/mandos/trunk : revision 1193

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

1

#!/usr/bin/python3 -bI

2

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

77

import itertools

78

import collections

79

import codecs

80

import unittest

80

81

82

import dbus

82

83

import dbus.service

88

89

import xml.dom.minidom

89

90

import inspect

90

91

92

if sys.version_info.major == 2:

93

__metaclass__ = type

94

str = unicode

95

96

# Show warnings by default

97

if not sys.warnoptions:

98

import warnings

99

warnings.simplefilter("default")

100

91

101

# Try to find the value of SO_BINDTODEVICE:

92

102

try:

93

103

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

113

123

# No value found

114

124

SO_BINDTODEVICE = None

115

125

116

if sys.version_info.major == 2:

117

str = unicode

118

119

126

if sys.version_info < (3, 2):

120

127

configparser.Configparser = configparser.SafeConfigParser

121

128

122

version = "1.8.6"

129

version = "1.8.9"

123

130

stored_state_file = "clients.pickle"

124

131

125

132

logger = logging.getLogger()

133

logging.captureWarnings(True) # Show warnings via the logging system

126

134

syslogger = None

127

135

128

136

try:

183

191

pass

184

192

185

193

186

class PGPEngine(object):

194

class PGPEngine:

187

195

"""A simple class for OpenPGP symmetric encryption & decryption"""

188

196

189

197

def __init__(self):

193

201

output = subprocess.check_output(["gpgconf"])

194

202

for line in output.splitlines():

195

203

name, text, path = line.split(b":")

196

if name == "gpg":

204

if name == b"gpg":

197

205

self.gpg = path

198

206

break

199

207

except OSError as e:

204

212

'--force-mdc',

205

213

'--quiet']

206

214

# Only GPG version 1 has the --no-use-agent option.

207

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

215

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

208

216

self.gnupgargs.append("--no-use-agent")

209

217

210

218

def __enter__(self):

279

287

280

288

281

289

# Pretend that we have an Avahi module

282

class avahi(object):

290

class avahi:

283

291

"""This isn't so much a class as it is a module-like namespace."""

284

292

IF_UNSPEC = -1 # avahi-common/address.h

285

293

PROTO_UNSPEC = -1 # avahi-common/address.h

319

327

pass

320

328

321

329

322

class AvahiService(object):

330

class AvahiService:

323

331

"""An Avahi (Zeroconf) service.

324

332

325

333

Attributes:

507

515

508

516

509

517

# Pretend that we have a GnuTLS module

510

class gnutls(object):

518

class gnutls:

511

519

"""This isn't so much a class as it is a module-like namespace."""

512

520

513

521

library = ctypes.util.find_library("gnutls")

576

584

pass

577

585

578

586

# Classes

579

class Credentials(object):

587

class Credentials:

580

588

def __init__(self):

581

589

self._c_object = gnutls.certificate_credentials_t()

582

590

gnutls.certificate_allocate_credentials(

586

594

def __del__(self):

587

595

gnutls.certificate_free_credentials(self._c_object)

588

596

589

class ClientSession(object):

597

class ClientSession:

590

598

def __init__(self, socket, credentials=None):

591

599

self._c_object = gnutls.session_t()

592

600

gnutls_flags = gnutls.CLIENT

818

826

connection.close()

819

827

820

828

821

class Client(object):

829

class Client:

822

830

"""A representation of a client host served by this server.

823

831

824

832

Attributes:

1043

1051

# Read return code from connection (see call_pipe)

1044

1052

returncode = connection.recv()

1045

1053

connection.close()

1046

self.checker.join()

1054

if self.checker is not None:

1055

self.checker.join()

1047

1056

self.checker_callback_tag = None

1048

1057

self.checker = None

1049

1058

1140

1149

kwargs=popen_args)

1141

1150

self.checker.start()

1142

1151

self.checker_callback_tag = GLib.io_add_watch(

1143

pipe[0].fileno(), GLib.IO_IN,

1152

GLib.IOChannel.unix_new(pipe[0].fileno()),

1153

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1144

1154

self.checker_callback, pipe[0], command)

1145

1155

# Re-run this periodically if run by GLib.timeout_add

1146

1156

return True

1401

1411

raise ValueError("Byte arrays not supported for non-"

1402

1412

"'ay' signature {!r}"

1403

1413

.format(prop._dbus_signature))

1404

value = dbus.ByteArray(b''.join(chr(byte)

1405

for byte in value))

1414

value = dbus.ByteArray(bytes(value))

1406

1415

prop(value)

1407

1416

1408

1417

@dbus.service.method(dbus.PROPERTIES_IFACE,

2213

2222

del _interface

2214

2223

2215

2224

2216

class ProxyClient(object):

2225

class ProxyClient:

2217

2226

def __init__(self, child_pipe, key_id, fpr, address):

2218

2227

self._pipe = child_pipe

2219

2228

self._pipe.send(('init', key_id, fpr, address))

2492

2501

return hex_fpr

2493

2502

2494

2503

2495

class MultiprocessingMixIn(object):

2504

class MultiprocessingMixIn:

2496

2505

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2497

2506

2498

2507

def sub_process_main(self, request, address):

2510

2519

return proc

2511

2520

2512

2521

2513

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2522

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

2514

2523

""" adds a pipe to the MixIn """

2515

2524

2516

2525

def process_request(self, request, client_address):

2531

2540

2532

2541

2533

2542

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2534

socketserver.TCPServer, object):

2543

socketserver.TCPServer):

2535

2544

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2536

2545

2537

2546

Attributes:

2670

2679

def add_pipe(self, parent_pipe, proc):

2671

2680

# Call "handle_ipc" for both data and EOF events

2672

2681

GLib.io_add_watch(

2673

parent_pipe.fileno(),

2674

GLib.IO_IN | GLib.IO_HUP,

2682

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2683

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2675

2684

functools.partial(self.handle_ipc,

2676

2685

parent_pipe=parent_pipe,

2677

2686

proc=proc))

2715

2724

return False

2716

2725

2717

2726

GLib.io_add_watch(

2718

parent_pipe.fileno(),

2719

GLib.IO_IN | GLib.IO_HUP,

2727

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2728

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2720

2729

functools.partial(self.handle_ipc,

2721

2730

parent_pipe=parent_pipe,

2722

2731

proc=proc,

2754

2763

def rfc3339_duration_to_delta(duration):

2755

2764

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2756

2765

2757

>>> rfc3339_duration_to_delta("P7D")

2758

datetime.timedelta(7)

2759

>>> rfc3339_duration_to_delta("PT60S")

2760

datetime.timedelta(0, 60)

2761

>>> rfc3339_duration_to_delta("PT60M")

2762

datetime.timedelta(0, 3600)

2763

>>> rfc3339_duration_to_delta("PT24H")

2764

datetime.timedelta(1)

2765

>>> rfc3339_duration_to_delta("P1W")

2766

datetime.timedelta(7)

2767

>>> rfc3339_duration_to_delta("PT5M30S")

2768

datetime.timedelta(0, 330)

2769

>>> rfc3339_duration_to_delta("P1DT3M20S")

2770

datetime.timedelta(1, 200)

2766

>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)

2767

True

2768

>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)

2769

True

2770

>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)

2771

True

2772

>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)

2773

True

2774

>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)

2775

True

2776

>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)

2777

True

2778

>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)

2779

True

2771

2780

"""

2772

2781

2773

2782

# Parsing an RFC 3339 duration with regular expressions is not

2853

2862

def string_to_delta(interval):

2854

2863

"""Parse a string and return a datetime.timedelta

2855

2864

2856

>>> string_to_delta('7d')

2857

datetime.timedelta(7)

2858

>>> string_to_delta('60s')

2859

datetime.timedelta(0, 60)

2860

>>> string_to_delta('60m')

2861

datetime.timedelta(0, 3600)

2862

>>> string_to_delta('24h')

2863

datetime.timedelta(1)

2864

>>> string_to_delta('1w')

2865

datetime.timedelta(7)

2866

>>> string_to_delta('5m 30s')

2867

datetime.timedelta(0, 330)

2865

>>> string_to_delta('7d') == datetime.timedelta(7)

2866

True

2867

>>> string_to_delta('60s') == datetime.timedelta(0, 60)

2868

True

2869

>>> string_to_delta('60m') == datetime.timedelta(0, 3600)

2870

True

2871

>>> string_to_delta('24h') == datetime.timedelta(1)

2872

True

2873

>>> string_to_delta('1w') == datetime.timedelta(7)

2874

True

2875

>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)

2876

True

2868

2877

"""

2869

2878

2870

2879

try:

2972

2981

2973

2982

options = parser.parse_args()

2974

2983

2975

if options.check:

2976

import doctest

2977

fail_count, test_count = doctest.testmod()

2978

sys.exit(os.EX_OK if fail_count == 0 else 1)

2979

2980

2984

# Default values for config file for server-global settings

2981

2985

if gnutls.has_rawpk:

2982

2986

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3245

3249

if isinstance(s, bytes)

3246

3250

else s) for s in

3247

3251

value["client_structure"]]

3248

# .name & .host

3249

for k in ("name", "host"):

3252

# .name, .host, and .checker_command

3253

for k in ("name", "host", "checker_command"):

3250

3254

if isinstance(value[k], bytes):

3251

3255

value[k] = value[k].decode("utf-8")

3252

3256

if "key_id" not in value:

3262

3266

for key, value in

3263

3267

bytes_old_client_settings.items()}

3264

3268

del bytes_old_client_settings

3265

# .host

3269

# .host and .checker_command

3266

3270

for value in old_client_settings.values():

3267

if isinstance(value["host"], bytes):

3268

value["host"] = (value["host"]

3269

.decode("utf-8"))

3271

for attribute in ("host", "checker_command"):

3272

if isinstance(value[attribute], bytes):

3273

value[attribute] = (value[attribute]

3274

.decode("utf-8"))

3270

3275

os.remove(stored_state_path)

3271

3276

except IOError as e:

3272

3277

if e.errno == errno.ENOENT:

3597

3602

sys.exit(1)

3598

3603

# End of Avahi example code

3599

3604

3600

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3601

lambda *args, **kwargs:

3602

(tcp_server.handle_request

3603

(*args[2:], **kwargs) or True))

3605

GLib.io_add_watch(

3606

GLib.IOChannel.unix_new(tcp_server.fileno()),

3607

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3608

lambda *args, **kwargs: (tcp_server.handle_request

3609

(*args[2:], **kwargs) or True))

3604

3610

3605

3611

logger.debug("Starting main loop")

3606

3612

main_loop.run()

3616

3622

# Must run before the D-Bus bus name gets deregistered

3617

3623

cleanup()

3618

3624

3625

3626

def should_only_run_tests():

3627

parser = argparse.ArgumentParser(add_help=False)

3628

parser.add_argument("--check", action='store_true')

3629

args, unknown_args = parser.parse_known_args()

3630

run_tests = args.check

3631

if run_tests:

3632

# Remove --check argument from sys.argv

3633

sys.argv[1:] = unknown_args

3634

return run_tests

3635

3636

# Add all tests from doctest strings

3637

def load_tests(loader, tests, none):

3638

import doctest

3639

tests.addTests(doctest.DocTestSuite())

3640

return tests

3619

3641

3620

3642

if __name__ == '__main__':

3621

main()

3643

try:

3644

if should_only_run_tests():

3645

# Call using ./mandos --check [--verbose]

3646

unittest.main()

3647

else:

3648

main()

3649

finally:

3650

logging.shutdown()