To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 896
- compare with another revision
- download diff
- download tarball
- view history from revision 896
- Committer: Teddy Hogeborn
- Date: 2017-02-21 21:42:08 UTC
- Revision ID: teddy@recompile.se-20170221214208-09wu1p4l2hjhqfoj
Use "read -r" in shell scripts to avoid backslash escapes
* initramfs-tools-hook: Use "read -r" to read filenames from network
hook given the "files" argument.
* initramfs-tools-script: Use "read -e" when parsing
"/conf/conf.d/cryptroot".
* mandos-keygen (keygen): Use "read -r" when reading passphrase.
* initramfs-tools-hook: Use "read -r" to read filenames from network
hook given the "files" argument.
* initramfs-tools-script: Use "read -e" when parsing
"/conf/conf.d/cryptroot".
* mandos-keygen (keygen): Use "read -r" when reading passphrase.
- files added:
- initramfs-tools-hook-conf
- files removed:
- debian/mandos-client.templates
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
31
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
32
#
115
114
if sys.version_info.major == 2:
116
115
str = unicode
117
116
118
version = "1.8.4"
117
version = "1.7.14"
119
118
stored_state_file = "clients.pickle"
120
119
121
120
logger = logging.getLogger()
275
274
276
275
277
276
# Pretend that we have an Avahi module
278
class avahi(object):
279
"""This isn't so much a class as it is a module-like namespace."""
277
class Avahi(object):
278
"""This isn't so much a class as it is a module-like namespace.
279
It is instantiated once, and simulates having an Avahi module."""
280
280
IF_UNSPEC = -1 # avahi-common/address.h
281
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
282
PROTO_INET = 0 # avahi-common/address.h
286
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
287
DBUS_PATH_SERVER = "/"
288
288
289
@staticmethod
290
def string_array_to_txt_array(t):
289
def string_array_to_txt_array(self, t):
291
290
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
291
for s in t), signature="ay")
293
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
298
297
SERVER_RUNNING = 2 # avahi-common/defs.h
299
298
SERVER_COLLISION = 3 # avahi-common/defs.h
300
299
SERVER_FAILURE = 4 # avahi-common/defs.h
300
avahi = Avahi()
301
301
302
302
303
303
class AvahiError(Exception):
495
495
class AvahiServiceToSyslog(AvahiService):
496
496
def rename(self, *args, **kwargs):
497
497
"""Add the new name to the syslog messages"""
498
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
498
ret = AvahiService.rename(self, *args, **kwargs)
499
499
syslogger.setFormatter(logging.Formatter(
500
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
501
501
.format(self.name)))
503
503
504
504
505
505
# Pretend that we have a GnuTLS module
506
class gnutls(object):
507
"""This isn't so much a class as it is a module-like namespace."""
506
class GnuTLS(object):
507
"""This isn't so much a class as it is a module-like namespace.
508
It is instantiated once, and simulates having a GnuTLS module."""
508
509
509
510
library = ctypes.util.find_library("gnutls")
510
511
if library is None:
511
512
library = ctypes.util.find_library("gnutls-deb0")
512
513
_library = ctypes.cdll.LoadLibrary(library)
513
514
del library
515
_need_version = b"3.3.0"
516
517
def __init__(self):
518
# Need to use "self" here, since this method is called before
519
# the assignment to the "gnutls" global variable happens.
520
if self.check_version(self._need_version) is None:
521
raise self.Error("Needs GnuTLS {} or later"
522
.format(self._need_version))
514
523
515
524
# Unless otherwise indicated, the constants and types below are
516
525
# all from the gnutls/gnutls.h C header file.
520
529
E_INTERRUPTED = -52
521
530
E_AGAIN = -28
522
531
CRT_OPENPGP = 2
523
CRT_RAWPK = 3
524
532
CLIENT = 2
525
533
SHUT_RDWR = 0
526
534
CRD_CERTIFICATE = 1
527
535
E_NO_CERTIFICATE_FOUND = -49
528
X509_FMT_DER = 0
529
NO_TICKETS = 1<<10
530
ENABLE_RAWPK = 1<<18
531
CTYPE_PEERS = 3
532
KEYID_USE_SHA256 = 1 # gnutls/x509.h
533
536
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
534
537
535
538
# Types
558
561
559
562
# Exceptions
560
563
class Error(Exception):
564
# We need to use the class name "GnuTLS" here, since this
565
# exception might be raised from within GnuTLS.__init__,
566
# which is called before the assignment to the "gnutls"
567
# global variable has happened.
561
568
def __init__(self, message=None, code=None, args=()):
562
569
# Default usage is by a message string, but if a return
563
570
# code is passed, convert it to a string with
564
571
# gnutls.strerror()
565
572
self.code = code
566
573
if message is None and code is not None:
567
message = gnutls.strerror(code)
568
return super(gnutls.Error, self).__init__(
574
message = GnuTLS.strerror(code)
575
return super(GnuTLS.Error, self).__init__(
569
576
message, *args)
570
577
571
578
class CertificateSecurityError(Error):
585
592
class ClientSession(object):
586
593
def __init__(self, socket, credentials=None):
587
594
self._c_object = gnutls.session_t()
588
gnutls_flags = gnutls.CLIENT
589
if gnutls.check_version("3.5.6"):
590
gnutls_flags |= gnutls.NO_TICKETS
591
if gnutls.has_rawpk:
592
gnutls_flags |= gnutls.ENABLE_RAWPK
593
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
594
del gnutls_flags
595
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
595
596
gnutls.set_default_priority(self._c_object)
596
597
gnutls.transport_set_ptr(self._c_object, socket.fileno())
597
598
gnutls.handshake_set_private_extensions(self._c_object,
729
730
check_version.argtypes = [ctypes.c_char_p]
730
731
check_version.restype = ctypes.c_char_p
731
732
732
_need_version = b"3.3.0"
733
if check_version(_need_version) is None:
734
raise self.Error("Needs GnuTLS {} or later"
735
.format(_need_version))
736
737
_tls_rawpk_version = b"3.6.6"
738
has_rawpk = bool(check_version(_tls_rawpk_version))
739
740
if has_rawpk:
741
# Types
742
class pubkey_st(ctypes.Structure):
743
_fields = []
744
pubkey_t = ctypes.POINTER(pubkey_st)
745
746
x509_crt_fmt_t = ctypes.c_int
747
748
# All the function declarations below are from gnutls/abstract.h
749
pubkey_init = _library.gnutls_pubkey_init
750
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
751
pubkey_init.restype = _error_code
752
753
pubkey_import = _library.gnutls_pubkey_import
754
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
755
x509_crt_fmt_t]
756
pubkey_import.restype = _error_code
757
758
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
759
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
760
ctypes.POINTER(ctypes.c_ubyte),
761
ctypes.POINTER(ctypes.c_size_t)]
762
pubkey_get_key_id.restype = _error_code
763
764
pubkey_deinit = _library.gnutls_pubkey_deinit
765
pubkey_deinit.argtypes = [pubkey_t]
766
pubkey_deinit.restype = None
767
else:
768
# All the function declarations below are from gnutls/openpgp.h
769
770
openpgp_crt_init = _library.gnutls_openpgp_crt_init
771
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
772
openpgp_crt_init.restype = _error_code
773
774
openpgp_crt_import = _library.gnutls_openpgp_crt_import
775
openpgp_crt_import.argtypes = [openpgp_crt_t,
776
ctypes.POINTER(datum_t),
777
openpgp_crt_fmt_t]
778
openpgp_crt_import.restype = _error_code
779
780
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
781
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
782
ctypes.POINTER(ctypes.c_uint)]
783
openpgp_crt_verify_self.restype = _error_code
784
785
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
786
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
787
openpgp_crt_deinit.restype = None
788
789
openpgp_crt_get_fingerprint = (
790
_library.gnutls_openpgp_crt_get_fingerprint)
791
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
792
ctypes.c_void_p,
793
ctypes.POINTER(
794
ctypes.c_size_t)]
795
openpgp_crt_get_fingerprint.restype = _error_code
796
797
if check_version("3.6.4"):
798
certificate_type_get2 = _library.gnutls_certificate_type_get2
799
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
800
certificate_type_get2.restype = _error_code
733
# All the function declarations below are from gnutls/openpgp.h
734
735
openpgp_crt_init = _library.gnutls_openpgp_crt_init
736
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
737
openpgp_crt_init.restype = _error_code
738
739
openpgp_crt_import = _library.gnutls_openpgp_crt_import
740
openpgp_crt_import.argtypes = [openpgp_crt_t,
741
ctypes.POINTER(datum_t),
742
openpgp_crt_fmt_t]
743
openpgp_crt_import.restype = _error_code
744
745
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
746
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
747
ctypes.POINTER(ctypes.c_uint)]
748
openpgp_crt_verify_self.restype = _error_code
749
750
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
751
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
752
openpgp_crt_deinit.restype = None
753
754
openpgp_crt_get_fingerprint = (
755
_library.gnutls_openpgp_crt_get_fingerprint)
756
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
757
ctypes.c_void_p,
758
ctypes.POINTER(
759
ctypes.c_size_t)]
760
openpgp_crt_get_fingerprint.restype = _error_code
801
761
802
762
# Remove non-public functions
803
763
del _error_code, _retry_on_error
764
# Create the global "gnutls" object, simulating a module
765
gnutls = GnuTLS()
804
766
805
767
806
768
def call_pipe(connection, # : multiprocessing.Connection
837
799
disable_initiator_tag: a GLib event source tag, or None
838
800
enabled: bool()
839
801
fingerprint: string (40 or 32 hexadecimal digits); used to
840
uniquely identify an OpenPGP client
841
key_id: string (64 hexadecimal digits); used to uniquely identify
842
a client using raw public keys
802
uniquely identify the client
843
803
host: string; available for use by the checker command
844
804
interval: datetime.timedelta(); How often to start a new checker
845
805
last_approval_request: datetime.datetime(); (UTC) or None
863
823
"""
864
824
865
825
runtime_expansions = ("approval_delay", "approval_duration",
866
"created", "enabled", "expires", "key_id",
826
"created", "enabled", "expires",
867
827
"fingerprint", "host", "interval",
868
828
"last_approval_request", "last_checked_ok",
869
829
"last_enabled", "name", "timeout")
899
859
client["enabled"] = config.getboolean(client_name,
900
860
"enabled")
901
861
902
# Uppercase and remove spaces from key_id and fingerprint
903
# for later comparison purposes with return value from the
904
# key_id() and fingerprint() functions
905
client["key_id"] = (section.get("key_id", "").upper()
906
.replace(" ", ""))
862
# Uppercase and remove spaces from fingerprint for later
863
# comparison purposes with return value from the
864
# fingerprint() function
907
865
client["fingerprint"] = (section["fingerprint"].upper()
908
866
.replace(" ", ""))
909
867
if "secret" in section:
953
911
self.expires = None
954
912
955
913
logger.debug("Creating client %r", self.name)
956
logger.debug(" Key ID: %s", self.key_id)
957
914
logger.debug(" Fingerprint: %s", self.fingerprint)
958
915
self.created = settings.get("created",
959
916
datetime.datetime.utcnow())
2041
1998
def Name_dbus_property(self):
2042
1999
return dbus.String(self.name)
2043
2000
2044
# KeyID - property
2045
@dbus_annotations(
2046
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2047
@dbus_service_property(_interface, signature="s", access="read")
2048
def KeyID_dbus_property(self):
2049
return dbus.String(self.key_id)
2050
2051
2001
# Fingerprint - property
2052
2002
@dbus_annotations(
2053
2003
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2209
2159
2210
2160
2211
2161
class ProxyClient(object):
2212
def __init__(self, child_pipe, key_id, fpr, address):
2162
def __init__(self, child_pipe, fpr, address):
2213
2163
self._pipe = child_pipe
2214
self._pipe.send(('init', key_id, fpr, address))
2164
self._pipe.send(('init', fpr, address))
2215
2165
if not self._pipe.recv():
2216
raise KeyError(key_id or fpr)
2166
raise KeyError(fpr)
2217
2167
2218
2168
def __getattribute__(self, name):
2219
2169
if name == '_pipe':
2286
2236
2287
2237
approval_required = False
2288
2238
try:
2289
if gnutls.has_rawpk:
2290
fpr = ""
2291
try:
2292
key_id = self.key_id(
2293
self.peer_certificate(session))
2294
except (TypeError, gnutls.Error) as error:
2295
logger.warning("Bad certificate: %s", error)
2296
return
2297
logger.debug("Key ID: %s", key_id)
2298
2299
else:
2300
key_id = ""
2301
try:
2302
fpr = self.fingerprint(
2303
self.peer_certificate(session))
2304
except (TypeError, gnutls.Error) as error:
2305
logger.warning("Bad certificate: %s", error)
2306
return
2307
logger.debug("Fingerprint: %s", fpr)
2308
2309
try:
2310
client = ProxyClient(child_pipe, key_id, fpr,
2239
try:
2240
fpr = self.fingerprint(
2241
self.peer_certificate(session))
2242
except (TypeError, gnutls.Error) as error:
2243
logger.warning("Bad certificate: %s", error)
2244
return
2245
logger.debug("Fingerprint: %s", fpr)
2246
2247
try:
2248
client = ProxyClient(child_pipe, fpr,
2311
2249
self.client_address)
2312
2250
except KeyError:
2313
2251
return
2390
2328
2391
2329
@staticmethod
2392
2330
def peer_certificate(session):
2393
"Return the peer's certificate as a bytestring"
2394
try:
2395
cert_type = gnutls.certificate_type_get2(session._c_object,
2396
gnutls.CTYPE_PEERS)
2397
except AttributeError:
2398
cert_type = gnutls.certificate_type_get(session._c_object)
2399
if gnutls.has_rawpk:
2400
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2401
else:
2402
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2403
# If not a valid certificate type...
2404
if cert_type not in valid_cert_types:
2405
logger.info("Cert type %r not in %r", cert_type,
2406
valid_cert_types)
2331
"Return the peer's OpenPGP certificate as a bytestring"
2332
# If not an OpenPGP certificate...
2333
if (gnutls.certificate_type_get(session._c_object)
2334
!= gnutls.CRT_OPENPGP):
2407
2335
# ...return invalid data
2408
2336
return b""
2409
2337
list_size = ctypes.c_uint(1)
2417
2345
return ctypes.string_at(cert.data, cert.size)
2418
2346
2419
2347
@staticmethod
2420
def key_id(certificate):
2421
"Convert a certificate bytestring to a hexdigit key ID"
2422
# New GnuTLS "datum" with the public key
2423
datum = gnutls.datum_t(
2424
ctypes.cast(ctypes.c_char_p(certificate),
2425
ctypes.POINTER(ctypes.c_ubyte)),
2426
ctypes.c_uint(len(certificate)))
2427
# XXX all these need to be created in the gnutls "module"
2428
# New empty GnuTLS certificate
2429
pubkey = gnutls.pubkey_t()
2430
gnutls.pubkey_init(ctypes.byref(pubkey))
2431
# Import the raw public key into the certificate
2432
gnutls.pubkey_import(pubkey,
2433
ctypes.byref(datum),
2434
gnutls.X509_FMT_DER)
2435
# New buffer for the key ID
2436
buf = ctypes.create_string_buffer(32)
2437
buf_len = ctypes.c_size_t(len(buf))
2438
# Get the key ID from the raw public key into the buffer
2439
gnutls.pubkey_get_key_id(pubkey,
2440
gnutls.KEYID_USE_SHA256,
2441
ctypes.cast(ctypes.byref(buf),
2442
ctypes.POINTER(ctypes.c_ubyte)),
2443
ctypes.byref(buf_len))
2444
# Deinit the certificate
2445
gnutls.pubkey_deinit(pubkey)
2446
2447
# Convert the buffer to a Python bytestring
2448
key_id = ctypes.string_at(buf, buf_len.value)
2449
# Convert the bytestring to hexadecimal notation
2450
hex_key_id = binascii.hexlify(key_id).upper()
2451
return hex_key_id
2452
2453
@staticmethod
2454
2348
def fingerprint(openpgp):
2455
2349
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2456
2350
# New GnuTLS "datum" with the OpenPGP public key
2470
2364
ctypes.byref(crtverify))
2471
2365
if crtverify.value != 0:
2472
2366
gnutls.openpgp_crt_deinit(crt)
2473
raise gnutls.CertificateSecurityError(code
2474
=crtverify.value)
2367
raise gnutls.CertificateSecurityError("Verify failed")
2475
2368
# New buffer for the fingerprint
2476
2369
buf = ctypes.create_string_buffer(20)
2477
2370
buf_len = ctypes.c_size_t()
2684
2577
command = request[0]
2685
2578
2686
2579
if command == 'init':
2687
key_id = request[1].decode("ascii")
2688
fpr = request[2].decode("ascii")
2689
address = request[3]
2580
fpr = request[1]
2581
address = request[2]
2690
2582
2691
2583
for c in self.clients.values():
2692
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2693
continue
2694
if key_id and c.key_id == key_id:
2695
client = c
2696
break
2697
if fpr and c.fingerprint == fpr:
2584
if c.fingerprint == fpr:
2698
2585
client = c
2699
2586
break
2700
2587
else:
2701
logger.info("Client not found for key ID: %s, address"
2702
": %s", key_id or fpr, address)
2588
logger.info("Client not found for fingerprint: %s, ad"
2589
"dress: %s", fpr, address)
2703
2590
if self.use_dbus:
2704
2591
# Emit D-Bus signal
2705
mandos_dbus_service.ClientNotFound(key_id or fpr,
2592
mandos_dbus_service.ClientNotFound(fpr,
2706
2593
address[0])
2707
2594
parent_pipe.send(False)
2708
2595
return False
2971
2858
sys.exit(os.EX_OK if fail_count == 0 else 1)
2972
2859
2973
2860
# Default values for config file for server-global settings
2974
if gnutls.has_rawpk:
2975
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2976
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2977
else:
2978
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2979
":+SIGN-DSA-SHA256")
2980
2861
server_defaults = {"interface": "",
2981
2862
"address": "",
2982
2863
"port": "",
2983
2864
"debug": "False",
2984
"priority": priority,
2865
"priority":
2866
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2867
":+SIGN-DSA-SHA256",
2985
2868
"servicename": "Mandos",
2986
2869
"use_dbus": "True",
2987
2870
"use_ipv6": "True",
2992
2875
"foreground": "False",
2993
2876
"zeroconf": "True",
2994
2877
}
2995
del priority
2996
2878
2997
2879
# Parse config file for server-global settings
2998
2880
server_config = configparser.SafeConfigParser(server_defaults)
3001
2883
# Convert the SafeConfigParser object to a dict
3002
2884
server_settings = server_config.defaults()
3003
2885
# Use the appropriate methods on the non-string config options
3004
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3005
"foreground", "zeroconf"):
2886
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3006
2887
server_settings[option] = server_config.getboolean("DEFAULT",
3007
2888
option)
3008
2889
if server_settings["port"]:
3242
3123
for k in ("name", "host"):
3243
3124
if isinstance(value[k], bytes):
3244
3125
value[k] = value[k].decode("utf-8")
3245
if not value.has_key("key_id"):
3246
value["key_id"] = ""
3247
elif not value.has_key("fingerprint"):
3248
value["fingerprint"] = ""
3249
3126
# old_client_settings
3250
3127
# .keys()
3251
3128
old_client_settings = {
3388
3265
pass
3389
3266
3390
3267
@dbus.service.signal(_interface, signature="ss")
3391
def ClientNotFound(self, key_id, address):
3268
def ClientNotFound(self, fingerprint, address):
3392
3269
"D-Bus signal"
3393
3270
pass
3394
3271
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0