/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2022-04-23 20:39:28 UTC
  • Revision ID: teddy@recompile.se-20220423203928-q2ngppp3pt7cfv4x
Makefile: Add comment about phase out of -lpthread

* Makefile (dracut-module/password-agent): Add comment about -lpthread
  being unnecessary in GNU C library 2.34 and later.

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
 
#!/usr/bin/python
2
 
# -*- mode: python; coding: utf-8 -*-
 
1
#!/usr/bin/python3 -bI
 
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
 
# Copyright © 2008-2019 Teddy Hogeborn
15
 
# Copyright © 2008-2019 Björn Påhlsson
 
14
# Copyright © 2008-2020 Teddy Hogeborn
 
15
# Copyright © 2008-2020 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
77
77
import itertools
78
78
import collections
79
79
import codecs
 
80
import unittest
 
81
import random
 
82
import shlex
80
83
 
81
84
import dbus
82
85
import dbus.service
 
86
import gi
83
87
from gi.repository import GLib
84
88
from dbus.mainloop.glib import DBusGMainLoop
85
89
import ctypes
87
91
import xml.dom.minidom
88
92
import inspect
89
93
 
 
94
if sys.version_info.major == 2:
 
95
    __metaclass__ = type
 
96
    str = unicode
 
97
 
 
98
# Add collections.abc.Callable if it does not exist
 
99
try:
 
100
    collections.abc.Callable
 
101
except AttributeError:
 
102
    class abc:
 
103
        Callable = collections.Callable
 
104
    collections.abc = abc
 
105
    del abc
 
106
 
 
107
# Add shlex.quote if it does not exist
 
108
try:
 
109
    shlex.quote
 
110
except AttributeError:
 
111
    shlex.quote = re.escape
 
112
 
 
113
# Show warnings by default
 
114
if not sys.warnoptions:
 
115
    import warnings
 
116
    warnings.simplefilter("default")
 
117
 
90
118
# Try to find the value of SO_BINDTODEVICE:
91
119
try:
92
120
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
112
140
            # No value found
113
141
            SO_BINDTODEVICE = None
114
142
 
115
 
if sys.version_info.major == 2:
116
 
    str = unicode
 
143
if sys.version_info < (3, 2):
 
144
    configparser.Configparser = configparser.SafeConfigParser
117
145
 
118
 
version = "1.8.3"
 
146
version = "1.8.14"
119
147
stored_state_file = "clients.pickle"
120
148
 
121
149
logger = logging.getLogger()
 
150
logging.captureWarnings(True)   # Show warnings via the logging system
122
151
syslogger = None
123
152
 
124
153
try:
179
208
    pass
180
209
 
181
210
 
182
 
class PGPEngine(object):
 
211
class PGPEngine:
183
212
    """A simple class for OpenPGP symmetric encryption & decryption"""
184
213
 
185
214
    def __init__(self):
189
218
            output = subprocess.check_output(["gpgconf"])
190
219
            for line in output.splitlines():
191
220
                name, text, path = line.split(b":")
192
 
                if name == "gpg":
 
221
                if name == b"gpg":
193
222
                    self.gpg = path
194
223
                    break
195
224
        except OSError as e:
200
229
                          '--force-mdc',
201
230
                          '--quiet']
202
231
        # Only GPG version 1 has the --no-use-agent option.
203
 
        if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
 
232
        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
204
233
            self.gnupgargs.append("--no-use-agent")
205
234
 
206
235
    def __enter__(self):
275
304
 
276
305
 
277
306
# Pretend that we have an Avahi module
278
 
class Avahi(object):
279
 
    """This isn't so much a class as it is a module-like namespace.
280
 
    It is instantiated once, and simulates having an Avahi module."""
 
307
class avahi:
 
308
    """This isn't so much a class as it is a module-like namespace."""
281
309
    IF_UNSPEC = -1               # avahi-common/address.h
282
310
    PROTO_UNSPEC = -1            # avahi-common/address.h
283
311
    PROTO_INET = 0               # avahi-common/address.h
287
315
    DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
288
316
    DBUS_PATH_SERVER = "/"
289
317
 
290
 
    def string_array_to_txt_array(self, t):
 
318
    @staticmethod
 
319
    def string_array_to_txt_array(t):
291
320
        return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
321
                           for s in t), signature="ay")
293
322
    ENTRY_GROUP_ESTABLISHED = 2  # avahi-common/defs.h
298
327
    SERVER_RUNNING = 2           # avahi-common/defs.h
299
328
    SERVER_COLLISION = 3         # avahi-common/defs.h
300
329
    SERVER_FAILURE = 4           # avahi-common/defs.h
301
 
avahi = Avahi()
302
330
 
303
331
 
304
332
class AvahiError(Exception):
316
344
    pass
317
345
 
318
346
 
319
 
class AvahiService(object):
 
347
class AvahiService:
320
348
    """An Avahi (Zeroconf) service.
321
349
 
322
350
    Attributes:
496
524
class AvahiServiceToSyslog(AvahiService):
497
525
    def rename(self, *args, **kwargs):
498
526
        """Add the new name to the syslog messages"""
499
 
        ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
 
527
        ret = super(AvahiServiceToSyslog, self).rename(*args,
 
528
                                                       **kwargs)
500
529
        syslogger.setFormatter(logging.Formatter(
501
530
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
502
531
            .format(self.name)))
504
533
 
505
534
 
506
535
# Pretend that we have a GnuTLS module
507
 
class GnuTLS(object):
508
 
    """This isn't so much a class as it is a module-like namespace.
509
 
    It is instantiated once, and simulates having a GnuTLS module."""
 
536
class gnutls:
 
537
    """This isn't so much a class as it is a module-like namespace."""
510
538
 
511
539
    library = ctypes.util.find_library("gnutls")
512
540
    if library is None:
513
541
        library = ctypes.util.find_library("gnutls-deb0")
514
542
    _library = ctypes.cdll.LoadLibrary(library)
515
543
    del library
516
 
    _need_version = b"3.3.0"
517
 
    _tls_rawpk_version = b"3.6.6"
518
 
 
519
 
    def __init__(self):
520
 
        # Need to use "self" here, since this method is called before
521
 
        # the assignment to the "gnutls" global variable happens.
522
 
        if self.check_version(self._need_version) is None:
523
 
            raise self.Error("Needs GnuTLS {} or later"
524
 
                             .format(self._need_version))
525
544
 
526
545
    # Unless otherwise indicated, the constants and types below are
527
546
    # all from the gnutls/gnutls.h C header file.
544
563
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
545
564
 
546
565
    # Types
547
 
    class session_int(ctypes.Structure):
 
566
    class _session_int(ctypes.Structure):
548
567
        _fields_ = []
549
 
    session_t = ctypes.POINTER(session_int)
 
568
    session_t = ctypes.POINTER(_session_int)
550
569
 
551
570
    class certificate_credentials_st(ctypes.Structure):
552
571
        _fields_ = []
558
577
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
559
578
                    ('size', ctypes.c_uint)]
560
579
 
561
 
    class openpgp_crt_int(ctypes.Structure):
 
580
    class _openpgp_crt_int(ctypes.Structure):
562
581
        _fields_ = []
563
 
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
 
582
    openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
564
583
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
565
584
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
566
585
    credentials_type_t = ctypes.c_int
569
588
 
570
589
    # Exceptions
571
590
    class Error(Exception):
572
 
        # We need to use the class name "GnuTLS" here, since this
573
 
        # exception might be raised from within GnuTLS.__init__,
574
 
        # which is called before the assignment to the "gnutls"
575
 
        # global variable has happened.
576
591
        def __init__(self, message=None, code=None, args=()):
577
592
            # Default usage is by a message string, but if a return
578
593
            # code is passed, convert it to a string with
579
594
            # gnutls.strerror()
580
595
            self.code = code
581
596
            if message is None and code is not None:
582
 
                message = GnuTLS.strerror(code)
583
 
            return super(GnuTLS.Error, self).__init__(
 
597
                message = gnutls.strerror(code).decode(
 
598
                    "utf-8", errors="replace")
 
599
            return super(gnutls.Error, self).__init__(
584
600
                message, *args)
585
601
 
586
602
    class CertificateSecurityError(Error):
587
603
        pass
588
604
 
 
605
    class PointerTo:
 
606
        def __init__(self, cls):
 
607
            self.cls = cls
 
608
 
 
609
        def from_param(self, obj):
 
610
            if not isinstance(obj, self.cls):
 
611
                raise TypeError("Not of type {}: {!r}"
 
612
                                .format(self.cls.__name__, obj))
 
613
            return ctypes.byref(obj.from_param(obj))
 
614
 
 
615
    class CastToVoidPointer:
 
616
        def __init__(self, cls):
 
617
            self.cls = cls
 
618
 
 
619
        def from_param(self, obj):
 
620
            if not isinstance(obj, self.cls):
 
621
                raise TypeError("Not of type {}: {!r}"
 
622
                                .format(self.cls.__name__, obj))
 
623
            return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
 
624
 
 
625
    class With_from_param:
 
626
        @classmethod
 
627
        def from_param(cls, obj):
 
628
            return obj._as_parameter_
 
629
 
589
630
    # Classes
590
 
    class Credentials(object):
 
631
    class Credentials(With_from_param):
591
632
        def __init__(self):
592
 
            self._c_object = gnutls.certificate_credentials_t()
593
 
            gnutls.certificate_allocate_credentials(
594
 
                ctypes.byref(self._c_object))
 
633
            self._as_parameter_ = gnutls.certificate_credentials_t()
 
634
            gnutls.certificate_allocate_credentials(self)
595
635
            self.type = gnutls.CRD_CERTIFICATE
596
636
 
597
637
        def __del__(self):
598
 
            gnutls.certificate_free_credentials(self._c_object)
 
638
            gnutls.certificate_free_credentials(self)
599
639
 
600
 
    class ClientSession(object):
 
640
    class ClientSession(With_from_param):
601
641
        def __init__(self, socket, credentials=None):
602
 
            self._c_object = gnutls.session_t()
 
642
            self._as_parameter_ = gnutls.session_t()
603
643
            gnutls_flags = gnutls.CLIENT
604
 
            if gnutls.check_version("3.5.6"):
 
644
            if gnutls.check_version(b"3.5.6"):
605
645
                gnutls_flags |= gnutls.NO_TICKETS
606
646
            if gnutls.has_rawpk:
607
647
                gnutls_flags |= gnutls.ENABLE_RAWPK
608
 
            gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
 
648
            gnutls.init(self, gnutls_flags)
609
649
            del gnutls_flags
610
 
            gnutls.set_default_priority(self._c_object)
611
 
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
612
 
            gnutls.handshake_set_private_extensions(self._c_object,
613
 
                                                    True)
 
650
            gnutls.set_default_priority(self)
 
651
            gnutls.transport_set_ptr(self, socket.fileno())
 
652
            gnutls.handshake_set_private_extensions(self, True)
614
653
            self.socket = socket
615
654
            if credentials is None:
616
655
                credentials = gnutls.Credentials()
617
 
            gnutls.credentials_set(self._c_object, credentials.type,
618
 
                                   ctypes.cast(credentials._c_object,
619
 
                                               ctypes.c_void_p))
 
656
            gnutls.credentials_set(self, credentials.type,
 
657
                                   credentials)
620
658
            self.credentials = credentials
621
659
 
622
660
        def __del__(self):
623
 
            gnutls.deinit(self._c_object)
 
661
            gnutls.deinit(self)
624
662
 
625
663
        def handshake(self):
626
 
            return gnutls.handshake(self._c_object)
 
664
            return gnutls.handshake(self)
627
665
 
628
666
        def send(self, data):
629
667
            data = bytes(data)
630
668
            data_len = len(data)
631
669
            while data_len > 0:
632
 
                data_len -= gnutls.record_send(self._c_object,
633
 
                                               data[-data_len:],
 
670
                data_len -= gnutls.record_send(self, data[-data_len:],
634
671
                                               data_len)
635
672
 
636
673
        def bye(self):
637
 
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
 
674
            return gnutls.bye(self, gnutls.SHUT_RDWR)
638
675
 
639
676
    # Error handling functions
640
677
    def _error_code(result):
641
678
        """A function to raise exceptions on errors, suitable
642
679
        for the 'restype' attribute on ctypes functions"""
643
 
        if result >= 0:
 
680
        if result >= gnutls.E_SUCCESS:
644
681
            return result
645
682
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
646
683
            raise gnutls.CertificateSecurityError(code=result)
647
684
        raise gnutls.Error(code=result)
648
685
 
649
 
    def _retry_on_error(result, func, arguments):
 
686
    def _retry_on_error(result, func, arguments,
 
687
                        _error_code=_error_code):
650
688
        """A function to retry on some errors, suitable
651
689
        for the 'errcheck' attribute on ctypes functions"""
652
 
        while result < 0:
 
690
        while result < gnutls.E_SUCCESS:
653
691
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
654
692
                return _error_code(result)
655
693
            result = func(*arguments)
660
698
 
661
699
    # Functions
662
700
    priority_set_direct = _library.gnutls_priority_set_direct
663
 
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
 
701
    priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
664
702
                                    ctypes.POINTER(ctypes.c_char_p)]
665
703
    priority_set_direct.restype = _error_code
666
704
 
667
705
    init = _library.gnutls_init
668
 
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
 
706
    init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
669
707
    init.restype = _error_code
670
708
 
671
709
    set_default_priority = _library.gnutls_set_default_priority
672
 
    set_default_priority.argtypes = [session_t]
 
710
    set_default_priority.argtypes = [ClientSession]
673
711
    set_default_priority.restype = _error_code
674
712
 
675
713
    record_send = _library.gnutls_record_send
676
 
    record_send.argtypes = [session_t, ctypes.c_void_p,
 
714
    record_send.argtypes = [ClientSession, ctypes.c_void_p,
677
715
                            ctypes.c_size_t]
678
716
    record_send.restype = ctypes.c_ssize_t
679
717
    record_send.errcheck = _retry_on_error
681
719
    certificate_allocate_credentials = (
682
720
        _library.gnutls_certificate_allocate_credentials)
683
721
    certificate_allocate_credentials.argtypes = [
684
 
        ctypes.POINTER(certificate_credentials_t)]
 
722
        PointerTo(Credentials)]
685
723
    certificate_allocate_credentials.restype = _error_code
686
724
 
687
725
    certificate_free_credentials = (
688
726
        _library.gnutls_certificate_free_credentials)
689
 
    certificate_free_credentials.argtypes = [
690
 
        certificate_credentials_t]
 
727
    certificate_free_credentials.argtypes = [Credentials]
691
728
    certificate_free_credentials.restype = None
692
729
 
693
730
    handshake_set_private_extensions = (
694
731
        _library.gnutls_handshake_set_private_extensions)
695
 
    handshake_set_private_extensions.argtypes = [session_t,
 
732
    handshake_set_private_extensions.argtypes = [ClientSession,
696
733
                                                 ctypes.c_int]
697
734
    handshake_set_private_extensions.restype = None
698
735
 
699
736
    credentials_set = _library.gnutls_credentials_set
700
 
    credentials_set.argtypes = [session_t, credentials_type_t,
701
 
                                ctypes.c_void_p]
 
737
    credentials_set.argtypes = [ClientSession, credentials_type_t,
 
738
                                CastToVoidPointer(Credentials)]
702
739
    credentials_set.restype = _error_code
703
740
 
704
741
    strerror = _library.gnutls_strerror
706
743
    strerror.restype = ctypes.c_char_p
707
744
 
708
745
    certificate_type_get = _library.gnutls_certificate_type_get
709
 
    certificate_type_get.argtypes = [session_t]
 
746
    certificate_type_get.argtypes = [ClientSession]
710
747
    certificate_type_get.restype = _error_code
711
748
 
712
749
    certificate_get_peers = _library.gnutls_certificate_get_peers
713
 
    certificate_get_peers.argtypes = [session_t,
 
750
    certificate_get_peers.argtypes = [ClientSession,
714
751
                                      ctypes.POINTER(ctypes.c_uint)]
715
752
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
716
753
 
723
760
    global_set_log_function.restype = None
724
761
 
725
762
    deinit = _library.gnutls_deinit
726
 
    deinit.argtypes = [session_t]
 
763
    deinit.argtypes = [ClientSession]
727
764
    deinit.restype = None
728
765
 
729
766
    handshake = _library.gnutls_handshake
730
 
    handshake.argtypes = [session_t]
731
 
    handshake.restype = _error_code
 
767
    handshake.argtypes = [ClientSession]
 
768
    handshake.restype = ctypes.c_int
732
769
    handshake.errcheck = _retry_on_error
733
770
 
734
771
    transport_set_ptr = _library.gnutls_transport_set_ptr
735
 
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
 
772
    transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
736
773
    transport_set_ptr.restype = None
737
774
 
738
775
    bye = _library.gnutls_bye
739
 
    bye.argtypes = [session_t, close_request_t]
740
 
    bye.restype = _error_code
 
776
    bye.argtypes = [ClientSession, close_request_t]
 
777
    bye.restype = ctypes.c_int
741
778
    bye.errcheck = _retry_on_error
742
779
 
743
780
    check_version = _library.gnutls_check_version
744
781
    check_version.argtypes = [ctypes.c_char_p]
745
782
    check_version.restype = ctypes.c_char_p
746
783
 
 
784
    _need_version = b"3.3.0"
 
785
    if check_version(_need_version) is None:
 
786
        raise self.Error("Needs GnuTLS {} or later"
 
787
                         .format(_need_version))
 
788
 
 
789
    _tls_rawpk_version = b"3.6.6"
747
790
    has_rawpk = bool(check_version(_tls_rawpk_version))
748
791
 
749
792
    if has_rawpk:
754
797
 
755
798
        x509_crt_fmt_t = ctypes.c_int
756
799
 
757
 
        # All the function declarations below are from gnutls/abstract.h
 
800
        # All the function declarations below are from
 
801
        # gnutls/abstract.h
758
802
        pubkey_init = _library.gnutls_pubkey_init
759
803
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
760
804
        pubkey_init.restype = _error_code
774
818
        pubkey_deinit.argtypes = [pubkey_t]
775
819
        pubkey_deinit.restype = None
776
820
    else:
777
 
        # All the function declarations below are from gnutls/openpgp.h
 
821
        # All the function declarations below are from
 
822
        # gnutls/openpgp.h
778
823
 
779
824
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
780
825
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
786
831
                                       openpgp_crt_fmt_t]
787
832
        openpgp_crt_import.restype = _error_code
788
833
 
789
 
        openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
790
 
        openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
791
 
                                            ctypes.POINTER(ctypes.c_uint)]
 
834
        openpgp_crt_verify_self = \
 
835
            _library.gnutls_openpgp_crt_verify_self
 
836
        openpgp_crt_verify_self.argtypes = [
 
837
            openpgp_crt_t,
 
838
            ctypes.c_uint,
 
839
            ctypes.POINTER(ctypes.c_uint),
 
840
        ]
792
841
        openpgp_crt_verify_self.restype = _error_code
793
842
 
794
843
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
803
852
                                                    ctypes.c_size_t)]
804
853
        openpgp_crt_get_fingerprint.restype = _error_code
805
854
 
806
 
    if check_version("3.6.4"):
 
855
    if check_version(b"3.6.4"):
807
856
        certificate_type_get2 = _library.gnutls_certificate_type_get2
808
 
        certificate_type_get2.argtypes = [session_t, ctypes.c_int]
 
857
        certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
809
858
        certificate_type_get2.restype = _error_code
810
859
 
811
860
    # Remove non-public functions
812
861
    del _error_code, _retry_on_error
813
 
# Create the global "gnutls" object, simulating a module
814
 
gnutls = GnuTLS()
815
862
 
816
863
 
817
864
def call_pipe(connection,       # : multiprocessing.Connection
825
872
    connection.close()
826
873
 
827
874
 
828
 
class Client(object):
 
875
class Client:
829
876
    """A representation of a client host served by this server.
830
877
 
831
878
    Attributes:
832
879
    approved:   bool(); 'None' if not yet approved/disapproved
833
880
    approval_delay: datetime.timedelta(); Time to wait for approval
834
881
    approval_duration: datetime.timedelta(); Duration of one approval
835
 
    checker:    subprocess.Popen(); a running checker process used
836
 
                                    to see if the client lives.
837
 
                                    'None' if no process is running.
 
882
    checker: multiprocessing.Process(); a running checker process used
 
883
             to see if the client lives. 'None' if no process is
 
884
             running.
838
885
    checker_callback_tag: a GLib event source tag, or None
839
886
    checker_command: string; External command which is run to check
840
887
                     if client lives.  %() expansions are done at
1034
1081
        if self.checker_initiator_tag is not None:
1035
1082
            GLib.source_remove(self.checker_initiator_tag)
1036
1083
        self.checker_initiator_tag = GLib.timeout_add(
1037
 
            int(self.interval.total_seconds() * 1000),
 
1084
            random.randrange(int(self.interval.total_seconds() * 1000
 
1085
                                 + 1)),
1038
1086
            self.start_checker)
1039
1087
        # Schedule a disable() when 'timeout' has passed
1040
1088
        if self.disable_initiator_tag is not None:
1047
1095
    def checker_callback(self, source, condition, connection,
1048
1096
                         command):
1049
1097
        """The checker has completed, so take appropriate actions."""
1050
 
        self.checker_callback_tag = None
1051
 
        self.checker = None
1052
1098
        # Read return code from connection (see call_pipe)
1053
1099
        returncode = connection.recv()
1054
1100
        connection.close()
 
1101
        if self.checker is not None:
 
1102
            self.checker.join()
 
1103
        self.checker_callback_tag = None
 
1104
        self.checker = None
1055
1105
 
1056
1106
        if returncode >= 0:
1057
1107
            self.last_checker_status = returncode
1113
1163
        if self.checker is None:
1114
1164
            # Escape attributes for the shell
1115
1165
            escaped_attrs = {
1116
 
                attr: re.escape(str(getattr(self, attr)))
 
1166
                attr: shlex.quote(str(getattr(self, attr)))
1117
1167
                for attr in self.runtime_expansions}
1118
1168
            try:
1119
1169
                command = self.checker_command % escaped_attrs
1146
1196
                kwargs=popen_args)
1147
1197
            self.checker.start()
1148
1198
            self.checker_callback_tag = GLib.io_add_watch(
1149
 
                pipe[0].fileno(), GLib.IO_IN,
 
1199
                GLib.IOChannel.unix_new(pipe[0].fileno()),
 
1200
                GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1150
1201
                self.checker_callback, pipe[0], command)
1151
1202
        # Re-run this periodically if run by GLib.timeout_add
1152
1203
        return True
1407
1458
                raise ValueError("Byte arrays not supported for non-"
1408
1459
                                 "'ay' signature {!r}"
1409
1460
                                 .format(prop._dbus_signature))
1410
 
            value = dbus.ByteArray(b''.join(chr(byte)
1411
 
                                            for byte in value))
 
1461
            value = dbus.ByteArray(bytes(value))
1412
1462
        prop(value)
1413
1463
 
1414
1464
    @dbus.service.method(dbus.PROPERTIES_IFACE,
2219
2269
    del _interface
2220
2270
 
2221
2271
 
2222
 
class ProxyClient(object):
 
2272
class ProxyClient:
2223
2273
    def __init__(self, child_pipe, key_id, fpr, address):
2224
2274
        self._pipe = child_pipe
2225
2275
        self._pipe.send(('init', key_id, fpr, address))
2270
2320
            priority = self.server.gnutls_priority
2271
2321
            if priority is None:
2272
2322
                priority = "NORMAL"
2273
 
            gnutls.priority_set_direct(session._c_object,
2274
 
                                       priority.encode("utf-8"),
2275
 
                                       None)
 
2323
            gnutls.priority_set_direct(session,
 
2324
                                       priority.encode("utf-8"), None)
2276
2325
 
2277
2326
            # Start communication using the Mandos protocol
2278
2327
            # Get protocol number
2298
2347
            approval_required = False
2299
2348
            try:
2300
2349
                if gnutls.has_rawpk:
2301
 
                    fpr = ""
 
2350
                    fpr = b""
2302
2351
                    try:
2303
2352
                        key_id = self.key_id(
2304
2353
                            self.peer_certificate(session))
2305
2354
                    except (TypeError, gnutls.Error) as error:
2306
2355
                        logger.warning("Bad certificate: %s", error)
2307
2356
                        return
2308
 
                    logger.debug("Key ID: %s", key_id)
 
2357
                    logger.debug("Key ID: %s",
 
2358
                                 key_id.decode("utf-8",
 
2359
                                               errors="replace"))
2309
2360
 
2310
2361
                else:
2311
 
                    key_id = ""
 
2362
                    key_id = b""
2312
2363
                    try:
2313
2364
                        fpr = self.fingerprint(
2314
2365
                            self.peer_certificate(session))
2403
2454
    def peer_certificate(session):
2404
2455
        "Return the peer's certificate as a bytestring"
2405
2456
        try:
2406
 
            cert_type = gnutls.certificate_type_get2(session._c_object,
2407
 
                                                     gnutls.CTYPE_PEERS)
 
2457
            cert_type = gnutls.certificate_type_get2(
 
2458
                session, gnutls.CTYPE_PEERS)
2408
2459
        except AttributeError:
2409
 
            cert_type = gnutls.certificate_type_get(session._c_object)
 
2460
            cert_type = gnutls.certificate_type_get(session)
2410
2461
        if gnutls.has_rawpk:
2411
2462
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2412
2463
        else:
2419
2470
            return b""
2420
2471
        list_size = ctypes.c_uint(1)
2421
2472
        cert_list = (gnutls.certificate_get_peers
2422
 
                     (session._c_object, ctypes.byref(list_size)))
 
2473
                     (session, ctypes.byref(list_size)))
2423
2474
        if not bool(cert_list) and list_size.value != 0:
2424
2475
            raise gnutls.Error("error getting peer certificate")
2425
2476
        if list_size.value == 0:
2447
2498
        buf = ctypes.create_string_buffer(32)
2448
2499
        buf_len = ctypes.c_size_t(len(buf))
2449
2500
        # Get the key ID from the raw public key into the buffer
2450
 
        gnutls.pubkey_get_key_id(pubkey,
2451
 
                                 gnutls.KEYID_USE_SHA256,
2452
 
                                 ctypes.cast(ctypes.byref(buf),
2453
 
                                             ctypes.POINTER(ctypes.c_ubyte)),
2454
 
                                 ctypes.byref(buf_len))
 
2501
        gnutls.pubkey_get_key_id(
 
2502
            pubkey,
 
2503
            gnutls.KEYID_USE_SHA256,
 
2504
            ctypes.cast(ctypes.byref(buf),
 
2505
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2506
            ctypes.byref(buf_len))
2455
2507
        # Deinit the certificate
2456
2508
        gnutls.pubkey_deinit(pubkey)
2457
2509
 
2498
2550
        return hex_fpr
2499
2551
 
2500
2552
 
2501
 
class MultiprocessingMixIn(object):
 
2553
class MultiprocessingMixIn:
2502
2554
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
2503
2555
 
2504
2556
    def sub_process_main(self, request, address):
2516
2568
        return proc
2517
2569
 
2518
2570
 
2519
 
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
2571
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2520
2572
    """ adds a pipe to the MixIn """
2521
2573
 
2522
2574
    def process_request(self, request, client_address):
2537
2589
 
2538
2590
 
2539
2591
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2540
 
                     socketserver.TCPServer, object):
 
2592
                     socketserver.TCPServer):
2541
2593
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
2542
2594
 
2543
2595
    Attributes:
2616
2668
                    raise
2617
2669
        # Only bind(2) the socket if we really need to.
2618
2670
        if self.server_address[0] or self.server_address[1]:
 
2671
            if self.server_address[1]:
 
2672
                self.allow_reuse_address = True
2619
2673
            if not self.server_address[0]:
2620
2674
                if self.address_family == socket.AF_INET6:
2621
2675
                    any_address = "::"  # in6addr_any
2674
2728
    def add_pipe(self, parent_pipe, proc):
2675
2729
        # Call "handle_ipc" for both data and EOF events
2676
2730
        GLib.io_add_watch(
2677
 
            parent_pipe.fileno(),
2678
 
            GLib.IO_IN | GLib.IO_HUP,
 
2731
            GLib.IOChannel.unix_new(parent_pipe.fileno()),
 
2732
            GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2679
2733
            functools.partial(self.handle_ipc,
2680
2734
                              parent_pipe=parent_pipe,
2681
2735
                              proc=proc))
2700
2754
            address = request[3]
2701
2755
 
2702
2756
            for c in self.clients.values():
2703
 
                if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
 
2757
                if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
 
2758
                              "27AE41E4649B934CA495991B7852B855"):
2704
2759
                    continue
2705
2760
                if key_id and c.key_id == key_id:
2706
2761
                    client = c
2719
2774
                return False
2720
2775
 
2721
2776
            GLib.io_add_watch(
2722
 
                parent_pipe.fileno(),
2723
 
                GLib.IO_IN | GLib.IO_HUP,
 
2777
                GLib.IOChannel.unix_new(parent_pipe.fileno()),
 
2778
                GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2724
2779
                functools.partial(self.handle_ipc,
2725
2780
                                  parent_pipe=parent_pipe,
2726
2781
                                  proc=proc,
2741
2796
        if command == 'getattr':
2742
2797
            attrname = request[1]
2743
2798
            if isinstance(client_object.__getattribute__(attrname),
2744
 
                          collections.Callable):
 
2799
                          collections.abc.Callable):
2745
2800
                parent_pipe.send(('function', ))
2746
2801
            else:
2747
2802
                parent_pipe.send((
2758
2813
def rfc3339_duration_to_delta(duration):
2759
2814
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2760
2815
 
2761
 
    >>> rfc3339_duration_to_delta("P7D")
2762
 
    datetime.timedelta(7)
2763
 
    >>> rfc3339_duration_to_delta("PT60S")
2764
 
    datetime.timedelta(0, 60)
2765
 
    >>> rfc3339_duration_to_delta("PT60M")
2766
 
    datetime.timedelta(0, 3600)
2767
 
    >>> rfc3339_duration_to_delta("PT24H")
2768
 
    datetime.timedelta(1)
2769
 
    >>> rfc3339_duration_to_delta("P1W")
2770
 
    datetime.timedelta(7)
2771
 
    >>> rfc3339_duration_to_delta("PT5M30S")
2772
 
    datetime.timedelta(0, 330)
2773
 
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2774
 
    datetime.timedelta(1, 200)
 
2816
    >>> timedelta = datetime.timedelta
 
2817
    >>> rfc3339_duration_to_delta("P7D") == timedelta(7)
 
2818
    True
 
2819
    >>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
 
2820
    True
 
2821
    >>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
 
2822
    True
 
2823
    >>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
 
2824
    True
 
2825
    >>> rfc3339_duration_to_delta("P1W") == timedelta(7)
 
2826
    True
 
2827
    >>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
 
2828
    True
 
2829
    >>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
 
2830
    True
 
2831
    >>> del timedelta
2775
2832
    """
2776
2833
 
2777
2834
    # Parsing an RFC 3339 duration with regular expressions is not
2857
2914
def string_to_delta(interval):
2858
2915
    """Parse a string and return a datetime.timedelta
2859
2916
 
2860
 
    >>> string_to_delta('7d')
2861
 
    datetime.timedelta(7)
2862
 
    >>> string_to_delta('60s')
2863
 
    datetime.timedelta(0, 60)
2864
 
    >>> string_to_delta('60m')
2865
 
    datetime.timedelta(0, 3600)
2866
 
    >>> string_to_delta('24h')
2867
 
    datetime.timedelta(1)
2868
 
    >>> string_to_delta('1w')
2869
 
    datetime.timedelta(7)
2870
 
    >>> string_to_delta('5m 30s')
2871
 
    datetime.timedelta(0, 330)
 
2917
    >>> string_to_delta('7d') == datetime.timedelta(7)
 
2918
    True
 
2919
    >>> string_to_delta('60s') == datetime.timedelta(0, 60)
 
2920
    True
 
2921
    >>> string_to_delta('60m') == datetime.timedelta(0, 3600)
 
2922
    True
 
2923
    >>> string_to_delta('24h') == datetime.timedelta(1)
 
2924
    True
 
2925
    >>> string_to_delta('1w') == datetime.timedelta(7)
 
2926
    True
 
2927
    >>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
 
2928
    True
2872
2929
    """
2873
2930
 
2874
2931
    try:
2976
3033
 
2977
3034
    options = parser.parse_args()
2978
3035
 
2979
 
    if options.check:
2980
 
        import doctest
2981
 
        fail_count, test_count = doctest.testmod()
2982
 
        sys.exit(os.EX_OK if fail_count == 0 else 1)
2983
 
 
2984
3036
    # Default values for config file for server-global settings
2985
3037
    if gnutls.has_rawpk:
2986
3038
        priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
3006
3058
    del priority
3007
3059
 
3008
3060
    # Parse config file for server-global settings
3009
 
    server_config = configparser.SafeConfigParser(server_defaults)
 
3061
    server_config = configparser.ConfigParser(server_defaults)
3010
3062
    del server_defaults
3011
3063
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
3012
 
    # Convert the SafeConfigParser object to a dict
 
3064
    # Convert the ConfigParser object to a dict
3013
3065
    server_settings = server_config.defaults()
3014
3066
    # Use the appropriate methods on the non-string config options
3015
3067
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
3087
3139
                                  server_settings["servicename"])))
3088
3140
 
3089
3141
    # Parse config file with clients
3090
 
    client_config = configparser.SafeConfigParser(Client
3091
 
                                                  .client_defaults)
 
3142
    client_config = configparser.ConfigParser(Client.client_defaults)
3092
3143
    client_config.read(os.path.join(server_settings["configdir"],
3093
3144
                                    "clients.conf"))
3094
3145
 
3150
3201
 
3151
3202
        @gnutls.log_func
3152
3203
        def debug_gnutls(level, string):
3153
 
            logger.debug("GnuTLS: %s", string[:-1])
 
3204
            logger.debug("GnuTLS: %s",
 
3205
                         string[:-1].decode("utf-8",
 
3206
                                            errors="replace"))
3154
3207
 
3155
3208
        gnutls.global_set_log_function(debug_gnutls)
3156
3209
 
3165
3218
        # Close all input and output, do double fork, etc.
3166
3219
        daemon()
3167
3220
 
3168
 
    # multiprocessing will use threads, so before we use GLib we need
3169
 
    # to inform GLib that threads will be used.
3170
 
    GLib.threads_init()
 
3221
    if gi.version_info < (3, 10, 2):
 
3222
        # multiprocessing will use threads, so before we use GLib we
 
3223
        # need to inform GLib that threads will be used.
 
3224
        GLib.threads_init()
3171
3225
 
3172
3226
    global main_loop
3173
3227
    # From the Avahi example code
3249
3303
                             if isinstance(s, bytes)
3250
3304
                             else s) for s in
3251
3305
                            value["client_structure"]]
3252
 
                        # .name & .host
3253
 
                        for k in ("name", "host"):
 
3306
                        # .name, .host, and .checker_command
 
3307
                        for k in ("name", "host", "checker_command"):
3254
3308
                            if isinstance(value[k], bytes):
3255
3309
                                value[k] = value[k].decode("utf-8")
3256
 
                        if not value.has_key("key_id"):
 
3310
                        if "key_id" not in value:
3257
3311
                            value["key_id"] = ""
3258
 
                        elif not value.has_key("fingerprint"):
 
3312
                        elif "fingerprint" not in value:
3259
3313
                            value["fingerprint"] = ""
3260
3314
                    #  old_client_settings
3261
3315
                    # .keys()
3266
3320
                        for key, value in
3267
3321
                        bytes_old_client_settings.items()}
3268
3322
                    del bytes_old_client_settings
3269
 
                    # .host
 
3323
                    # .host and .checker_command
3270
3324
                    for value in old_client_settings.values():
3271
 
                        if isinstance(value["host"], bytes):
3272
 
                            value["host"] = (value["host"]
3273
 
                                             .decode("utf-8"))
 
3325
                        for attribute in ("host", "checker_command"):
 
3326
                            if isinstance(value[attribute], bytes):
 
3327
                                value[attribute] = (value[attribute]
 
3328
                                                    .decode("utf-8"))
3274
3329
            os.remove(stored_state_path)
3275
3330
        except IOError as e:
3276
3331
            if e.errno == errno.ENOENT:
3601
3656
                sys.exit(1)
3602
3657
            # End of Avahi example code
3603
3658
 
3604
 
        GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3605
 
                          lambda *args, **kwargs:
3606
 
                          (tcp_server.handle_request
3607
 
                           (*args[2:], **kwargs) or True))
 
3659
        GLib.io_add_watch(
 
3660
            GLib.IOChannel.unix_new(tcp_server.fileno()),
 
3661
            GLib.PRIORITY_DEFAULT, GLib.IO_IN,
 
3662
            lambda *args, **kwargs: (tcp_server.handle_request
 
3663
                                     (*args[2:], **kwargs) or True))
3608
3664
 
3609
3665
        logger.debug("Starting main loop")
3610
3666
        main_loop.run()
3620
3676
    # Must run before the D-Bus bus name gets deregistered
3621
3677
    cleanup()
3622
3678
 
 
3679
 
 
3680
def should_only_run_tests():
 
3681
    parser = argparse.ArgumentParser(add_help=False)
 
3682
    parser.add_argument("--check", action='store_true')
 
3683
    args, unknown_args = parser.parse_known_args()
 
3684
    run_tests = args.check
 
3685
    if run_tests:
 
3686
        # Remove --check argument from sys.argv
 
3687
        sys.argv[1:] = unknown_args
 
3688
    return run_tests
 
3689
 
 
3690
# Add all tests from doctest strings
 
3691
def load_tests(loader, tests, none):
 
3692
    import doctest
 
3693
    tests.addTests(doctest.DocTestSuite())
 
3694
    return tests
3623
3695
 
3624
3696
if __name__ == '__main__':
3625
 
    main()
 
3697
    try:
 
3698
        if should_only_run_tests():
 
3699
            # Call using ./mandos --check [--verbose]
 
3700
            unittest.main()
 
3701
        else:
 
3702
            main()
 
3703
    finally:
 
3704
        logging.shutdown()