/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2022-04-23 21:14:38 UTC
  • Revision ID: teddy@recompile.se-20220423211438-qadwdpyodk1zfra5
Debian package: Client: Update Lintian override file

* debian/mandos-client.lintian-overrides: Remove all empty commented
  lines.  Re-word text to avoid negation.  Rename "setuid-binary" tag
  to "elevated-privileges".

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
 
#!/usr/bin/python
2
 
# -*- mode: python; coding: utf-8 -*-
 
1
#!/usr/bin/python3 -bI
 
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
 
# Copyright © 2008-2019 Teddy Hogeborn
15
 
# Copyright © 2008-2019 Björn Påhlsson
 
14
# Copyright © 2008-2020 Teddy Hogeborn
 
15
# Copyright © 2008-2020 Björn Påhlsson
16
16
#
17
17
# This file is part of Mandos.
18
18
#
77
77
import itertools
78
78
import collections
79
79
import codecs
 
80
import unittest
 
81
import random
 
82
import shlex
80
83
 
81
84
import dbus
82
85
import dbus.service
 
86
import gi
83
87
from gi.repository import GLib
84
88
from dbus.mainloop.glib import DBusGMainLoop
85
89
import ctypes
87
91
import xml.dom.minidom
88
92
import inspect
89
93
 
 
94
if sys.version_info.major == 2:
 
95
    __metaclass__ = type
 
96
    str = unicode
 
97
 
 
98
# Add collections.abc.Callable if it does not exist
 
99
try:
 
100
    collections.abc.Callable
 
101
except AttributeError:
 
102
    class abc:
 
103
        Callable = collections.Callable
 
104
    collections.abc = abc
 
105
    del abc
 
106
 
 
107
# Add shlex.quote if it does not exist
 
108
try:
 
109
    shlex.quote
 
110
except AttributeError:
 
111
    shlex.quote = re.escape
 
112
 
 
113
# Show warnings by default
 
114
if not sys.warnoptions:
 
115
    import warnings
 
116
    warnings.simplefilter("default")
 
117
 
90
118
# Try to find the value of SO_BINDTODEVICE:
91
119
try:
92
120
    # This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
112
140
            # No value found
113
141
            SO_BINDTODEVICE = None
114
142
 
115
 
if sys.version_info.major == 2:
116
 
    str = unicode
 
143
if sys.version_info < (3, 2):
 
144
    configparser.Configparser = configparser.SafeConfigParser
117
145
 
118
 
version = "1.8.4"
 
146
version = "1.8.14"
119
147
stored_state_file = "clients.pickle"
120
148
 
121
149
logger = logging.getLogger()
 
150
logging.captureWarnings(True)   # Show warnings via the logging system
122
151
syslogger = None
123
152
 
124
153
try:
179
208
    pass
180
209
 
181
210
 
182
 
class PGPEngine(object):
 
211
class PGPEngine:
183
212
    """A simple class for OpenPGP symmetric encryption & decryption"""
184
213
 
185
214
    def __init__(self):
189
218
            output = subprocess.check_output(["gpgconf"])
190
219
            for line in output.splitlines():
191
220
                name, text, path = line.split(b":")
192
 
                if name == "gpg":
 
221
                if name == b"gpg":
193
222
                    self.gpg = path
194
223
                    break
195
224
        except OSError as e:
200
229
                          '--force-mdc',
201
230
                          '--quiet']
202
231
        # Only GPG version 1 has the --no-use-agent option.
203
 
        if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
 
232
        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
204
233
            self.gnupgargs.append("--no-use-agent")
205
234
 
206
235
    def __enter__(self):
275
304
 
276
305
 
277
306
# Pretend that we have an Avahi module
278
 
class avahi(object):
 
307
class avahi:
279
308
    """This isn't so much a class as it is a module-like namespace."""
280
309
    IF_UNSPEC = -1               # avahi-common/address.h
281
310
    PROTO_UNSPEC = -1            # avahi-common/address.h
315
344
    pass
316
345
 
317
346
 
318
 
class AvahiService(object):
 
347
class AvahiService:
319
348
    """An Avahi (Zeroconf) service.
320
349
 
321
350
    Attributes:
495
524
class AvahiServiceToSyslog(AvahiService):
496
525
    def rename(self, *args, **kwargs):
497
526
        """Add the new name to the syslog messages"""
498
 
        ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
 
527
        ret = super(AvahiServiceToSyslog, self).rename(*args,
 
528
                                                       **kwargs)
499
529
        syslogger.setFormatter(logging.Formatter(
500
530
            'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
501
531
            .format(self.name)))
503
533
 
504
534
 
505
535
# Pretend that we have a GnuTLS module
506
 
class gnutls(object):
 
536
class gnutls:
507
537
    """This isn't so much a class as it is a module-like namespace."""
508
538
 
509
539
    library = ctypes.util.find_library("gnutls")
533
563
    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h
534
564
 
535
565
    # Types
536
 
    class session_int(ctypes.Structure):
 
566
    class _session_int(ctypes.Structure):
537
567
        _fields_ = []
538
 
    session_t = ctypes.POINTER(session_int)
 
568
    session_t = ctypes.POINTER(_session_int)
539
569
 
540
570
    class certificate_credentials_st(ctypes.Structure):
541
571
        _fields_ = []
547
577
        _fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
548
578
                    ('size', ctypes.c_uint)]
549
579
 
550
 
    class openpgp_crt_int(ctypes.Structure):
 
580
    class _openpgp_crt_int(ctypes.Structure):
551
581
        _fields_ = []
552
 
    openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
 
582
    openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
553
583
    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h
554
584
    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
555
585
    credentials_type_t = ctypes.c_int
564
594
            # gnutls.strerror()
565
595
            self.code = code
566
596
            if message is None and code is not None:
567
 
                message = gnutls.strerror(code)
 
597
                message = gnutls.strerror(code).decode(
 
598
                    "utf-8", errors="replace")
568
599
            return super(gnutls.Error, self).__init__(
569
600
                message, *args)
570
601
 
571
602
    class CertificateSecurityError(Error):
572
603
        pass
573
604
 
 
605
    class PointerTo:
 
606
        def __init__(self, cls):
 
607
            self.cls = cls
 
608
 
 
609
        def from_param(self, obj):
 
610
            if not isinstance(obj, self.cls):
 
611
                raise TypeError("Not of type {}: {!r}"
 
612
                                .format(self.cls.__name__, obj))
 
613
            return ctypes.byref(obj.from_param(obj))
 
614
 
 
615
    class CastToVoidPointer:
 
616
        def __init__(self, cls):
 
617
            self.cls = cls
 
618
 
 
619
        def from_param(self, obj):
 
620
            if not isinstance(obj, self.cls):
 
621
                raise TypeError("Not of type {}: {!r}"
 
622
                                .format(self.cls.__name__, obj))
 
623
            return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
 
624
 
 
625
    class With_from_param:
 
626
        @classmethod
 
627
        def from_param(cls, obj):
 
628
            return obj._as_parameter_
 
629
 
574
630
    # Classes
575
 
    class Credentials(object):
 
631
    class Credentials(With_from_param):
576
632
        def __init__(self):
577
 
            self._c_object = gnutls.certificate_credentials_t()
578
 
            gnutls.certificate_allocate_credentials(
579
 
                ctypes.byref(self._c_object))
 
633
            self._as_parameter_ = gnutls.certificate_credentials_t()
 
634
            gnutls.certificate_allocate_credentials(self)
580
635
            self.type = gnutls.CRD_CERTIFICATE
581
636
 
582
637
        def __del__(self):
583
 
            gnutls.certificate_free_credentials(self._c_object)
 
638
            gnutls.certificate_free_credentials(self)
584
639
 
585
 
    class ClientSession(object):
 
640
    class ClientSession(With_from_param):
586
641
        def __init__(self, socket, credentials=None):
587
 
            self._c_object = gnutls.session_t()
 
642
            self._as_parameter_ = gnutls.session_t()
588
643
            gnutls_flags = gnutls.CLIENT
589
644
            if gnutls.check_version(b"3.5.6"):
590
645
                gnutls_flags |= gnutls.NO_TICKETS
591
646
            if gnutls.has_rawpk:
592
647
                gnutls_flags |= gnutls.ENABLE_RAWPK
593
 
            gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
 
648
            gnutls.init(self, gnutls_flags)
594
649
            del gnutls_flags
595
 
            gnutls.set_default_priority(self._c_object)
596
 
            gnutls.transport_set_ptr(self._c_object, socket.fileno())
597
 
            gnutls.handshake_set_private_extensions(self._c_object,
598
 
                                                    True)
 
650
            gnutls.set_default_priority(self)
 
651
            gnutls.transport_set_ptr(self, socket.fileno())
 
652
            gnutls.handshake_set_private_extensions(self, True)
599
653
            self.socket = socket
600
654
            if credentials is None:
601
655
                credentials = gnutls.Credentials()
602
 
            gnutls.credentials_set(self._c_object, credentials.type,
603
 
                                   ctypes.cast(credentials._c_object,
604
 
                                               ctypes.c_void_p))
 
656
            gnutls.credentials_set(self, credentials.type,
 
657
                                   credentials)
605
658
            self.credentials = credentials
606
659
 
607
660
        def __del__(self):
608
 
            gnutls.deinit(self._c_object)
 
661
            gnutls.deinit(self)
609
662
 
610
663
        def handshake(self):
611
 
            return gnutls.handshake(self._c_object)
 
664
            return gnutls.handshake(self)
612
665
 
613
666
        def send(self, data):
614
667
            data = bytes(data)
615
668
            data_len = len(data)
616
669
            while data_len > 0:
617
 
                data_len -= gnutls.record_send(self._c_object,
618
 
                                               data[-data_len:],
 
670
                data_len -= gnutls.record_send(self, data[-data_len:],
619
671
                                               data_len)
620
672
 
621
673
        def bye(self):
622
 
            return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
 
674
            return gnutls.bye(self, gnutls.SHUT_RDWR)
623
675
 
624
676
    # Error handling functions
625
677
    def _error_code(result):
626
678
        """A function to raise exceptions on errors, suitable
627
679
        for the 'restype' attribute on ctypes functions"""
628
 
        if result >= 0:
 
680
        if result >= gnutls.E_SUCCESS:
629
681
            return result
630
682
        if result == gnutls.E_NO_CERTIFICATE_FOUND:
631
683
            raise gnutls.CertificateSecurityError(code=result)
632
684
        raise gnutls.Error(code=result)
633
685
 
634
 
    def _retry_on_error(result, func, arguments):
 
686
    def _retry_on_error(result, func, arguments,
 
687
                        _error_code=_error_code):
635
688
        """A function to retry on some errors, suitable
636
689
        for the 'errcheck' attribute on ctypes functions"""
637
 
        while result < 0:
 
690
        while result < gnutls.E_SUCCESS:
638
691
            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
639
692
                return _error_code(result)
640
693
            result = func(*arguments)
645
698
 
646
699
    # Functions
647
700
    priority_set_direct = _library.gnutls_priority_set_direct
648
 
    priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
 
701
    priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
649
702
                                    ctypes.POINTER(ctypes.c_char_p)]
650
703
    priority_set_direct.restype = _error_code
651
704
 
652
705
    init = _library.gnutls_init
653
 
    init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
 
706
    init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
654
707
    init.restype = _error_code
655
708
 
656
709
    set_default_priority = _library.gnutls_set_default_priority
657
 
    set_default_priority.argtypes = [session_t]
 
710
    set_default_priority.argtypes = [ClientSession]
658
711
    set_default_priority.restype = _error_code
659
712
 
660
713
    record_send = _library.gnutls_record_send
661
 
    record_send.argtypes = [session_t, ctypes.c_void_p,
 
714
    record_send.argtypes = [ClientSession, ctypes.c_void_p,
662
715
                            ctypes.c_size_t]
663
716
    record_send.restype = ctypes.c_ssize_t
664
717
    record_send.errcheck = _retry_on_error
666
719
    certificate_allocate_credentials = (
667
720
        _library.gnutls_certificate_allocate_credentials)
668
721
    certificate_allocate_credentials.argtypes = [
669
 
        ctypes.POINTER(certificate_credentials_t)]
 
722
        PointerTo(Credentials)]
670
723
    certificate_allocate_credentials.restype = _error_code
671
724
 
672
725
    certificate_free_credentials = (
673
726
        _library.gnutls_certificate_free_credentials)
674
 
    certificate_free_credentials.argtypes = [
675
 
        certificate_credentials_t]
 
727
    certificate_free_credentials.argtypes = [Credentials]
676
728
    certificate_free_credentials.restype = None
677
729
 
678
730
    handshake_set_private_extensions = (
679
731
        _library.gnutls_handshake_set_private_extensions)
680
 
    handshake_set_private_extensions.argtypes = [session_t,
 
732
    handshake_set_private_extensions.argtypes = [ClientSession,
681
733
                                                 ctypes.c_int]
682
734
    handshake_set_private_extensions.restype = None
683
735
 
684
736
    credentials_set = _library.gnutls_credentials_set
685
 
    credentials_set.argtypes = [session_t, credentials_type_t,
686
 
                                ctypes.c_void_p]
 
737
    credentials_set.argtypes = [ClientSession, credentials_type_t,
 
738
                                CastToVoidPointer(Credentials)]
687
739
    credentials_set.restype = _error_code
688
740
 
689
741
    strerror = _library.gnutls_strerror
691
743
    strerror.restype = ctypes.c_char_p
692
744
 
693
745
    certificate_type_get = _library.gnutls_certificate_type_get
694
 
    certificate_type_get.argtypes = [session_t]
 
746
    certificate_type_get.argtypes = [ClientSession]
695
747
    certificate_type_get.restype = _error_code
696
748
 
697
749
    certificate_get_peers = _library.gnutls_certificate_get_peers
698
 
    certificate_get_peers.argtypes = [session_t,
 
750
    certificate_get_peers.argtypes = [ClientSession,
699
751
                                      ctypes.POINTER(ctypes.c_uint)]
700
752
    certificate_get_peers.restype = ctypes.POINTER(datum_t)
701
753
 
708
760
    global_set_log_function.restype = None
709
761
 
710
762
    deinit = _library.gnutls_deinit
711
 
    deinit.argtypes = [session_t]
 
763
    deinit.argtypes = [ClientSession]
712
764
    deinit.restype = None
713
765
 
714
766
    handshake = _library.gnutls_handshake
715
 
    handshake.argtypes = [session_t]
716
 
    handshake.restype = _error_code
 
767
    handshake.argtypes = [ClientSession]
 
768
    handshake.restype = ctypes.c_int
717
769
    handshake.errcheck = _retry_on_error
718
770
 
719
771
    transport_set_ptr = _library.gnutls_transport_set_ptr
720
 
    transport_set_ptr.argtypes = [session_t, transport_ptr_t]
 
772
    transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
721
773
    transport_set_ptr.restype = None
722
774
 
723
775
    bye = _library.gnutls_bye
724
 
    bye.argtypes = [session_t, close_request_t]
725
 
    bye.restype = _error_code
 
776
    bye.argtypes = [ClientSession, close_request_t]
 
777
    bye.restype = ctypes.c_int
726
778
    bye.errcheck = _retry_on_error
727
779
 
728
780
    check_version = _library.gnutls_check_version
745
797
 
746
798
        x509_crt_fmt_t = ctypes.c_int
747
799
 
748
 
        # All the function declarations below are from gnutls/abstract.h
 
800
        # All the function declarations below are from
 
801
        # gnutls/abstract.h
749
802
        pubkey_init = _library.gnutls_pubkey_init
750
803
        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
751
804
        pubkey_init.restype = _error_code
765
818
        pubkey_deinit.argtypes = [pubkey_t]
766
819
        pubkey_deinit.restype = None
767
820
    else:
768
 
        # All the function declarations below are from gnutls/openpgp.h
 
821
        # All the function declarations below are from
 
822
        # gnutls/openpgp.h
769
823
 
770
824
        openpgp_crt_init = _library.gnutls_openpgp_crt_init
771
825
        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
777
831
                                       openpgp_crt_fmt_t]
778
832
        openpgp_crt_import.restype = _error_code
779
833
 
780
 
        openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
781
 
        openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
782
 
                                            ctypes.POINTER(ctypes.c_uint)]
 
834
        openpgp_crt_verify_self = \
 
835
            _library.gnutls_openpgp_crt_verify_self
 
836
        openpgp_crt_verify_self.argtypes = [
 
837
            openpgp_crt_t,
 
838
            ctypes.c_uint,
 
839
            ctypes.POINTER(ctypes.c_uint),
 
840
        ]
783
841
        openpgp_crt_verify_self.restype = _error_code
784
842
 
785
843
        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
796
854
 
797
855
    if check_version(b"3.6.4"):
798
856
        certificate_type_get2 = _library.gnutls_certificate_type_get2
799
 
        certificate_type_get2.argtypes = [session_t, ctypes.c_int]
 
857
        certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
800
858
        certificate_type_get2.restype = _error_code
801
859
 
802
860
    # Remove non-public functions
814
872
    connection.close()
815
873
 
816
874
 
817
 
class Client(object):
 
875
class Client:
818
876
    """A representation of a client host served by this server.
819
877
 
820
878
    Attributes:
821
879
    approved:   bool(); 'None' if not yet approved/disapproved
822
880
    approval_delay: datetime.timedelta(); Time to wait for approval
823
881
    approval_duration: datetime.timedelta(); Duration of one approval
824
 
    checker:    subprocess.Popen(); a running checker process used
825
 
                                    to see if the client lives.
826
 
                                    'None' if no process is running.
 
882
    checker: multiprocessing.Process(); a running checker process used
 
883
             to see if the client lives. 'None' if no process is
 
884
             running.
827
885
    checker_callback_tag: a GLib event source tag, or None
828
886
    checker_command: string; External command which is run to check
829
887
                     if client lives.  %() expansions are done at
1023
1081
        if self.checker_initiator_tag is not None:
1024
1082
            GLib.source_remove(self.checker_initiator_tag)
1025
1083
        self.checker_initiator_tag = GLib.timeout_add(
1026
 
            int(self.interval.total_seconds() * 1000),
 
1084
            random.randrange(int(self.interval.total_seconds() * 1000
 
1085
                                 + 1)),
1027
1086
            self.start_checker)
1028
1087
        # Schedule a disable() when 'timeout' has passed
1029
1088
        if self.disable_initiator_tag is not None:
1036
1095
    def checker_callback(self, source, condition, connection,
1037
1096
                         command):
1038
1097
        """The checker has completed, so take appropriate actions."""
1039
 
        self.checker_callback_tag = None
1040
 
        self.checker = None
1041
1098
        # Read return code from connection (see call_pipe)
1042
1099
        returncode = connection.recv()
1043
1100
        connection.close()
 
1101
        if self.checker is not None:
 
1102
            self.checker.join()
 
1103
        self.checker_callback_tag = None
 
1104
        self.checker = None
1044
1105
 
1045
1106
        if returncode >= 0:
1046
1107
            self.last_checker_status = returncode
1102
1163
        if self.checker is None:
1103
1164
            # Escape attributes for the shell
1104
1165
            escaped_attrs = {
1105
 
                attr: re.escape(str(getattr(self, attr)))
 
1166
                attr: shlex.quote(str(getattr(self, attr)))
1106
1167
                for attr in self.runtime_expansions}
1107
1168
            try:
1108
1169
                command = self.checker_command % escaped_attrs
1135
1196
                kwargs=popen_args)
1136
1197
            self.checker.start()
1137
1198
            self.checker_callback_tag = GLib.io_add_watch(
1138
 
                pipe[0].fileno(), GLib.IO_IN,
 
1199
                GLib.IOChannel.unix_new(pipe[0].fileno()),
 
1200
                GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1139
1201
                self.checker_callback, pipe[0], command)
1140
1202
        # Re-run this periodically if run by GLib.timeout_add
1141
1203
        return True
1396
1458
                raise ValueError("Byte arrays not supported for non-"
1397
1459
                                 "'ay' signature {!r}"
1398
1460
                                 .format(prop._dbus_signature))
1399
 
            value = dbus.ByteArray(b''.join(chr(byte)
1400
 
                                            for byte in value))
 
1461
            value = dbus.ByteArray(bytes(value))
1401
1462
        prop(value)
1402
1463
 
1403
1464
    @dbus.service.method(dbus.PROPERTIES_IFACE,
2208
2269
    del _interface
2209
2270
 
2210
2271
 
2211
 
class ProxyClient(object):
 
2272
class ProxyClient:
2212
2273
    def __init__(self, child_pipe, key_id, fpr, address):
2213
2274
        self._pipe = child_pipe
2214
2275
        self._pipe.send(('init', key_id, fpr, address))
2259
2320
            priority = self.server.gnutls_priority
2260
2321
            if priority is None:
2261
2322
                priority = "NORMAL"
2262
 
            gnutls.priority_set_direct(session._c_object,
2263
 
                                       priority.encode("utf-8"),
2264
 
                                       None)
 
2323
            gnutls.priority_set_direct(session,
 
2324
                                       priority.encode("utf-8"), None)
2265
2325
 
2266
2326
            # Start communication using the Mandos protocol
2267
2327
            # Get protocol number
2294
2354
                    except (TypeError, gnutls.Error) as error:
2295
2355
                        logger.warning("Bad certificate: %s", error)
2296
2356
                        return
2297
 
                    logger.debug("Key ID: %s", key_id)
 
2357
                    logger.debug("Key ID: %s",
 
2358
                                 key_id.decode("utf-8",
 
2359
                                               errors="replace"))
2298
2360
 
2299
2361
                else:
2300
2362
                    key_id = b""
2392
2454
    def peer_certificate(session):
2393
2455
        "Return the peer's certificate as a bytestring"
2394
2456
        try:
2395
 
            cert_type = gnutls.certificate_type_get2(session._c_object,
2396
 
                                                     gnutls.CTYPE_PEERS)
 
2457
            cert_type = gnutls.certificate_type_get2(
 
2458
                session, gnutls.CTYPE_PEERS)
2397
2459
        except AttributeError:
2398
 
            cert_type = gnutls.certificate_type_get(session._c_object)
 
2460
            cert_type = gnutls.certificate_type_get(session)
2399
2461
        if gnutls.has_rawpk:
2400
2462
            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2401
2463
        else:
2408
2470
            return b""
2409
2471
        list_size = ctypes.c_uint(1)
2410
2472
        cert_list = (gnutls.certificate_get_peers
2411
 
                     (session._c_object, ctypes.byref(list_size)))
 
2473
                     (session, ctypes.byref(list_size)))
2412
2474
        if not bool(cert_list) and list_size.value != 0:
2413
2475
            raise gnutls.Error("error getting peer certificate")
2414
2476
        if list_size.value == 0:
2436
2498
        buf = ctypes.create_string_buffer(32)
2437
2499
        buf_len = ctypes.c_size_t(len(buf))
2438
2500
        # Get the key ID from the raw public key into the buffer
2439
 
        gnutls.pubkey_get_key_id(pubkey,
2440
 
                                 gnutls.KEYID_USE_SHA256,
2441
 
                                 ctypes.cast(ctypes.byref(buf),
2442
 
                                             ctypes.POINTER(ctypes.c_ubyte)),
2443
 
                                 ctypes.byref(buf_len))
 
2501
        gnutls.pubkey_get_key_id(
 
2502
            pubkey,
 
2503
            gnutls.KEYID_USE_SHA256,
 
2504
            ctypes.cast(ctypes.byref(buf),
 
2505
                        ctypes.POINTER(ctypes.c_ubyte)),
 
2506
            ctypes.byref(buf_len))
2444
2507
        # Deinit the certificate
2445
2508
        gnutls.pubkey_deinit(pubkey)
2446
2509
 
2487
2550
        return hex_fpr
2488
2551
 
2489
2552
 
2490
 
class MultiprocessingMixIn(object):
 
2553
class MultiprocessingMixIn:
2491
2554
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
2492
2555
 
2493
2556
    def sub_process_main(self, request, address):
2505
2568
        return proc
2506
2569
 
2507
2570
 
2508
 
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
2571
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2509
2572
    """ adds a pipe to the MixIn """
2510
2573
 
2511
2574
    def process_request(self, request, client_address):
2526
2589
 
2527
2590
 
2528
2591
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2529
 
                     socketserver.TCPServer, object):
 
2592
                     socketserver.TCPServer):
2530
2593
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
2531
2594
 
2532
2595
    Attributes:
2665
2728
    def add_pipe(self, parent_pipe, proc):
2666
2729
        # Call "handle_ipc" for both data and EOF events
2667
2730
        GLib.io_add_watch(
2668
 
            parent_pipe.fileno(),
2669
 
            GLib.IO_IN | GLib.IO_HUP,
 
2731
            GLib.IOChannel.unix_new(parent_pipe.fileno()),
 
2732
            GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2670
2733
            functools.partial(self.handle_ipc,
2671
2734
                              parent_pipe=parent_pipe,
2672
2735
                              proc=proc))
2691
2754
            address = request[3]
2692
2755
 
2693
2756
            for c in self.clients.values():
2694
 
                if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
 
2757
                if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
 
2758
                              "27AE41E4649B934CA495991B7852B855"):
2695
2759
                    continue
2696
2760
                if key_id and c.key_id == key_id:
2697
2761
                    client = c
2710
2774
                return False
2711
2775
 
2712
2776
            GLib.io_add_watch(
2713
 
                parent_pipe.fileno(),
2714
 
                GLib.IO_IN | GLib.IO_HUP,
 
2777
                GLib.IOChannel.unix_new(parent_pipe.fileno()),
 
2778
                GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2715
2779
                functools.partial(self.handle_ipc,
2716
2780
                                  parent_pipe=parent_pipe,
2717
2781
                                  proc=proc,
2732
2796
        if command == 'getattr':
2733
2797
            attrname = request[1]
2734
2798
            if isinstance(client_object.__getattribute__(attrname),
2735
 
                          collections.Callable):
 
2799
                          collections.abc.Callable):
2736
2800
                parent_pipe.send(('function', ))
2737
2801
            else:
2738
2802
                parent_pipe.send((
2749
2813
def rfc3339_duration_to_delta(duration):
2750
2814
    """Parse an RFC 3339 "duration" and return a datetime.timedelta
2751
2815
 
2752
 
    >>> rfc3339_duration_to_delta("P7D")
2753
 
    datetime.timedelta(7)
2754
 
    >>> rfc3339_duration_to_delta("PT60S")
2755
 
    datetime.timedelta(0, 60)
2756
 
    >>> rfc3339_duration_to_delta("PT60M")
2757
 
    datetime.timedelta(0, 3600)
2758
 
    >>> rfc3339_duration_to_delta("PT24H")
2759
 
    datetime.timedelta(1)
2760
 
    >>> rfc3339_duration_to_delta("P1W")
2761
 
    datetime.timedelta(7)
2762
 
    >>> rfc3339_duration_to_delta("PT5M30S")
2763
 
    datetime.timedelta(0, 330)
2764
 
    >>> rfc3339_duration_to_delta("P1DT3M20S")
2765
 
    datetime.timedelta(1, 200)
 
2816
    >>> timedelta = datetime.timedelta
 
2817
    >>> rfc3339_duration_to_delta("P7D") == timedelta(7)
 
2818
    True
 
2819
    >>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
 
2820
    True
 
2821
    >>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
 
2822
    True
 
2823
    >>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
 
2824
    True
 
2825
    >>> rfc3339_duration_to_delta("P1W") == timedelta(7)
 
2826
    True
 
2827
    >>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
 
2828
    True
 
2829
    >>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
 
2830
    True
 
2831
    >>> del timedelta
2766
2832
    """
2767
2833
 
2768
2834
    # Parsing an RFC 3339 duration with regular expressions is not
2848
2914
def string_to_delta(interval):
2849
2915
    """Parse a string and return a datetime.timedelta
2850
2916
 
2851
 
    >>> string_to_delta('7d')
2852
 
    datetime.timedelta(7)
2853
 
    >>> string_to_delta('60s')
2854
 
    datetime.timedelta(0, 60)
2855
 
    >>> string_to_delta('60m')
2856
 
    datetime.timedelta(0, 3600)
2857
 
    >>> string_to_delta('24h')
2858
 
    datetime.timedelta(1)
2859
 
    >>> string_to_delta('1w')
2860
 
    datetime.timedelta(7)
2861
 
    >>> string_to_delta('5m 30s')
2862
 
    datetime.timedelta(0, 330)
 
2917
    >>> string_to_delta('7d') == datetime.timedelta(7)
 
2918
    True
 
2919
    >>> string_to_delta('60s') == datetime.timedelta(0, 60)
 
2920
    True
 
2921
    >>> string_to_delta('60m') == datetime.timedelta(0, 3600)
 
2922
    True
 
2923
    >>> string_to_delta('24h') == datetime.timedelta(1)
 
2924
    True
 
2925
    >>> string_to_delta('1w') == datetime.timedelta(7)
 
2926
    True
 
2927
    >>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
 
2928
    True
2863
2929
    """
2864
2930
 
2865
2931
    try:
2967
3033
 
2968
3034
    options = parser.parse_args()
2969
3035
 
2970
 
    if options.check:
2971
 
        import doctest
2972
 
        fail_count, test_count = doctest.testmod()
2973
 
        sys.exit(os.EX_OK if fail_count == 0 else 1)
2974
 
 
2975
3036
    # Default values for config file for server-global settings
2976
3037
    if gnutls.has_rawpk:
2977
3038
        priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2997
3058
    del priority
2998
3059
 
2999
3060
    # Parse config file for server-global settings
3000
 
    server_config = configparser.SafeConfigParser(server_defaults)
 
3061
    server_config = configparser.ConfigParser(server_defaults)
3001
3062
    del server_defaults
3002
3063
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
3003
 
    # Convert the SafeConfigParser object to a dict
 
3064
    # Convert the ConfigParser object to a dict
3004
3065
    server_settings = server_config.defaults()
3005
3066
    # Use the appropriate methods on the non-string config options
3006
3067
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
3078
3139
                                  server_settings["servicename"])))
3079
3140
 
3080
3141
    # Parse config file with clients
3081
 
    client_config = configparser.SafeConfigParser(Client
3082
 
                                                  .client_defaults)
 
3142
    client_config = configparser.ConfigParser(Client.client_defaults)
3083
3143
    client_config.read(os.path.join(server_settings["configdir"],
3084
3144
                                    "clients.conf"))
3085
3145
 
3141
3201
 
3142
3202
        @gnutls.log_func
3143
3203
        def debug_gnutls(level, string):
3144
 
            logger.debug("GnuTLS: %s", string[:-1])
 
3204
            logger.debug("GnuTLS: %s",
 
3205
                         string[:-1].decode("utf-8",
 
3206
                                            errors="replace"))
3145
3207
 
3146
3208
        gnutls.global_set_log_function(debug_gnutls)
3147
3209
 
3156
3218
        # Close all input and output, do double fork, etc.
3157
3219
        daemon()
3158
3220
 
3159
 
    # multiprocessing will use threads, so before we use GLib we need
3160
 
    # to inform GLib that threads will be used.
3161
 
    GLib.threads_init()
 
3221
    if gi.version_info < (3, 10, 2):
 
3222
        # multiprocessing will use threads, so before we use GLib we
 
3223
        # need to inform GLib that threads will be used.
 
3224
        GLib.threads_init()
3162
3225
 
3163
3226
    global main_loop
3164
3227
    # From the Avahi example code
3240
3303
                             if isinstance(s, bytes)
3241
3304
                             else s) for s in
3242
3305
                            value["client_structure"]]
3243
 
                        # .name & .host
3244
 
                        for k in ("name", "host"):
 
3306
                        # .name, .host, and .checker_command
 
3307
                        for k in ("name", "host", "checker_command"):
3245
3308
                            if isinstance(value[k], bytes):
3246
3309
                                value[k] = value[k].decode("utf-8")
3247
3310
                        if "key_id" not in value:
3257
3320
                        for key, value in
3258
3321
                        bytes_old_client_settings.items()}
3259
3322
                    del bytes_old_client_settings
3260
 
                    # .host
 
3323
                    # .host and .checker_command
3261
3324
                    for value in old_client_settings.values():
3262
 
                        if isinstance(value["host"], bytes):
3263
 
                            value["host"] = (value["host"]
3264
 
                                             .decode("utf-8"))
 
3325
                        for attribute in ("host", "checker_command"):
 
3326
                            if isinstance(value[attribute], bytes):
 
3327
                                value[attribute] = (value[attribute]
 
3328
                                                    .decode("utf-8"))
3265
3329
            os.remove(stored_state_path)
3266
3330
        except IOError as e:
3267
3331
            if e.errno == errno.ENOENT:
3592
3656
                sys.exit(1)
3593
3657
            # End of Avahi example code
3594
3658
 
3595
 
        GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3596
 
                          lambda *args, **kwargs:
3597
 
                          (tcp_server.handle_request
3598
 
                           (*args[2:], **kwargs) or True))
 
3659
        GLib.io_add_watch(
 
3660
            GLib.IOChannel.unix_new(tcp_server.fileno()),
 
3661
            GLib.PRIORITY_DEFAULT, GLib.IO_IN,
 
3662
            lambda *args, **kwargs: (tcp_server.handle_request
 
3663
                                     (*args[2:], **kwargs) or True))
3599
3664
 
3600
3665
        logger.debug("Starting main loop")
3601
3666
        main_loop.run()
3611
3676
    # Must run before the D-Bus bus name gets deregistered
3612
3677
    cleanup()
3613
3678
 
 
3679
 
 
3680
def should_only_run_tests():
 
3681
    parser = argparse.ArgumentParser(add_help=False)
 
3682
    parser.add_argument("--check", action='store_true')
 
3683
    args, unknown_args = parser.parse_known_args()
 
3684
    run_tests = args.check
 
3685
    if run_tests:
 
3686
        # Remove --check argument from sys.argv
 
3687
        sys.argv[1:] = unknown_args
 
3688
    return run_tests
 
3689
 
 
3690
# Add all tests from doctest strings
 
3691
def load_tests(loader, tests, none):
 
3692
    import doctest
 
3693
    tests.addTests(doctest.DocTestSuite())
 
3694
    return tests
3614
3695
 
3615
3696
if __name__ == '__main__':
3616
 
    main()
 
3697
    try:
 
3698
        if should_only_run_tests():
 
3699
            # Call using ./mandos --check [--verbose]
 
3700
            unittest.main()
 
3701
        else:
 
3702
            main()
 
3703
    finally:
 
3704
        logging.shutdown()