/mandos/trunk : revision 1175

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

1

#!/usr/bin/python3 -b

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

77

import itertools

78

import collections

79

import codecs

80

import unittest

80

81

82

import dbus

82

83

import dbus.service

88

89

import xml.dom.minidom

89

90

import inspect

90

91

92

if sys.version_info.major == 2:

93

__metaclass__ = type

94

95

# Show warnings by default

96

if not sys.warnoptions:

97

import warnings

98

warnings.simplefilter("default")

99

91

100

# Try to find the value of SO_BINDTODEVICE:

92

101

try:

93

102

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

119

128

if sys.version_info < (3, 2):

120

129

configparser.Configparser = configparser.SafeConfigParser

121

130

122

version = "1.8.6"

131

version = "1.8.8"

123

132

stored_state_file = "clients.pickle"

124

133

125

134

logger = logging.getLogger()

135

logging.captureWarnings(True) # Show warnings via the logging system

126

136

syslogger = None

127

137

128

138

try:

183

193

pass

184

194

185

195

186

class PGPEngine(object):

196

class PGPEngine:

187

197

"""A simple class for OpenPGP symmetric encryption & decryption"""

188

198

189

199

def __init__(self):

193

203

output = subprocess.check_output(["gpgconf"])

194

204

for line in output.splitlines():

195

205

name, text, path = line.split(b":")

196

if name == "gpg":

206

if name == b"gpg":

197

207

self.gpg = path

198

208

break

199

209

except OSError as e:

204

214

'--force-mdc',

205

215

'--quiet']

206

216

# Only GPG version 1 has the --no-use-agent option.

207

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

217

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

208

218

self.gnupgargs.append("--no-use-agent")

209

219

210

220

def __enter__(self):

279

289

280

290

281

291

# Pretend that we have an Avahi module

282

class avahi(object):

292

class avahi:

283

293

"""This isn't so much a class as it is a module-like namespace."""

284

294

IF_UNSPEC = -1 # avahi-common/address.h

285

295

PROTO_UNSPEC = -1 # avahi-common/address.h

319

329

pass

320

330

321

331

322

class AvahiService(object):

332

class AvahiService:

323

333

"""An Avahi (Zeroconf) service.

324

334

325

335

Attributes:

507

517

508

518

509

519

# Pretend that we have a GnuTLS module

510

class gnutls(object):

520

class gnutls:

511

521

"""This isn't so much a class as it is a module-like namespace."""

512

522

513

523

library = ctypes.util.find_library("gnutls")

576

586

pass

577

587

578

588

# Classes

579

class Credentials(object):

589

class Credentials:

580

590

def __init__(self):

581

591

self._c_object = gnutls.certificate_credentials_t()

582

592

gnutls.certificate_allocate_credentials(

586

596

def __del__(self):

587

597

gnutls.certificate_free_credentials(self._c_object)

588

598

589

class ClientSession(object):

599

class ClientSession:

590

600

def __init__(self, socket, credentials=None):

591

601

self._c_object = gnutls.session_t()

592

602

gnutls_flags = gnutls.CLIENT

818

828

connection.close()

819

829

820

830

821

class Client(object):

831

class Client:

822

832

"""A representation of a client host served by this server.

823

833

824

834

Attributes:

1140

1150

kwargs=popen_args)

1141

1151

self.checker.start()

1142

1152

self.checker_callback_tag = GLib.io_add_watch(

1143

pipe[0].fileno(), GLib.IO_IN,

1153

GLib.IOChannel.unix_new(pipe[0].fileno()),

1154

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1144

1155

self.checker_callback, pipe[0], command)

1145

1156

# Re-run this periodically if run by GLib.timeout_add

1146

1157

return True

2213

2224

del _interface

2214

2225

2215

2226

2216

class ProxyClient(object):

2227

class ProxyClient:

2217

2228

def __init__(self, child_pipe, key_id, fpr, address):

2218

2229

self._pipe = child_pipe

2219

2230

self._pipe.send(('init', key_id, fpr, address))

2492

2503

return hex_fpr

2493

2504

2494

2505

2495

class MultiprocessingMixIn(object):

2506

class MultiprocessingMixIn:

2496

2507

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2497

2508

2498

2509

def sub_process_main(self, request, address):

2510

2521

return proc

2511

2522

2512

2523

2513

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2524

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

2514

2525

""" adds a pipe to the MixIn """

2515

2526

2516

2527

def process_request(self, request, client_address):

2531

2542

2532

2543

2533

2544

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2534

socketserver.TCPServer, object):

2545

socketserver.TCPServer):

2535

2546

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2536

2547

2537

2548

Attributes:

2670

2681

def add_pipe(self, parent_pipe, proc):

2671

2682

# Call "handle_ipc" for both data and EOF events

2672

2683

GLib.io_add_watch(

2673

parent_pipe.fileno(),

2674

GLib.IO_IN | GLib.IO_HUP,

2684

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2685

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2675

2686

functools.partial(self.handle_ipc,

2676

2687

parent_pipe=parent_pipe,

2677

2688

proc=proc))

2715

2726

return False

2716

2727

2717

2728

GLib.io_add_watch(

2718

parent_pipe.fileno(),

2719

GLib.IO_IN | GLib.IO_HUP,

2729

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2730

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2720

2731

functools.partial(self.handle_ipc,

2721

2732

parent_pipe=parent_pipe,

2722

2733

proc=proc,

2754

2765

def rfc3339_duration_to_delta(duration):

2755

2766

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2756

2767

2757

>>> rfc3339_duration_to_delta("P7D")

2758

datetime.timedelta(7)

2759

>>> rfc3339_duration_to_delta("PT60S")

2760

datetime.timedelta(0, 60)

2761

>>> rfc3339_duration_to_delta("PT60M")

2762

datetime.timedelta(0, 3600)

2763

>>> rfc3339_duration_to_delta("PT24H")

2764

datetime.timedelta(1)

2765

>>> rfc3339_duration_to_delta("P1W")

2766

datetime.timedelta(7)

2767

>>> rfc3339_duration_to_delta("PT5M30S")

2768

datetime.timedelta(0, 330)

2769

>>> rfc3339_duration_to_delta("P1DT3M20S")

2770

datetime.timedelta(1, 200)

2768

>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)

2769

True

2770

>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)

2771

True

2772

>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)

2773

True

2774

>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)

2775

True

2776

>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)

2777

True

2778

>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)

2779

True

2780

>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)

2781

True

2771

2782

"""

2772

2783

2773

2784

# Parsing an RFC 3339 duration with regular expressions is not

2853

2864

def string_to_delta(interval):

2854

2865

"""Parse a string and return a datetime.timedelta

2855

2866

2856

>>> string_to_delta('7d')

2857

datetime.timedelta(7)

2858

>>> string_to_delta('60s')

2859

datetime.timedelta(0, 60)

2860

>>> string_to_delta('60m')

2861

datetime.timedelta(0, 3600)

2862

>>> string_to_delta('24h')

2863

datetime.timedelta(1)

2864

>>> string_to_delta('1w')

2865

datetime.timedelta(7)

2866

>>> string_to_delta('5m 30s')

2867

datetime.timedelta(0, 330)

2867

>>> string_to_delta('7d') == datetime.timedelta(7)

2868

True

2869

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2870

True

2871

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2872

True

2873

>>> string_to_delta('24h') == datetime.timedelta(1)

2874

True

2875

>>> string_to_delta('1w') == datetime.timedelta(7)

2876

True

2877

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2878

True

2868

2879

"""

2869

2880

2870

2881

try:

2972

2983

2973

2984

options = parser.parse_args()

2974

2985

2975

if options.check:

2976

import doctest

2977

fail_count, test_count = doctest.testmod()

2978

sys.exit(os.EX_OK if fail_count == 0 else 1)

2979

2980

2986

# Default values for config file for server-global settings

2981

2987

if gnutls.has_rawpk:

2982

2988

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3245

3251

if isinstance(s, bytes)

3246

3252

else s) for s in

3247

3253

value["client_structure"]]

3248

# .name & .host

3249

for k in ("name", "host"):

3254

# .name, .host, and .checker_command

3255

for k in ("name", "host", "checker_command"):

3250

3256

if isinstance(value[k], bytes):

3251

3257

value[k] = value[k].decode("utf-8")

3252

3258

if "key_id" not in value:

3262

3268

for key, value in

3263

3269

bytes_old_client_settings.items()}

3264

3270

del bytes_old_client_settings

3265

# .host

3271

# .host and .checker_command

3266

3272

for value in old_client_settings.values():

3267

if isinstance(value["host"], bytes):

3268

value["host"] = (value["host"]

3269

.decode("utf-8"))

3273

for attribute in ("host", "checker_command"):

3274

if isinstance(value[attribute], bytes):

3275

value[attribute] = (value[attribute]

3276

.decode("utf-8"))

3270

3277

os.remove(stored_state_path)

3271

3278

except IOError as e:

3272

3279

if e.errno == errno.ENOENT:

3597

3604

sys.exit(1)

3598

3605

# End of Avahi example code

3599

3606

3600

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3601

lambda *args, **kwargs:

3602

(tcp_server.handle_request

3603

(*args[2:], **kwargs) or True))

3607

GLib.io_add_watch(

3608

GLib.IOChannel.unix_new(tcp_server.fileno()),

3609

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3610

lambda *args, **kwargs: (tcp_server.handle_request

3611

(*args[2:], **kwargs) or True))

3604

3612

3605

3613

logger.debug("Starting main loop")

3606

3614

main_loop.run()

3616

3624

# Must run before the D-Bus bus name gets deregistered

3617

3625

cleanup()

3618

3626

3627

3628

def should_only_run_tests():

3629

parser = argparse.ArgumentParser(add_help=False)

3630

parser.add_argument("--check", action='store_true')

3631

args, unknown_args = parser.parse_known_args()

3632

run_tests = args.check

3633

if run_tests:

3634

# Remove --check argument from sys.argv

3635

sys.argv[1:] = unknown_args

3636

return run_tests

3637

3638

# Add all tests from doctest strings

3639

def load_tests(loader, tests, none):

3640

import doctest

3641

tests.addTests(doctest.DocTestSuite())

3642

return tests

3619

3643

3620

3644

if __name__ == '__main__':

3621

main()

3645

try:

3646

if should_only_run_tests():

3647

# Call using ./mandos --check [--verbose]

3648

unittest.main()

3649

else:

3650

main()

3651

finally:

3652

logging.shutdown()