/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2021-02-03 08:33:43 UTC
  • Revision ID: teddy@recompile.se-20210203083343-spdbhxgd5v8e3lv9
Update copyright year

* debian/copyright: Update copyright year to 2021.
* dracut-module/password-agent.c: - '' -
* dracut-module/password-agent.xml: Update copyright year to 2020.
* intro.xml: - '' -
* plugin-helpers/mandos-client-iprouteadddel.c: Update copyright year
  to 2021.
* plugin-runner.c: - '' -
* plugins.d/askpass-fifo.c: - '' -
* plugins.d/mandos-client.c: - '' -
* plugins.d/password-prompt.c: - '' -
* plugins.d/plymouth.c: - '' -
* plugins.d/splashy.c: - '' -
* plugins.d/usplash.c: - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
1
 
#!/usr/bin/python3 -b
 
1
#!/usr/bin/python3 -bI
2
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
 
# Copyright © 2008-2019 Teddy Hogeborn
15
 
# Copyright © 2008-2019 Björn Påhlsson
 
14
# Copyright © 2008-2020 Teddy Hogeborn
 
15
# Copyright © 2008-2020 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
78
78
import collections
79
79
import codecs
80
80
import unittest
 
81
import random
 
82
import shlex
81
83
 
82
84
import dbus
83
85
import dbus.service
91
93
 
92
94
if sys.version_info.major == 2:
93
95
    __metaclass__ = type
 
96
    str = unicode
 
97
 
 
98
# Add collections.abc.Callable if it does not exist
 
99
try:
 
100
    collections.abc.Callable
 
101
except AttributeError:
 
102
    class abc:
 
103
        Callable = collections.Callable
 
104
    collections.abc = abc
 
105
    del abc
 
106
 
 
107
# Add shlex.quote if it does not exist
 
108
try:
 
109
    shlex.quote
 
110
except AttributeError:
 
111
    shlex.quote = re.escape
94
112
 
95
113
# Show warnings by default
96
114
if not sys.warnoptions:
122
140
            # No value found
123
141
            SO_BINDTODEVICE = None
124
142
 
125
 
if sys.version_info.major == 2:
126
 
    str = unicode
127
 
 
128
143
if sys.version_info < (3, 2):
129
144
    configparser.Configparser = configparser.SafeConfigParser
130
145
 
131
 
version = "1.8.9"
 
146
version = "1.8.13"
132
147
stored_state_file = "clients.pickle"
133
148
 
134
149
logger = logging.getLogger()
509
524
class AvahiServiceToSyslog(AvahiService):
510
525
    def rename(self, *args, **kwargs):
511
526
        """Add the new name to the syslog messages"""
512
 
        ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
 
527
        ret = super(AvahiServiceToSyslog, self).rename(*args,
 
528
                                                       **kwargs)
513
529
        syslogger.setFormatter(logging.Formatter(
514
530
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
515
531
            .format(self.name)))
759
775
 
760
776
        x509_crt_fmt_t = ctypes.c_int
761
777
 
762
 
        # All the function declarations below are from gnutls/abstract.h
 
778
        # All the function declarations below are from
 
779
        # gnutls/abstract.h
763
780
        pubkey_init = _library.gnutls_pubkey_init
764
781
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
765
782
        pubkey_init.restype = _error_code
779
796
        pubkey_deinit.argtypes = [pubkey_t]
780
797
        pubkey_deinit.restype = None
781
798
    else:
782
 
        # All the function declarations below are from gnutls/openpgp.h
 
799
        # All the function declarations below are from
 
800
        # gnutls/openpgp.h
783
801
 
784
802
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
785
803
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
791
809
                                       openpgp_crt_fmt_t]
792
810
        openpgp_crt_import.restype = _error_code
793
811
 
794
 
        openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
795
 
        openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
796
 
                                            ctypes.POINTER(ctypes.c_uint)]
 
812
        openpgp_crt_verify_self = \
 
813
            _library.gnutls_openpgp_crt_verify_self
 
814
        openpgp_crt_verify_self.argtypes = [
 
815
            openpgp_crt_t,
 
816
            ctypes.c_uint,
 
817
            ctypes.POINTER(ctypes.c_uint),
 
818
        ]
797
819
        openpgp_crt_verify_self.restype = _error_code
798
820
 
799
821
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
1037
1059
        if self.checker_initiator_tag is not None:
1038
1060
            GLib.source_remove(self.checker_initiator_tag)
1039
1061
        self.checker_initiator_tag = GLib.timeout_add(
1040
 
            int(self.interval.total_seconds() * 1000),
 
1062
            random.randrange(int(self.interval.total_seconds() * 1000
 
1063
                                 + 1)),
1041
1064
            self.start_checker)
1042
1065
        # Schedule a disable() when 'timeout' has passed
1043
1066
        if self.disable_initiator_tag is not None:
1118
1141
        if self.checker is None:
1119
1142
            # Escape attributes for the shell
1120
1143
            escaped_attrs = {
1121
 
                attr: re.escape(str(getattr(self, attr)))
 
1144
                attr: shlex.quote(str(getattr(self, attr)))
1122
1145
                for attr in self.runtime_expansions}
1123
1146
            try:
1124
1147
                command = self.checker_command % escaped_attrs
1413
1436
                raise ValueError("Byte arrays not supported for non-"
1414
1437
                                 "'ay' signature {!r}"
1415
1438
                                 .format(prop._dbus_signature))
1416
 
            value = dbus.ByteArray(b''.join(chr(byte)
1417
 
                                            for byte in value))
 
1439
            value = dbus.ByteArray(bytes(value))
1418
1440
        prop(value)
1419
1441
 
1420
1442
    @dbus.service.method(dbus.PROPERTIES_IFACE,
2453
2475
        buf = ctypes.create_string_buffer(32)
2454
2476
        buf_len = ctypes.c_size_t(len(buf))
2455
2477
        # Get the key ID from the raw public key into the buffer
2456
 
        gnutls.pubkey_get_key_id(pubkey,
2457
 
                                 gnutls.KEYID_USE_SHA256,
2458
 
                                 ctypes.cast(ctypes.byref(buf),
2459
 
                                             ctypes.POINTER(ctypes.c_ubyte)),
2460
 
                                 ctypes.byref(buf_len))
 
2478
        gnutls.pubkey_get_key_id(
 
2479
            pubkey,
 
2480
            gnutls.KEYID_USE_SHA256,
 
2481
            ctypes.cast(ctypes.byref(buf),
 
2482
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2483
            ctypes.byref(buf_len))
2461
2484
        # Deinit the certificate
2462
2485
        gnutls.pubkey_deinit(pubkey)
2463
2486
 
2708
2731
            address = request[3]
2709
2732
 
2710
2733
            for c in self.clients.values():
2711
 
                if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
 
2734
                if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
 
2735
                              "27AE41E4649B934CA495991B7852B855"):
2712
2736
                    continue
2713
2737
                if key_id and c.key_id == key_id:
2714
2738
                    client = c
2749
2773
        if command == 'getattr':
2750
2774
            attrname = request[1]
2751
2775
            if isinstance(client_object.__getattribute__(attrname),
2752
 
                          collections.Callable):
 
2776
                          collections.abc.Callable):
2753
2777
                parent_pipe.send(('function', ))
2754
2778
            else:
2755
2779
                parent_pipe.send((
2766
2790
def rfc3339_duration_to_delta(duration):
2767
2791
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2768
2792
 
2769
 
    >>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2770
 
    True
2771
 
    >>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2772
 
    True
2773
 
    >>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2774
 
    True
2775
 
    >>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2776
 
    True
2777
 
    >>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2778
 
    True
2779
 
    >>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2780
 
    True
2781
 
    >>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2782
 
    True
 
2793
    >>> timedelta = datetime.timedelta
 
2794
    >>> rfc3339_duration_to_delta("P7D") == timedelta(7)
 
2795
    True
 
2796
    >>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
 
2797
    True
 
2798
    >>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
 
2799
    True
 
2800
    >>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
 
2801
    True
 
2802
    >>> rfc3339_duration_to_delta("P1W") == timedelta(7)
 
2803
    True
 
2804
    >>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
 
2805
    True
 
2806
    >>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
 
2807
    True
 
2808
    >>> del timedelta
2783
2809
    """
2784
2810
 
2785
2811
    # Parsing an RFC 3339 duration with regular expressions is not