535
506
# Pretend that we have a GnuTLS module
537
"""This isn't so much a class as it is a module-like namespace."""
507
class GnuTLS(object):
508
"""This isn't so much a class as it is a module-like namespace.
509
It is instantiated once, and simulates having a GnuTLS module."""
539
511
library = ctypes.util.find_library("gnutls")
540
512
if library is None:
541
513
library = ctypes.util.find_library("gnutls-deb0")
542
514
_library = ctypes.cdll.LoadLibrary(library)
516
_need_version = b"3.3.0"
519
# Need to use "self" here, since this method is called before
520
# the assignment to the "gnutls" global variable happens.
521
if self.check_version(self._need_version) is None:
522
raise self.Error("Needs GnuTLS {} or later"
523
.format(self._need_version))
545
525
# Unless otherwise indicated, the constants and types below are
546
526
# all from the gnutls/gnutls.h C header file.
590
564
class Error(Exception):
565
# We need to use the class name "GnuTLS" here, since this
566
# exception might be raised from within GnuTLS.__init__,
567
# which is called before the assignment to the "gnutls"
568
# global variable has happened.
591
569
def __init__(self, message=None, code=None, args=()):
592
570
# Default usage is by a message string, but if a return
593
571
# code is passed, convert it to a string with
594
572
# gnutls.strerror()
596
574
if message is None and code is not None:
597
message = gnutls.strerror(code)
598
return super(gnutls.Error, self).__init__(
575
message = GnuTLS.strerror(code)
576
return super(GnuTLS.Error, self).__init__(
601
579
class CertificateSecurityError(Error):
583
class Credentials(object):
606
584
def __init__(self):
607
585
self._c_object = gnutls.certificate_credentials_t()
608
586
gnutls.certificate_allocate_credentials(
612
590
def __del__(self):
613
591
gnutls.certificate_free_credentials(self._c_object)
593
class ClientSession(object):
616
594
def __init__(self, socket, credentials=None):
617
595
self._c_object = gnutls.session_t()
618
gnutls_flags = gnutls.CLIENT
619
if gnutls.check_version(b"3.5.6"):
620
gnutls_flags |= gnutls.NO_TICKETS
622
gnutls_flags |= gnutls.ENABLE_RAWPK
623
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
596
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
625
597
gnutls.set_default_priority(self._c_object)
626
598
gnutls.transport_set_ptr(self._c_object, socket.fileno())
627
599
gnutls.handshake_set_private_extensions(self._c_object,
760
731
check_version.argtypes = [ctypes.c_char_p]
761
732
check_version.restype = ctypes.c_char_p
763
_need_version = b"3.3.0"
764
if check_version(_need_version) is None:
765
raise self.Error("Needs GnuTLS {} or later"
766
.format(_need_version))
768
_tls_rawpk_version = b"3.6.6"
769
has_rawpk = bool(check_version(_tls_rawpk_version))
773
class pubkey_st(ctypes.Structure):
775
pubkey_t = ctypes.POINTER(pubkey_st)
777
x509_crt_fmt_t = ctypes.c_int
779
# All the function declarations below are from
781
pubkey_init = _library.gnutls_pubkey_init
782
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
783
pubkey_init.restype = _error_code
785
pubkey_import = _library.gnutls_pubkey_import
786
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
788
pubkey_import.restype = _error_code
790
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
791
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
792
ctypes.POINTER(ctypes.c_ubyte),
793
ctypes.POINTER(ctypes.c_size_t)]
794
pubkey_get_key_id.restype = _error_code
796
pubkey_deinit = _library.gnutls_pubkey_deinit
797
pubkey_deinit.argtypes = [pubkey_t]
798
pubkey_deinit.restype = None
800
# All the function declarations below are from
803
openpgp_crt_init = _library.gnutls_openpgp_crt_init
804
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
805
openpgp_crt_init.restype = _error_code
807
openpgp_crt_import = _library.gnutls_openpgp_crt_import
808
openpgp_crt_import.argtypes = [openpgp_crt_t,
809
ctypes.POINTER(datum_t),
811
openpgp_crt_import.restype = _error_code
813
openpgp_crt_verify_self = \
814
_library.gnutls_openpgp_crt_verify_self
815
openpgp_crt_verify_self.argtypes = [
818
ctypes.POINTER(ctypes.c_uint),
820
openpgp_crt_verify_self.restype = _error_code
822
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
823
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
824
openpgp_crt_deinit.restype = None
826
openpgp_crt_get_fingerprint = (
827
_library.gnutls_openpgp_crt_get_fingerprint)
828
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
832
openpgp_crt_get_fingerprint.restype = _error_code
834
if check_version(b"3.6.4"):
835
certificate_type_get2 = _library.gnutls_certificate_type_get2
836
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
837
certificate_type_get2.restype = _error_code
734
# All the function declarations below are from gnutls/openpgp.h
736
openpgp_crt_init = _library.gnutls_openpgp_crt_init
737
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
738
openpgp_crt_init.restype = _error_code
740
openpgp_crt_import = _library.gnutls_openpgp_crt_import
741
openpgp_crt_import.argtypes = [openpgp_crt_t,
742
ctypes.POINTER(datum_t),
744
openpgp_crt_import.restype = _error_code
746
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
747
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
748
ctypes.POINTER(ctypes.c_uint)]
749
openpgp_crt_verify_self.restype = _error_code
751
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
752
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
753
openpgp_crt_deinit.restype = None
755
openpgp_crt_get_fingerprint = (
756
_library.gnutls_openpgp_crt_get_fingerprint)
757
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
761
openpgp_crt_get_fingerprint.restype = _error_code
839
763
# Remove non-public functions
840
764
del _error_code, _retry_on_error
765
# Create the global "gnutls" object, simulating a module
843
769
def call_pipe(connection, # : multiprocessing.Connection
851
777
connection.close()
780
class Client(object):
855
781
"""A representation of a client host served by this server.
858
784
approved: bool(); 'None' if not yet approved/disapproved
859
785
approval_delay: datetime.timedelta(); Time to wait for approval
860
786
approval_duration: datetime.timedelta(); Duration of one approval
861
checker: multiprocessing.Process(); a running checker process used
862
to see if the client lives. 'None' if no process is
787
checker: subprocess.Popen(); a running checker process used
788
to see if the client lives.
789
'None' if no process is running.
864
790
checker_callback_tag: a GLib event source tag, or None
865
791
checker_command: string; External command which is run to check
866
792
if client lives. %() expansions are done at
902
826
runtime_expansions = ("approval_delay", "approval_duration",
903
"created", "enabled", "expires", "key_id",
827
"created", "enabled", "expires",
904
828
"fingerprint", "host", "interval",
905
829
"last_approval_request", "last_checked_ok",
906
830
"last_enabled", "name", "timeout")
2252
def __init__(self, child_pipe, key_id, fpr, address):
2162
class ProxyClient(object):
2163
def __init__(self, child_pipe, fpr, address):
2253
2164
self._pipe = child_pipe
2254
self._pipe.send(('init', key_id, fpr, address))
2165
self._pipe.send(('init', fpr, address))
2255
2166
if not self._pipe.recv():
2256
raise KeyError(key_id or fpr)
2258
2169
def __getattribute__(self, name):
2259
2170
if name == '_pipe':
2327
2238
approval_required = False
2329
if gnutls.has_rawpk:
2332
key_id = self.key_id(
2333
self.peer_certificate(session))
2334
except (TypeError, gnutls.Error) as error:
2335
logger.warning("Bad certificate: %s", error)
2337
logger.debug("Key ID: %s", key_id)
2342
fpr = self.fingerprint(
2343
self.peer_certificate(session))
2344
except (TypeError, gnutls.Error) as error:
2345
logger.warning("Bad certificate: %s", error)
2347
logger.debug("Fingerprint: %s", fpr)
2350
client = ProxyClient(child_pipe, key_id, fpr,
2241
fpr = self.fingerprint(
2242
self.peer_certificate(session))
2243
except (TypeError, gnutls.Error) as error:
2244
logger.warning("Bad certificate: %s", error)
2246
logger.debug("Fingerprint: %s", fpr)
2249
client = ProxyClient(child_pipe, fpr,
2351
2250
self.client_address)
2352
2251
except KeyError:
2432
2331
def peer_certificate(session):
2433
"Return the peer's certificate as a bytestring"
2435
cert_type = gnutls.certificate_type_get2(session._c_object,
2437
except AttributeError:
2438
cert_type = gnutls.certificate_type_get(session._c_object)
2439
if gnutls.has_rawpk:
2440
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2442
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2443
# If not a valid certificate type...
2444
if cert_type not in valid_cert_types:
2445
logger.info("Cert type %r not in %r", cert_type,
2332
"Return the peer's OpenPGP certificate as a bytestring"
2333
# If not an OpenPGP certificate...
2334
if (gnutls.certificate_type_get(session._c_object)
2335
!= gnutls.CRT_OPENPGP):
2447
2336
# ...return invalid data
2449
2338
list_size = ctypes.c_uint(1)
2457
2346
return ctypes.string_at(cert.data, cert.size)
2460
def key_id(certificate):
2461
"Convert a certificate bytestring to a hexdigit key ID"
2462
# New GnuTLS "datum" with the public key
2463
datum = gnutls.datum_t(
2464
ctypes.cast(ctypes.c_char_p(certificate),
2465
ctypes.POINTER(ctypes.c_ubyte)),
2466
ctypes.c_uint(len(certificate)))
2467
# XXX all these need to be created in the gnutls "module"
2468
# New empty GnuTLS certificate
2469
pubkey = gnutls.pubkey_t()
2470
gnutls.pubkey_init(ctypes.byref(pubkey))
2471
# Import the raw public key into the certificate
2472
gnutls.pubkey_import(pubkey,
2473
ctypes.byref(datum),
2474
gnutls.X509_FMT_DER)
2475
# New buffer for the key ID
2476
buf = ctypes.create_string_buffer(32)
2477
buf_len = ctypes.c_size_t(len(buf))
2478
# Get the key ID from the raw public key into the buffer
2479
gnutls.pubkey_get_key_id(
2481
gnutls.KEYID_USE_SHA256,
2482
ctypes.cast(ctypes.byref(buf),
2483
ctypes.POINTER(ctypes.c_ubyte)),
2484
ctypes.byref(buf_len))
2485
# Deinit the certificate
2486
gnutls.pubkey_deinit(pubkey)
2488
# Convert the buffer to a Python bytestring
2489
key_id = ctypes.string_at(buf, buf_len.value)
2490
# Convert the bytestring to hexadecimal notation
2491
hex_key_id = binascii.hexlify(key_id).upper()
2495
2349
def fingerprint(openpgp):
2496
2350
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2497
2351
# New GnuTLS "datum" with the OpenPGP public key
2727
2578
command = request[0]
2729
2580
if command == 'init':
2730
key_id = request[1].decode("ascii")
2731
fpr = request[2].decode("ascii")
2732
address = request[3]
2581
fpr = request[1].decode("ascii")
2582
address = request[2]
2734
2584
for c in self.clients.values():
2735
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2736
"27AE41E4649B934CA495991B7852B855"):
2738
if key_id and c.key_id == key_id:
2741
if fpr and c.fingerprint == fpr:
2585
if c.fingerprint == fpr:
2745
logger.info("Client not found for key ID: %s, address"
2746
": %s", key_id or fpr, address)
2589
logger.info("Client not found for fingerprint: %s, ad"
2590
"dress: %s", fpr, address)
2747
2591
if self.use_dbus:
2748
2592
# Emit D-Bus signal
2749
mandos_dbus_service.ClientNotFound(key_id or fpr,
2593
mandos_dbus_service.ClientNotFound(fpr,
2751
2595
parent_pipe.send(False)
2754
2598
GLib.io_add_watch(
2755
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2756
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2599
parent_pipe.fileno(),
2600
GLib.IO_IN | GLib.IO_HUP,
2757
2601
functools.partial(self.handle_ipc,
2758
2602
parent_pipe=parent_pipe,
2791
2635
def rfc3339_duration_to_delta(duration):
2792
2636
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2794
>>> timedelta = datetime.timedelta
2795
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2797
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2799
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2801
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2803
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2805
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2807
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2638
>>> rfc3339_duration_to_delta("P7D")
2639
datetime.timedelta(7)
2640
>>> rfc3339_duration_to_delta("PT60S")
2641
datetime.timedelta(0, 60)
2642
>>> rfc3339_duration_to_delta("PT60M")
2643
datetime.timedelta(0, 3600)
2644
>>> rfc3339_duration_to_delta("PT24H")
2645
datetime.timedelta(1)
2646
>>> rfc3339_duration_to_delta("P1W")
2647
datetime.timedelta(7)
2648
>>> rfc3339_duration_to_delta("PT5M30S")
2649
datetime.timedelta(0, 330)
2650
>>> rfc3339_duration_to_delta("P1DT3M20S")
2651
datetime.timedelta(1, 200)
2812
2654
# Parsing an RFC 3339 duration with regular expressions is not
2892
2734
def string_to_delta(interval):
2893
2735
"""Parse a string and return a datetime.timedelta
2895
>>> string_to_delta('7d') == datetime.timedelta(7)
2897
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2899
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2901
>>> string_to_delta('24h') == datetime.timedelta(1)
2903
>>> string_to_delta('1w') == datetime.timedelta(7)
2905
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2737
>>> string_to_delta('7d')
2738
datetime.timedelta(7)
2739
>>> string_to_delta('60s')
2740
datetime.timedelta(0, 60)
2741
>>> string_to_delta('60m')
2742
datetime.timedelta(0, 3600)
2743
>>> string_to_delta('24h')
2744
datetime.timedelta(1)
2745
>>> string_to_delta('1w')
2746
datetime.timedelta(7)
2747
>>> string_to_delta('5m 30s')
2748
datetime.timedelta(0, 330)
3633
3470
# End of Avahi example code
3636
GLib.IOChannel.unix_new(tcp_server.fileno()),
3637
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3638
lambda *args, **kwargs: (tcp_server.handle_request
3639
(*args[2:], **kwargs) or True))
3472
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3473
lambda *args, **kwargs:
3474
(tcp_server.handle_request
3475
(*args[2:], **kwargs) or True))
3641
3477
logger.debug("Starting main loop")
3642
3478
main_loop.run()
3652
3488
# Must run before the D-Bus bus name gets deregistered
3656
def should_only_run_tests():
3657
parser = argparse.ArgumentParser(add_help=False)
3658
parser.add_argument("--check", action='store_true')
3659
args, unknown_args = parser.parse_known_args()
3660
run_tests = args.check
3662
# Remove --check argument from sys.argv
3663
sys.argv[1:] = unknown_args
3666
# Add all tests from doctest strings
3667
def load_tests(loader, tests, none):
3669
tests.addTests(doctest.DocTestSuite())
3672
3492
if __name__ == '__main__':
3674
if should_only_run_tests():
3675
# Call using ./mandos --check [--verbose]