/mandos/trunk : revision 969

1

#!/usr/bin/python3 -bI

2

# -*- coding: utf-8; lexical-binding: t -*-

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This file is part of Mandos.

18

#

31

#

32

# Contact the authors at <mandos@recompile.se>.

33

#

34

35

from __future__ import (division, absolute_import, print_function,

35

36

unicode_literals)

36

37

39

40

except ImportError:

40

41

pass

41

42

import sys

43

import unittest

44

import argparse

45

import logging

46

import os

47

43

try:

48

44

import SocketServer as socketserver

49

45

except ImportError:

50

46

import socketserver

51

47

import socket

48

import argparse

52

49

import datetime

53

50

import errno

54

51

try:

55

52

import ConfigParser as configparser

56

53

except ImportError:

57

54

import configparser

55

import sys

58

56

import re

57

import os

59

58

import signal

60

59

import subprocess

61

60

import atexit

62

61

import stat

62

import logging

63

import logging.handlers

64

import pwd

65

import contextlib

77

import itertools

78

import collections

79

import codecs

80

import random

81

import shlex

82

80

83

81

import dbus

84

82

import dbus.service

85

import gi

86

83

from gi.repository import GLib

87

84

from dbus.mainloop.glib import DBusGMainLoop

88

85

import ctypes

90

87

import xml.dom.minidom

91

88

import inspect

92

89

93

if sys.version_info.major == 2:

94

__metaclass__ = type

95

str = unicode

96

input = raw_input

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Show warnings by default

114

if not sys.warnoptions:

115

import warnings

116

warnings.simplefilter("default")

117

118

90

# Try to find the value of SO_BINDTODEVICE:

119

91

try:

120

92

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

140

112

# No value found

141

113

SO_BINDTODEVICE = None

142

114

143

if sys.version_info < (3, 2):

144

configparser.Configparser = configparser.SafeConfigParser

115

if sys.version_info.major == 2:

116

str = unicode

145

117

146

version = "1.8.14"

118

version = "1.7.20"

147

119

stored_state_file = "clients.pickle"

148

120

149

log = logging.getLogger(os.path.basename(sys.argv[0]))

150

logging.captureWarnings(True) # Show warnings via the logging system

121

logger = logging.getLogger()

151

122

syslogger = None

152

123

153

124

try:

189

160

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

190

161

address="/dev/log"))

191

162

syslogger.setFormatter(logging.Formatter

192

("Mandos [%(process)d]: %(levelname)s:"

193

" %(message)s"))

194

log.addHandler(syslogger)

163

('Mandos [%(process)d]: %(levelname)s:'

164

' %(message)s'))

165

logger.addHandler(syslogger)

195

166

196

167

if debug:

197

168

console = logging.StreamHandler()

198

console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

199

" [%(process)d]:"

200

" %(levelname)s:"

201

" %(message)s"))

202

log.addHandler(console)

203

log.setLevel(level)

169

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

170

' [%(process)d]:'

171

' %(levelname)s:'

172

' %(message)s'))

173

logger.addHandler(console)

174

logger.setLevel(level)

204

175

205

176

206

177

class PGPError(Exception):

208

179

pass

209

180

210

181

211

class PGPEngine:

182

class PGPEngine(object):

212

183

"""A simple class for OpenPGP symmetric encryption & decryption"""

213

184

214

185

def __init__(self):

218

189

output = subprocess.check_output(["gpgconf"])

219

190

for line in output.splitlines():

220

191

name, text, path = line.split(b":")

221

if name == b"gpg":

192

if name == "gpg":

222

193

self.gpg = path

223

194

break

224

195

except OSError as e:

225

196

if e.errno != errno.ENOENT:

226

197

raise

227

self.gnupgargs = ["--batch",

228

"--homedir", self.tempdir,

229

"--force-mdc",

230

"--quiet"]

198

self.gnupgargs = ['--batch',

199

'--homedir', self.tempdir,

200

'--force-mdc',

201

'--quiet']

231

202

# Only GPG version 1 has the --no-use-agent option.

232

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

203

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

233

204

self.gnupgargs.append("--no-use-agent")

234

205

235

206

def __enter__(self):

272

243

dir=self.tempdir) as passfile:

273

244

passfile.write(passphrase)

274

245

passfile.flush()

275

proc = subprocess.Popen([self.gpg, "--symmetric",

276

"--passphrase-file",

246

proc = subprocess.Popen([self.gpg, '--symmetric',

247

'--passphrase-file',

277

248

passfile.name]

278

249

+ self.gnupgargs,

279

250

stdin=subprocess.PIPE,

290

261

dir=self.tempdir) as passfile:

291

262

passfile.write(passphrase)

292

263

passfile.flush()

293

proc = subprocess.Popen([self.gpg, "--decrypt",

294

"--passphrase-file",

264

proc = subprocess.Popen([self.gpg, '--decrypt',

265

'--passphrase-file',

295

266

passfile.name]

296

267

+ self.gnupgargs,

297

268

stdin=subprocess.PIPE,

304

275

305

276

306

277

# Pretend that we have an Avahi module

307

class avahi:

308

"""This isn't so much a class as it is a module-like namespace."""

278

class Avahi(object):

279

"""This isn't so much a class as it is a module-like namespace.

280

It is instantiated once, and simulates having an Avahi module."""

309

281

IF_UNSPEC = -1 # avahi-common/address.h

310

282

PROTO_UNSPEC = -1 # avahi-common/address.h

311

283

PROTO_INET = 0 # avahi-common/address.h

315

287

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

316

288

DBUS_PATH_SERVER = "/"

317

289

318

@staticmethod

319

def string_array_to_txt_array(t):

290

def string_array_to_txt_array(self, t):

320

291

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

321

292

for s in t), signature="ay")

322

293

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

327

298

SERVER_RUNNING = 2 # avahi-common/defs.h

328

299

SERVER_COLLISION = 3 # avahi-common/defs.h

329

300

SERVER_FAILURE = 4 # avahi-common/defs.h

301

avahi = Avahi()

330

302

331

303

332

304

class AvahiError(Exception):

344

316

pass

345

317

346

318

347

class AvahiService:

319

class AvahiService(object):

348

320

"""An Avahi (Zeroconf) service.

349

321

350

322

Attributes:

351

323

interface: integer; avahi.IF_UNSPEC or an interface index.

352

324

Used to optionally bind to the specified interface.

353

name: string; Example: "Mandos"

354

type: string; Example: "_mandos._tcp".

325

name: string; Example: 'Mandos'

326

type: string; Example: '_mandos._tcp'.

355

327

See <https://www.iana.org/assignments/service-names-port-numbers>

356

328

port: integer; what port to announce

357

329

TXT: list of strings; TXT record for the service

394

366

def rename(self, remove=True):

395

367

"""Derived from the Avahi example code"""

396

368

if self.rename_count >= self.max_renames:

397

log.critical("No suitable Zeroconf service name found"

398

" after %i retries, exiting.",

399

self.rename_count)

369

logger.critical("No suitable Zeroconf service name found"

370

" after %i retries, exiting.",

371

self.rename_count)

400

372

raise AvahiServiceError("Too many renames")

401

373

self.name = str(

402

374

self.server.GetAlternativeServiceName(self.name))

403

375

self.rename_count += 1

404

log.info("Changing Zeroconf service name to %r ...",

405

self.name)

376

logger.info("Changing Zeroconf service name to %r ...",

377

self.name)

406

378

if remove:

407

379

self.remove()

408

380

try:

410

382

except dbus.exceptions.DBusException as error:

411

383

if (error.get_dbus_name()

412

384

== "org.freedesktop.Avahi.CollisionError"):

413

log.info("Local Zeroconf service name collision.")

385

logger.info("Local Zeroconf service name collision.")

414

386

return self.rename(remove=False)

415

387

else:

416

log.critical("D-Bus Exception", exc_info=error)

388

logger.critical("D-Bus Exception", exc_info=error)

417

389

self.cleanup()

418

390

os._exit(1)

419

391

435

407

avahi.DBUS_INTERFACE_ENTRY_GROUP)

436

408

self.entry_group_state_changed_match = (

437

409

self.group.connect_to_signal(

438

"StateChanged", self.entry_group_state_changed))

439

log.debug("Adding Zeroconf service '%s' of type '%s' ...",

440

self.name, self.type)

410

'StateChanged', self.entry_group_state_changed))

411

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

412

self.name, self.type)

441

413

self.group.AddService(

442

414

self.interface,

443

415

self.protocol,

450

422

451

423

def entry_group_state_changed(self, state, error):

452

424

"""Derived from the Avahi example code"""

453

log.debug("Avahi entry group state change: %i", state)

425

logger.debug("Avahi entry group state change: %i", state)

454

426

455

427

if state == avahi.ENTRY_GROUP_ESTABLISHED:

456

log.debug("Zeroconf service established.")

428

logger.debug("Zeroconf service established.")

457

429

elif state == avahi.ENTRY_GROUP_COLLISION:

458

log.info("Zeroconf service name collision.")

430

logger.info("Zeroconf service name collision.")

459

431

self.rename()

460

432

elif state == avahi.ENTRY_GROUP_FAILURE:

461

log.critical("Avahi: Error in group state changed %s",

462

str(error))

433

logger.critical("Avahi: Error in group state changed %s",

434

str(error))

463

435

raise AvahiGroupError("State changed: {!s}".format(error))

464

436

465

437

def cleanup(self):

475

447

476

448

def server_state_changed(self, state, error=None):

477

449

"""Derived from the Avahi example code"""

478

log.debug("Avahi server state change: %i", state)

450

logger.debug("Avahi server state change: %i", state)

479

451

bad_states = {

480

452

avahi.SERVER_INVALID: "Zeroconf server invalid",

481

453

avahi.SERVER_REGISTERING: None,

485

457

if state in bad_states:

486

458

if bad_states[state] is not None:

487

459

if error is None:

488

log.error(bad_states[state])

460

logger.error(bad_states[state])

489

461

else:

490

log.error(bad_states[state] + ": %r", error)

462

logger.error(bad_states[state] + ": %r", error)

491

463

self.cleanup()

492

464

elif state == avahi.SERVER_RUNNING:

493

465

try:

495

467

except dbus.exceptions.DBusException as error:

496

468

if (error.get_dbus_name()

497

469

== "org.freedesktop.Avahi.CollisionError"):

498

log.info("Local Zeroconf service name collision.")

470

logger.info("Local Zeroconf service name"

471

" collision.")

499

472

return self.rename(remove=False)

500

473

else:

501

log.critical("D-Bus Exception", exc_info=error)

474

logger.critical("D-Bus Exception", exc_info=error)

502

475

self.cleanup()

503

476

os._exit(1)

504

477

else:

505

478

if error is None:

506

log.debug("Unknown state: %r", state)

479

logger.debug("Unknown state: %r", state)

507

480

else:

508

log.debug("Unknown state: %r: %r", state, error)

481

logger.debug("Unknown state: %r: %r", state, error)

509

482

510

483

def activate(self):

511

484

"""Derived from the Avahi example code"""

523

496

class AvahiServiceToSyslog(AvahiService):

524

497

def rename(self, *args, **kwargs):

525

498

"""Add the new name to the syslog messages"""

526

ret = super(AvahiServiceToSyslog, self).rename(*args,

527

**kwargs)

499

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

528

500

syslogger.setFormatter(logging.Formatter(

529

"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

501

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

530

502

.format(self.name)))

531

503

return ret

532

504

533

505

534

506

# Pretend that we have a GnuTLS module

535

class gnutls:

536

"""This isn't so much a class as it is a module-like namespace."""

507

class GnuTLS(object):

508

"""This isn't so much a class as it is a module-like namespace.

509

It is instantiated once, and simulates having a GnuTLS module."""

537

510

538

511

library = ctypes.util.find_library("gnutls")

539

512

if library is None:

540

513

library = ctypes.util.find_library("gnutls-deb0")

541

514

_library = ctypes.cdll.LoadLibrary(library)

542

515

del library

516

_need_version = b"3.3.0"

517

_tls_rawpk_version = b"3.6.6"

518

519

def __init__(self):

520

# Need to use "self" here, since this method is called before

521

# the assignment to the "gnutls" global variable happens.

522

if self.check_version(self._need_version) is None:

523

raise self.Error("Needs GnuTLS {} or later"

524

.format(self._need_version))

543

525

544

526

# Unless otherwise indicated, the constants and types below are

545

527

# all from the gnutls/gnutls.h C header file.

562

544

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

563

545

564

546

# Types

565

class _session_int(ctypes.Structure):

547

class session_int(ctypes.Structure):

566

548

_fields_ = []

567

session_t = ctypes.POINTER(_session_int)

549

session_t = ctypes.POINTER(session_int)

568

550

569

551

class certificate_credentials_st(ctypes.Structure):

570

552

_fields_ = []

573

555

certificate_type_t = ctypes.c_int

574

556

575

557

class datum_t(ctypes.Structure):

576

_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

577

("size", ctypes.c_uint)]

558

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

559

('size', ctypes.c_uint)]

578

560

579

class _openpgp_crt_int(ctypes.Structure):

561

class openpgp_crt_int(ctypes.Structure):

580

562

_fields_ = []

581

openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

563

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

582

564

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

583

565

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

584

566

credentials_type_t = ctypes.c_int

587

569

588

570

# Exceptions

589

571

class Error(Exception):

572

# We need to use the class name "GnuTLS" here, since this

573

# exception might be raised from within GnuTLS.__init__,

574

# which is called before the assignment to the "gnutls"

575

# global variable has happened.

590

576

def __init__(self, message=None, code=None, args=()):

591

577

# Default usage is by a message string, but if a return

592

578

# code is passed, convert it to a string with

593

579

# gnutls.strerror()

594

580

self.code = code

595

581

if message is None and code is not None:

596

message = gnutls.strerror(code).decode(

597

"utf-8", errors="replace")

598

return super(gnutls.Error, self).__init__(

582

message = GnuTLS.strerror(code)

583

return super(GnuTLS.Error, self).__init__(

599

584

message, *args)

600

585

601

586

class CertificateSecurityError(Error):

602

587

pass

603

588

604

class PointerTo:

605

def __init__(self, cls):

606

self.cls = cls

607

608

def from_param(self, obj):

609

if not isinstance(obj, self.cls):

610

raise TypeError("Not of type {}: {!r}"

611

.format(self.cls.__name__, obj))

612

return ctypes.byref(obj.from_param(obj))

613

614

class CastToVoidPointer:

615

def __init__(self, cls):

616

self.cls = cls

617

618

def from_param(self, obj):

619

if not isinstance(obj, self.cls):

620

raise TypeError("Not of type {}: {!r}"

621

.format(self.cls.__name__, obj))

622

return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

623

624

class With_from_param:

625

@classmethod

626

def from_param(cls, obj):

627

return obj._as_parameter_

628

629

589

# Classes

630

class Credentials(With_from_param):

590

class Credentials(object):

631

591

def __init__(self):

632

self._as_parameter_ = gnutls.certificate_credentials_t()

633

gnutls.certificate_allocate_credentials(self)

592

self._c_object = gnutls.certificate_credentials_t()

593

gnutls.certificate_allocate_credentials(

594

ctypes.byref(self._c_object))

634

595

self.type = gnutls.CRD_CERTIFICATE

635

596

636

597

def __del__(self):

637

gnutls.certificate_free_credentials(self)

598

gnutls.certificate_free_credentials(self._c_object)

638

599

639

class ClientSession(With_from_param):

600

class ClientSession(object):

640

601

def __init__(self, socket, credentials=None):

641

self._as_parameter_ = gnutls.session_t()

602

self._c_object = gnutls.session_t()

642

603

gnutls_flags = gnutls.CLIENT

643

if gnutls.check_version(b"3.5.6"):

604

if gnutls.check_version("3.5.6"):

644

605

gnutls_flags |= gnutls.NO_TICKETS

645

606

if gnutls.has_rawpk:

646

607

gnutls_flags |= gnutls.ENABLE_RAWPK

647

gnutls.init(self, gnutls_flags)

608

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

648

609

del gnutls_flags

649

gnutls.set_default_priority(self)

650

gnutls.transport_set_ptr(self, socket.fileno())

651

gnutls.handshake_set_private_extensions(self, True)

610

gnutls.set_default_priority(self._c_object)

611

gnutls.transport_set_ptr(self._c_object, socket.fileno())

612

gnutls.handshake_set_private_extensions(self._c_object,

613

True)

652

614

self.socket = socket

653

615

if credentials is None:

654

616

credentials = gnutls.Credentials()

655

gnutls.credentials_set(self, credentials.type,

656

credentials)

617

gnutls.credentials_set(self._c_object, credentials.type,

618

ctypes.cast(credentials._c_object,

619

ctypes.c_void_p))

657

620

self.credentials = credentials

658

621

659

622

def __del__(self):

660

gnutls.deinit(self)

623

gnutls.deinit(self._c_object)

661

624

662

625

def handshake(self):

663

return gnutls.handshake(self)

626

return gnutls.handshake(self._c_object)

664

627

665

628

def send(self, data):

666

629

data = bytes(data)

667

630

data_len = len(data)

668

631

while data_len > 0:

669

data_len -= gnutls.record_send(self, data[-data_len:],

632

data_len -= gnutls.record_send(self._c_object,

633

data[-data_len:],

670

634

data_len)

671

635

672

636

def bye(self):

673

return gnutls.bye(self, gnutls.SHUT_RDWR)

637

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

674

638

675

639

# Error handling functions

676

640

def _error_code(result):

677

641

"""A function to raise exceptions on errors, suitable

678

for the "restype" attribute on ctypes functions"""

679

if result >= gnutls.E_SUCCESS:

642

for the 'restype' attribute on ctypes functions"""

643

if result >= 0:

680

644

return result

681

645

if result == gnutls.E_NO_CERTIFICATE_FOUND:

682

646

raise gnutls.CertificateSecurityError(code=result)

683

647

raise gnutls.Error(code=result)

684

648

685

def _retry_on_error(result, func, arguments,

686

_error_code=_error_code):

649

def _retry_on_error(result, func, arguments):

687

650

"""A function to retry on some errors, suitable

688

for the "errcheck" attribute on ctypes functions"""

689

while result < gnutls.E_SUCCESS:

651

for the 'errcheck' attribute on ctypes functions"""

652

while result < 0:

690

653

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

691

654

return _error_code(result)

692

655

result = func(*arguments)

697

660

698

661

# Functions

699

662

priority_set_direct = _library.gnutls_priority_set_direct

700

priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

663

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

701

664

ctypes.POINTER(ctypes.c_char_p)]

702

665

priority_set_direct.restype = _error_code

703

666

704

667

init = _library.gnutls_init

705

init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

668

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

706

669

init.restype = _error_code

707

670

708

671

set_default_priority = _library.gnutls_set_default_priority

709

set_default_priority.argtypes = [ClientSession]

672

set_default_priority.argtypes = [session_t]

710

673

set_default_priority.restype = _error_code

711

674

712

675

record_send = _library.gnutls_record_send

713

record_send.argtypes = [ClientSession, ctypes.c_void_p,

676

record_send.argtypes = [session_t, ctypes.c_void_p,

714

677

ctypes.c_size_t]

715

678

record_send.restype = ctypes.c_ssize_t

716

679

record_send.errcheck = _retry_on_error

718

681

certificate_allocate_credentials = (

719

682

_library.gnutls_certificate_allocate_credentials)

720

683

certificate_allocate_credentials.argtypes = [

721

PointerTo(Credentials)]

684

ctypes.POINTER(certificate_credentials_t)]

722

685

certificate_allocate_credentials.restype = _error_code

723

686

724

687

certificate_free_credentials = (

725

688

_library.gnutls_certificate_free_credentials)

726

certificate_free_credentials.argtypes = [Credentials]

689

certificate_free_credentials.argtypes = [

690

certificate_credentials_t]

727

691

certificate_free_credentials.restype = None

728

692

729

693

handshake_set_private_extensions = (

730

694

_library.gnutls_handshake_set_private_extensions)

731

handshake_set_private_extensions.argtypes = [ClientSession,

695

handshake_set_private_extensions.argtypes = [session_t,

732

696

ctypes.c_int]

733

697

handshake_set_private_extensions.restype = None

734

698

735

699

credentials_set = _library.gnutls_credentials_set

736

credentials_set.argtypes = [ClientSession, credentials_type_t,

737

CastToVoidPointer(Credentials)]

700

credentials_set.argtypes = [session_t, credentials_type_t,

701

ctypes.c_void_p]

738

702

credentials_set.restype = _error_code

739

703

740

704

strerror = _library.gnutls_strerror

742

706

strerror.restype = ctypes.c_char_p

743

707

744

708

certificate_type_get = _library.gnutls_certificate_type_get

745

certificate_type_get.argtypes = [ClientSession]

709

certificate_type_get.argtypes = [session_t]

746

710

certificate_type_get.restype = _error_code

747

711

748

712

certificate_get_peers = _library.gnutls_certificate_get_peers

749

certificate_get_peers.argtypes = [ClientSession,

713

certificate_get_peers.argtypes = [session_t,

750

714

ctypes.POINTER(ctypes.c_uint)]

751

715

certificate_get_peers.restype = ctypes.POINTER(datum_t)

752

716

759

723

global_set_log_function.restype = None

760

724

761

725

deinit = _library.gnutls_deinit

762

deinit.argtypes = [ClientSession]

726

deinit.argtypes = [session_t]

763

727

deinit.restype = None

764

728

765

729

handshake = _library.gnutls_handshake

766

handshake.argtypes = [ClientSession]

767

handshake.restype = ctypes.c_int

730

handshake.argtypes = [session_t]

731

handshake.restype = _error_code

768

732

handshake.errcheck = _retry_on_error

769

733

770

734

transport_set_ptr = _library.gnutls_transport_set_ptr

771

transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

735

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

772

736

transport_set_ptr.restype = None

773

737

774

738

bye = _library.gnutls_bye

775

bye.argtypes = [ClientSession, close_request_t]

776

bye.restype = ctypes.c_int

739

bye.argtypes = [session_t, close_request_t]

740

bye.restype = _error_code

777

741

bye.errcheck = _retry_on_error

778

742

779

743

check_version = _library.gnutls_check_version

780

744

check_version.argtypes = [ctypes.c_char_p]

781

745

check_version.restype = ctypes.c_char_p

782

746

783

_need_version = b"3.3.0"

784

if check_version(_need_version) is None:

785

raise self.Error("Needs GnuTLS {} or later"

786

.format(_need_version))

787

788

_tls_rawpk_version = b"3.6.6"

789

747

has_rawpk = bool(check_version(_tls_rawpk_version))

790

748

791

749

if has_rawpk:

796

754

797

755

x509_crt_fmt_t = ctypes.c_int

798

756

799

# All the function declarations below are from

800

# gnutls/abstract.h

757

# All the function declarations below are from gnutls/abstract.h

801

758

pubkey_init = _library.gnutls_pubkey_init

802

759

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

803

760

pubkey_init.restype = _error_code

817

774

pubkey_deinit.argtypes = [pubkey_t]

818

775

pubkey_deinit.restype = None

819

776

else:

820

# All the function declarations below are from

821

# gnutls/openpgp.h

777

# All the function declarations below are from gnutls/openpgp.h

822

778

823

779

openpgp_crt_init = _library.gnutls_openpgp_crt_init

824

780

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

830

786

openpgp_crt_fmt_t]

831

787

openpgp_crt_import.restype = _error_code

832

788

833

openpgp_crt_verify_self = \

834

_library.gnutls_openpgp_crt_verify_self

835

openpgp_crt_verify_self.argtypes = [

836

openpgp_crt_t,

837

ctypes.c_uint,

838

ctypes.POINTER(ctypes.c_uint),

839

]

789

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

790

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

791

ctypes.POINTER(ctypes.c_uint)]

840

792

openpgp_crt_verify_self.restype = _error_code

841

793

842

794

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

851

803

ctypes.c_size_t)]

852

804

openpgp_crt_get_fingerprint.restype = _error_code

853

805

854

if check_version(b"3.6.4"):

806

if check_version("3.6.4"):

855

807

certificate_type_get2 = _library.gnutls_certificate_type_get2

856

certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

808

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

857

809

certificate_type_get2.restype = _error_code

858

810

859

811

# Remove non-public functions

860

812

del _error_code, _retry_on_error

813

# Create the global "gnutls" object, simulating a module

814

gnutls = GnuTLS()

861

815

862

816

863

817

def call_pipe(connection, # : multiprocessing.Connection

871

825

connection.close()

872

826

873

827

874

class Client:

828

class Client(object):

875

829

"""A representation of a client host served by this server.

876

830

877

831

Attributes:

878

approved: bool(); None if not yet approved/disapproved

832

approved: bool(); 'None' if not yet approved/disapproved

879

833

approval_delay: datetime.timedelta(); Time to wait for approval

880

834

approval_duration: datetime.timedelta(); Duration of one approval

881

checker: multiprocessing.Process(); a running checker process used

882

to see if the client lives. None if no process is

883

running.

835

checker: subprocess.Popen(); a running checker process used

836

to see if the client lives.

837

'None' if no process is running.

884

838

checker_callback_tag: a GLib event source tag, or None

885

839

checker_command: string; External command which is run to check

886

840

if client lives. %() expansions are done at

1009

963

self.last_enabled = None

1010

964

self.expires = None

1011

965

1012

log.debug("Creating client %r", self.name)

1013

log.debug(" Key ID: %s", self.key_id)

1014

log.debug(" Fingerprint: %s", self.fingerprint)

966

logger.debug("Creating client %r", self.name)

967

logger.debug(" Key ID: %s", self.key_id)

968

logger.debug(" Fingerprint: %s", self.fingerprint)

1015

969

self.created = settings.get("created",

1016

970

datetime.datetime.utcnow())

1017

971

1056

1010

if not getattr(self, "enabled", False):

1057

1011

return False

1058

1012

if not quiet:

1059

log.info("Disabling client %s", self.name)

1013

logger.info("Disabling client %s", self.name)

1060

1014

if getattr(self, "disable_initiator_tag", None) is not None:

1061

1015

GLib.source_remove(self.disable_initiator_tag)

1062

1016

self.disable_initiator_tag = None

1080

1034

if self.checker_initiator_tag is not None:

1081

1035

GLib.source_remove(self.checker_initiator_tag)

1082

1036

self.checker_initiator_tag = GLib.timeout_add(

1083

random.randrange(int(self.interval.total_seconds() * 1000

1084

+ 1)),

1037

int(self.interval.total_seconds() * 1000),

1085

1038

self.start_checker)

1086

1039

# Schedule a disable() when 'timeout' has passed

1087

1040

if self.disable_initiator_tag is not None:

1094

1047

def checker_callback(self, source, condition, connection,

1095

1048

command):

1096

1049

"""The checker has completed, so take appropriate actions."""

1050

self.checker_callback_tag = None

1051

self.checker = None

1097

1052

# Read return code from connection (see call_pipe)

1098

1053

returncode = connection.recv()

1099

1054

connection.close()

1100

if self.checker is not None:

1101

self.checker.join()

1102

self.checker_callback_tag = None

1103

self.checker = None

1104

1055

1105

1056

if returncode >= 0:

1106

1057

self.last_checker_status = returncode

1107

1058

self.last_checker_signal = None

1108

1059

if self.last_checker_status == 0:

1109

log.info("Checker for %(name)s succeeded", vars(self))

1060

logger.info("Checker for %(name)s succeeded",

1061

vars(self))

1110

1062

self.checked_ok()

1111

1063

else:

1112

log.info("Checker for %(name)s failed", vars(self))

1064

logger.info("Checker for %(name)s failed", vars(self))

1113

1065

else:

1114

1066

self.last_checker_status = -1

1115

1067

self.last_checker_signal = -returncode

1116

log.warning("Checker for %(name)s crashed?", vars(self))

1068

logger.warning("Checker for %(name)s crashed?",

1069

vars(self))

1117

1070

return False

1118

1071

1119

1072

def checked_ok(self):

1153

1106

# should be.

1154

1107

1155

1108

if self.checker is not None and not self.checker.is_alive():

1156

log.warning("Checker was not alive; joining")

1109

logger.warning("Checker was not alive; joining")

1157

1110

self.checker.join()

1158

1111

self.checker = None

1159

1112

# Start a new checker if needed

1160

1113

if self.checker is None:

1161

1114

# Escape attributes for the shell

1162

1115

escaped_attrs = {

1163

attr: shlex.quote(str(getattr(self, attr)))

1116

attr: re.escape(str(getattr(self, attr)))

1164

1117

for attr in self.runtime_expansions}

1165

1118

try:

1166

1119

command = self.checker_command % escaped_attrs

1167

1120

except TypeError as error:

1168

log.error('Could not format string "%s"',

1169

self.checker_command, exc_info=error)

1121

logger.error('Could not format string "%s"',

1122

self.checker_command,

1123

exc_info=error)

1170

1124

return True # Try again later

1171

1125

self.current_checker_command = command

1172

log.info("Starting checker %r for %s", command, self.name)

1126

logger.info("Starting checker %r for %s", command,

1127

self.name)

1173

1128

# We don't need to redirect stdout and stderr, since

1174

1129

# in normal mode, that is already done by daemon(),

1175

1130

# and in debug mode we don't want to. (Stdin is

1191

1146

kwargs=popen_args)

1192

1147

self.checker.start()

1193

1148

self.checker_callback_tag = GLib.io_add_watch(

1194

GLib.IOChannel.unix_new(pipe[0].fileno()),

1195

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1149

pipe[0].fileno(), GLib.IO_IN,

1196

1150

self.checker_callback, pipe[0], command)

1197

1151

# Re-run this periodically if run by GLib.timeout_add

1198

1152

return True

1204

1158

self.checker_callback_tag = None

1205

1159

if getattr(self, "checker", None) is None:

1206

1160

return

1207

log.debug("Stopping checker for %(name)s", vars(self))

1161

logger.debug("Stopping checker for %(name)s", vars(self))

1208

1162

self.checker.terminate()

1209

1163

self.checker = None

1210

1164

1237

1191

func._dbus_name = func.__name__

1238

1192

if func._dbus_name.endswith("_dbus_property"):

1239

1193

func._dbus_name = func._dbus_name[:-14]

1240

func._dbus_get_args_options = {"byte_arrays": byte_arrays}

1194

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

1241

1195

return func

1242

1196

1243

1197

return decorator

1332

1286

1333

1287

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1334

1288

out_signature="s",

1335

path_keyword="object_path",

1336

connection_keyword="connection")

1289

path_keyword='object_path',

1290

connection_keyword='connection')

1337

1291

def Introspect(self, object_path, connection):

1338

1292

"""Overloading of standard D-Bus method.

1339

1293

1388

1342

document.unlink()

1389

1343

except (AttributeError, xml.dom.DOMException,

1390

1344

xml.parsers.expat.ExpatError) as error:

1391

log.error("Failed to override Introspection method",

1392

exc_info=error)

1345

logger.error("Failed to override Introspection method",

1346

exc_info=error)

1393

1347

return xmlstring

1394

1348

1395

1349

1453

1407

raise ValueError("Byte arrays not supported for non-"

1454

1408

"'ay' signature {!r}"

1455

1409

.format(prop._dbus_signature))

1456

value = dbus.ByteArray(bytes(value))

1410

value = dbus.ByteArray(b''.join(chr(byte)

1411

for byte in value))

1457

1412

prop(value)

1458

1413

1459

1414

@dbus.service.method(dbus.PROPERTIES_IFACE,

1492

1447

1493

1448

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1494

1449

out_signature="s",

1495

path_keyword="object_path",

1496

connection_keyword="connection")

1450

path_keyword='object_path',

1451

connection_keyword='connection')

1497

1452

def Introspect(self, object_path, connection):

1498

1453

"""Overloading of standard D-Bus method.

1499

1454

1555

1510

document.unlink()

1556

1511

except (AttributeError, xml.dom.DOMException,

1557

1512

xml.parsers.expat.ExpatError) as error:

1558

log.error("Failed to override Introspection method",

1559

exc_info=error)

1513

logger.error("Failed to override Introspection method",

1514

exc_info=error)

1560

1515

return xmlstring

1561

1516

1562

1517

1594

1549

1595

1550

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1596

1551

out_signature="s",

1597

path_keyword="object_path",

1598

connection_keyword="connection")

1552

path_keyword='object_path',

1553

connection_keyword='connection')

1599

1554

def Introspect(self, object_path, connection):

1600

1555

"""Overloading of standard D-Bus method.

1601

1556

1626

1581

document.unlink()

1627

1582

except (AttributeError, xml.dom.DOMException,

1628

1583

xml.parsers.expat.ExpatError) as error:

1629

log.error("Failed to override Introspection method",

1630

exc_info=error)

1584

logger.error("Failed to override Introspection method",

1585

exc_info=error)

1631

1586

return xmlstring

1632

1587

1633

1588

2264

2219

del _interface

2265

2220

2266

2221

2267

class ProxyClient:

2222

class ProxyClient(object):

2268

2223

def __init__(self, child_pipe, key_id, fpr, address):

2269

2224

self._pipe = child_pipe

2270

self._pipe.send(("init", key_id, fpr, address))

2225

self._pipe.send(('init', key_id, fpr, address))

2271

2226

if not self._pipe.recv():

2272

2227

raise KeyError(key_id or fpr)

2273

2228

2274

2229

def __getattribute__(self, name):

2275

if name == "_pipe":

2230

if name == '_pipe':

2276

2231

return super(ProxyClient, self).__getattribute__(name)

2277

self._pipe.send(("getattr", name))

2232

self._pipe.send(('getattr', name))

2278

2233

data = self._pipe.recv()

2279

if data[0] == "data":

2234

if data[0] == 'data':

2280

2235

return data[1]

2281

if data[0] == "function":

2236

if data[0] == 'function':

2282

2237

2283

2238

def func(*args, **kwargs):

2284

self._pipe.send(("funcall", name, args, kwargs))

2239

self._pipe.send(('funcall', name, args, kwargs))

2285

2240

return self._pipe.recv()[1]

2286

2241

2287

2242

return func

2288

2243

2289

2244

def __setattr__(self, name, value):

2290

if name == "_pipe":

2245

if name == '_pipe':

2291

2246

return super(ProxyClient, self).__setattr__(name, value)

2292

self._pipe.send(("setattr", name, value))

2247

self._pipe.send(('setattr', name, value))

2293

2248

2294

2249

2295

2250

class ClientHandler(socketserver.BaseRequestHandler, object):

2300

2255

2301

2256

def handle(self):

2302

2257

with contextlib.closing(self.server.child_pipe) as child_pipe:

2303

log.info("TCP connection from: %s",

2304

str(self.client_address))

2305

log.debug("Pipe FD: %d", self.server.child_pipe.fileno())

2258

logger.info("TCP connection from: %s",

2259

str(self.client_address))

2260

logger.debug("Pipe FD: %d",

2261

self.server.child_pipe.fileno())

2306

2262

2307

2263

session = gnutls.ClientSession(self.request)

2308

2264

2309

# priority = ":".join(("NONE", "+VERS-TLS1.1",

2265

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2310

2266

# "+AES-256-CBC", "+SHA1",

2311

2267

# "+COMP-NULL", "+CTYPE-OPENPGP",

2312

2268

# "+DHE-DSS"))

2314

2270

priority = self.server.gnutls_priority

2315

2271

if priority is None:

2316

2272

priority = "NORMAL"

2317

gnutls.priority_set_direct(session,

2318

priority.encode("utf-8"), None)

2273

gnutls.priority_set_direct(session._c_object,

2274

priority.encode("utf-8"),

2275

None)

2319

2276

2320

2277

# Start communication using the Mandos protocol

2321

2278

# Get protocol number

2322

2279

line = self.request.makefile().readline()

2323

log.debug("Protocol version: %r", line)

2280

logger.debug("Protocol version: %r", line)

2324

2281

try:

2325

2282

if int(line.strip().split()[0]) > 1:

2326

2283

raise RuntimeError(line)

2327

2284

except (ValueError, IndexError, RuntimeError) as error:

2328

log.error("Unknown protocol version: %s", error)

2285

logger.error("Unknown protocol version: %s", error)

2329

2286

return

2330

2287

2331

2288

# Start GnuTLS connection

2332

2289

try:

2333

2290

session.handshake()

2334

2291

except gnutls.Error as error:

2335

log.warning("Handshake failed: %s", error)

2292

logger.warning("Handshake failed: %s", error)

2336

2293

# Do not run session.bye() here: the session is not

2337

2294

# established. Just abandon the request.

2338

2295

return

2339

log.debug("Handshake succeeded")

2296

logger.debug("Handshake succeeded")

2340

2297

2341

2298

approval_required = False

2342

2299

try:

2343

2300

if gnutls.has_rawpk:

2344

fpr = b""

2301

fpr = ""

2345

2302

try:

2346

2303

key_id = self.key_id(

2347

2304

self.peer_certificate(session))

2348

2305

except (TypeError, gnutls.Error) as error:

2349

log.warning("Bad certificate: %s", error)

2306

logger.warning("Bad certificate: %s", error)

2350

2307

return

2351

log.debug("Key ID: %s",

2352

key_id.decode("utf-8",

2353

errors="replace"))

2308

logger.debug("Key ID: %s", key_id)

2354

2309

2355

2310

else:

2356

key_id = b""

2311

key_id = ""

2357

2312

try:

2358

2313

fpr = self.fingerprint(

2359

2314

self.peer_certificate(session))

2360

2315

except (TypeError, gnutls.Error) as error:

2361

log.warning("Bad certificate: %s", error)

2316

logger.warning("Bad certificate: %s", error)

2362

2317

return

2363

log.debug("Fingerprint: %s", fpr)

2318

logger.debug("Fingerprint: %s", fpr)

2364

2319

2365

2320

try:

2366

2321

client = ProxyClient(child_pipe, key_id, fpr,

2375

2330

2376

2331

while True:

2377

2332

if not client.enabled:

2378

log.info("Client %s is disabled", client.name)

2333

logger.info("Client %s is disabled",

2334

client.name)

2379

2335

if self.server.use_dbus:

2380

2336

# Emit D-Bus signal

2381

2337

client.Rejected("Disabled")

2385

2341

# We are approved or approval is disabled

2386

2342

break

2387

2343

elif client.approved is None:

2388

log.info("Client %s needs approval",

2389

client.name)

2344

logger.info("Client %s needs approval",

2345

client.name)

2390

2346

if self.server.use_dbus:

2391

2347

# Emit D-Bus signal

2392

2348

client.NeedApproval(

2393

2349

client.approval_delay.total_seconds()

2394

2350

* 1000, client.approved_by_default)

2395

2351

else:

2396

log.warning("Client %s was not approved",

2397

client.name)

2352

logger.warning("Client %s was not approved",

2353

client.name)

2398

2354

if self.server.use_dbus:

2399

2355

# Emit D-Bus signal

2400

2356

client.Rejected("Denied")

2408

2364

time2 = datetime.datetime.now()

2409

2365

if (time2 - time) >= delay:

2410

2366

if not client.approved_by_default:

2411

log.warning("Client %s timed out while"

2412

" waiting for approval",

2413

client.name)

2367

logger.warning("Client %s timed out while"

2368

" waiting for approval",

2369

client.name)

2414

2370

if self.server.use_dbus:

2415

2371

# Emit D-Bus signal

2416

2372

client.Rejected("Approval timed out")

2423

2379

try:

2424

2380

session.send(client.secret)

2425

2381

except gnutls.Error as error:

2426

log.warning("gnutls send failed", exc_info=error)

2382

logger.warning("gnutls send failed",

2383

exc_info=error)

2427

2384

return

2428

2385

2429

log.info("Sending secret to %s", client.name)

2386

logger.info("Sending secret to %s", client.name)

2430

2387

# bump the timeout using extended_timeout

2431

2388

client.bump_timeout(client.extended_timeout)

2432

2389

if self.server.use_dbus:

2439

2396

try:

2440

2397

session.bye()

2441

2398

except gnutls.Error as error:

2442

log.warning("GnuTLS bye failed", exc_info=error)

2399

logger.warning("GnuTLS bye failed",

2400

exc_info=error)

2443

2401

2444

2402

@staticmethod

2445

2403

def peer_certificate(session):

2446

2404

"Return the peer's certificate as a bytestring"

2447

2405

try:

2448

cert_type = gnutls.certificate_type_get2(

2449

session, gnutls.CTYPE_PEERS)

2406

cert_type = gnutls.certificate_type_get2(session._c_object,

2407

gnutls.CTYPE_PEERS)

2450

2408

except AttributeError:

2451

cert_type = gnutls.certificate_type_get(session)

2409

cert_type = gnutls.certificate_type_get(session._c_object)

2452

2410

if gnutls.has_rawpk:

2453

2411

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2454

2412

else:

2455

2413

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2456

2414

# If not a valid certificate type...

2457

2415

if cert_type not in valid_cert_types:

2458

log.info("Cert type %r not in %r", cert_type,

2459

valid_cert_types)

2416

logger.info("Cert type %r not in %r", cert_type,

2417

valid_cert_types)

2460

2418

# ...return invalid data

2461

2419

return b""

2462

2420

list_size = ctypes.c_uint(1)

2463

2421

cert_list = (gnutls.certificate_get_peers

2464

(session, ctypes.byref(list_size)))

2422

(session._c_object, ctypes.byref(list_size)))

2465

2423

if not bool(cert_list) and list_size.value != 0:

2466

2424

raise gnutls.Error("error getting peer certificate")

2467

2425

if list_size.value == 0:

2489

2447

buf = ctypes.create_string_buffer(32)

2490

2448

buf_len = ctypes.c_size_t(len(buf))

2491

2449

# Get the key ID from the raw public key into the buffer

2492

gnutls.pubkey_get_key_id(

2493

pubkey,

2494

gnutls.KEYID_USE_SHA256,

2495

ctypes.cast(ctypes.byref(buf),

2496

ctypes.POINTER(ctypes.c_ubyte)),

2497

ctypes.byref(buf_len))

2450

gnutls.pubkey_get_key_id(pubkey,

2451

gnutls.KEYID_USE_SHA256,

2452

ctypes.cast(ctypes.byref(buf),

2453

ctypes.POINTER(ctypes.c_ubyte)),

2454

ctypes.byref(buf_len))

2498

2455

# Deinit the certificate

2499

2456

gnutls.pubkey_deinit(pubkey)

2500

2457

2541

2498

return hex_fpr

2542

2499

2543

2500

2544

class MultiprocessingMixIn:

2501

class MultiprocessingMixIn(object):

2545

2502

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2546

2503

2547

2504

def sub_process_main(self, request, address):

2559

2516

return proc

2560

2517

2561

2518

2562

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

2519

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2563

2520

""" adds a pipe to the MixIn """

2564

2521

2565

2522

def process_request(self, request, client_address):

2580

2537

2581

2538

2582

2539

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2583

socketserver.TCPServer):

2584

"""IPv6-capable TCP server. Accepts None as address and/or port

2540

socketserver.TCPServer, object):

2541

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2585

2542

2586

2543

Attributes:

2587

2544

enabled: Boolean; whether this server is activated yet

2638

2595

if SO_BINDTODEVICE is None:

2639

2596

# Fall back to a hard-coded value which seems to be

2640

2597

# common enough.

2641

log.warning("SO_BINDTODEVICE not found, trying 25")

2598

logger.warning("SO_BINDTODEVICE not found, trying 25")

2642

2599

SO_BINDTODEVICE = 25

2643

2600

try:

2644

2601

self.socket.setsockopt(

2646

2603

(self.interface + "\0").encode("utf-8"))

2647

2604

except socket.error as error:

2648

2605

if error.errno == errno.EPERM:

2649

log.error("No permission to bind to interface %s",

2650

self.interface)

2606

logger.error("No permission to bind to"

2607

" interface %s", self.interface)

2651

2608

elif error.errno == errno.ENOPROTOOPT:

2652

log.error("SO_BINDTODEVICE not available; cannot"

2653

" bind to interface %s", self.interface)

2609

logger.error("SO_BINDTODEVICE not available;"

2610

" cannot bind to interface %s",

2611

self.interface)

2654

2612

elif error.errno == errno.ENODEV:

2655

log.error("Interface %s does not exist, cannot"

2656

" bind", self.interface)

2613

logger.error("Interface %s does not exist,"

2614

" cannot bind", self.interface)

2657

2615

else:

2658

2616

raise

2659

2617

# Only bind(2) the socket if we really need to.

2660

2618

if self.server_address[0] or self.server_address[1]:

2661

if self.server_address[1]:

2662

self.allow_reuse_address = True

2663

2619

if not self.server_address[0]:

2664

2620

if self.address_family == socket.AF_INET6:

2665

2621

any_address = "::" # in6addr_any

2718

2674

def add_pipe(self, parent_pipe, proc):

2719

2675

# Call "handle_ipc" for both data and EOF events

2720

2676

GLib.io_add_watch(

2721

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2722

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2677

parent_pipe.fileno(),

2678

GLib.IO_IN | GLib.IO_HUP,

2723

2679

functools.partial(self.handle_ipc,

2724

2680

parent_pipe=parent_pipe,

2725

2681

proc=proc))

2738

2694

request = parent_pipe.recv()

2739

2695

command = request[0]

2740

2696

2741

if command == "init":

2697

if command == 'init':

2742

2698

key_id = request[1].decode("ascii")

2743

2699

fpr = request[2].decode("ascii")

2744

2700

address = request[3]

2745

2701

2746

2702

for c in self.clients.values():

2747

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2748

"27AE41E4649B934CA495991B7852B855"):

2749

continue

2750

2703

if key_id and c.key_id == key_id:

2751

2704

client = c

2752

2705

break

2754

2707

client = c

2755

2708

break

2756

2709

else:

2757

log.info("Client not found for key ID: %s, address:"

2758

" %s", key_id or fpr, address)

2710

logger.info("Client not found for key ID: %s, address"

2711

": %s", key_id or fpr, address)

2759

2712

if self.use_dbus:

2760

2713

# Emit D-Bus signal

2761

2714

mandos_dbus_service.ClientNotFound(key_id or fpr,

2764

2717

return False

2765

2718

2766

2719

GLib.io_add_watch(

2767

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2768

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2720

parent_pipe.fileno(),

2721

GLib.IO_IN | GLib.IO_HUP,

2769

2722

functools.partial(self.handle_ipc,

2770

2723

parent_pipe=parent_pipe,

2771

2724

proc=proc,

2774

2727

# remove the old hook in favor of the new above hook on

2775

2728

# same fileno

2776

2729

return False

2777

if command == "funcall":

2730

if command == 'funcall':

2778

2731

funcname = request[1]

2779

2732

args = request[2]

2780

2733

kwargs = request[3]

2781

2734

2782

parent_pipe.send(("data", getattr(client_object,

2735

parent_pipe.send(('data', getattr(client_object,

2783

2736

funcname)(*args,

2784

2737

**kwargs)))

2785

2738

2786

if command == "getattr":

2739

if command == 'getattr':

2787

2740

attrname = request[1]

2788

2741

if isinstance(client_object.__getattribute__(attrname),

2789

collections.abc.Callable):

2790

parent_pipe.send(("function", ))

2742

collections.Callable):

2743

parent_pipe.send(('function', ))

2791

2744

else:

2792

2745

parent_pipe.send((

2793

"data", client_object.__getattribute__(attrname)))

2746

'data', client_object.__getattribute__(attrname)))

2794

2747

2795

if command == "setattr":

2748

if command == 'setattr':

2796

2749

attrname = request[1]

2797

2750

value = request[2]

2798

2751

setattr(client_object, attrname, value)

2803

2756

def rfc3339_duration_to_delta(duration):

2804

2757

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2805

2758

2806

>>> timedelta = datetime.timedelta

2807

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2808

True

2809

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2810

True

2811

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2812

True

2813

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2814

True

2815

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2816

True

2817

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2818

True

2819

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2820

True

2821

>>> del timedelta

2759

>>> rfc3339_duration_to_delta("P7D")

2760

datetime.timedelta(7)

2761

>>> rfc3339_duration_to_delta("PT60S")

2762

datetime.timedelta(0, 60)

2763

>>> rfc3339_duration_to_delta("PT60M")

2764

datetime.timedelta(0, 3600)

2765

>>> rfc3339_duration_to_delta("PT24H")

2766

datetime.timedelta(1)

2767

>>> rfc3339_duration_to_delta("P1W")

2768

datetime.timedelta(7)

2769

>>> rfc3339_duration_to_delta("PT5M30S")

2770

datetime.timedelta(0, 330)

2771

>>> rfc3339_duration_to_delta("P1DT3M20S")

2772

datetime.timedelta(1, 200)

2822

2773

"""

2823

2774

2824

2775

# Parsing an RFC 3339 duration with regular expressions is not

2904

2855

def string_to_delta(interval):

2905

2856

"""Parse a string and return a datetime.timedelta

2906

2857

2907

>>> string_to_delta("7d") == datetime.timedelta(7)

2908

True

2909

>>> string_to_delta("60s") == datetime.timedelta(0, 60)

2910

True

2911

>>> string_to_delta("60m") == datetime.timedelta(0, 3600)

2912

True

2913

>>> string_to_delta("24h") == datetime.timedelta(1)

2914

True

2915

>>> string_to_delta("1w") == datetime.timedelta(7)

2916

True

2917

>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

2918

True

2858

>>> string_to_delta('7d')

2859

datetime.timedelta(7)

2860

>>> string_to_delta('60s')

2861

datetime.timedelta(0, 60)

2862

>>> string_to_delta('60m')

2863

datetime.timedelta(0, 3600)

2864

>>> string_to_delta('24h')

2865

datetime.timedelta(1)

2866

>>> string_to_delta('1w')

2867

datetime.timedelta(7)

2868

>>> string_to_delta('5m 30s')

2869

datetime.timedelta(0, 330)

2919

2870

"""

2920

2871

2921

2872

try:

3023

2974

3024

2975

options = parser.parse_args()

3025

2976

2977

if options.check:

2978

import doctest

2979

fail_count, test_count = doctest.testmod()

2980

sys.exit(os.EX_OK if fail_count == 0 else 1)

2981

3026

2982

# Default values for config file for server-global settings

3027

2983

if gnutls.has_rawpk:

3028

2984

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3048

3004

del priority

3049

3005

3050

3006

# Parse config file for server-global settings

3051

server_config = configparser.ConfigParser(server_defaults)

3007

server_config = configparser.SafeConfigParser(server_defaults)

3052

3008

del server_defaults

3053

3009

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3054

# Convert the ConfigParser object to a dict

3010

# Convert the SafeConfigParser object to a dict

3055

3011

server_settings = server_config.defaults()

3056

3012

# Use the appropriate methods on the non-string config options

3057

3013

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3124

3080

3125

3081

if server_settings["servicename"] != "Mandos":

3126

3082

syslogger.setFormatter(

3127

logging.Formatter("Mandos ({}) [%(process)d]:"

3128

" %(levelname)s: %(message)s".format(

3083

logging.Formatter('Mandos ({}) [%(process)d]:'

3084

' %(levelname)s: %(message)s'.format(

3129

3085

server_settings["servicename"])))

3130

3086

3131

3087

# Parse config file with clients

3132

client_config = configparser.ConfigParser(Client.client_defaults)

3088

client_config = configparser.SafeConfigParser(Client

3089

.client_defaults)

3133

3090

client_config.read(os.path.join(server_settings["configdir"],

3134

3091

"clients.conf"))

3135

3092

3155

3112

try:

3156

3113

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

3157

3114

except IOError as e:

3158

log.error("Could not open file %r", pidfilename,

3159

exc_info=e)

3115

logger.error("Could not open file %r", pidfilename,

3116

exc_info=e)

3160

3117

3161

3118

for name, group in (("_mandos", "_mandos"),

3162

3119

("mandos", "mandos"),

3173

3130

try:

3174

3131

os.setgid(gid)

3175

3132

os.setuid(uid)

3176

log.debug("Did setuid/setgid to %s:%s", uid, gid)

3133

if debug:

3134

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3135

gid))

3177

3136

except OSError as error:

3178

log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,

3179

os.strerror(error.errno))

3137

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3138

.format(uid, gid, os.strerror(error.errno)))

3180

3139

if error.errno != errno.EPERM:

3181

3140

raise

3182

3141

3189

3148

3190

3149

@gnutls.log_func

3191

3150

def debug_gnutls(level, string):

3192

log.debug("GnuTLS: %s",

3193

string[:-1].decode("utf-8", errors="replace"))

3151

logger.debug("GnuTLS: %s", string[:-1])

3194

3152

3195

3153

gnutls.global_set_log_function(debug_gnutls)

3196

3154

3205

3163

# Close all input and output, do double fork, etc.

3206

3164

daemon()

3207

3165

3208

if gi.version_info < (3, 10, 2):

3209

# multiprocessing will use threads, so before we use GLib we

3210

# need to inform GLib that threads will be used.

3211

GLib.threads_init()

3166

# multiprocessing will use threads, so before we use GLib we need

3167

# to inform GLib that threads will be used.

3168

GLib.threads_init()

3212

3169

3213

3170

global main_loop

3214

3171

# From the Avahi example code

3225

3182

"se.bsnet.fukt.Mandos", bus,

3226

3183

do_not_queue=True)

3227

3184

except dbus.exceptions.DBusException as e:

3228

log.error("Disabling D-Bus:", exc_info=e)

3185

logger.error("Disabling D-Bus:", exc_info=e)

3229

3186

use_dbus = False

3230

3187

server_settings["use_dbus"] = False

3231

3188

tcp_server.use_dbus = False

3290

3247

if isinstance(s, bytes)

3291

3248

else s) for s in

3292

3249

value["client_structure"]]

3293

# .name, .host, and .checker_command

3294

for k in ("name", "host", "checker_command"):

3250

# .name & .host

3251

for k in ("name", "host"):

3295

3252

if isinstance(value[k], bytes):

3296

3253

value[k] = value[k].decode("utf-8")

3297

if "key_id" not in value:

3254

if not value.has_key("key_id"):

3298

3255

value["key_id"] = ""

3299

elif "fingerprint" not in value:

3256

elif not value.has_key("fingerprint"):

3300

3257

value["fingerprint"] = ""

3301

3258

# old_client_settings

3302

3259

# .keys()

3307

3264

for key, value in

3308

3265

bytes_old_client_settings.items()}

3309

3266

del bytes_old_client_settings

3310

# .host and .checker_command

3267

# .host

3311

3268

for value in old_client_settings.values():

3312

for attribute in ("host", "checker_command"):

3313

if isinstance(value[attribute], bytes):

3314

value[attribute] = (value[attribute]

3315

.decode("utf-8"))

3269

if isinstance(value["host"], bytes):

3270

value["host"] = (value["host"]

3271

.decode("utf-8"))

3316

3272

os.remove(stored_state_path)

3317

3273

except IOError as e:

3318

3274

if e.errno == errno.ENOENT:

3319

log.warning("Could not load persistent state:"

3320

" %s", os.strerror(e.errno))

3275

logger.warning("Could not load persistent state:"

3276

" {}".format(os.strerror(e.errno)))

3321

3277

else:

3322

log.critical("Could not load persistent state:",

3323

exc_info=e)

3278

logger.critical("Could not load persistent state:",

3279

exc_info=e)

3324

3280

raise

3325

3281

except EOFError as e:

3326

log.warning("Could not load persistent state: EOFError:",

3327

exc_info=e)

3282

logger.warning("Could not load persistent state: "

3283

"EOFError:",

3284

exc_info=e)

3328

3285

3329

3286

with PGPEngine() as pgp:

3330

3287

for client_name, client in clients_data.items():

3357

3314

if client["enabled"]:

3358

3315

if datetime.datetime.utcnow() >= client["expires"]:

3359

3316

if not client["last_checked_ok"]:

3360

log.warning("disabling client %s - Client"

3361

" never performed a successful"

3362

" checker", client_name)

3317

logger.warning(

3318

"disabling client {} - Client never "

3319

"performed a successful checker".format(

3320

client_name))

3363

3321

client["enabled"] = False

3364

3322

elif client["last_checker_status"] != 0:

3365

log.warning("disabling client %s - Client"

3366

" last checker failed with error"

3367

" code %s", client_name,

3368

client["last_checker_status"])

3323

logger.warning(

3324

"disabling client {} - Client last"

3325

" checker failed with error code"

3326

" {}".format(

3327

client_name,

3328

client["last_checker_status"]))

3369

3329

client["enabled"] = False

3370

3330

else:

3371

3331

client["expires"] = (

3372

3332

datetime.datetime.utcnow()

3373

3333

+ client["timeout"])

3374

log.debug("Last checker succeeded, keeping %s"

3375

" enabled", client_name)

3334

logger.debug("Last checker succeeded,"

3335

" keeping {} enabled".format(

3336

client_name))

3376

3337

try:

3377

3338

client["secret"] = pgp.decrypt(

3378

3339

client["encrypted_secret"],

3379

3340

client_settings[client_name]["secret"])

3380

3341

except PGPError:

3381

3342

# If decryption fails, we use secret from new settings

3382

log.debug("Failed to decrypt %s old secret",

3383

client_name)

3343

logger.debug("Failed to decrypt {} old secret".format(

3344

client_name))

3384

3345

client["secret"] = (client_settings[client_name]

3385

3346

["secret"])

3386

3347

3400

3361

server_settings=server_settings)

3401

3362

3402

3363

if not tcp_server.clients:

3403

log.warning("No clients defined")

3364

logger.warning("No clients defined")

3404

3365

3405

3366

if not foreground:

3406

3367

if pidfile is not None:

3409

3370

with pidfile:

3410

3371

print(pid, file=pidfile)

3411

3372

except IOError:

3412

log.error("Could not write to file %r with PID %d",

3413

pidfilename, pid)

3373

logger.error("Could not write to file %r with PID %d",

3374

pidfilename, pid)

3414

3375

del pidfile

3415

3376

del pidfilename

3416

3377

3566

3527

3567

3528

try:

3568

3529

with tempfile.NamedTemporaryFile(

3569

mode="wb",

3530

mode='wb',

3570

3531

suffix=".pickle",

3571

prefix="clients-",

3532

prefix='clients-',

3572

3533

dir=os.path.dirname(stored_state_path),

3573

3534

delete=False) as stored_state:

3574

3535

pickle.dump((clients, client_settings), stored_state,

3582

3543

except NameError:

3583

3544

pass

3584

3545

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3585

log.warning("Could not save persistent state: %s",

3586

os.strerror(e.errno))

3546

logger.warning("Could not save persistent state: {}"

3547

.format(os.strerror(e.errno)))

3587

3548

else:

3588

log.warning("Could not save persistent state:",

3589

exc_info=e)

3549

logger.warning("Could not save persistent state:",

3550

exc_info=e)

3590

3551

raise

3591

3552

3592

3553

# Delete all clients, and settings from config

3618

3579

if zeroconf:

3619

3580

service.port = tcp_server.socket.getsockname()[1]

3620

3581

if use_ipv6:

3621

log.info("Now listening on address %r, port %d, flowinfo %d,"

3622

" scope_id %d", *tcp_server.socket.getsockname())

3582

logger.info("Now listening on address %r, port %d,"

3583

" flowinfo %d, scope_id %d",

3584

*tcp_server.socket.getsockname())

3623

3585

else: # IPv4

3624

log.info("Now listening on address %r, port %d",

3625

*tcp_server.socket.getsockname())

3586

logger.info("Now listening on address %r, port %d",

3587

*tcp_server.socket.getsockname())

3626

3588

3627

3589

# service.interface = tcp_server.socket.getsockname()[3]

3628

3590

3632

3594

try:

3633

3595

service.activate()

3634

3596

except dbus.exceptions.DBusException as error:

3635

log.critical("D-Bus Exception", exc_info=error)

3597

logger.critical("D-Bus Exception", exc_info=error)

3636

3598

cleanup()

3637

3599

sys.exit(1)

3638

3600

# End of Avahi example code

3639

3601

3640

GLib.io_add_watch(

3641

GLib.IOChannel.unix_new(tcp_server.fileno()),

3642

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3643

lambda *args, **kwargs: (tcp_server.handle_request

3644

(*args[2:], **kwargs) or True))

3602

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3603

lambda *args, **kwargs:

3604

(tcp_server.handle_request

3605

(*args[2:], **kwargs) or True))

3645

3606

3646

log.debug("Starting main loop")

3607

logger.debug("Starting main loop")

3647

3608

main_loop.run()

3648

3609

except AvahiError as error:

3649

log.critical("Avahi Error", exc_info=error)

3610

logger.critical("Avahi Error", exc_info=error)

3650

3611

cleanup()

3651

3612

sys.exit(1)

3652

3613

except KeyboardInterrupt:

3653

3614

if debug:

3654

3615

print("", file=sys.stderr)

3655

log.debug("Server received KeyboardInterrupt")

3656

log.debug("Server exiting")

3616

logger.debug("Server received KeyboardInterrupt")

3617

logger.debug("Server exiting")

3657

3618

# Must run before the D-Bus bus name gets deregistered

3658

3619

cleanup()

3659

3620

3660

3661

def parse_test_args():

3662

# type: () -> argparse.Namespace

3663

parser = argparse.ArgumentParser(add_help=False)

3664

parser.add_argument("--check", action="store_true")

3665

parser.add_argument("--prefix", )

3666

args, unknown_args = parser.parse_known_args()

3667

if args.check:

3668

# Remove test options from sys.argv

3669

sys.argv[1:] = unknown_args

3670

return args

3671

3672

# Add all tests from doctest strings

3673

def load_tests(loader, tests, none):

3674

import doctest

3675

tests.addTests(doctest.DocTestSuite())

3676

return tests

3677

3678

if __name__ == "__main__":

3679

options = parse_test_args()

3680

try:

3681

if options.check:

3682

extra_test_prefix = options.prefix

3683

if extra_test_prefix is not None:

3684

if not (unittest.main(argv=[""], exit=False)

3685

.result.wasSuccessful()):

3686

sys.exit(1)

3687

class ExtraTestLoader(unittest.TestLoader):

3688

testMethodPrefix = extra_test_prefix

3689

# Call using ./scriptname --test [--verbose]

3690

unittest.main(argv=[""], testLoader=ExtraTestLoader())

3691

else:

3692

unittest.main(argv=[""])

3693

else:

3694

main()

3695

finally:

3696

logging.shutdown()

3697

3698

# Local Variables:

3699

# run-tests:

3700

# (lambda (&optional extra)

3701

# (if (not (funcall run-tests-in-test-buffer default-directory

3702

# extra))

3703

# (funcall show-test-buffer-in-test-window)

3704

# (funcall remove-test-window)

3705

# (if extra (message "Extra tests run successfully!"))))

3706

# run-tests-in-test-buffer:

3707

# (lambda (dir &optional extra)

3708

# (with-current-buffer (get-buffer-create "*Test*")

3709

# (setq buffer-read-only nil

3710

# default-directory dir)

3711

# (erase-buffer)

3712

# (compilation-mode))

3713

# (let ((inhibit-read-only t))

3714

# (= (process-file-shell-command

3715

# (funcall get-command-line extra)

3716

# nil "*Test*") 0)))

3717

# get-command-line:

3718

# (lambda (&optional extra)

3719

# (let ((quoted-script

3720

# (shell-quote-argument (funcall get-script-name))))

3721

# (format

3722

# (concat "%s --check" (if extra " --prefix=atest" ""))

3723

# quoted-script)))

3724

# get-script-name:

3725

# (lambda ()

3726

# (if (fboundp 'file-local-name)

3727

# (file-local-name (buffer-file-name))

3728

# (or (file-remote-p (buffer-file-name) 'localname)

3729

# (buffer-file-name))))

3730

# remove-test-window:

3731

# (lambda ()

3732

# (let ((test-window (get-buffer-window "*Test*")))

3733

# (if test-window (delete-window test-window))))

3734

# show-test-buffer-in-test-window:

3735

# (lambda ()

3736

# (when (not (get-buffer-window-list "*Test*"))

3737

# (setq next-error-last-buffer (get-buffer "*Test*"))

3738

# (let* ((side (if (>= (window-width) 146) 'right 'bottom))

3739

# (display-buffer-overriding-action

3740

# `((display-buffer-in-side-window) (side . ,side)

3741

# (window-height . fit-window-to-buffer)

3742

# (window-width . fit-window-to-buffer))))

3743

# (display-buffer "*Test*"))))

3744

# eval:

3745

# (progn

3746

# (let* ((run-extra-tests (lambda () (interactive)

3747

# (funcall run-tests t)))

3748

# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t

3749

# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c

3750

# (setq minor-mode-overriding-map-alist

3751

# (cons `(run-tests . ,outer-keymap)

3752

# minor-mode-overriding-map-alist)))

3753

# (add-hook 'after-save-hook run-tests 90 t))

3754

# End:

3621

3622

if __name__ == '__main__':

3623

main()