/mandos/trunk

#!/usr/bin/python3 -bI

# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-

# Copyright © 2008-2020 Teddy Hogeborn

# Copyright © 2008-2020 Björn Påhlsson

import unittest

import random

import shlex

import gi

if sys.version_info.major == 2:

    __metaclass__ = type

    str = unicode

 

# Add collections.abc.Callable if it does not exist

try:

    collections.abc.Callable

except AttributeError:

    class abc:

        Callable = collections.Callable

    collections.abc = abc

    del abc

 

# Add shlex.quote if it does not exist

try:

    shlex.quote

except AttributeError:

    shlex.quote = re.escape

 

# Show warnings by default

if not sys.warnoptions:

    import warnings

    warnings.simplefilter("default")

 

if sys.version_info < (3, 2):

    configparser.Configparser = configparser.SafeConfigParser

version = "1.8.14"

logging.captureWarnings(True)   # Show warnings via the logging system

                           ("Mandos [%(process)d]: %(levelname)s:"

                            " %(message)s"))

        console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

                                               " [%(process)d]:"

                                               " %(levelname)s:"

                                               " %(message)s"))

class PGPEngine:

                if name == b"gpg":

        self.gnupgargs = ["--batch",

                          "--homedir", self.tempdir,

                          "--force-mdc",

                          "--quiet"]

        if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

            proc = subprocess.Popen([self.gpg, "--symmetric",

                                     "--passphrase-file",

            proc = subprocess.Popen([self.gpg, "--decrypt",

                                     "--passphrase-file",

class avahi:

    """This isn't so much a class as it is a module-like namespace."""

    @staticmethod

    def string_array_to_txt_array(t):

class AvahiService:

    name: string; Example: "Mandos"

    type: string; Example: "_mandos._tcp".

                "StateChanged", self.entry_group_state_changed))

        ret = super(AvahiServiceToSyslog, self).rename(*args,

                                                       **kwargs)

            "Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

class gnutls:

    """This isn't so much a class as it is a module-like namespace."""

    CRT_RAWPK = 3

    X509_FMT_DER = 0

    NO_TICKETS = 1<<10

    ENABLE_RAWPK = 1<<18

    CTYPE_PEERS = 3

    KEYID_USE_SHA256 = 1        # gnutls/x509.h

    class _session_int(ctypes.Structure):

    session_t = ctypes.POINTER(_session_int)

        _fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

                    ("size", ctypes.c_uint)]

    class _openpgp_crt_int(ctypes.Structure):

    openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

                message = gnutls.strerror(code).decode(

                    "utf-8", errors="replace")

            return super(gnutls.Error, self).__init__(

    class PointerTo:

        def __init__(self, cls):

            self.cls = cls

 

        def from_param(self, obj):

            if not isinstance(obj, self.cls):

                raise TypeError("Not of type {}: {!r}"

                                .format(self.cls.__name__, obj))

            return ctypes.byref(obj.from_param(obj))

 

    class CastToVoidPointer:

        def __init__(self, cls):

            self.cls = cls

 

        def from_param(self, obj):

            if not isinstance(obj, self.cls):

                raise TypeError("Not of type {}: {!r}"

                                .format(self.cls.__name__, obj))

            return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

 

    class With_from_param:

        @classmethod

        def from_param(cls, obj):

            return obj._as_parameter_

 

    class Credentials(With_from_param):

            self._as_parameter_ = gnutls.certificate_credentials_t()

            gnutls.certificate_allocate_credentials(self)

            gnutls.certificate_free_credentials(self)

    class ClientSession(With_from_param):

            self._as_parameter_ = gnutls.session_t()

            gnutls_flags = gnutls.CLIENT

            if gnutls.check_version(b"3.5.6"):

                gnutls_flags |= gnutls.NO_TICKETS

            if gnutls.has_rawpk:

                gnutls_flags |= gnutls.ENABLE_RAWPK

            gnutls.init(self, gnutls_flags)

            del gnutls_flags

            gnutls.set_default_priority(self)

            gnutls.transport_set_ptr(self, socket.fileno())

            gnutls.handshake_set_private_extensions(self, True)

            gnutls.credentials_set(self, credentials.type,

                                   credentials)

            gnutls.deinit(self)

            return gnutls.handshake(self)

                data_len -= gnutls.record_send(self, data[-data_len:],

            return gnutls.bye(self, gnutls.SHUT_RDWR)

        for the "restype" attribute on ctypes functions"""

        if result >= gnutls.E_SUCCESS:

    def _retry_on_error(result, func, arguments,

                        _error_code=_error_code):

        for the "errcheck" attribute on ctypes functions"""

        while result < gnutls.E_SUCCESS:

    priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

    init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

    set_default_priority.argtypes = [ClientSession]

    record_send.argtypes = [ClientSession, ctypes.c_void_p,

        PointerTo(Credentials)]

    certificate_free_credentials.argtypes = [Credentials]

    handshake_set_private_extensions.argtypes = [ClientSession,

    credentials_set.argtypes = [ClientSession, credentials_type_t,

                                CastToVoidPointer(Credentials)]

    certificate_type_get.argtypes = [ClientSession]

    certificate_get_peers.argtypes = [ClientSession,

    deinit.argtypes = [ClientSession]

    handshake.argtypes = [ClientSession]

    handshake.restype = ctypes.c_int

    transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

    bye.argtypes = [ClientSession, close_request_t]

    bye.restype = ctypes.c_int

    _need_version = b"3.3.0"

    if check_version(_need_version) is None:

        raise self.Error("Needs GnuTLS {} or later"

                         .format(_need_version))

 

    _tls_rawpk_version = b"3.6.6"

    has_rawpk = bool(check_version(_tls_rawpk_version))

 

    if has_rawpk:

        # Types

        class pubkey_st(ctypes.Structure):

            _fields = []

        pubkey_t = ctypes.POINTER(pubkey_st)

 

        x509_crt_fmt_t = ctypes.c_int

 

        # All the function declarations below are from

        # gnutls/abstract.h

        pubkey_init = _library.gnutls_pubkey_init

        pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

        pubkey_init.restype = _error_code

 

        pubkey_import = _library.gnutls_pubkey_import

        pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

                                  x509_crt_fmt_t]

        pubkey_import.restype = _error_code

 

        pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

        pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

                                      ctypes.POINTER(ctypes.c_ubyte),

                                      ctypes.POINTER(ctypes.c_size_t)]

        pubkey_get_key_id.restype = _error_code

 

        pubkey_deinit = _library.gnutls_pubkey_deinit

        pubkey_deinit.argtypes = [pubkey_t]

        pubkey_deinit.restype = None

    else:

        # All the function declarations below are from

        # gnutls/openpgp.h

 

        openpgp_crt_init = _library.gnutls_openpgp_crt_init

        openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

        openpgp_crt_init.restype = _error_code

 

        openpgp_crt_import = _library.gnutls_openpgp_crt_import

        openpgp_crt_import.argtypes = [openpgp_crt_t,

                                       ctypes.POINTER(datum_t),

                                       openpgp_crt_fmt_t]

        openpgp_crt_import.restype = _error_code

 

        openpgp_crt_verify_self = \

            _library.gnutls_openpgp_crt_verify_self

        openpgp_crt_verify_self.argtypes = [

            openpgp_crt_t,

            ctypes.c_uint,

            ctypes.POINTER(ctypes.c_uint),

        ]

        openpgp_crt_verify_self.restype = _error_code

 

        openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

        openpgp_crt_deinit.argtypes = [openpgp_crt_t]

        openpgp_crt_deinit.restype = None

 

        openpgp_crt_get_fingerprint = (

            _library.gnutls_openpgp_crt_get_fingerprint)

        openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

                                                ctypes.c_void_p,

                                                ctypes.POINTER(

                                                    ctypes.c_size_t)]

        openpgp_crt_get_fingerprint.restype = _error_code

 

    if check_version(b"3.6.4"):

        certificate_type_get2 = _library.gnutls_certificate_type_get2

        certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

        certificate_type_get2.restype = _error_code

class Client:

    approved:   bool(); None if not yet approved/disapproved

    checker: multiprocessing.Process(); a running checker process used

             to see if the client lives. None if no process is

             running.

                 uniquely identify an OpenPGP client

    key_id: string (64 hexadecimal digits); used to uniquely identify

            a client using raw public keys

                          "created", "enabled", "expires", "key_id",

            # Uppercase and remove spaces from key_id and fingerprint

            # for later comparison purposes with return value from the

            # key_id() and fingerprint() functions

            client["key_id"] = (section.get("key_id", "").upper()

                                .replace(" ", ""))

        logger.debug("  Key ID: %s", self.key_id)

            random.randrange(int(self.interval.total_seconds() * 1000

                                 + 1)),

        if self.checker is not None:

            self.checker.join()

        self.checker_callback_tag = None

        self.checker = None

                attr: shlex.quote(str(getattr(self, attr)))

                GLib.IOChannel.unix_new(pipe[0].fileno()),

                GLib.PRIORITY_DEFAULT, GLib.IO_IN,

        func._dbus_get_args_options = {"byte_arrays": byte_arrays}

                         path_keyword="object_path",

                         connection_keyword="connection")

            value = dbus.ByteArray(bytes(value))

                         path_keyword="object_path",

                         connection_keyword="connection")

                         path_keyword="object_path",

                         connection_keyword="connection")

    # KeyID - property

    @dbus_annotations(

        {"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

    @dbus_service_property(_interface, signature="s", access="read")

    def KeyID_dbus_property(self):

        return dbus.String(self.key_id)

 

class ProxyClient:

    def __init__(self, child_pipe, key_id, fpr, address):

        self._pipe.send(("init", key_id, fpr, address))

            raise KeyError(key_id or fpr)

        if name == "_pipe":

        self._pipe.send(("getattr", name))

        if data[0] == "data":

        if data[0] == "function":

                self._pipe.send(("funcall", name, args, kwargs))

        if name == "_pipe":

        self._pipe.send(("setattr", name, value))

            # priority = ":".join(("NONE", "+VERS-TLS1.1",

            gnutls.priority_set_direct(session,

                                       priority.encode("utf-8"), None)

                if gnutls.has_rawpk:

                    fpr = b""

                    try:

                        key_id = self.key_id(

                            self.peer_certificate(session))

                    except (TypeError, gnutls.Error) as error:

                        logger.warning("Bad certificate: %s", error)

                        return

                    logger.debug("Key ID: %s",

                                 key_id.decode("utf-8",

                                               errors="replace"))

 

                else:

                    key_id = b""

                    try:

                        fpr = self.fingerprint(

                            self.peer_certificate(session))

                    except (TypeError, gnutls.Error) as error:

                        logger.warning("Bad certificate: %s", error)

                        return

                    logger.debug("Fingerprint: %s", fpr)

 

                try:

                    client = ProxyClient(child_pipe, key_id, fpr,

        "Return the peer's certificate as a bytestring"

        try:

            cert_type = gnutls.certificate_type_get2(

                session, gnutls.CTYPE_PEERS)

        except AttributeError:

            cert_type = gnutls.certificate_type_get(session)

        if gnutls.has_rawpk:

            valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

        else:

            valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

        # If not a valid certificate type...

        if cert_type not in valid_cert_types:

            logger.info("Cert type %r not in %r", cert_type,

                        valid_cert_types)

                     (session, ctypes.byref(list_size)))

    def key_id(certificate):

        "Convert a certificate bytestring to a hexdigit key ID"

        # New GnuTLS "datum" with the public key

        datum = gnutls.datum_t(

            ctypes.cast(ctypes.c_char_p(certificate),

                        ctypes.POINTER(ctypes.c_ubyte)),

            ctypes.c_uint(len(certificate)))

        # XXX all these need to be created in the gnutls "module"

        # New empty GnuTLS certificate

        pubkey = gnutls.pubkey_t()

        gnutls.pubkey_init(ctypes.byref(pubkey))

        # Import the raw public key into the certificate

        gnutls.pubkey_import(pubkey,

                             ctypes.byref(datum),

                             gnutls.X509_FMT_DER)

        # New buffer for the key ID

        buf = ctypes.create_string_buffer(32)

        buf_len = ctypes.c_size_t(len(buf))

        # Get the key ID from the raw public key into the buffer

        gnutls.pubkey_get_key_id(

            pubkey,

            gnutls.KEYID_USE_SHA256,

            ctypes.cast(ctypes.byref(buf),

                        ctypes.POINTER(ctypes.c_ubyte)),

            ctypes.byref(buf_len))

        # Deinit the certificate

        gnutls.pubkey_deinit(pubkey)

 

        # Convert the buffer to a Python bytestring

        key_id = ctypes.string_at(buf, buf_len.value)

        # Convert the bytestring to hexadecimal notation

        hex_key_id = binascii.hexlify(key_id).upper()

        return hex_key_id

 

    @staticmethod

            raise gnutls.CertificateSecurityError(code

                                                  =crtverify.value)

class MultiprocessingMixIn:

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

                     socketserver.TCPServer):

    """IPv6-capable TCP server.  Accepts None as address and/or port

            if self.server_address[1]:

                self.allow_reuse_address = True

            GLib.IOChannel.unix_new(parent_pipe.fileno()),

            GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

        if command == "init":

            key_id = request[1].decode("ascii")

            fpr = request[2].decode("ascii")

            address = request[3]

                if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

                              "27AE41E4649B934CA495991B7852B855"):

                    continue

                if key_id and c.key_id == key_id:

                    client = c

                    break

                if fpr and c.fingerprint == fpr:

                logger.info("Client not found for key ID: %s, address"

                            ": %s", key_id or fpr, address)

                    mandos_dbus_service.ClientNotFound(key_id or fpr,

                GLib.IOChannel.unix_new(parent_pipe.fileno()),

                GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

        if command == "funcall":

            parent_pipe.send(("data", getattr(client_object,

        if command == "getattr":

                          collections.abc.Callable):

                parent_pipe.send(("function", ))

                    "data", client_object.__getattribute__(attrname)))

        if command == "setattr":

    >>> timedelta = datetime.timedelta

    >>> rfc3339_duration_to_delta("P7D") == timedelta(7)

    True

    >>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

    True

    >>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

    True

    >>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

    True

    >>> rfc3339_duration_to_delta("P1W") == timedelta(7)

    True

    >>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

    True

    >>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

    True

    >>> del timedelta

    >>> string_to_delta("7d") == datetime.timedelta(7)

    True

    >>> string_to_delta("60s") == datetime.timedelta(0, 60)

    True

    >>> string_to_delta("60m") == datetime.timedelta(0, 3600)

    True

    >>> string_to_delta("24h") == datetime.timedelta(1)

    True

    >>> string_to_delta("1w") == datetime.timedelta(7)

    True

    >>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

    True

    if gnutls.has_rawpk:

        priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

                    ":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

    else:

        priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

                    ":+SIGN-DSA-SHA256")

                       "priority": priority,

    del priority

    server_config = configparser.ConfigParser(server_defaults)

    # Convert the ConfigParser object to a dict

            logging.Formatter("Mandos ({}) [%(process)d]:"

                              " %(levelname)s: %(message)s".format(

    client_config = configparser.ConfigParser(Client.client_defaults)

            logger.debug("GnuTLS: %s",

                         string[:-1].decode("utf-8",

                                            errors="replace"))

    if gi.version_info < (3, 10, 2):

        # multiprocessing will use threads, so before we use GLib we

        # need to inform GLib that threads will be used.

        GLib.threads_init()

                        # .name, .host, and .checker_command

                        for k in ("name", "host", "checker_command"):

                        if "key_id" not in value:

                            value["key_id"] = ""

                        elif "fingerprint" not in value:

                            value["fingerprint"] = ""

                    # .host and .checker_command

                        for attribute in ("host", "checker_command"):

                            if isinstance(value[attribute], bytes):

                                value[attribute] = (value[attribute]

                                                    .decode("utf-8"))

            def ClientNotFound(self, key_id, address):

                    mode="wb",

                    prefix="clients-",

        GLib.io_add_watch(

            GLib.IOChannel.unix_new(tcp_server.fileno()),

            GLib.PRIORITY_DEFAULT, GLib.IO_IN,

            lambda *args, **kwargs: (tcp_server.handle_request

                                     (*args[2:], **kwargs) or True))

 

def should_only_run_tests():

    parser = argparse.ArgumentParser(add_help=False)

    parser.add_argument("--check", action="store_true")

    args, unknown_args = parser.parse_known_args()

    run_tests = args.check

    if run_tests:

        # Remove --check argument from sys.argv

        sys.argv[1:] = unknown_args

    return run_tests

 

# Add all tests from doctest strings

def load_tests(loader, tests, none):

    import doctest

    tests.addTests(doctest.DocTestSuite())

    return tests

 

if __name__ == "__main__":

    try:

        if should_only_run_tests():

            # Call using ./mandos --check [--verbose]

            unittest.main()

        else:

            main()

    finally:

        logging.shutdown()