/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2019-08-18 00:42:22 UTC
  • Revision ID: teddy@recompile.se-20190818004222-lfrgtnmqz766a08e
Client: Use the systemd sysusers.d mechanism, if present

* Makefile (install-client-nokey): Also install sysusers.d file, if
                                   $(SYSUSERS) exists.
* sysusers.d-mandos.conf: Adjust comment to match reality.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
1
 
#!/usr/bin/python3 -bI
2
 
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
 
1
#!/usr/bin/python
 
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
 
# Copyright © 2008-2020 Teddy Hogeborn
15
 
# Copyright © 2008-2020 Björn Påhlsson
 
14
# Copyright © 2008-2019 Teddy Hogeborn
 
15
# Copyright © 2008-2019 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
77
77
import itertools
78
78
import collections
79
79
import codecs
80
 
import unittest
81
 
import random
82
 
import shlex
83
80
 
84
81
import dbus
85
82
import dbus.service
93
90
 
94
91
if sys.version_info.major == 2:
95
92
    __metaclass__ = type
96
 
    str = unicode
97
 
 
98
 
# Add collections.abc.Callable if it does not exist
99
 
try:
100
 
    collections.abc.Callable
101
 
except AttributeError:
102
 
    class abc:
103
 
        Callable = collections.Callable
104
 
    collections.abc = abc
105
 
    del abc
106
 
 
107
 
# Add shlex.quote if it does not exist
108
 
try:
109
 
    shlex.quote
110
 
except AttributeError:
111
 
    shlex.quote = re.escape
112
 
 
113
 
# Show warnings by default
114
 
if not sys.warnoptions:
115
 
    import warnings
116
 
    warnings.simplefilter("default")
117
93
 
118
94
# Try to find the value of SO_BINDTODEVICE:
119
95
try:
140
116
            # No value found
141
117
            SO_BINDTODEVICE = None
142
118
 
 
119
if sys.version_info.major == 2:
 
120
    str = unicode
 
121
 
143
122
if sys.version_info < (3, 2):
144
123
    configparser.Configparser = configparser.SafeConfigParser
145
124
 
146
 
version = "1.8.14"
 
125
version = "1.8.7"
147
126
stored_state_file = "clients.pickle"
148
127
 
149
128
logger = logging.getLogger()
150
 
logging.captureWarnings(True)   # Show warnings via the logging system
151
129
syslogger = None
152
130
 
153
131
try:
218
196
            output = subprocess.check_output(["gpgconf"])
219
197
            for line in output.splitlines():
220
198
                name, text, path = line.split(b":")
221
 
                if name == b"gpg":
 
199
                if name == "gpg":
222
200
                    self.gpg = path
223
201
                    break
224
202
        except OSError as e:
229
207
                          '--force-mdc',
230
208
                          '--quiet']
231
209
        # Only GPG version 1 has the --no-use-agent option.
232
 
        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
 
210
        if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
233
211
            self.gnupgargs.append("--no-use-agent")
234
212
 
235
213
    def __enter__(self):
524
502
class AvahiServiceToSyslog(AvahiService):
525
503
    def rename(self, *args, **kwargs):
526
504
        """Add the new name to the syslog messages"""
527
 
        ret = super(AvahiServiceToSyslog, self).rename(*args,
528
 
                                                       **kwargs)
 
505
        ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
529
506
        syslogger.setFormatter(logging.Formatter(
530
507
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
531
508
            .format(self.name)))
661
638
            raise gnutls.CertificateSecurityError(code=result)
662
639
        raise gnutls.Error(code=result)
663
640
 
664
 
    def _retry_on_error(result, func, arguments,
665
 
                        _error_code=_error_code):
 
641
    def _retry_on_error(result, func, arguments):
666
642
        """A function to retry on some errors, suitable
667
643
        for the 'errcheck' attribute on ctypes functions"""
668
644
        while result < 0:
776
752
 
777
753
        x509_crt_fmt_t = ctypes.c_int
778
754
 
779
 
        # All the function declarations below are from
780
 
        # gnutls/abstract.h
 
755
        # All the function declarations below are from gnutls/abstract.h
781
756
        pubkey_init = _library.gnutls_pubkey_init
782
757
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
783
758
        pubkey_init.restype = _error_code
797
772
        pubkey_deinit.argtypes = [pubkey_t]
798
773
        pubkey_deinit.restype = None
799
774
    else:
800
 
        # All the function declarations below are from
801
 
        # gnutls/openpgp.h
 
775
        # All the function declarations below are from gnutls/openpgp.h
802
776
 
803
777
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
804
778
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
810
784
                                       openpgp_crt_fmt_t]
811
785
        openpgp_crt_import.restype = _error_code
812
786
 
813
 
        openpgp_crt_verify_self = \
814
 
            _library.gnutls_openpgp_crt_verify_self
815
 
        openpgp_crt_verify_self.argtypes = [
816
 
            openpgp_crt_t,
817
 
            ctypes.c_uint,
818
 
            ctypes.POINTER(ctypes.c_uint),
819
 
        ]
 
787
        openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
 
788
        openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
 
789
                                            ctypes.POINTER(ctypes.c_uint)]
820
790
        openpgp_crt_verify_self.restype = _error_code
821
791
 
822
792
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
1060
1030
        if self.checker_initiator_tag is not None:
1061
1031
            GLib.source_remove(self.checker_initiator_tag)
1062
1032
        self.checker_initiator_tag = GLib.timeout_add(
1063
 
            random.randrange(int(self.interval.total_seconds() * 1000
1064
 
                                 + 1)),
 
1033
            int(self.interval.total_seconds() * 1000),
1065
1034
            self.start_checker)
1066
1035
        # Schedule a disable() when 'timeout' has passed
1067
1036
        if self.disable_initiator_tag is not None:
1077
1046
        # Read return code from connection (see call_pipe)
1078
1047
        returncode = connection.recv()
1079
1048
        connection.close()
1080
 
        if self.checker is not None:
1081
 
            self.checker.join()
 
1049
        self.checker.join()
1082
1050
        self.checker_callback_tag = None
1083
1051
        self.checker = None
1084
1052
 
1142
1110
        if self.checker is None:
1143
1111
            # Escape attributes for the shell
1144
1112
            escaped_attrs = {
1145
 
                attr: shlex.quote(str(getattr(self, attr)))
 
1113
                attr: re.escape(str(getattr(self, attr)))
1146
1114
                for attr in self.runtime_expansions}
1147
1115
            try:
1148
1116
                command = self.checker_command % escaped_attrs
1175
1143
                kwargs=popen_args)
1176
1144
            self.checker.start()
1177
1145
            self.checker_callback_tag = GLib.io_add_watch(
1178
 
                GLib.IOChannel.unix_new(pipe[0].fileno()),
1179
 
                GLib.PRIORITY_DEFAULT, GLib.IO_IN,
 
1146
                pipe[0].fileno(), GLib.IO_IN,
1180
1147
                self.checker_callback, pipe[0], command)
1181
1148
        # Re-run this periodically if run by GLib.timeout_add
1182
1149
        return True
1437
1404
                raise ValueError("Byte arrays not supported for non-"
1438
1405
                                 "'ay' signature {!r}"
1439
1406
                                 .format(prop._dbus_signature))
1440
 
            value = dbus.ByteArray(bytes(value))
 
1407
            value = dbus.ByteArray(b''.join(chr(byte)
 
1408
                                            for byte in value))
1441
1409
        prop(value)
1442
1410
 
1443
1411
    @dbus.service.method(dbus.PROPERTIES_IFACE,
2476
2444
        buf = ctypes.create_string_buffer(32)
2477
2445
        buf_len = ctypes.c_size_t(len(buf))
2478
2446
        # Get the key ID from the raw public key into the buffer
2479
 
        gnutls.pubkey_get_key_id(
2480
 
            pubkey,
2481
 
            gnutls.KEYID_USE_SHA256,
2482
 
            ctypes.cast(ctypes.byref(buf),
2483
 
                        ctypes.POINTER(ctypes.c_ubyte)),
2484
 
            ctypes.byref(buf_len))
 
2447
        gnutls.pubkey_get_key_id(pubkey,
 
2448
                                 gnutls.KEYID_USE_SHA256,
 
2449
                                 ctypes.cast(ctypes.byref(buf),
 
2450
                                             ctypes.POINTER(ctypes.c_ubyte)),
 
2451
                                 ctypes.byref(buf_len))
2485
2452
        # Deinit the certificate
2486
2453
        gnutls.pubkey_deinit(pubkey)
2487
2454
 
2706
2673
    def add_pipe(self, parent_pipe, proc):
2707
2674
        # Call "handle_ipc" for both data and EOF events
2708
2675
        GLib.io_add_watch(
2709
 
            GLib.IOChannel.unix_new(parent_pipe.fileno()),
2710
 
            GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
 
2676
            parent_pipe.fileno(),
 
2677
            GLib.IO_IN | GLib.IO_HUP,
2711
2678
            functools.partial(self.handle_ipc,
2712
2679
                              parent_pipe=parent_pipe,
2713
2680
                              proc=proc))
2732
2699
            address = request[3]
2733
2700
 
2734
2701
            for c in self.clients.values():
2735
 
                if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2736
 
                              "27AE41E4649B934CA495991B7852B855"):
 
2702
                if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2737
2703
                    continue
2738
2704
                if key_id and c.key_id == key_id:
2739
2705
                    client = c
2752
2718
                return False
2753
2719
 
2754
2720
            GLib.io_add_watch(
2755
 
                GLib.IOChannel.unix_new(parent_pipe.fileno()),
2756
 
                GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
 
2721
                parent_pipe.fileno(),
 
2722
                GLib.IO_IN | GLib.IO_HUP,
2757
2723
                functools.partial(self.handle_ipc,
2758
2724
                                  parent_pipe=parent_pipe,
2759
2725
                                  proc=proc,
2774
2740
        if command == 'getattr':
2775
2741
            attrname = request[1]
2776
2742
            if isinstance(client_object.__getattribute__(attrname),
2777
 
                          collections.abc.Callable):
 
2743
                          collections.Callable):
2778
2744
                parent_pipe.send(('function', ))
2779
2745
            else:
2780
2746
                parent_pipe.send((
2791
2757
def rfc3339_duration_to_delta(duration):
2792
2758
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2793
2759
 
2794
 
    >>> timedelta = datetime.timedelta
2795
 
    >>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2796
 
    True
2797
 
    >>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2798
 
    True
2799
 
    >>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2800
 
    True
2801
 
    >>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2802
 
    True
2803
 
    >>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2804
 
    True
2805
 
    >>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2806
 
    True
2807
 
    >>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2808
 
    True
2809
 
    >>> del timedelta
 
2760
    >>> rfc3339_duration_to_delta("P7D")
 
2761
    datetime.timedelta(7)
 
2762
    >>> rfc3339_duration_to_delta("PT60S")
 
2763
    datetime.timedelta(0, 60)
 
2764
    >>> rfc3339_duration_to_delta("PT60M")
 
2765
    datetime.timedelta(0, 3600)
 
2766
    >>> rfc3339_duration_to_delta("PT24H")
 
2767
    datetime.timedelta(1)
 
2768
    >>> rfc3339_duration_to_delta("P1W")
 
2769
    datetime.timedelta(7)
 
2770
    >>> rfc3339_duration_to_delta("PT5M30S")
 
2771
    datetime.timedelta(0, 330)
 
2772
    >>> rfc3339_duration_to_delta("P1DT3M20S")
 
2773
    datetime.timedelta(1, 200)
2810
2774
    """
2811
2775
 
2812
2776
    # Parsing an RFC 3339 duration with regular expressions is not
2892
2856
def string_to_delta(interval):
2893
2857
    """Parse a string and return a datetime.timedelta
2894
2858
 
2895
 
    >>> string_to_delta('7d') == datetime.timedelta(7)
2896
 
    True
2897
 
    >>> string_to_delta('60s') == datetime.timedelta(0, 60)
2898
 
    True
2899
 
    >>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2900
 
    True
2901
 
    >>> string_to_delta('24h') == datetime.timedelta(1)
2902
 
    True
2903
 
    >>> string_to_delta('1w') == datetime.timedelta(7)
2904
 
    True
2905
 
    >>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2906
 
    True
 
2859
    >>> string_to_delta('7d')
 
2860
    datetime.timedelta(7)
 
2861
    >>> string_to_delta('60s')
 
2862
    datetime.timedelta(0, 60)
 
2863
    >>> string_to_delta('60m')
 
2864
    datetime.timedelta(0, 3600)
 
2865
    >>> string_to_delta('24h')
 
2866
    datetime.timedelta(1)
 
2867
    >>> string_to_delta('1w')
 
2868
    datetime.timedelta(7)
 
2869
    >>> string_to_delta('5m 30s')
 
2870
    datetime.timedelta(0, 330)
2907
2871
    """
2908
2872
 
2909
2873
    try:
3011
2975
 
3012
2976
    options = parser.parse_args()
3013
2977
 
 
2978
    if options.check:
 
2979
        import doctest
 
2980
        fail_count, test_count = doctest.testmod()
 
2981
        sys.exit(os.EX_OK if fail_count == 0 else 1)
 
2982
 
3014
2983
    # Default values for config file for server-global settings
3015
2984
    if gnutls.has_rawpk:
3016
2985
        priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3279
3248
                             if isinstance(s, bytes)
3280
3249
                             else s) for s in
3281
3250
                            value["client_structure"]]
3282
 
                        # .name, .host, and .checker_command
3283
 
                        for k in ("name", "host", "checker_command"):
 
3251
                        # .name & .host
 
3252
                        for k in ("name", "host"):
3284
3253
                            if isinstance(value[k], bytes):
3285
3254
                                value[k] = value[k].decode("utf-8")
3286
3255
                        if "key_id" not in value:
3296
3265
                        for key, value in
3297
3266
                        bytes_old_client_settings.items()}
3298
3267
                    del bytes_old_client_settings
3299
 
                    # .host and .checker_command
 
3268
                    # .host
3300
3269
                    for value in old_client_settings.values():
3301
 
                        for attribute in ("host", "checker_command"):
3302
 
                            if isinstance(value[attribute], bytes):
3303
 
                                value[attribute] = (value[attribute]
3304
 
                                                    .decode("utf-8"))
 
3270
                        if isinstance(value["host"], bytes):
 
3271
                            value["host"] = (value["host"]
 
3272
                                             .decode("utf-8"))
3305
3273
            os.remove(stored_state_path)
3306
3274
        except IOError as e:
3307
3275
            if e.errno == errno.ENOENT:
3632
3600
                sys.exit(1)
3633
3601
            # End of Avahi example code
3634
3602
 
3635
 
        GLib.io_add_watch(
3636
 
            GLib.IOChannel.unix_new(tcp_server.fileno()),
3637
 
            GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3638
 
            lambda *args, **kwargs: (tcp_server.handle_request
3639
 
                                     (*args[2:], **kwargs) or True))
 
3603
        GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
 
3604
                          lambda *args, **kwargs:
 
3605
                          (tcp_server.handle_request
 
3606
                           (*args[2:], **kwargs) or True))
3640
3607
 
3641
3608
        logger.debug("Starting main loop")
3642
3609
        main_loop.run()
3652
3619
    # Must run before the D-Bus bus name gets deregistered
3653
3620
    cleanup()
3654
3621
 
3655
 
 
3656
 
def should_only_run_tests():
3657
 
    parser = argparse.ArgumentParser(add_help=False)
3658
 
    parser.add_argument("--check", action='store_true')
3659
 
    args, unknown_args = parser.parse_known_args()
3660
 
    run_tests = args.check
3661
 
    if run_tests:
3662
 
        # Remove --check argument from sys.argv
3663
 
        sys.argv[1:] = unknown_args
3664
 
    return run_tests
3665
 
 
3666
 
# Add all tests from doctest strings
3667
 
def load_tests(loader, tests, none):
3668
 
    import doctest
3669
 
    tests.addTests(doctest.DocTestSuite())
3670
 
    return tests
3671
3622
 
3672
3623
if __name__ == '__main__':
3673
 
    try:
3674
 
        if should_only_run_tests():
3675
 
            # Call using ./mandos --check [--verbose]
3676
 
            unittest.main()
3677
 
        else:
3678
 
            main()
3679
 
    finally:
3680
 
        logging.shutdown()
 
3624
    main()