To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 1201
- compare with another revision
- download diff
- download tarball
- view history from revision 1201
- Committer: teddy at recompile
- Date: 2020-02-05 21:39:28 UTC
- Revision ID: teddy@recompile.se-20200205213928-vpvt0fwfg47ikv6f
Allow users to alter ask-password-mandos.service
If a user uses dracut with systemd and wishes to modify the options
passed to password-agent(8mandos) or mandos-client(8mandos), they
should be able to do so by simply creating a file
/etc/systemd/system/ask-password-mandos.service.d/override.conf,
containing, for instance:
[Service]
Environment=MANDOS_CLIENT_OPTIONS=--debug
Adding PASSWORD_AGENT_OPTIONS should also be possible (but should not
normally be needed).
* dracut-module/ask-password-mandos.service ([Service]/ExecStart): Add
$PASSWORD_AGENT_OPTIONS before "--" and "$MANDOS_CLIENT_OPTIONS" to
end of line.
* dracut-module/module-setup.sh (install): Install all files named
/etc/systemd/system/ask-password-mandos.service.d/*.conf if any
exists. Also add --dh-params before $MANDOS_CLIENT_OPTIONS instead
of at end of line.
If a user uses dracut with systemd and wishes to modify the options
passed to password-agent(8mandos) or mandos-client(8mandos), they
should be able to do so by simply creating a file
/etc/systemd/system/ask-password-mandos.service.d/override.conf,
containing, for instance:
[Service]
Environment=MANDOS_CLIENT_OPTIONS=--debug
Adding PASSWORD_AGENT_OPTIONS should also be possible (but should not
normally be needed).
* dracut-module/ask-password-mandos.service ([Service]/ExecStart): Add
$PASSWORD_AGENT_OPTIONS before "--" and "$MANDOS_CLIENT_OPTIONS" to
end of line.
* dracut-module/module-setup.sh (install): Install all files named
/etc/systemd/system/ask-password-mandos.service.d/*.conf if any
exists. Also add --dh-params before $MANDOS_CLIENT_OPTIONS instead
of at end of line.
- files modified:
- DBUS-API
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2020 Teddy Hogeborn
15
# Copyright © 2008-2020 Björn Påhlsson
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
79
79
import codecs
80
80
import unittest
81
81
import random
82
import shlex
83
82
84
83
import dbus
85
84
import dbus.service
95
94
__metaclass__ = type
96
95
str = unicode
97
96
98
# Add collections.abc.Callable if it does not exist
99
try:
100
collections.abc.Callable
101
except AttributeError:
102
class abc:
103
Callable = collections.Callable
104
collections.abc = abc
105
del abc
106
107
# Add shlex.quote if it does not exist
108
try:
109
shlex.quote
110
except AttributeError:
111
shlex.quote = re.escape
112
113
97
# Show warnings by default
114
98
if not sys.warnoptions:
115
99
import warnings
143
127
if sys.version_info < (3, 2):
144
128
configparser.Configparser = configparser.SafeConfigParser
145
129
146
version = "1.8.14"
130
version = "1.8.9"
147
131
stored_state_file = "clients.pickle"
148
132
149
133
logger = logging.getLogger()
524
508
class AvahiServiceToSyslog(AvahiService):
525
509
def rename(self, *args, **kwargs):
526
510
"""Add the new name to the syslog messages"""
527
ret = super(AvahiServiceToSyslog, self).rename(*args,
528
**kwargs)
511
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
529
512
syslogger.setFormatter(logging.Formatter(
530
513
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
531
514
.format(self.name)))
563
546
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
564
547
565
548
# Types
566
class _session_int(ctypes.Structure):
549
class session_int(ctypes.Structure):
567
550
_fields_ = []
568
session_t = ctypes.POINTER(_session_int)
551
session_t = ctypes.POINTER(session_int)
569
552
570
553
class certificate_credentials_st(ctypes.Structure):
571
554
_fields_ = []
577
560
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
578
561
('size', ctypes.c_uint)]
579
562
580
class _openpgp_crt_int(ctypes.Structure):
563
class openpgp_crt_int(ctypes.Structure):
581
564
_fields_ = []
582
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
565
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
583
566
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
584
567
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
585
568
credentials_type_t = ctypes.c_int
594
577
# gnutls.strerror()
595
578
self.code = code
596
579
if message is None and code is not None:
597
message = gnutls.strerror(code).decode(
598
"utf-8", errors="replace")
580
message = gnutls.strerror(code)
599
581
return super(gnutls.Error, self).__init__(
600
582
message, *args)
601
583
602
584
class CertificateSecurityError(Error):
603
585
pass
604
586
605
class PointerTo:
606
def __init__(self, cls):
607
self.cls = cls
608
609
def from_param(self, obj):
610
if not isinstance(obj, self.cls):
611
raise TypeError("Not of type {}: {!r}"
612
.format(self.cls.__name__, obj))
613
return ctypes.byref(obj.from_param(obj))
614
615
class CastToVoidPointer:
616
def __init__(self, cls):
617
self.cls = cls
618
619
def from_param(self, obj):
620
if not isinstance(obj, self.cls):
621
raise TypeError("Not of type {}: {!r}"
622
.format(self.cls.__name__, obj))
623
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
624
625
class With_from_param:
626
@classmethod
627
def from_param(cls, obj):
628
return obj._as_parameter_
629
630
587
# Classes
631
class Credentials(With_from_param):
588
class Credentials:
632
589
def __init__(self):
633
self._as_parameter_ = gnutls.certificate_credentials_t()
634
gnutls.certificate_allocate_credentials(self)
590
self._c_object = gnutls.certificate_credentials_t()
591
gnutls.certificate_allocate_credentials(
592
ctypes.byref(self._c_object))
635
593
self.type = gnutls.CRD_CERTIFICATE
636
594
637
595
def __del__(self):
638
gnutls.certificate_free_credentials(self)
596
gnutls.certificate_free_credentials(self._c_object)
639
597
640
class ClientSession(With_from_param):
598
class ClientSession:
641
599
def __init__(self, socket, credentials=None):
642
self._as_parameter_ = gnutls.session_t()
600
self._c_object = gnutls.session_t()
643
601
gnutls_flags = gnutls.CLIENT
644
602
if gnutls.check_version(b"3.5.6"):
645
603
gnutls_flags |= gnutls.NO_TICKETS
646
604
if gnutls.has_rawpk:
647
605
gnutls_flags |= gnutls.ENABLE_RAWPK
648
gnutls.init(self, gnutls_flags)
606
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
649
607
del gnutls_flags
650
gnutls.set_default_priority(self)
651
gnutls.transport_set_ptr(self, socket.fileno())
652
gnutls.handshake_set_private_extensions(self, True)
608
gnutls.set_default_priority(self._c_object)
609
gnutls.transport_set_ptr(self._c_object, socket.fileno())
610
gnutls.handshake_set_private_extensions(self._c_object,
611
True)
653
612
self.socket = socket
654
613
if credentials is None:
655
614
credentials = gnutls.Credentials()
656
gnutls.credentials_set(self, credentials.type,
657
credentials)
615
gnutls.credentials_set(self._c_object, credentials.type,
616
ctypes.cast(credentials._c_object,
617
ctypes.c_void_p))
658
618
self.credentials = credentials
659
619
660
620
def __del__(self):
661
gnutls.deinit(self)
621
gnutls.deinit(self._c_object)
662
622
663
623
def handshake(self):
664
return gnutls.handshake(self)
624
return gnutls.handshake(self._c_object)
665
625
666
626
def send(self, data):
667
627
data = bytes(data)
668
628
data_len = len(data)
669
629
while data_len > 0:
670
data_len -= gnutls.record_send(self, data[-data_len:],
630
data_len -= gnutls.record_send(self._c_object,
631
data[-data_len:],
671
632
data_len)
672
633
673
634
def bye(self):
674
return gnutls.bye(self, gnutls.SHUT_RDWR)
635
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
675
636
676
637
# Error handling functions
677
638
def _error_code(result):
678
639
"""A function to raise exceptions on errors, suitable
679
640
for the 'restype' attribute on ctypes functions"""
680
if result >= gnutls.E_SUCCESS:
641
if result >= 0:
681
642
return result
682
643
if result == gnutls.E_NO_CERTIFICATE_FOUND:
683
644
raise gnutls.CertificateSecurityError(code=result)
684
645
raise gnutls.Error(code=result)
685
646
686
def _retry_on_error(result, func, arguments,
687
_error_code=_error_code):
647
def _retry_on_error(result, func, arguments):
688
648
"""A function to retry on some errors, suitable
689
649
for the 'errcheck' attribute on ctypes functions"""
690
while result < gnutls.E_SUCCESS:
650
while result < 0:
691
651
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
692
652
return _error_code(result)
693
653
result = func(*arguments)
698
658
699
659
# Functions
700
660
priority_set_direct = _library.gnutls_priority_set_direct
701
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
661
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
702
662
ctypes.POINTER(ctypes.c_char_p)]
703
663
priority_set_direct.restype = _error_code
704
664
705
665
init = _library.gnutls_init
706
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
666
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
707
667
init.restype = _error_code
708
668
709
669
set_default_priority = _library.gnutls_set_default_priority
710
set_default_priority.argtypes = [ClientSession]
670
set_default_priority.argtypes = [session_t]
711
671
set_default_priority.restype = _error_code
712
672
713
673
record_send = _library.gnutls_record_send
714
record_send.argtypes = [ClientSession, ctypes.c_void_p,
674
record_send.argtypes = [session_t, ctypes.c_void_p,
715
675
ctypes.c_size_t]
716
676
record_send.restype = ctypes.c_ssize_t
717
677
record_send.errcheck = _retry_on_error
719
679
certificate_allocate_credentials = (
720
680
_library.gnutls_certificate_allocate_credentials)
721
681
certificate_allocate_credentials.argtypes = [
722
PointerTo(Credentials)]
682
ctypes.POINTER(certificate_credentials_t)]
723
683
certificate_allocate_credentials.restype = _error_code
724
684
725
685
certificate_free_credentials = (
726
686
_library.gnutls_certificate_free_credentials)
727
certificate_free_credentials.argtypes = [Credentials]
687
certificate_free_credentials.argtypes = [
688
certificate_credentials_t]
728
689
certificate_free_credentials.restype = None
729
690
730
691
handshake_set_private_extensions = (
731
692
_library.gnutls_handshake_set_private_extensions)
732
handshake_set_private_extensions.argtypes = [ClientSession,
693
handshake_set_private_extensions.argtypes = [session_t,
733
694
ctypes.c_int]
734
695
handshake_set_private_extensions.restype = None
735
696
736
697
credentials_set = _library.gnutls_credentials_set
737
credentials_set.argtypes = [ClientSession, credentials_type_t,
738
CastToVoidPointer(Credentials)]
698
credentials_set.argtypes = [session_t, credentials_type_t,
699
ctypes.c_void_p]
739
700
credentials_set.restype = _error_code
740
701
741
702
strerror = _library.gnutls_strerror
743
704
strerror.restype = ctypes.c_char_p
744
705
745
706
certificate_type_get = _library.gnutls_certificate_type_get
746
certificate_type_get.argtypes = [ClientSession]
707
certificate_type_get.argtypes = [session_t]
747
708
certificate_type_get.restype = _error_code
748
709
749
710
certificate_get_peers = _library.gnutls_certificate_get_peers
750
certificate_get_peers.argtypes = [ClientSession,
711
certificate_get_peers.argtypes = [session_t,
751
712
ctypes.POINTER(ctypes.c_uint)]
752
713
certificate_get_peers.restype = ctypes.POINTER(datum_t)
753
714
760
721
global_set_log_function.restype = None
761
722
762
723
deinit = _library.gnutls_deinit
763
deinit.argtypes = [ClientSession]
724
deinit.argtypes = [session_t]
764
725
deinit.restype = None
765
726
766
727
handshake = _library.gnutls_handshake
767
handshake.argtypes = [ClientSession]
768
handshake.restype = ctypes.c_int
728
handshake.argtypes = [session_t]
729
handshake.restype = _error_code
769
730
handshake.errcheck = _retry_on_error
770
731
771
732
transport_set_ptr = _library.gnutls_transport_set_ptr
772
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
733
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
773
734
transport_set_ptr.restype = None
774
735
775
736
bye = _library.gnutls_bye
776
bye.argtypes = [ClientSession, close_request_t]
777
bye.restype = ctypes.c_int
737
bye.argtypes = [session_t, close_request_t]
738
bye.restype = _error_code
778
739
bye.errcheck = _retry_on_error
779
740
780
741
check_version = _library.gnutls_check_version
797
758
798
759
x509_crt_fmt_t = ctypes.c_int
799
760
800
# All the function declarations below are from
801
# gnutls/abstract.h
761
# All the function declarations below are from gnutls/abstract.h
802
762
pubkey_init = _library.gnutls_pubkey_init
803
763
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
804
764
pubkey_init.restype = _error_code
818
778
pubkey_deinit.argtypes = [pubkey_t]
819
779
pubkey_deinit.restype = None
820
780
else:
821
# All the function declarations below are from
822
# gnutls/openpgp.h
781
# All the function declarations below are from gnutls/openpgp.h
823
782
824
783
openpgp_crt_init = _library.gnutls_openpgp_crt_init
825
784
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
831
790
openpgp_crt_fmt_t]
832
791
openpgp_crt_import.restype = _error_code
833
792
834
openpgp_crt_verify_self = \
835
_library.gnutls_openpgp_crt_verify_self
836
openpgp_crt_verify_self.argtypes = [
837
openpgp_crt_t,
838
ctypes.c_uint,
839
ctypes.POINTER(ctypes.c_uint),
840
]
793
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
794
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
795
ctypes.POINTER(ctypes.c_uint)]
841
796
openpgp_crt_verify_self.restype = _error_code
842
797
843
798
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
854
809
855
810
if check_version(b"3.6.4"):
856
811
certificate_type_get2 = _library.gnutls_certificate_type_get2
857
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
812
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
858
813
certificate_type_get2.restype = _error_code
859
814
860
815
# Remove non-public functions
1163
1118
if self.checker is None:
1164
1119
# Escape attributes for the shell
1165
1120
escaped_attrs = {
1166
attr: shlex.quote(str(getattr(self, attr)))
1121
attr: re.escape(str(getattr(self, attr)))
1167
1122
for attr in self.runtime_expansions}
1168
1123
try:
1169
1124
command = self.checker_command % escaped_attrs
2320
2275
priority = self.server.gnutls_priority
2321
2276
if priority is None:
2322
2277
priority = "NORMAL"
2323
gnutls.priority_set_direct(session,
2324
priority.encode("utf-8"), None)
2278
gnutls.priority_set_direct(session._c_object,
2279
priority.encode("utf-8"),
2280
None)
2325
2281
2326
2282
# Start communication using the Mandos protocol
2327
2283
# Get protocol number
2354
2310
except (TypeError, gnutls.Error) as error:
2355
2311
logger.warning("Bad certificate: %s", error)
2356
2312
return
2357
logger.debug("Key ID: %s",
2358
key_id.decode("utf-8",
2359
errors="replace"))
2313
logger.debug("Key ID: %s", key_id)
2360
2314
2361
2315
else:
2362
2316
key_id = b""
2454
2408
def peer_certificate(session):
2455
2409
"Return the peer's certificate as a bytestring"
2456
2410
try:
2457
cert_type = gnutls.certificate_type_get2(
2458
session, gnutls.CTYPE_PEERS)
2411
cert_type = gnutls.certificate_type_get2(session._c_object,
2412
gnutls.CTYPE_PEERS)
2459
2413
except AttributeError:
2460
cert_type = gnutls.certificate_type_get(session)
2414
cert_type = gnutls.certificate_type_get(session._c_object)
2461
2415
if gnutls.has_rawpk:
2462
2416
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2463
2417
else:
2470
2424
return b""
2471
2425
list_size = ctypes.c_uint(1)
2472
2426
cert_list = (gnutls.certificate_get_peers
2473
(session, ctypes.byref(list_size)))
2427
(session._c_object, ctypes.byref(list_size)))
2474
2428
if not bool(cert_list) and list_size.value != 0:
2475
2429
raise gnutls.Error("error getting peer certificate")
2476
2430
if list_size.value == 0:
2498
2452
buf = ctypes.create_string_buffer(32)
2499
2453
buf_len = ctypes.c_size_t(len(buf))
2500
2454
# Get the key ID from the raw public key into the buffer
2501
gnutls.pubkey_get_key_id(
2502
pubkey,
2503
gnutls.KEYID_USE_SHA256,
2504
ctypes.cast(ctypes.byref(buf),
2505
ctypes.POINTER(ctypes.c_ubyte)),
2506
ctypes.byref(buf_len))
2455
gnutls.pubkey_get_key_id(pubkey,
2456
gnutls.KEYID_USE_SHA256,
2457
ctypes.cast(ctypes.byref(buf),
2458
ctypes.POINTER(ctypes.c_ubyte)),
2459
ctypes.byref(buf_len))
2507
2460
# Deinit the certificate
2508
2461
gnutls.pubkey_deinit(pubkey)
2509
2462
2754
2707
address = request[3]
2755
2708
2756
2709
for c in self.clients.values():
2757
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2758
"27AE41E4649B934CA495991B7852B855"):
2710
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2759
2711
continue
2760
2712
if key_id and c.key_id == key_id:
2761
2713
client = c
2796
2748
if command == 'getattr':
2797
2749
attrname = request[1]
2798
2750
if isinstance(client_object.__getattribute__(attrname),
2799
collections.abc.Callable):
2751
collections.Callable):
2800
2752
parent_pipe.send(('function', ))
2801
2753
else:
2802
2754
parent_pipe.send((
2813
2765
def rfc3339_duration_to_delta(duration):
2814
2766
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2815
2767
2816
>>> timedelta = datetime.timedelta
2817
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2818
True
2819
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2820
True
2821
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2822
True
2823
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2824
True
2825
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2826
True
2827
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2828
True
2829
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2830
True
2831
>>> del timedelta
2768
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2769
True
2770
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2771
True
2772
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2773
True
2774
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2775
True
2776
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2777
True
2778
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2779
True
2780
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2781
True
2832
2782
"""
2833
2783
2834
2784
# Parsing an RFC 3339 duration with regular expressions is not
3201
3151
3202
3152
@gnutls.log_func
3203
3153
def debug_gnutls(level, string):
3204
logger.debug("GnuTLS: %s",
3205
string[:-1].decode("utf-8",
3206
errors="replace"))
3154
logger.debug("GnuTLS: %s", string[:-1])
3207
3155
3208
3156
gnutls.global_set_log_function(debug_gnutls)
3209
3157
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0