/mandos/trunk

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

#

# Mandos server - give out binary blobs to connecting clients.

# "AvahiService" class, and some lines in "main".

#

# Everything else is

#

# This file is part of Mandos.

#

import collections

import codecs

import unittest

 

import dbus

import dbus.service

 

if sys.version_info.major == 2:

    __metaclass__ = type

 

# Show warnings by default

if not sys.warnoptions:

            # No value found

            SO_BINDTODEVICE = None

 

if sys.version_info < (3, 2):

    configparser.Configparser = configparser.SafeConfigParser

 

stored_state_file = "clients.pickle"

 

logger = logging.getLogger()

        facility=logging.handlers.SysLogHandler.LOG_DAEMON,

        address="/dev/log"))

    syslogger.setFormatter(logging.Formatter

    logger.addHandler(syslogger)

 

    if debug:

        console = logging.StreamHandler()

        logger.addHandler(console)

    logger.setLevel(level)

 

        except OSError as e:

            if e.errno != errno.ENOENT:

                raise

        # Only GPG version 1 has the --no-use-agent option.

        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

            self.gnupgargs.append("--no-use-agent")

                dir=self.tempdir) as passfile:

            passfile.write(passphrase)

            passfile.flush()

                                     passfile.name]

                                    + self.gnupgargs,

                                    stdin=subprocess.PIPE,

                dir=self.tempdir) as passfile:

            passfile.write(passphrase)

            passfile.flush()

                                     passfile.name]

                                    + self.gnupgargs,

                                    stdin=subprocess.PIPE,

    Attributes:

    interface: integer; avahi.IF_UNSPEC or an interface index.

               Used to optionally bind to the specified interface.

     See <https://www.iana.org/assignments/service-names-port-numbers>

    port: integer; what port to announce

    TXT: list of strings; TXT record for the service

                avahi.DBUS_INTERFACE_ENTRY_GROUP)

        self.entry_group_state_changed_match = (

            self.group.connect_to_signal(

        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

                     self.name, self.type)

        self.group.AddService(

class AvahiServiceToSyslog(AvahiService):

    def rename(self, *args, **kwargs):

        """Add the new name to the syslog messages"""

        syslogger.setFormatter(logging.Formatter(

            .format(self.name)))

        return ret

 

    OPENPGP_FMT_RAW = 0         # gnutls/openpgp.h

 

    # Types

        _fields_ = []

 

    class certificate_credentials_st(ctypes.Structure):

        _fields_ = []

    certificate_type_t = ctypes.c_int

 

    class datum_t(ctypes.Structure):

 

        _fields_ = []

    openpgp_crt_fmt_t = ctypes.c_int  # gnutls/openpgp.h

    log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

    credentials_type_t = ctypes.c_int

            # gnutls.strerror()

            self.code = code

            if message is None and code is not None:

            return super(gnutls.Error, self).__init__(

                message, *args)

 

    class CertificateSecurityError(Error):

        pass

 

    # Classes

        def __init__(self):

            self.type = gnutls.CRD_CERTIFICATE

 

        def __del__(self):

 

        def __init__(self, socket, credentials=None):

            gnutls_flags = gnutls.CLIENT

            if gnutls.check_version(b"3.5.6"):

                gnutls_flags |= gnutls.NO_TICKETS

            if gnutls.has_rawpk:

                gnutls_flags |= gnutls.ENABLE_RAWPK

            del gnutls_flags

            self.socket = socket

            if credentials is None:

                credentials = gnutls.Credentials()

            self.credentials = credentials

 

        def __del__(self):

 

        def handshake(self):

 

        def send(self, data):

            data = bytes(data)

            data_len = len(data)

            while data_len > 0:

                                               data_len)

 

        def bye(self):

 

    # Error handling functions

    def _error_code(result):

        """A function to raise exceptions on errors, suitable

            return result

        if result == gnutls.E_NO_CERTIFICATE_FOUND:

            raise gnutls.CertificateSecurityError(code=result)

        raise gnutls.Error(code=result)

 

        """A function to retry on some errors, suitable

            if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

                return _error_code(result)

            result = func(*arguments)

 

    # Functions

    priority_set_direct = _library.gnutls_priority_set_direct

                                    ctypes.POINTER(ctypes.c_char_p)]

    priority_set_direct.restype = _error_code

 

    init = _library.gnutls_init

    init.restype = _error_code

 

    set_default_priority = _library.gnutls_set_default_priority

    set_default_priority.restype = _error_code

 

    record_send = _library.gnutls_record_send

                            ctypes.c_size_t]

    record_send.restype = ctypes.c_ssize_t

    record_send.errcheck = _retry_on_error

    certificate_allocate_credentials = (

        _library.gnutls_certificate_allocate_credentials)

    certificate_allocate_credentials.argtypes = [

    certificate_allocate_credentials.restype = _error_code

 

    certificate_free_credentials = (

        _library.gnutls_certificate_free_credentials)

    certificate_free_credentials.restype = None

 

    handshake_set_private_extensions = (

        _library.gnutls_handshake_set_private_extensions)

                                                 ctypes.c_int]

    handshake_set_private_extensions.restype = None

 

    credentials_set = _library.gnutls_credentials_set

    credentials_set.restype = _error_code

 

    strerror = _library.gnutls_strerror

    strerror.restype = ctypes.c_char_p

 

    certificate_type_get = _library.gnutls_certificate_type_get

    certificate_type_get.restype = _error_code

 

    certificate_get_peers = _library.gnutls_certificate_get_peers

                                      ctypes.POINTER(ctypes.c_uint)]

    certificate_get_peers.restype = ctypes.POINTER(datum_t)

 

    global_set_log_function.restype = None

 

    deinit = _library.gnutls_deinit

    deinit.restype = None

 

    handshake = _library.gnutls_handshake

    handshake.errcheck = _retry_on_error

 

    transport_set_ptr = _library.gnutls_transport_set_ptr

    transport_set_ptr.restype = None

 

    bye = _library.gnutls_bye

    bye.errcheck = _retry_on_error

 

    check_version = _library.gnutls_check_version

 

        x509_crt_fmt_t = ctypes.c_int

 

        pubkey_init = _library.gnutls_pubkey_init

        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

        pubkey_init.restype = _error_code

        pubkey_deinit.argtypes = [pubkey_t]

        pubkey_deinit.restype = None

    else:

 

        openpgp_crt_init = _library.gnutls_openpgp_crt_init

        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

                                       openpgp_crt_fmt_t]

        openpgp_crt_import.restype = _error_code

 

        openpgp_crt_verify_self.restype = _error_code

 

        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

 

    if check_version(b"3.6.4"):

        certificate_type_get2 = _library.gnutls_certificate_type_get2

        certificate_type_get2.restype = _error_code

 

    # Remove non-public functions

    """A representation of a client host served by this server.

 

    Attributes:

    approval_delay: datetime.timedelta(); Time to wait for approval

    approval_duration: datetime.timedelta(); Duration of one approval

    checker: multiprocessing.Process(); a running checker process used

             running.

    checker_callback_tag: a GLib event source tag, or None

    checker_command: string; External command which is run to check

        if self.checker_initiator_tag is not None:

            GLib.source_remove(self.checker_initiator_tag)

        self.checker_initiator_tag = GLib.timeout_add(

            self.start_checker)

        # Schedule a disable() when 'timeout' has passed

        if self.disable_initiator_tag is not None:

        if self.checker is None:

            # Escape attributes for the shell

            escaped_attrs = {

                for attr in self.runtime_expansions}

            try:

                command = self.checker_command % escaped_attrs

        func._dbus_name = func.__name__

        if func._dbus_name.endswith("_dbus_property"):

            func._dbus_name = func._dbus_name[:-14]

        return func

 

    return decorator

 

    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,

                         out_signature="s",

    def Introspect(self, object_path, connection):

        """Overloading of standard D-Bus method.

 

                raise ValueError("Byte arrays not supported for non-"

                                 "'ay' signature {!r}"

                                 .format(prop._dbus_signature))

        prop(value)

 

    @dbus.service.method(dbus.PROPERTIES_IFACE,

 

    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,

                         out_signature="s",

    def Introspect(self, object_path, connection):

        """Overloading of standard D-Bus method.

 

 

    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,

                         out_signature="s",

    def Introspect(self, object_path, connection):

        """Overloading of standard D-Bus method.

 

class ProxyClient:

    def __init__(self, child_pipe, key_id, fpr, address):

        self._pipe = child_pipe

        if not self._pipe.recv():

            raise KeyError(key_id or fpr)

 

    def __getattribute__(self, name):

            return super(ProxyClient, self).__getattribute__(name)

        data = self._pipe.recv()

            return data[1]

 

            def func(*args, **kwargs):

                return self._pipe.recv()[1]

 

            return func

 

    def __setattr__(self, name, value):

            return super(ProxyClient, self).__setattr__(name, value)

 

 

class ClientHandler(socketserver.BaseRequestHandler, object):

 

            session = gnutls.ClientSession(self.request)

 

            #                       "+AES-256-CBC", "+SHA1",

            #                       "+COMP-NULL", "+CTYPE-OPENPGP",

            #                       "+DHE-DSS"))

            priority = self.server.gnutls_priority

            if priority is None:

                priority = "NORMAL"

 

            # Start communication using the Mandos protocol

            # Get protocol number

                    except (TypeError, gnutls.Error) as error:

                        logger.warning("Bad certificate: %s", error)

                        return

 

                else:

                    key_id = b""

    def peer_certificate(session):

        "Return the peer's certificate as a bytestring"

        try:

        except AttributeError:

        if gnutls.has_rawpk:

            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

        else:

            return b""

        list_size = ctypes.c_uint(1)

        cert_list = (gnutls.certificate_get_peers

        if not bool(cert_list) and list_size.value != 0:

            raise gnutls.Error("error getting peer certificate")

        if list_size.value == 0:

        buf = ctypes.create_string_buffer(32)

        buf_len = ctypes.c_size_t(len(buf))

        # Get the key ID from the raw public key into the buffer

        # Deinit the certificate

        gnutls.pubkey_deinit(pubkey)

 

 

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

                     socketserver.TCPServer):

 

    Attributes:

        enabled:        Boolean; whether this server is activated yet

        request = parent_pipe.recv()

        command = request[0]

 

            key_id = request[1].decode("ascii")

            fpr = request[2].decode("ascii")

            address = request[3]

 

            for c in self.clients.values():

                    continue

                if key_id and c.key_id == key_id:

                    client = c

            # remove the old hook in favor of the new above hook on

            # same fileno

            return False

            funcname = request[1]

            args = request[2]

            kwargs = request[3]

 

                                              funcname)(*args,

                                                        **kwargs)))

 

            attrname = request[1]

            if isinstance(client_object.__getattribute__(attrname),

            else:

                parent_pipe.send((

 

            attrname = request[1]

            value = request[2]

            setattr(client_object, attrname, value)

def rfc3339_duration_to_delta(duration):

    """Parse an RFC 3339 "duration" and return a datetime.timedelta

 

    """

 

    # Parsing an RFC 3339 duration with regular expressions is not

def string_to_delta(interval):

    """Parse a string and return a datetime.timedelta

 

    True

    """

 

 

    if server_settings["servicename"] != "Mandos":

        syslogger.setFormatter(

                                  server_settings["servicename"])))

 

    # Parse config file with clients

 

        @gnutls.log_func

        def debug_gnutls(level, string):

 

        gnutls.global_set_log_function(debug_gnutls)

 

 

        try:

            with tempfile.NamedTemporaryFile(

                    suffix=".pickle",

                    dir=os.path.dirname(stored_state_path),

                    delete=False) as stored_state:

                pickle.dump((clients, client_settings), stored_state,

 

def should_only_run_tests():

    parser = argparse.ArgumentParser(add_help=False)

    args, unknown_args = parser.parse_known_args()

    run_tests = args.check

    if run_tests:

    tests.addTests(doctest.DocTestSuite())

    return tests

 

    try:

        if should_only_run_tests():

            # Call using ./mandos --check [--verbose]