/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: teddy at recompile
  • Date: 2019-12-04 23:52:20 UTC
  • Revision ID: teddy@recompile.se-20191204235220-yn88brp0scmqwy2t
Remove non-project-specific pattern from .bzrignore

Only project-specific patterns should be in the .bzrignore file.
Other generic patterns should be in the ~/.config/breezy/ignore and
~/.bazaar/ignore files.

* .bzrignore (.tramp_history): Remove.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
1
 
#!/usr/bin/python
2
 
# -*- mode: python; coding: utf-8 -*-
 
1
#!/usr/bin/python3 -bI
 
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
77
77
import itertools
78
78
import collections
79
79
import codecs
 
80
import unittest
80
81
 
81
82
import dbus
82
83
import dbus.service
 
84
import gi
83
85
from gi.repository import GLib
84
86
from dbus.mainloop.glib import DBusGMainLoop
85
87
import ctypes
87
89
import xml.dom.minidom
88
90
import inspect
89
91
 
 
92
if sys.version_info.major == 2:
 
93
    __metaclass__ = type
 
94
    str = unicode
 
95
 
 
96
# Show warnings by default
 
97
if not sys.warnoptions:
 
98
    import warnings
 
99
    warnings.simplefilter("default")
 
100
 
90
101
# Try to find the value of SO_BINDTODEVICE:
91
102
try:
92
103
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
112
123
            # No value found
113
124
            SO_BINDTODEVICE = None
114
125
 
115
 
if sys.version_info.major == 2:
116
 
    str = unicode
 
126
if sys.version_info < (3, 2):
 
127
    configparser.Configparser = configparser.SafeConfigParser
117
128
 
118
 
version = "1.8.4"
 
129
version = "1.8.9"
119
130
stored_state_file = "clients.pickle"
120
131
 
121
132
logger = logging.getLogger()
 
133
logging.captureWarnings(True)   # Show warnings via the logging system
122
134
syslogger = None
123
135
 
124
136
try:
179
191
    pass
180
192
 
181
193
 
182
 
class PGPEngine(object):
 
194
class PGPEngine:
183
195
    """A simple class for OpenPGP symmetric encryption & decryption"""
184
196
 
185
197
    def __init__(self):
189
201
            output = subprocess.check_output(["gpgconf"])
190
202
            for line in output.splitlines():
191
203
                name, text, path = line.split(b":")
192
 
                if name == "gpg":
 
204
                if name == b"gpg":
193
205
                    self.gpg = path
194
206
                    break
195
207
        except OSError as e:
200
212
                          '--force-mdc',
201
213
                          '--quiet']
202
214
        # Only GPG version 1 has the --no-use-agent option.
203
 
        if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
 
215
        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
204
216
            self.gnupgargs.append("--no-use-agent")
205
217
 
206
218
    def __enter__(self):
275
287
 
276
288
 
277
289
# Pretend that we have an Avahi module
278
 
class avahi(object):
 
290
class avahi:
279
291
    """This isn't so much a class as it is a module-like namespace."""
280
292
    IF_UNSPEC = -1               # avahi-common/address.h
281
293
    PROTO_UNSPEC = -1            # avahi-common/address.h
315
327
    pass
316
328
 
317
329
 
318
 
class AvahiService(object):
 
330
class AvahiService:
319
331
    """An Avahi (Zeroconf) service.
320
332
 
321
333
    Attributes:
503
515
 
504
516
 
505
517
# Pretend that we have a GnuTLS module
506
 
class gnutls(object):
 
518
class gnutls:
507
519
    """This isn't so much a class as it is a module-like namespace."""
508
520
 
509
521
    library = ctypes.util.find_library("gnutls")
572
584
        pass
573
585
 
574
586
    # Classes
575
 
    class Credentials(object):
 
587
    class Credentials:
576
588
        def __init__(self):
577
589
            self._c_object = gnutls.certificate_credentials_t()
578
590
            gnutls.certificate_allocate_credentials(
582
594
        def __del__(self):
583
595
            gnutls.certificate_free_credentials(self._c_object)
584
596
 
585
 
    class ClientSession(object):
 
597
    class ClientSession:
586
598
        def __init__(self, socket, credentials=None):
587
599
            self._c_object = gnutls.session_t()
588
600
            gnutls_flags = gnutls.CLIENT
814
826
    connection.close()
815
827
 
816
828
 
817
 
class Client(object):
 
829
class Client:
818
830
    """A representation of a client host served by this server.
819
831
 
820
832
    Attributes:
1039
1051
        # Read return code from connection (see call_pipe)
1040
1052
        returncode = connection.recv()
1041
1053
        connection.close()
1042
 
        self.checker.join()
 
1054
        if self.checker is not None:
 
1055
            self.checker.join()
1043
1056
        self.checker_callback_tag = None
1044
1057
        self.checker = None
1045
1058
 
1136
1149
                kwargs=popen_args)
1137
1150
            self.checker.start()
1138
1151
            self.checker_callback_tag = GLib.io_add_watch(
1139
 
                pipe[0].fileno(), GLib.IO_IN,
 
1152
                GLib.IOChannel.unix_new(pipe[0].fileno()),
 
1153
                GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1140
1154
                self.checker_callback, pipe[0], command)
1141
1155
        # Re-run this periodically if run by GLib.timeout_add
1142
1156
        return True
1397
1411
                raise ValueError("Byte arrays not supported for non-"
1398
1412
                                 "'ay' signature {!r}"
1399
1413
                                 .format(prop._dbus_signature))
1400
 
            value = dbus.ByteArray(b''.join(chr(byte)
1401
 
                                            for byte in value))
 
1414
            value = dbus.ByteArray(bytes(value))
1402
1415
        prop(value)
1403
1416
 
1404
1417
    @dbus.service.method(dbus.PROPERTIES_IFACE,
2209
2222
    del _interface
2210
2223
 
2211
2224
 
2212
 
class ProxyClient(object):
 
2225
class ProxyClient:
2213
2226
    def __init__(self, child_pipe, key_id, fpr, address):
2214
2227
        self._pipe = child_pipe
2215
2228
        self._pipe.send(('init', key_id, fpr, address))
2488
2501
        return hex_fpr
2489
2502
 
2490
2503
 
2491
 
class MultiprocessingMixIn(object):
 
2504
class MultiprocessingMixIn:
2492
2505
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
2493
2506
 
2494
2507
    def sub_process_main(self, request, address):
2506
2519
        return proc
2507
2520
 
2508
2521
 
2509
 
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
2522
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2510
2523
    """ adds a pipe to the MixIn """
2511
2524
 
2512
2525
    def process_request(self, request, client_address):
2527
2540
 
2528
2541
 
2529
2542
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2530
 
                     socketserver.TCPServer, object):
 
2543
                     socketserver.TCPServer):
2531
2544
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
2532
2545
 
2533
2546
    Attributes:
2666
2679
    def add_pipe(self, parent_pipe, proc):
2667
2680
        # Call "handle_ipc" for both data and EOF events
2668
2681
        GLib.io_add_watch(
2669
 
            parent_pipe.fileno(),
2670
 
            GLib.IO_IN | GLib.IO_HUP,
 
2682
            GLib.IOChannel.unix_new(parent_pipe.fileno()),
 
2683
            GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2671
2684
            functools.partial(self.handle_ipc,
2672
2685
                              parent_pipe=parent_pipe,
2673
2686
                              proc=proc))
2711
2724
                return False
2712
2725
 
2713
2726
            GLib.io_add_watch(
2714
 
                parent_pipe.fileno(),
2715
 
                GLib.IO_IN | GLib.IO_HUP,
 
2727
                GLib.IOChannel.unix_new(parent_pipe.fileno()),
 
2728
                GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2716
2729
                functools.partial(self.handle_ipc,
2717
2730
                                  parent_pipe=parent_pipe,
2718
2731
                                  proc=proc,
2750
2763
def rfc3339_duration_to_delta(duration):
2751
2764
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2752
2765
 
2753
 
    >>> rfc3339_duration_to_delta("P7D")
2754
 
    datetime.timedelta(7)
2755
 
    >>> rfc3339_duration_to_delta("PT60S")
2756
 
    datetime.timedelta(0, 60)
2757
 
    >>> rfc3339_duration_to_delta("PT60M")
2758
 
    datetime.timedelta(0, 3600)
2759
 
    >>> rfc3339_duration_to_delta("PT24H")
2760
 
    datetime.timedelta(1)
2761
 
    >>> rfc3339_duration_to_delta("P1W")
2762
 
    datetime.timedelta(7)
2763
 
    >>> rfc3339_duration_to_delta("PT5M30S")
2764
 
    datetime.timedelta(0, 330)
2765
 
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2766
 
    datetime.timedelta(1, 200)
 
2766
    >>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
 
2767
    True
 
2768
    >>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
 
2769
    True
 
2770
    >>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
 
2771
    True
 
2772
    >>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
 
2773
    True
 
2774
    >>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
 
2775
    True
 
2776
    >>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
 
2777
    True
 
2778
    >>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
 
2779
    True
2767
2780
    """
2768
2781
 
2769
2782
    # Parsing an RFC 3339 duration with regular expressions is not
2849
2862
def string_to_delta(interval):
2850
2863
    """Parse a string and return a datetime.timedelta
2851
2864
 
2852
 
    >>> string_to_delta('7d')
2853
 
    datetime.timedelta(7)
2854
 
    >>> string_to_delta('60s')
2855
 
    datetime.timedelta(0, 60)
2856
 
    >>> string_to_delta('60m')
2857
 
    datetime.timedelta(0, 3600)
2858
 
    >>> string_to_delta('24h')
2859
 
    datetime.timedelta(1)
2860
 
    >>> string_to_delta('1w')
2861
 
    datetime.timedelta(7)
2862
 
    >>> string_to_delta('5m 30s')
2863
 
    datetime.timedelta(0, 330)
 
2865
    >>> string_to_delta('7d') == datetime.timedelta(7)
 
2866
    True
 
2867
    >>> string_to_delta('60s') == datetime.timedelta(0, 60)
 
2868
    True
 
2869
    >>> string_to_delta('60m') == datetime.timedelta(0, 3600)
 
2870
    True
 
2871
    >>> string_to_delta('24h') == datetime.timedelta(1)
 
2872
    True
 
2873
    >>> string_to_delta('1w') == datetime.timedelta(7)
 
2874
    True
 
2875
    >>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
 
2876
    True
2864
2877
    """
2865
2878
 
2866
2879
    try:
2968
2981
 
2969
2982
    options = parser.parse_args()
2970
2983
 
2971
 
    if options.check:
2972
 
        import doctest
2973
 
        fail_count, test_count = doctest.testmod()
2974
 
        sys.exit(os.EX_OK if fail_count == 0 else 1)
2975
 
 
2976
2984
    # Default values for config file for server-global settings
2977
2985
    if gnutls.has_rawpk:
2978
2986
        priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2998
3006
    del priority
2999
3007
 
3000
3008
    # Parse config file for server-global settings
3001
 
    server_config = configparser.SafeConfigParser(server_defaults)
 
3009
    server_config = configparser.ConfigParser(server_defaults)
3002
3010
    del server_defaults
3003
3011
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
3004
 
    # Convert the SafeConfigParser object to a dict
 
3012
    # Convert the ConfigParser object to a dict
3005
3013
    server_settings = server_config.defaults()
3006
3014
    # Use the appropriate methods on the non-string config options
3007
3015
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
3079
3087
                                  server_settings["servicename"])))
3080
3088
 
3081
3089
    # Parse config file with clients
3082
 
    client_config = configparser.SafeConfigParser(Client
3083
 
                                                  .client_defaults)
 
3090
    client_config = configparser.ConfigParser(Client.client_defaults)
3084
3091
    client_config.read(os.path.join(server_settings["configdir"],
3085
3092
                                    "clients.conf"))
3086
3093
 
3157
3164
        # Close all input and output, do double fork, etc.
3158
3165
        daemon()
3159
3166
 
3160
 
    # multiprocessing will use threads, so before we use GLib we need
3161
 
    # to inform GLib that threads will be used.
3162
 
    GLib.threads_init()
 
3167
    if gi.version_info < (3, 10, 2):
 
3168
        # multiprocessing will use threads, so before we use GLib we
 
3169
        # need to inform GLib that threads will be used.
 
3170
        GLib.threads_init()
3163
3171
 
3164
3172
    global main_loop
3165
3173
    # From the Avahi example code
3241
3249
                             if isinstance(s, bytes)
3242
3250
                             else s) for s in
3243
3251
                            value["client_structure"]]
3244
 
                        # .name & .host
3245
 
                        for k in ("name", "host"):
 
3252
                        # .name, .host, and .checker_command
 
3253
                        for k in ("name", "host", "checker_command"):
3246
3254
                            if isinstance(value[k], bytes):
3247
3255
                                value[k] = value[k].decode("utf-8")
3248
3256
                        if "key_id" not in value:
3258
3266
                        for key, value in
3259
3267
                        bytes_old_client_settings.items()}
3260
3268
                    del bytes_old_client_settings
3261
 
                    # .host
 
3269
                    # .host and .checker_command
3262
3270
                    for value in old_client_settings.values():
3263
 
                        if isinstance(value["host"], bytes):
3264
 
                            value["host"] = (value["host"]
3265
 
                                             .decode("utf-8"))
 
3271
                        for attribute in ("host", "checker_command"):
 
3272
                            if isinstance(value[attribute], bytes):
 
3273
                                value[attribute] = (value[attribute]
 
3274
                                                    .decode("utf-8"))
3266
3275
            os.remove(stored_state_path)
3267
3276
        except IOError as e:
3268
3277
            if e.errno == errno.ENOENT:
3593
3602
                sys.exit(1)
3594
3603
            # End of Avahi example code
3595
3604
 
3596
 
        GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3597
 
                          lambda *args, **kwargs:
3598
 
                          (tcp_server.handle_request
3599
 
                           (*args[2:], **kwargs) or True))
 
3605
        GLib.io_add_watch(
 
3606
            GLib.IOChannel.unix_new(tcp_server.fileno()),
 
3607
            GLib.PRIORITY_DEFAULT, GLib.IO_IN,
 
3608
            lambda *args, **kwargs: (tcp_server.handle_request
 
3609
                                     (*args[2:], **kwargs) or True))
3600
3610
 
3601
3611
        logger.debug("Starting main loop")
3602
3612
        main_loop.run()
3612
3622
    # Must run before the D-Bus bus name gets deregistered
3613
3623
    cleanup()
3614
3624
 
 
3625
 
 
3626
def should_only_run_tests():
 
3627
    parser = argparse.ArgumentParser(add_help=False)
 
3628
    parser.add_argument("--check", action='store_true')
 
3629
    args, unknown_args = parser.parse_known_args()
 
3630
    run_tests = args.check
 
3631
    if run_tests:
 
3632
        # Remove --check argument from sys.argv
 
3633
        sys.argv[1:] = unknown_args
 
3634
    return run_tests
 
3635
 
 
3636
# Add all tests from doctest strings
 
3637
def load_tests(loader, tests, none):
 
3638
    import doctest
 
3639
    tests.addTests(doctest.DocTestSuite())
 
3640
    return tests
3615
3641
 
3616
3642
if __name__ == '__main__':
3617
 
    main()
 
3643
    try:
 
3644
        if should_only_run_tests():
 
3645
            # Call using ./mandos --check [--verbose]
 
3646
            unittest.main()
 
3647
        else:
 
3648
            main()
 
3649
    finally:
 
3650
        logging.shutdown()