590
        def __init__(self, socket, credentials=None):
601
591
            self._c_object = gnutls.session_t()
602
592
            gnutls_flags = gnutls.CLIENT
828
818
    connection.close()
829
819
 
830
820
 
831
 
class Client:
 
821
class Client(object):
832
822
    """A representation of a client host served by this server.
833
823
 
834
824
    Attributes:
1150
1140
                kwargs=popen_args)
1151
1141
            self.checker.start()
1152
1142
            self.checker_callback_tag = GLib.io_add_watch(
1153
 
                GLib.IOChannel.unix_new(pipe[0].fileno()),
1154
 
                GLib.PRIORITY_DEFAULT, GLib.IO_IN,
 
1143
                pipe[0].fileno(), GLib.IO_IN,
1155
1144
                self.checker_callback, pipe[0], command)
1156
1145
        # Re-run this periodically if run by GLib.timeout_add
1157
1146
        return True
2224
2213
    del _interface
2225
2214
 
2226
2215
 
2227
 
class ProxyClient:
 
2216
class ProxyClient(object):
2228
2217
    def __init__(self, child_pipe, key_id, fpr, address):
2229
2218
        self._pipe = child_pipe
2230
2219
        self._pipe.send(('init', key_id, fpr, address))
2503
2492
        return hex_fpr
2504
2493
 
2505
2494
 
2506
 
class MultiprocessingMixIn:
 
2495
class MultiprocessingMixIn(object):
2507
2496
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
2508
2497
 
2509
2498
    def sub_process_main(self, request, address):
2521
2510
        return proc
2522
2511
 
2523
2512
 
2524
 
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
 
2513
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2525
2514
    """ adds a pipe to the MixIn """
2526
2515
 
2527
2516
    def process_request(self, request, client_address):
2542
2531
 
2543
2532
 
2544
2533
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2545
 
                     socketserver.TCPServer):
 
2534
                     socketserver.TCPServer, object):
2546
2535
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
2547
2536
 
2548
2537
    Attributes:
2681
2670
    def add_pipe(self, parent_pipe, proc):
2682
2671
        # Call "handle_ipc" for both data and EOF events
2683
2672
        GLib.io_add_watch(
2684
 
            GLib.IOChannel.unix_new(parent_pipe.fileno()),
2685
 
            GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
 
2673
            parent_pipe.fileno(),
 
2674
            GLib.IO_IN | GLib.IO_HUP,
2686
2675
            functools.partial(self.handle_ipc,
2687
2676
                              parent_pipe=parent_pipe,
2688
2677
                              proc=proc))
2726
2715
                return False
2727
2716
 
2728
2717
            GLib.io_add_watch(
2729
 
                GLib.IOChannel.unix_new(parent_pipe.fileno()),
2730
 
                GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
 
2718
                parent_pipe.fileno(),
 
2719
                GLib.IO_IN | GLib.IO_HUP,
2731
2720
                functools.partial(self.handle_ipc,
2732
2721
                                  parent_pipe=parent_pipe,
2733
2722
                                  proc=proc,
2765
2754
def rfc3339_duration_to_delta(duration):
2766
2755
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2767
2756
 
2768
 
    >>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2769
 
    True
2770
 
    >>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2771
 
    True
2772
 
    >>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2773
 
    True
2774
 
    >>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2775
 
    True
2776
 
    >>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2777
 
    True
2778
 
    >>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2779
 
    True
2780
 
    >>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2781
 
    True
 
2757
    >>> rfc3339_duration_to_delta("P7D")
 
2758
    datetime.timedelta(7)
 
2759
    >>> rfc3339_duration_to_delta("PT60S")
 
2760
    datetime.timedelta(0, 60)
 
2761
    >>> rfc3339_duration_to_delta("PT60M")
 
2762
    datetime.timedelta(0, 3600)
 
2763
    >>> rfc3339_duration_to_delta("PT24H")
 
2764
    datetime.timedelta(1)
 
2765
    >>> rfc3339_duration_to_delta("P1W")
 
2766
    datetime.timedelta(7)
 
2767
    >>> rfc3339_duration_to_delta("PT5M30S")
 
2768
    datetime.timedelta(0, 330)
 
2769
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
2770
    datetime.timedelta(1, 200)
2782
2771
    """
2783
2772
 
2784
2773
    # Parsing an RFC 3339 duration with regular expressions is not
2864
2853
def string_to_delta(interval):
2865
2854
    """Parse a string and return a datetime.timedelta
2866
2855
 
2867
 
    >>> string_to_delta('7d') == datetime.timedelta(7)
2868
 
    True
2869
 
    >>> string_to_delta('60s') == datetime.timedelta(0, 60)
2870
 
    True
2871
 
    >>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2872
 
    True
2873
 
    >>> string_to_delta('24h') == datetime.timedelta(1)
2874
 
    True
2875
 
    >>> string_to_delta('1w') == datetime.timedelta(7)
2876
 
    True
2877
 
    >>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2878
 
    True
 
2856
    >>> string_to_delta('7d')
 
2857
    datetime.timedelta(7)
 
2858
    >>> string_to_delta('60s')
 
2859
    datetime.timedelta(0, 60)
 
2860
    >>> string_to_delta('60m')
 
2861
    datetime.timedelta(0, 3600)
 
2862
    >>> string_to_delta('24h')
 
2863
    datetime.timedelta(1)
 
2864
    >>> string_to_delta('1w')
 
2865
    datetime.timedelta(7)
 
2866
    >>> string_to_delta('5m 30s')
 
2867
    datetime.timedelta(0, 330)
2879
2868
    """
2880
2869
 
2881
2870
    try:
2983
2972
 
2984
2973
    options = parser.parse_args()
2985
2974
 
 
2975
    if options.check:
 
2976
        import doctest
 
2977
        fail_count, test_count = doctest.testmod()
 
2978
        sys.exit(os.EX_OK if fail_count == 0 else 1)
 
2979
 
2986
2980
    # Default values for config file for server-global settings
2987
2981
    if gnutls.has_rawpk:
2988
2982
        priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3603
3597
                sys.exit(1)
3604
3598
            # End of Avahi example code
3605
3599
 
3606
 
        GLib.io_add_watch(
3607
 
            GLib.IOChannel.unix_new(tcp_server.fileno()),
3608
 
            GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3609
 
            lambda *args, **kwargs: (tcp_server.handle_request
3610
 
                                     (*args[2:], **kwargs) or True))
 
3600
        GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
 
3601
                          lambda *args, **kwargs:
 
3602
                          (tcp_server.handle_request
 
3603
                           (*args[2:], **kwargs) or True))
3611
3604
 
3612
3605
        logger.debug("Starting main loop")
3613
3606
        main_loop.run()
3623
3616
    # Must run before the D-Bus bus name gets deregistered
3624
3617
    cleanup()
3625
3618
 
3626
 
 
3627
 
def should_only_run_tests():
3628
 
    parser = argparse.ArgumentParser(add_help=False)
3629
 
    parser.add_argument("--check", action='store_true')
3630
 
    args, unknown_args = parser.parse_known_args()
3631
 
    run_tests = args.check
3632
 
    if run_tests:
3633
 
        # Remove --check argument from sys.argv
3634
 
        sys.argv[1:] = unknown_args
3635
 
    return run_tests
3636
 
 
3637
 
# Add all tests from doctest strings
3638
 
def load_tests(loader, tests, none):
3639
 
    import doctest
3640
 
    tests.addTests(doctest.DocTestSuite())
3641
 
    return tests
3642
3619
 
3643
3620
if __name__ == '__main__':
3644
 
    try:
3645
 
        if should_only_run_tests():
3646
 
            # Call using ./mandos --check [--verbose]
3647
 
            unittest.main()
3648
 
        else:
3649
 
            main()
3650
 
    finally:
3651
 
        logging.shutdown()
 
3621
    main()