To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 905
- compare with another revision
- download diff
- download tarball
- view history from revision 905
- Committer: Teddy Hogeborn
- Date: 2017-08-20 14:14:14 UTC
- Revision ID: teddy@recompile.se-20170820141414-m034xuebg7ccaeui
Add some more restrictions to the systemd service file.
* mandos.service ([Service]/ProtectKernelTunables): New; set to "yes".
([Service]/ProtectControlGroups): - '' -
* mandos.service ([Service]/ProtectKernelTunables): New; set to "yes".
([Service]/ProtectControlGroups): - '' -
- files added:
- initramfs-tools-hook-conf
- files removed:
- debian/mandos-client.templates
- debian/tests
- dracut-module
- files modified:
- .bzrignore
added
removed
mandos
1
#!/usr/bin/python3 -bI
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
1
#!/usr/bin/python
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
5
5
#
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
16
#
17
# This file is part of Mandos.
18
#
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2017 Teddy Hogeborn
15
# Copyright © 2008-2017 Björn Påhlsson
16
#
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
23
21
#
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
28
26
#
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
31
30
#
32
31
# Contact the authors at <mandos@recompile.se>.
33
32
#
77
76
import itertools
78
77
import collections
79
78
import codecs
80
import unittest
81
79
82
80
import dbus
83
81
import dbus.service
84
import gi
85
82
from gi.repository import GLib
86
83
from dbus.mainloop.glib import DBusGMainLoop
87
84
import ctypes
89
86
import xml.dom.minidom
90
87
import inspect
91
88
92
if sys.version_info.major == 2:
93
__metaclass__ = type
94
95
# Show warnings by default
96
if not sys.warnoptions:
97
import warnings
98
warnings.simplefilter("default")
99
100
89
# Try to find the value of SO_BINDTODEVICE:
101
90
try:
102
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
125
114
if sys.version_info.major == 2:
126
115
str = unicode
127
116
128
if sys.version_info < (3, 2):
129
configparser.Configparser = configparser.SafeConfigParser
130
131
version = "1.8.9"
117
version = "1.7.15"
132
118
stored_state_file = "clients.pickle"
133
119
134
120
logger = logging.getLogger()
135
logging.captureWarnings(True) # Show warnings via the logging system
136
121
syslogger = None
137
122
138
123
try:
193
178
pass
194
179
195
180
196
class PGPEngine:
181
class PGPEngine(object):
197
182
"""A simple class for OpenPGP symmetric encryption & decryption"""
198
183
199
184
def __init__(self):
203
188
output = subprocess.check_output(["gpgconf"])
204
189
for line in output.splitlines():
205
190
name, text, path = line.split(b":")
206
if name == b"gpg":
191
if name == "gpg":
207
192
self.gpg = path
208
193
break
209
194
except OSError as e:
214
199
'--force-mdc',
215
200
'--quiet']
216
201
# Only GPG version 1 has the --no-use-agent option.
217
if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):
202
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
218
203
self.gnupgargs.append("--no-use-agent")
219
204
220
205
def __enter__(self):
289
274
290
275
291
276
# Pretend that we have an Avahi module
292
class avahi:
293
"""This isn't so much a class as it is a module-like namespace."""
277
class Avahi(object):
278
"""This isn't so much a class as it is a module-like namespace.
279
It is instantiated once, and simulates having an Avahi module."""
294
280
IF_UNSPEC = -1 # avahi-common/address.h
295
281
PROTO_UNSPEC = -1 # avahi-common/address.h
296
282
PROTO_INET = 0 # avahi-common/address.h
300
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
301
287
DBUS_PATH_SERVER = "/"
302
288
303
@staticmethod
304
def string_array_to_txt_array(t):
289
def string_array_to_txt_array(self, t):
305
290
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
306
291
for s in t), signature="ay")
307
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
312
297
SERVER_RUNNING = 2 # avahi-common/defs.h
313
298
SERVER_COLLISION = 3 # avahi-common/defs.h
314
299
SERVER_FAILURE = 4 # avahi-common/defs.h
300
avahi = Avahi()
315
301
316
302
317
303
class AvahiError(Exception):
329
315
pass
330
316
331
317
332
class AvahiService:
318
class AvahiService(object):
333
319
"""An Avahi (Zeroconf) service.
334
320
335
321
Attributes:
509
495
class AvahiServiceToSyslog(AvahiService):
510
496
def rename(self, *args, **kwargs):
511
497
"""Add the new name to the syslog messages"""
512
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
498
ret = AvahiService.rename(self, *args, **kwargs)
513
499
syslogger.setFormatter(logging.Formatter(
514
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
515
501
.format(self.name)))
517
503
518
504
519
505
# Pretend that we have a GnuTLS module
520
class gnutls:
521
"""This isn't so much a class as it is a module-like namespace."""
506
class GnuTLS(object):
507
"""This isn't so much a class as it is a module-like namespace.
508
It is instantiated once, and simulates having a GnuTLS module."""
522
509
523
510
library = ctypes.util.find_library("gnutls")
524
511
if library is None:
525
512
library = ctypes.util.find_library("gnutls-deb0")
526
513
_library = ctypes.cdll.LoadLibrary(library)
527
514
del library
515
_need_version = b"3.3.0"
516
517
def __init__(self):
518
# Need to use "self" here, since this method is called before
519
# the assignment to the "gnutls" global variable happens.
520
if self.check_version(self._need_version) is None:
521
raise self.Error("Needs GnuTLS {} or later"
522
.format(self._need_version))
528
523
529
524
# Unless otherwise indicated, the constants and types below are
530
525
# all from the gnutls/gnutls.h C header file.
534
529
E_INTERRUPTED = -52
535
530
E_AGAIN = -28
536
531
CRT_OPENPGP = 2
537
CRT_RAWPK = 3
538
532
CLIENT = 2
539
533
SHUT_RDWR = 0
540
534
CRD_CERTIFICATE = 1
541
535
E_NO_CERTIFICATE_FOUND = -49
542
X509_FMT_DER = 0
543
NO_TICKETS = 1<<10
544
ENABLE_RAWPK = 1<<18
545
CTYPE_PEERS = 3
546
KEYID_USE_SHA256 = 1 # gnutls/x509.h
547
536
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
548
537
549
538
# Types
572
561
573
562
# Exceptions
574
563
class Error(Exception):
564
# We need to use the class name "GnuTLS" here, since this
565
# exception might be raised from within GnuTLS.__init__,
566
# which is called before the assignment to the "gnutls"
567
# global variable has happened.
575
568
def __init__(self, message=None, code=None, args=()):
576
569
# Default usage is by a message string, but if a return
577
570
# code is passed, convert it to a string with
578
571
# gnutls.strerror()
579
572
self.code = code
580
573
if message is None and code is not None:
581
message = gnutls.strerror(code)
582
return super(gnutls.Error, self).__init__(
574
message = GnuTLS.strerror(code)
575
return super(GnuTLS.Error, self).__init__(
583
576
message, *args)
584
577
585
578
class CertificateSecurityError(Error):
586
579
pass
587
580
588
581
# Classes
589
class Credentials:
582
class Credentials(object):
590
583
def __init__(self):
591
584
self._c_object = gnutls.certificate_credentials_t()
592
585
gnutls.certificate_allocate_credentials(
596
589
def __del__(self):
597
590
gnutls.certificate_free_credentials(self._c_object)
598
591
599
class ClientSession:
592
class ClientSession(object):
600
593
def __init__(self, socket, credentials=None):
601
594
self._c_object = gnutls.session_t()
602
gnutls_flags = gnutls.CLIENT
603
if gnutls.check_version(b"3.5.6"):
604
gnutls_flags |= gnutls.NO_TICKETS
605
if gnutls.has_rawpk:
606
gnutls_flags |= gnutls.ENABLE_RAWPK
607
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
608
del gnutls_flags
595
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
609
596
gnutls.set_default_priority(self._c_object)
610
597
gnutls.transport_set_ptr(self._c_object, socket.fileno())
611
598
gnutls.handshake_set_private_extensions(self._c_object,
743
730
check_version.argtypes = [ctypes.c_char_p]
744
731
check_version.restype = ctypes.c_char_p
745
732
746
_need_version = b"3.3.0"
747
if check_version(_need_version) is None:
748
raise self.Error("Needs GnuTLS {} or later"
749
.format(_need_version))
750
751
_tls_rawpk_version = b"3.6.6"
752
has_rawpk = bool(check_version(_tls_rawpk_version))
753
754
if has_rawpk:
755
# Types
756
class pubkey_st(ctypes.Structure):
757
_fields = []
758
pubkey_t = ctypes.POINTER(pubkey_st)
759
760
x509_crt_fmt_t = ctypes.c_int
761
762
# All the function declarations below are from gnutls/abstract.h
763
pubkey_init = _library.gnutls_pubkey_init
764
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
765
pubkey_init.restype = _error_code
766
767
pubkey_import = _library.gnutls_pubkey_import
768
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
769
x509_crt_fmt_t]
770
pubkey_import.restype = _error_code
771
772
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
773
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
774
ctypes.POINTER(ctypes.c_ubyte),
775
ctypes.POINTER(ctypes.c_size_t)]
776
pubkey_get_key_id.restype = _error_code
777
778
pubkey_deinit = _library.gnutls_pubkey_deinit
779
pubkey_deinit.argtypes = [pubkey_t]
780
pubkey_deinit.restype = None
781
else:
782
# All the function declarations below are from gnutls/openpgp.h
783
784
openpgp_crt_init = _library.gnutls_openpgp_crt_init
785
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
786
openpgp_crt_init.restype = _error_code
787
788
openpgp_crt_import = _library.gnutls_openpgp_crt_import
789
openpgp_crt_import.argtypes = [openpgp_crt_t,
790
ctypes.POINTER(datum_t),
791
openpgp_crt_fmt_t]
792
openpgp_crt_import.restype = _error_code
793
794
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
795
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
796
ctypes.POINTER(ctypes.c_uint)]
797
openpgp_crt_verify_self.restype = _error_code
798
799
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
800
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
801
openpgp_crt_deinit.restype = None
802
803
openpgp_crt_get_fingerprint = (
804
_library.gnutls_openpgp_crt_get_fingerprint)
805
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
806
ctypes.c_void_p,
807
ctypes.POINTER(
808
ctypes.c_size_t)]
809
openpgp_crt_get_fingerprint.restype = _error_code
810
811
if check_version(b"3.6.4"):
812
certificate_type_get2 = _library.gnutls_certificate_type_get2
813
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
814
certificate_type_get2.restype = _error_code
733
# All the function declarations below are from gnutls/openpgp.h
734
735
openpgp_crt_init = _library.gnutls_openpgp_crt_init
736
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
737
openpgp_crt_init.restype = _error_code
738
739
openpgp_crt_import = _library.gnutls_openpgp_crt_import
740
openpgp_crt_import.argtypes = [openpgp_crt_t,
741
ctypes.POINTER(datum_t),
742
openpgp_crt_fmt_t]
743
openpgp_crt_import.restype = _error_code
744
745
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
746
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
747
ctypes.POINTER(ctypes.c_uint)]
748
openpgp_crt_verify_self.restype = _error_code
749
750
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
751
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
752
openpgp_crt_deinit.restype = None
753
754
openpgp_crt_get_fingerprint = (
755
_library.gnutls_openpgp_crt_get_fingerprint)
756
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
757
ctypes.c_void_p,
758
ctypes.POINTER(
759
ctypes.c_size_t)]
760
openpgp_crt_get_fingerprint.restype = _error_code
815
761
816
762
# Remove non-public functions
817
763
del _error_code, _retry_on_error
764
# Create the global "gnutls" object, simulating a module
765
gnutls = GnuTLS()
818
766
819
767
820
768
def call_pipe(connection, # : multiprocessing.Connection
828
776
connection.close()
829
777
830
778
831
class Client:
779
class Client(object):
832
780
"""A representation of a client host served by this server.
833
781
834
782
Attributes:
835
783
approved: bool(); 'None' if not yet approved/disapproved
836
784
approval_delay: datetime.timedelta(); Time to wait for approval
837
785
approval_duration: datetime.timedelta(); Duration of one approval
838
checker: multiprocessing.Process(); a running checker process used
839
to see if the client lives. 'None' if no process is
840
running.
786
checker: subprocess.Popen(); a running checker process used
787
to see if the client lives.
788
'None' if no process is running.
841
789
checker_callback_tag: a GLib event source tag, or None
842
790
checker_command: string; External command which is run to check
843
791
if client lives. %() expansions are done at
851
799
disable_initiator_tag: a GLib event source tag, or None
852
800
enabled: bool()
853
801
fingerprint: string (40 or 32 hexadecimal digits); used to
854
uniquely identify an OpenPGP client
855
key_id: string (64 hexadecimal digits); used to uniquely identify
856
a client using raw public keys
802
uniquely identify the client
857
803
host: string; available for use by the checker command
858
804
interval: datetime.timedelta(); How often to start a new checker
859
805
last_approval_request: datetime.datetime(); (UTC) or None
877
823
"""
878
824
879
825
runtime_expansions = ("approval_delay", "approval_duration",
880
"created", "enabled", "expires", "key_id",
826
"created", "enabled", "expires",
881
827
"fingerprint", "host", "interval",
882
828
"last_approval_request", "last_checked_ok",
883
829
"last_enabled", "name", "timeout")
913
859
client["enabled"] = config.getboolean(client_name,
914
860
"enabled")
915
861
916
# Uppercase and remove spaces from key_id and fingerprint
917
# for later comparison purposes with return value from the
918
# key_id() and fingerprint() functions
919
client["key_id"] = (section.get("key_id", "").upper()
920
.replace(" ", ""))
862
# Uppercase and remove spaces from fingerprint for later
863
# comparison purposes with return value from the
864
# fingerprint() function
921
865
client["fingerprint"] = (section["fingerprint"].upper()
922
866
.replace(" ", ""))
923
867
if "secret" in section:
967
911
self.expires = None
968
912
969
913
logger.debug("Creating client %r", self.name)
970
logger.debug(" Key ID: %s", self.key_id)
971
914
logger.debug(" Fingerprint: %s", self.fingerprint)
972
915
self.created = settings.get("created",
973
916
datetime.datetime.utcnow())
1050
993
def checker_callback(self, source, condition, connection,
1051
994
command):
1052
995
"""The checker has completed, so take appropriate actions."""
996
self.checker_callback_tag = None
997
self.checker = None
1053
998
# Read return code from connection (see call_pipe)
1054
999
returncode = connection.recv()
1055
1000
connection.close()
1056
if self.checker is not None:
1057
self.checker.join()
1058
self.checker_callback_tag = None
1059
self.checker = None
1060
1001
1061
1002
if returncode >= 0:
1062
1003
self.last_checker_status = returncode
1151
1092
kwargs=popen_args)
1152
1093
self.checker.start()
1153
1094
self.checker_callback_tag = GLib.io_add_watch(
1154
GLib.IOChannel.unix_new(pipe[0].fileno()),
1155
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1095
pipe[0].fileno(), GLib.IO_IN,
1156
1096
self.checker_callback, pipe[0], command)
1157
1097
# Re-run this periodically if run by GLib.timeout_add
1158
1098
return True
2058
1998
def Name_dbus_property(self):
2059
1999
return dbus.String(self.name)
2060
2000
2061
# KeyID - property
2062
@dbus_annotations(
2063
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2064
@dbus_service_property(_interface, signature="s", access="read")
2065
def KeyID_dbus_property(self):
2066
return dbus.String(self.key_id)
2067
2068
2001
# Fingerprint - property
2069
2002
@dbus_annotations(
2070
2003
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2225
2158
del _interface
2226
2159
2227
2160
2228
class ProxyClient:
2229
def __init__(self, child_pipe, key_id, fpr, address):
2161
class ProxyClient(object):
2162
def __init__(self, child_pipe, fpr, address):
2230
2163
self._pipe = child_pipe
2231
self._pipe.send(('init', key_id, fpr, address))
2164
self._pipe.send(('init', fpr, address))
2232
2165
if not self._pipe.recv():
2233
raise KeyError(key_id or fpr)
2166
raise KeyError(fpr)
2234
2167
2235
2168
def __getattribute__(self, name):
2236
2169
if name == '_pipe':
2303
2236
2304
2237
approval_required = False
2305
2238
try:
2306
if gnutls.has_rawpk:
2307
fpr = b""
2308
try:
2309
key_id = self.key_id(
2310
self.peer_certificate(session))
2311
except (TypeError, gnutls.Error) as error:
2312
logger.warning("Bad certificate: %s", error)
2313
return
2314
logger.debug("Key ID: %s", key_id)
2315
2316
else:
2317
key_id = b""
2318
try:
2319
fpr = self.fingerprint(
2320
self.peer_certificate(session))
2321
except (TypeError, gnutls.Error) as error:
2322
logger.warning("Bad certificate: %s", error)
2323
return
2324
logger.debug("Fingerprint: %s", fpr)
2325
2326
try:
2327
client = ProxyClient(child_pipe, key_id, fpr,
2239
try:
2240
fpr = self.fingerprint(
2241
self.peer_certificate(session))
2242
except (TypeError, gnutls.Error) as error:
2243
logger.warning("Bad certificate: %s", error)
2244
return
2245
logger.debug("Fingerprint: %s", fpr)
2246
2247
try:
2248
client = ProxyClient(child_pipe, fpr,
2328
2249
self.client_address)
2329
2250
except KeyError:
2330
2251
return
2407
2328
2408
2329
@staticmethod
2409
2330
def peer_certificate(session):
2410
"Return the peer's certificate as a bytestring"
2411
try:
2412
cert_type = gnutls.certificate_type_get2(session._c_object,
2413
gnutls.CTYPE_PEERS)
2414
except AttributeError:
2415
cert_type = gnutls.certificate_type_get(session._c_object)
2416
if gnutls.has_rawpk:
2417
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2418
else:
2419
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2420
# If not a valid certificate type...
2421
if cert_type not in valid_cert_types:
2422
logger.info("Cert type %r not in %r", cert_type,
2423
valid_cert_types)
2331
"Return the peer's OpenPGP certificate as a bytestring"
2332
# If not an OpenPGP certificate...
2333
if (gnutls.certificate_type_get(session._c_object)
2334
!= gnutls.CRT_OPENPGP):
2424
2335
# ...return invalid data
2425
2336
return b""
2426
2337
list_size = ctypes.c_uint(1)
2434
2345
return ctypes.string_at(cert.data, cert.size)
2435
2346
2436
2347
@staticmethod
2437
def key_id(certificate):
2438
"Convert a certificate bytestring to a hexdigit key ID"
2439
# New GnuTLS "datum" with the public key
2440
datum = gnutls.datum_t(
2441
ctypes.cast(ctypes.c_char_p(certificate),
2442
ctypes.POINTER(ctypes.c_ubyte)),
2443
ctypes.c_uint(len(certificate)))
2444
# XXX all these need to be created in the gnutls "module"
2445
# New empty GnuTLS certificate
2446
pubkey = gnutls.pubkey_t()
2447
gnutls.pubkey_init(ctypes.byref(pubkey))
2448
# Import the raw public key into the certificate
2449
gnutls.pubkey_import(pubkey,
2450
ctypes.byref(datum),
2451
gnutls.X509_FMT_DER)
2452
# New buffer for the key ID
2453
buf = ctypes.create_string_buffer(32)
2454
buf_len = ctypes.c_size_t(len(buf))
2455
# Get the key ID from the raw public key into the buffer
2456
gnutls.pubkey_get_key_id(pubkey,
2457
gnutls.KEYID_USE_SHA256,
2458
ctypes.cast(ctypes.byref(buf),
2459
ctypes.POINTER(ctypes.c_ubyte)),
2460
ctypes.byref(buf_len))
2461
# Deinit the certificate
2462
gnutls.pubkey_deinit(pubkey)
2463
2464
# Convert the buffer to a Python bytestring
2465
key_id = ctypes.string_at(buf, buf_len.value)
2466
# Convert the bytestring to hexadecimal notation
2467
hex_key_id = binascii.hexlify(key_id).upper()
2468
return hex_key_id
2469
2470
@staticmethod
2471
2348
def fingerprint(openpgp):
2472
2349
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2473
2350
# New GnuTLS "datum" with the OpenPGP public key
2487
2364
ctypes.byref(crtverify))
2488
2365
if crtverify.value != 0:
2489
2366
gnutls.openpgp_crt_deinit(crt)
2490
raise gnutls.CertificateSecurityError(code
2491
=crtverify.value)
2367
raise gnutls.CertificateSecurityError("Verify failed")
2492
2368
# New buffer for the fingerprint
2493
2369
buf = ctypes.create_string_buffer(20)
2494
2370
buf_len = ctypes.c_size_t()
2504
2380
return hex_fpr
2505
2381
2506
2382
2507
class MultiprocessingMixIn:
2383
class MultiprocessingMixIn(object):
2508
2384
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2509
2385
2510
2386
def sub_process_main(self, request, address):
2522
2398
return proc
2523
2399
2524
2400
2525
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2401
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2526
2402
""" adds a pipe to the MixIn """
2527
2403
2528
2404
def process_request(self, request, client_address):
2543
2419
2544
2420
2545
2421
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2546
socketserver.TCPServer):
2422
socketserver.TCPServer, object):
2547
2423
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2548
2424
2549
2425
Attributes:
2622
2498
raise
2623
2499
# Only bind(2) the socket if we really need to.
2624
2500
if self.server_address[0] or self.server_address[1]:
2625
if self.server_address[1]:
2626
self.allow_reuse_address = True
2627
2501
if not self.server_address[0]:
2628
2502
if self.address_family == socket.AF_INET6:
2629
2503
any_address = "::" # in6addr_any
2682
2556
def add_pipe(self, parent_pipe, proc):
2683
2557
# Call "handle_ipc" for both data and EOF events
2684
2558
GLib.io_add_watch(
2685
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2686
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2559
parent_pipe.fileno(),
2560
GLib.IO_IN | GLib.IO_HUP,
2687
2561
functools.partial(self.handle_ipc,
2688
2562
parent_pipe=parent_pipe,
2689
2563
proc=proc))
2703
2577
command = request[0]
2704
2578
2705
2579
if command == 'init':
2706
key_id = request[1].decode("ascii")
2707
fpr = request[2].decode("ascii")
2708
address = request[3]
2580
fpr = request[1]
2581
address = request[2]
2709
2582
2710
2583
for c in self.clients.values():
2711
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2712
continue
2713
if key_id and c.key_id == key_id:
2714
client = c
2715
break
2716
if fpr and c.fingerprint == fpr:
2584
if c.fingerprint == fpr:
2717
2585
client = c
2718
2586
break
2719
2587
else:
2720
logger.info("Client not found for key ID: %s, address"
2721
": %s", key_id or fpr, address)
2588
logger.info("Client not found for fingerprint: %s, ad"
2589
"dress: %s", fpr, address)
2722
2590
if self.use_dbus:
2723
2591
# Emit D-Bus signal
2724
mandos_dbus_service.ClientNotFound(key_id or fpr,
2592
mandos_dbus_service.ClientNotFound(fpr,
2725
2593
address[0])
2726
2594
parent_pipe.send(False)
2727
2595
return False
2728
2596
2729
2597
GLib.io_add_watch(
2730
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2731
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2598
parent_pipe.fileno(),
2599
GLib.IO_IN | GLib.IO_HUP,
2732
2600
functools.partial(self.handle_ipc,
2733
2601
parent_pipe=parent_pipe,
2734
2602
proc=proc,
2766
2634
def rfc3339_duration_to_delta(duration):
2767
2635
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2768
2636
2769
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2770
True
2771
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2772
True
2773
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2774
True
2775
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2776
True
2777
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2778
True
2779
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2780
True
2781
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2782
True
2637
>>> rfc3339_duration_to_delta("P7D")
2638
datetime.timedelta(7)
2639
>>> rfc3339_duration_to_delta("PT60S")
2640
datetime.timedelta(0, 60)
2641
>>> rfc3339_duration_to_delta("PT60M")
2642
datetime.timedelta(0, 3600)
2643
>>> rfc3339_duration_to_delta("PT24H")
2644
datetime.timedelta(1)
2645
>>> rfc3339_duration_to_delta("P1W")
2646
datetime.timedelta(7)
2647
>>> rfc3339_duration_to_delta("PT5M30S")
2648
datetime.timedelta(0, 330)
2649
>>> rfc3339_duration_to_delta("P1DT3M20S")
2650
datetime.timedelta(1, 200)
2783
2651
"""
2784
2652
2785
2653
# Parsing an RFC 3339 duration with regular expressions is not
2865
2733
def string_to_delta(interval):
2866
2734
"""Parse a string and return a datetime.timedelta
2867
2735
2868
>>> string_to_delta('7d') == datetime.timedelta(7)
2869
True
2870
>>> string_to_delta('60s') == datetime.timedelta(0, 60)
2871
True
2872
>>> string_to_delta('60m') == datetime.timedelta(0, 3600)
2873
True
2874
>>> string_to_delta('24h') == datetime.timedelta(1)
2875
True
2876
>>> string_to_delta('1w') == datetime.timedelta(7)
2877
True
2878
>>> string_to_delta('5m 30s') == datetime.timedelta(0, 330)
2879
True
2736
>>> string_to_delta('7d')
2737
datetime.timedelta(7)
2738
>>> string_to_delta('60s')
2739
datetime.timedelta(0, 60)
2740
>>> string_to_delta('60m')
2741
datetime.timedelta(0, 3600)
2742
>>> string_to_delta('24h')
2743
datetime.timedelta(1)
2744
>>> string_to_delta('1w')
2745
datetime.timedelta(7)
2746
>>> string_to_delta('5m 30s')
2747
datetime.timedelta(0, 330)
2880
2748
"""
2881
2749
2882
2750
try:
2984
2852
2985
2853
options = parser.parse_args()
2986
2854
2855
if options.check:
2856
import doctest
2857
fail_count, test_count = doctest.testmod()
2858
sys.exit(os.EX_OK if fail_count == 0 else 1)
2859
2987
2860
# Default values for config file for server-global settings
2988
if gnutls.has_rawpk:
2989
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2990
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2991
else:
2992
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2993
":+SIGN-DSA-SHA256")
2994
2861
server_defaults = {"interface": "",
2995
2862
"address": "",
2996
2863
"port": "",
2997
2864
"debug": "False",
2998
"priority": priority,
2865
"priority":
2866
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2867
":+SIGN-DSA-SHA256",
2999
2868
"servicename": "Mandos",
3000
2869
"use_dbus": "True",
3001
2870
"use_ipv6": "True",
3006
2875
"foreground": "False",
3007
2876
"zeroconf": "True",
3008
2877
}
3009
del priority
3010
2878
3011
2879
# Parse config file for server-global settings
3012
server_config = configparser.ConfigParser(server_defaults)
2880
server_config = configparser.SafeConfigParser(server_defaults)
3013
2881
del server_defaults
3014
2882
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3015
# Convert the ConfigParser object to a dict
2883
# Convert the SafeConfigParser object to a dict
3016
2884
server_settings = server_config.defaults()
3017
2885
# Use the appropriate methods on the non-string config options
3018
2886
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3090
2958
server_settings["servicename"])))
3091
2959
3092
2960
# Parse config file with clients
3093
client_config = configparser.ConfigParser(Client.client_defaults)
2961
client_config = configparser.SafeConfigParser(Client
2962
.client_defaults)
3094
2963
client_config.read(os.path.join(server_settings["configdir"],
3095
2964
"clients.conf"))
3096
2965
3167
3036
# Close all input and output, do double fork, etc.
3168
3037
daemon()
3169
3038
3170
if gi.version_info < (3, 10, 2):
3171
# multiprocessing will use threads, so before we use GLib we
3172
# need to inform GLib that threads will be used.
3173
GLib.threads_init()
3039
# multiprocessing will use threads, so before we use GLib we need
3040
# to inform GLib that threads will be used.
3041
GLib.threads_init()
3174
3042
3175
3043
global main_loop
3176
3044
# From the Avahi example code
3252
3120
if isinstance(s, bytes)
3253
3121
else s) for s in
3254
3122
value["client_structure"]]
3255
# .name, .host, and .checker_command
3256
for k in ("name", "host", "checker_command"):
3123
# .name & .host
3124
for k in ("name", "host"):
3257
3125
if isinstance(value[k], bytes):
3258
3126
value[k] = value[k].decode("utf-8")
3259
if "key_id" not in value:
3260
value["key_id"] = ""
3261
elif "fingerprint" not in value:
3262
value["fingerprint"] = ""
3263
3127
# old_client_settings
3264
3128
# .keys()
3265
3129
old_client_settings = {
3269
3133
for key, value in
3270
3134
bytes_old_client_settings.items()}
3271
3135
del bytes_old_client_settings
3272
# .host and .checker_command
3136
# .host
3273
3137
for value in old_client_settings.values():
3274
for attribute in ("host", "checker_command"):
3275
if isinstance(value[attribute], bytes):
3276
value[attribute] = (value[attribute]
3277
.decode("utf-8"))
3138
if isinstance(value["host"], bytes):
3139
value["host"] = (value["host"]
3140
.decode("utf-8"))
3278
3141
os.remove(stored_state_path)
3279
3142
except IOError as e:
3280
3143
if e.errno == errno.ENOENT:
3403
3266
pass
3404
3267
3405
3268
@dbus.service.signal(_interface, signature="ss")
3406
def ClientNotFound(self, key_id, address):
3269
def ClientNotFound(self, fingerprint, address):
3407
3270
"D-Bus signal"
3408
3271
pass
3409
3272
3605
3468
sys.exit(1)
3606
3469
# End of Avahi example code
3607
3470
3608
GLib.io_add_watch(
3609
GLib.IOChannel.unix_new(tcp_server.fileno()),
3610
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3611
lambda *args, **kwargs: (tcp_server.handle_request
3612
(*args[2:], **kwargs) or True))
3471
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3472
lambda *args, **kwargs:
3473
(tcp_server.handle_request
3474
(*args[2:], **kwargs) or True))
3613
3475
3614
3476
logger.debug("Starting main loop")
3615
3477
main_loop.run()
3625
3487
# Must run before the D-Bus bus name gets deregistered
3626
3488
cleanup()
3627
3489
3628
3629
def should_only_run_tests():
3630
parser = argparse.ArgumentParser(add_help=False)
3631
parser.add_argument("--check", action='store_true')
3632
args, unknown_args = parser.parse_known_args()
3633
run_tests = args.check
3634
if run_tests:
3635
# Remove --check argument from sys.argv
3636
sys.argv[1:] = unknown_args
3637
return run_tests
3638
3639
# Add all tests from doctest strings
3640
def load_tests(loader, tests, none):
3641
import doctest
3642
tests.addTests(doctest.DocTestSuite())
3643
return tests
3644
3490
3645
3491
if __name__ == '__main__':
3646
try:
3647
if should_only_run_tests():
3648
# Call using ./mandos --check [--verbose]
3649
unittest.main()
3650
else:
3651
main()
3652
finally:
3653
logging.shutdown()
3492
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0