70
import cPickle as pickle
65
import cPickle as pickle
73
66
import multiprocessing
82
74
import dbus.service
84
from gi.repository import GLib
85
77
from dbus.mainloop.glib import DBusGMainLoop
88
80
import xml.dom.minidom
91
# Try to find the value of SO_BINDTODEVICE:
93
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
94
# newer, and it is also the most natural place for it:
95
84
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
96
85
except AttributeError:
98
# This is where SO_BINDTODEVICE was up to and including Python
100
87
from IN import SO_BINDTODEVICE
101
88
except ImportError:
102
# In Python 2.7 it seems to have been removed entirely.
103
# Try running the C preprocessor:
105
cc = subprocess.Popen(["cc", "--language=c", "-E",
107
stdin=subprocess.PIPE,
108
stdout=subprocess.PIPE)
109
stdout = cc.communicate(
110
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
111
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
112
except (OSError, ValueError, IndexError):
114
SO_BINDTODEVICE = None
116
if sys.version_info.major == 2:
119
if sys.version_info < (3, 2):
120
configparser.Configparser = configparser.SafeConfigParser
89
SO_BINDTODEVICE = None
123
92
stored_state_file = "clients.pickle"
125
94
logger = logging.getLogger()
129
if_nametoindex = ctypes.cdll.LoadLibrary(
130
ctypes.util.find_library("c")).if_nametoindex
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
131
101
except (OSError, AttributeError):
133
102
def if_nametoindex(interface):
134
103
"Get an interface index the hard way, i.e. using fcntl()"
135
104
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
136
105
with contextlib.closing(socket.socket()) as s:
137
106
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
138
struct.pack(b"16s16x", interface))
139
interface_index = struct.unpack("I", ifreq[16:20])[0]
107
struct.pack(str("16s16x"),
109
interface_index = struct.unpack(str("I"),
140
111
return interface_index
143
def copy_function(func):
144
"""Make a copy of a function"""
145
if sys.version_info.major == 2:
146
return types.FunctionType(func.func_code,
152
return types.FunctionType(func.__code__,
159
114
def initlogger(debug, level=logging.WARNING):
160
115
"""init logger and add loglevel"""
163
syslogger = (logging.handlers.SysLogHandler(
164
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
118
syslogger = (logging.handlers.SysLogHandler
120
logging.handlers.SysLogHandler.LOG_DAEMON,
121
address = str("/dev/log")))
166
122
syslogger.setFormatter(logging.Formatter
167
123
('Mandos [%(process)d]: %(levelname)s:'
169
125
logger.addHandler(syslogger)
172
128
console = logging.StreamHandler()
173
129
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
240
182
.replace(b"\n", b"\\n")
241
183
.replace(b"\0", b"\\x00"))
244
186
def encrypt(self, data, password):
245
187
passphrase = self.password_encode(password)
246
with tempfile.NamedTemporaryFile(
247
dir=self.tempdir) as passfile:
188
with tempfile.NamedTemporaryFile(dir=self.tempdir
248
190
passfile.write(passphrase)
250
proc = subprocess.Popen([self.gpg, '--symmetric',
192
proc = subprocess.Popen(['gpg', '--symmetric',
251
193
'--passphrase-file',
253
195
+ self.gnupgargs,
254
stdin=subprocess.PIPE,
255
stdout=subprocess.PIPE,
256
stderr=subprocess.PIPE)
257
ciphertext, err = proc.communicate(input=data)
196
stdin = subprocess.PIPE,
197
stdout = subprocess.PIPE,
198
stderr = subprocess.PIPE)
199
ciphertext, err = proc.communicate(input = data)
258
200
if proc.returncode != 0:
259
201
raise PGPError(err)
260
202
return ciphertext
262
204
def decrypt(self, data, password):
263
205
passphrase = self.password_encode(password)
264
with tempfile.NamedTemporaryFile(
265
dir=self.tempdir) as passfile:
206
with tempfile.NamedTemporaryFile(dir = self.tempdir
266
208
passfile.write(passphrase)
268
proc = subprocess.Popen([self.gpg, '--decrypt',
210
proc = subprocess.Popen(['gpg', '--decrypt',
269
211
'--passphrase-file',
271
213
+ self.gnupgargs,
272
stdin=subprocess.PIPE,
273
stdout=subprocess.PIPE,
274
stderr=subprocess.PIPE)
275
decrypted_plaintext, err = proc.communicate(input=data)
214
stdin = subprocess.PIPE,
215
stdout = subprocess.PIPE,
216
stderr = subprocess.PIPE)
217
decrypted_plaintext, err = proc.communicate(input
276
219
if proc.returncode != 0:
277
220
raise PGPError(err)
278
221
return decrypted_plaintext
281
# Pretend that we have an Avahi module
283
"""This isn't so much a class as it is a module-like namespace."""
284
IF_UNSPEC = -1 # avahi-common/address.h
285
PROTO_UNSPEC = -1 # avahi-common/address.h
286
PROTO_INET = 0 # avahi-common/address.h
287
PROTO_INET6 = 1 # avahi-common/address.h
288
DBUS_NAME = "org.freedesktop.Avahi"
289
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
290
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
291
DBUS_PATH_SERVER = "/"
294
def string_array_to_txt_array(t):
295
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
296
for s in t), signature="ay")
297
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
298
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
299
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
300
SERVER_INVALID = 0 # avahi-common/defs.h
301
SERVER_REGISTERING = 1 # avahi-common/defs.h
302
SERVER_RUNNING = 2 # avahi-common/defs.h
303
SERVER_COLLISION = 3 # avahi-common/defs.h
304
SERVER_FAILURE = 4 # avahi-common/defs.h
307
224
class AvahiError(Exception):
308
225
def __init__(self, value, *args, **kwargs):
309
226
self.value = value
310
return super(AvahiError, self).__init__(value, *args,
227
super(AvahiError, self).__init__(value, *args, **kwargs)
228
def __unicode__(self):
229
return unicode(repr(self.value))
314
231
class AvahiServiceError(AvahiError):
318
234
class AvahiGroupError(AvahiError):
322
238
class AvahiService(object):
323
239
"""An Avahi (Zeroconf) service.
326
242
interface: integer; avahi.IF_UNSPEC or an interface index.
327
243
Used to optionally bind to the specified interface.
492
386
follow_name_owner_changes=True),
493
387
avahi.DBUS_INTERFACE_SERVER)
494
388
self.server.connect_to_signal("StateChanged",
495
self.server_state_changed)
389
self.server_state_changed)
496
390
self.server_state_changed(self.server.GetState())
499
393
class AvahiServiceToSyslog(AvahiService):
500
def rename(self, *args, **kwargs):
501
395
"""Add the new name to the syslog messages"""
502
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
503
syslogger.setFormatter(logging.Formatter(
504
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
396
ret = AvahiService.rename(self)
397
syslogger.setFormatter(logging.Formatter
398
('Mandos ({}) [%(process)d]:'
399
' %(levelname)s: %(message)s'
509
# Pretend that we have a GnuTLS module
510
class gnutls(object):
511
"""This isn't so much a class as it is a module-like namespace."""
513
library = ctypes.util.find_library("gnutls")
515
library = ctypes.util.find_library("gnutls-deb0")
516
_library = ctypes.cdll.LoadLibrary(library)
519
# Unless otherwise indicated, the constants and types below are
520
# all from the gnutls/gnutls.h C header file.
531
E_NO_CERTIFICATE_FOUND = -49
536
KEYID_USE_SHA256 = 1 # gnutls/x509.h
537
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
540
class session_int(ctypes.Structure):
542
session_t = ctypes.POINTER(session_int)
544
class certificate_credentials_st(ctypes.Structure):
546
certificate_credentials_t = ctypes.POINTER(
547
certificate_credentials_st)
548
certificate_type_t = ctypes.c_int
550
class datum_t(ctypes.Structure):
551
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
552
('size', ctypes.c_uint)]
554
class openpgp_crt_int(ctypes.Structure):
556
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
557
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
558
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
559
credentials_type_t = ctypes.c_int
560
transport_ptr_t = ctypes.c_void_p
561
close_request_t = ctypes.c_int
564
class Error(Exception):
565
def __init__(self, message=None, code=None, args=()):
566
# Default usage is by a message string, but if a return
567
# code is passed, convert it to a string with
570
if message is None and code is not None:
571
message = gnutls.strerror(code)
572
return super(gnutls.Error, self).__init__(
575
class CertificateSecurityError(Error):
579
class Credentials(object):
581
self._c_object = gnutls.certificate_credentials_t()
582
gnutls.certificate_allocate_credentials(
583
ctypes.byref(self._c_object))
584
self.type = gnutls.CRD_CERTIFICATE
587
gnutls.certificate_free_credentials(self._c_object)
589
class ClientSession(object):
590
def __init__(self, socket, credentials=None):
591
self._c_object = gnutls.session_t()
592
gnutls_flags = gnutls.CLIENT
593
if gnutls.check_version(b"3.5.6"):
594
gnutls_flags |= gnutls.NO_TICKETS
596
gnutls_flags |= gnutls.ENABLE_RAWPK
597
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
599
gnutls.set_default_priority(self._c_object)
600
gnutls.transport_set_ptr(self._c_object, socket.fileno())
601
gnutls.handshake_set_private_extensions(self._c_object,
604
if credentials is None:
605
credentials = gnutls.Credentials()
606
gnutls.credentials_set(self._c_object, credentials.type,
607
ctypes.cast(credentials._c_object,
609
self.credentials = credentials
612
gnutls.deinit(self._c_object)
615
return gnutls.handshake(self._c_object)
617
def send(self, data):
621
data_len -= gnutls.record_send(self._c_object,
626
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
628
# Error handling functions
629
def _error_code(result):
630
"""A function to raise exceptions on errors, suitable
631
for the 'restype' attribute on ctypes functions"""
634
if result == gnutls.E_NO_CERTIFICATE_FOUND:
635
raise gnutls.CertificateSecurityError(code=result)
636
raise gnutls.Error(code=result)
638
def _retry_on_error(result, func, arguments):
639
"""A function to retry on some errors, suitable
640
for the 'errcheck' attribute on ctypes functions"""
642
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
643
return _error_code(result)
644
result = func(*arguments)
647
# Unless otherwise indicated, the function declarations below are
648
# all from the gnutls/gnutls.h C header file.
651
priority_set_direct = _library.gnutls_priority_set_direct
652
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
653
ctypes.POINTER(ctypes.c_char_p)]
654
priority_set_direct.restype = _error_code
656
init = _library.gnutls_init
657
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
658
init.restype = _error_code
660
set_default_priority = _library.gnutls_set_default_priority
661
set_default_priority.argtypes = [session_t]
662
set_default_priority.restype = _error_code
664
record_send = _library.gnutls_record_send
665
record_send.argtypes = [session_t, ctypes.c_void_p,
667
record_send.restype = ctypes.c_ssize_t
668
record_send.errcheck = _retry_on_error
670
certificate_allocate_credentials = (
671
_library.gnutls_certificate_allocate_credentials)
672
certificate_allocate_credentials.argtypes = [
673
ctypes.POINTER(certificate_credentials_t)]
674
certificate_allocate_credentials.restype = _error_code
676
certificate_free_credentials = (
677
_library.gnutls_certificate_free_credentials)
678
certificate_free_credentials.argtypes = [
679
certificate_credentials_t]
680
certificate_free_credentials.restype = None
682
handshake_set_private_extensions = (
683
_library.gnutls_handshake_set_private_extensions)
684
handshake_set_private_extensions.argtypes = [session_t,
686
handshake_set_private_extensions.restype = None
688
credentials_set = _library.gnutls_credentials_set
689
credentials_set.argtypes = [session_t, credentials_type_t,
691
credentials_set.restype = _error_code
693
strerror = _library.gnutls_strerror
694
strerror.argtypes = [ctypes.c_int]
695
strerror.restype = ctypes.c_char_p
697
certificate_type_get = _library.gnutls_certificate_type_get
698
certificate_type_get.argtypes = [session_t]
699
certificate_type_get.restype = _error_code
701
certificate_get_peers = _library.gnutls_certificate_get_peers
702
certificate_get_peers.argtypes = [session_t,
703
ctypes.POINTER(ctypes.c_uint)]
704
certificate_get_peers.restype = ctypes.POINTER(datum_t)
706
global_set_log_level = _library.gnutls_global_set_log_level
707
global_set_log_level.argtypes = [ctypes.c_int]
708
global_set_log_level.restype = None
710
global_set_log_function = _library.gnutls_global_set_log_function
711
global_set_log_function.argtypes = [log_func]
712
global_set_log_function.restype = None
714
deinit = _library.gnutls_deinit
715
deinit.argtypes = [session_t]
716
deinit.restype = None
718
handshake = _library.gnutls_handshake
719
handshake.argtypes = [session_t]
720
handshake.restype = _error_code
721
handshake.errcheck = _retry_on_error
723
transport_set_ptr = _library.gnutls_transport_set_ptr
724
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
725
transport_set_ptr.restype = None
727
bye = _library.gnutls_bye
728
bye.argtypes = [session_t, close_request_t]
729
bye.restype = _error_code
730
bye.errcheck = _retry_on_error
732
check_version = _library.gnutls_check_version
733
check_version.argtypes = [ctypes.c_char_p]
734
check_version.restype = ctypes.c_char_p
736
_need_version = b"3.3.0"
737
if check_version(_need_version) is None:
738
raise self.Error("Needs GnuTLS {} or later"
739
.format(_need_version))
741
_tls_rawpk_version = b"3.6.6"
742
has_rawpk = bool(check_version(_tls_rawpk_version))
746
class pubkey_st(ctypes.Structure):
748
pubkey_t = ctypes.POINTER(pubkey_st)
750
x509_crt_fmt_t = ctypes.c_int
752
# All the function declarations below are from gnutls/abstract.h
753
pubkey_init = _library.gnutls_pubkey_init
754
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
755
pubkey_init.restype = _error_code
757
pubkey_import = _library.gnutls_pubkey_import
758
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
760
pubkey_import.restype = _error_code
762
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
763
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
764
ctypes.POINTER(ctypes.c_ubyte),
765
ctypes.POINTER(ctypes.c_size_t)]
766
pubkey_get_key_id.restype = _error_code
768
pubkey_deinit = _library.gnutls_pubkey_deinit
769
pubkey_deinit.argtypes = [pubkey_t]
770
pubkey_deinit.restype = None
772
# All the function declarations below are from gnutls/openpgp.h
774
openpgp_crt_init = _library.gnutls_openpgp_crt_init
775
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
776
openpgp_crt_init.restype = _error_code
778
openpgp_crt_import = _library.gnutls_openpgp_crt_import
779
openpgp_crt_import.argtypes = [openpgp_crt_t,
780
ctypes.POINTER(datum_t),
782
openpgp_crt_import.restype = _error_code
784
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
785
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
786
ctypes.POINTER(ctypes.c_uint)]
787
openpgp_crt_verify_self.restype = _error_code
789
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
790
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
791
openpgp_crt_deinit.restype = None
793
openpgp_crt_get_fingerprint = (
794
_library.gnutls_openpgp_crt_get_fingerprint)
795
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
799
openpgp_crt_get_fingerprint.restype = _error_code
801
if check_version(b"3.6.4"):
802
certificate_type_get2 = _library.gnutls_certificate_type_get2
803
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
804
certificate_type_get2.restype = _error_code
806
# Remove non-public functions
807
del _error_code, _retry_on_error
810
def call_pipe(connection, # : multiprocessing.Connection
811
func, *args, **kwargs):
812
"""This function is meant to be called by multiprocessing.Process
814
This function runs func(*args, **kwargs), and writes the resulting
815
return value on the provided multiprocessing.Connection.
817
connection.send(func(*args, **kwargs))
821
404
class Client(object):
822
405
"""A representation of a client host served by this server.
825
408
approved: bool(); 'None' if not yet approved/disapproved
826
409
approval_delay: datetime.timedelta(); Time to wait for approval
827
410
approval_duration: datetime.timedelta(); Duration of one approval
828
checker: multiprocessing.Process(); a running checker process used
829
to see if the client lives. 'None' if no process is
831
checker_callback_tag: a GLib event source tag, or None
411
checker: subprocess.Popen(); a running checker process used
412
to see if the client lives.
413
'None' if no process is running.
414
checker_callback_tag: a gobject event source tag, or None
832
415
checker_command: string; External command which is run to check
833
416
if client lives. %() expansions are done at
834
417
runtime with vars(self) as dict, so that for
835
418
instance %(name)s can be used in the command.
836
checker_initiator_tag: a GLib event source tag, or None
419
checker_initiator_tag: a gobject event source tag, or None
837
420
created: datetime.datetime(); (UTC) object creation
838
421
client_structure: Object describing what attributes a client has
839
422
and is used for storing the client at exit
840
423
current_checker_command: string; current running checker_command
841
disable_initiator_tag: a GLib event source tag, or None
424
disable_initiator_tag: a gobject event source tag, or None
843
426
fingerprint: string (40 or 32 hexadecimal digits); used to
844
uniquely identify an OpenPGP client
845
key_id: string (64 hexadecimal digits); used to uniquely identify
846
a client using raw public keys
427
uniquely identify the client
847
428
host: string; available for use by the checker command
848
429
interval: datetime.timedelta(); How often to start a new checker
849
430
last_approval_request: datetime.datetime(); (UTC) or None
1006
582
logger.info("Disabling client %s", self.name)
1007
583
if getattr(self, "disable_initiator_tag", None) is not None:
1008
GLib.source_remove(self.disable_initiator_tag)
584
gobject.source_remove(self.disable_initiator_tag)
1009
585
self.disable_initiator_tag = None
1010
586
self.expires = None
1011
587
if getattr(self, "checker_initiator_tag", None) is not None:
1012
GLib.source_remove(self.checker_initiator_tag)
588
gobject.source_remove(self.checker_initiator_tag)
1013
589
self.checker_initiator_tag = None
1014
590
self.stop_checker()
1015
591
self.enabled = False
1017
593
self.send_changedstate()
1018
# Do not run this again if called by a GLib.timeout_add
594
# Do not run this again if called by a gobject.timeout_add
1021
597
def __del__(self):
1024
600
def init_checker(self):
1025
601
# Schedule a new checker to be started an 'interval' from now,
1026
602
# and every interval from then on.
1027
603
if self.checker_initiator_tag is not None:
1028
GLib.source_remove(self.checker_initiator_tag)
1029
self.checker_initiator_tag = GLib.timeout_add(
1030
int(self.interval.total_seconds() * 1000),
604
gobject.source_remove(self.checker_initiator_tag)
605
self.checker_initiator_tag = (gobject.timeout_add
607
.total_seconds() * 1000),
1032
609
# Schedule a disable() when 'timeout' has passed
1033
610
if self.disable_initiator_tag is not None:
1034
GLib.source_remove(self.disable_initiator_tag)
1035
self.disable_initiator_tag = GLib.timeout_add(
1036
int(self.timeout.total_seconds() * 1000), self.disable)
611
gobject.source_remove(self.disable_initiator_tag)
612
self.disable_initiator_tag = (gobject.timeout_add
614
.total_seconds() * 1000),
1037
616
# Also start a new checker *right now*.
1038
617
self.start_checker()
1040
def checker_callback(self, source, condition, connection,
619
def checker_callback(self, pid, condition, command):
1042
620
"""The checker has completed, so take appropriate actions."""
1043
# Read return code from connection (see call_pipe)
1044
returncode = connection.recv()
1047
621
self.checker_callback_tag = None
1048
622
self.checker = None
1051
self.last_checker_status = returncode
1052
self.last_checker_signal = None
623
if os.WIFEXITED(condition):
624
self.last_checker_status = os.WEXITSTATUS(condition)
1053
625
if self.last_checker_status == 0:
1054
626
logger.info("Checker for %(name)s succeeded",
1056
628
self.checked_ok()
1058
logger.info("Checker for %(name)s failed", vars(self))
630
logger.info("Checker for %(name)s failed",
1060
633
self.last_checker_status = -1
1061
self.last_checker_signal = -returncode
1062
634
logger.warning("Checker for %(name)s crashed?",
1066
637
def checked_ok(self):
1067
638
"""Assert that the client has been seen, alive and well."""
1068
639
self.last_checked_ok = datetime.datetime.utcnow()
1069
640
self.last_checker_status = 0
1070
self.last_checker_signal = None
1071
641
self.bump_timeout()
1073
643
def bump_timeout(self, timeout=None):
1074
644
"""Bump up the timeout for this client."""
1075
645
if timeout is None:
1076
646
timeout = self.timeout
1077
647
if self.disable_initiator_tag is not None:
1078
GLib.source_remove(self.disable_initiator_tag)
648
gobject.source_remove(self.disable_initiator_tag)
1079
649
self.disable_initiator_tag = None
1080
650
if getattr(self, "enabled", False):
1081
self.disable_initiator_tag = GLib.timeout_add(
1082
int(timeout.total_seconds() * 1000), self.disable)
651
self.disable_initiator_tag = (gobject.timeout_add
652
(int(timeout.total_seconds()
653
* 1000), self.disable))
1083
654
self.expires = datetime.datetime.utcnow() + timeout
1085
656
def need_approval(self):
1086
657
self.last_approval_request = datetime.datetime.utcnow()
1088
659
def start_checker(self):
1089
660
"""Start a new checker subprocess if one is not running.
1091
662
If a checker already exists, leave it running and do
1093
664
# The reason for not killing a running checker is that if we
1098
669
# checkers alone, the checker would have to take more time
1099
670
# than 'timeout' for the client to be disabled, which is as it
1102
if self.checker is not None and not self.checker.is_alive():
1103
logger.warning("Checker was not alive; joining")
673
# If a checker exists, make sure it is not a zombie
675
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
676
except AttributeError:
678
except OSError as error:
679
if error.errno != errno.ECHILD:
683
logger.warning("Checker was a zombie")
684
gobject.source_remove(self.checker_callback_tag)
685
self.checker_callback(pid, status,
686
self.current_checker_command)
1106
687
# Start a new checker if needed
1107
688
if self.checker is None:
1108
689
# Escape attributes for the shell
1110
attr: re.escape(str(getattr(self, attr)))
1111
for attr in self.runtime_expansions}
690
escaped_attrs = { attr:
691
re.escape(unicode(getattr(self,
693
for attr in self.runtime_expansions }
1113
695
command = self.checker_command % escaped_attrs
1114
696
except TypeError as error:
1115
697
logger.error('Could not format string "%s"',
1116
self.checker_command,
698
self.checker_command, exc_info=error)
699
return True # Try again later
700
self.current_checker_command = command
702
logger.info("Starting checker %r for %s",
704
# We don't need to redirect stdout and stderr, since
705
# in normal mode, that is already done by daemon(),
706
# and in debug mode we don't want to. (Stdin is
707
# always replaced by /dev/null.)
708
# The exception is when not debugging but nevertheless
709
# running in the foreground; use the previously
712
if (not self.server_settings["debug"]
713
and self.server_settings["foreground"]):
714
popen_args.update({"stdout": wnull,
716
self.checker = subprocess.Popen(command,
720
except OSError as error:
721
logger.error("Failed to start subprocess",
1118
return True # Try again later
1119
self.current_checker_command = command
1120
logger.info("Starting checker %r for %s", command,
1122
# We don't need to redirect stdout and stderr, since
1123
# in normal mode, that is already done by daemon(),
1124
# and in debug mode we don't want to. (Stdin is
1125
# always replaced by /dev/null.)
1126
# The exception is when not debugging but nevertheless
1127
# running in the foreground; use the previously
1129
popen_args = {"close_fds": True,
1132
if (not self.server_settings["debug"]
1133
and self.server_settings["foreground"]):
1134
popen_args.update({"stdout": wnull,
1136
pipe = multiprocessing.Pipe(duplex=False)
1137
self.checker = multiprocessing.Process(
1139
args=(pipe[1], subprocess.call, command),
1141
self.checker.start()
1142
self.checker_callback_tag = GLib.io_add_watch(
1143
pipe[0].fileno(), GLib.IO_IN,
1144
self.checker_callback, pipe[0], command)
1145
# Re-run this periodically if run by GLib.timeout_add
724
self.checker_callback_tag = (gobject.child_watch_add
726
self.checker_callback,
728
# The checker may have completed before the gobject
729
# watch was added. Check for this.
731
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
732
except OSError as error:
733
if error.errno == errno.ECHILD:
734
# This should never happen
735
logger.error("Child process vanished",
740
gobject.source_remove(self.checker_callback_tag)
741
self.checker_callback(pid, status, command)
742
# Re-run this periodically if run by gobject.timeout_add
1148
745
def stop_checker(self):
1149
746
"""Force the checker process, if any, to stop."""
1150
747
if self.checker_callback_tag:
1151
GLib.source_remove(self.checker_callback_tag)
748
gobject.source_remove(self.checker_callback_tag)
1152
749
self.checker_callback_tag = None
1153
750
if getattr(self, "checker", None) is None:
1155
752
logger.debug("Stopping checker for %(name)s", vars(self))
1156
self.checker.terminate()
754
self.checker.terminate()
756
#if self.checker.poll() is None:
757
# self.checker.kill()
758
except OSError as error:
759
if error.errno != errno.ESRCH: # No such process
1157
761
self.checker = None
1160
def dbus_service_property(dbus_interface,
764
def dbus_service_property(dbus_interface, signature="v",
765
access="readwrite", byte_arrays=False):
1164
766
"""Decorators for marking methods of a DBusObjectWithProperties to
1165
767
become properties on the D-Bus.
1167
769
The decorated method will be called with no arguments by "Get"
1168
770
and with one argument by "Set".
1170
772
The parameters, where they are supported, are the same as
1171
773
dbus.service.method, except there is only "signature", since the
1172
774
type from Get() and the type sent to Set() is the same.
1255
class DBusObjectWithAnnotations(dbus.service.Object):
1256
"""A D-Bus object with annotations.
1258
Classes inheriting from this can use the dbus_annotations
1259
decorator to add annotations to methods or signals.
850
class DBusObjectWithProperties(dbus.service.Object):
851
"""A D-Bus object with properties.
853
Classes inheriting from this can use the dbus_service_property
854
decorator to expose methods as D-Bus properties. It exposes the
855
standard Get(), Set(), and GetAll() methods on the D-Bus.
1263
859
def _is_dbus_thing(thing):
1264
860
"""Returns a function testing if an attribute is a D-Bus thing
1266
862
If called like _is_dbus_thing("method") it returns a function
1267
863
suitable for use as predicate to inspect.getmembers().
1269
865
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1272
868
def _get_all_dbus_things(self, thing):
1273
869
"""Returns a generator of (name, attribute) pairs
1275
return ((getattr(athing.__get__(self), "_dbus_name", name),
871
return ((getattr(athing.__get__(self), "_dbus_name",
1276
873
athing.__get__(self))
1277
874
for cls in self.__class__.__mro__
1278
875
for name, athing in
1279
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1281
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1283
path_keyword='object_path',
1284
connection_keyword='connection')
1285
def Introspect(self, object_path, connection):
1286
"""Overloading of standard D-Bus method.
1288
Inserts annotation tags on methods and signals.
1290
xmlstring = dbus.service.Object.Introspect(self, object_path,
1293
document = xml.dom.minidom.parseString(xmlstring)
1295
for if_tag in document.getElementsByTagName("interface"):
1296
# Add annotation tags
1297
for typ in ("method", "signal"):
1298
for tag in if_tag.getElementsByTagName(typ):
1300
for name, prop in (self.
1301
_get_all_dbus_things(typ)):
1302
if (name == tag.getAttribute("name")
1303
and prop._dbus_interface
1304
== if_tag.getAttribute("name")):
1305
annots.update(getattr(
1306
prop, "_dbus_annotations", {}))
1307
for name, value in annots.items():
1308
ann_tag = document.createElement(
1310
ann_tag.setAttribute("name", name)
1311
ann_tag.setAttribute("value", value)
1312
tag.appendChild(ann_tag)
1313
# Add interface annotation tags
1314
for annotation, value in dict(
1315
itertools.chain.from_iterable(
1316
annotations().items()
1317
for name, annotations
1318
in self._get_all_dbus_things("interface")
1319
if name == if_tag.getAttribute("name")
1321
ann_tag = document.createElement("annotation")
1322
ann_tag.setAttribute("name", annotation)
1323
ann_tag.setAttribute("value", value)
1324
if_tag.appendChild(ann_tag)
1325
# Fix argument name for the Introspect method itself
1326
if (if_tag.getAttribute("name")
1327
== dbus.INTROSPECTABLE_IFACE):
1328
for cn in if_tag.getElementsByTagName("method"):
1329
if cn.getAttribute("name") == "Introspect":
1330
for arg in cn.getElementsByTagName("arg"):
1331
if (arg.getAttribute("direction")
1333
arg.setAttribute("name",
1335
xmlstring = document.toxml("utf-8")
1337
except (AttributeError, xml.dom.DOMException,
1338
xml.parsers.expat.ExpatError) as error:
1339
logger.error("Failed to override Introspection method",
1344
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1345
"""A D-Bus object with properties.
1347
Classes inheriting from this can use the dbus_service_property
1348
decorator to expose methods as D-Bus properties. It exposes the
1349
standard Get(), Set(), and GetAll() methods on the D-Bus.
876
inspect.getmembers(cls,
877
self._is_dbus_thing(thing)))
1352
879
def _get_dbus_property(self, interface_name, property_name):
1353
880
"""Returns a bound method if one exists which is a D-Bus
1354
881
property with the specified name and interface.
1356
for cls in self.__class__.__mro__:
1357
for name, value in inspect.getmembers(
1358
cls, self._is_dbus_thing("property")):
883
for cls in self.__class__.__mro__:
884
for name, value in (inspect.getmembers
886
self._is_dbus_thing("property"))):
1359
887
if (value._dbus_name == property_name
1360
888
and value._dbus_interface == interface_name):
1361
889
return value.__get__(self)
1363
891
# No such property
1364
raise DBusPropertyNotFound("{}:{}.{}".format(
1365
self.dbus_object_path, interface_name, property_name))
1368
def _get_all_interface_names(cls):
1369
"""Get a sequence of all interfaces supported by an object"""
1370
return (name for name in set(getattr(getattr(x, attr),
1371
"_dbus_interface", None)
1372
for x in (inspect.getmro(cls))
1374
if name is not None)
1376
@dbus.service.method(dbus.PROPERTIES_IFACE,
892
raise DBusPropertyNotFound(self.dbus_object_path + ":"
893
+ interface_name + "."
896
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1378
897
out_signature="v")
1379
898
def Get(self, interface_name, property_name):
1380
899
"""Standard D-Bus property Get() method, see D-Bus standard.
1509
1031
return xmlstring
1513
dbus.OBJECT_MANAGER_IFACE
1514
except AttributeError:
1515
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1518
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1519
"""A D-Bus object with an ObjectManager.
1521
Classes inheriting from this exposes the standard
1522
GetManagedObjects call and the InterfacesAdded and
1523
InterfacesRemoved signals on the standard
1524
"org.freedesktop.DBus.ObjectManager" interface.
1526
Note: No signals are sent automatically; they must be sent
1529
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1530
out_signature="a{oa{sa{sv}}}")
1531
def GetManagedObjects(self):
1532
"""This function must be overridden"""
1533
raise NotImplementedError()
1535
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1536
signature="oa{sa{sv}}")
1537
def InterfacesAdded(self, object_path, interfaces_and_properties):
1540
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1541
def InterfacesRemoved(self, object_path, interfaces):
1544
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1546
path_keyword='object_path',
1547
connection_keyword='connection')
1548
def Introspect(self, object_path, connection):
1549
"""Overloading of standard D-Bus method.
1551
Override return argument name of GetManagedObjects to be
1552
"objpath_interfaces_and_properties"
1554
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1558
document = xml.dom.minidom.parseString(xmlstring)
1560
for if_tag in document.getElementsByTagName("interface"):
1561
# Fix argument name for the GetManagedObjects method
1562
if (if_tag.getAttribute("name")
1563
== dbus.OBJECT_MANAGER_IFACE):
1564
for cn in if_tag.getElementsByTagName("method"):
1565
if (cn.getAttribute("name")
1566
== "GetManagedObjects"):
1567
for arg in cn.getElementsByTagName("arg"):
1568
if (arg.getAttribute("direction")
1572
"objpath_interfaces"
1574
xmlstring = document.toxml("utf-8")
1576
except (AttributeError, xml.dom.DOMException,
1577
xml.parsers.expat.ExpatError) as error:
1578
logger.error("Failed to override Introspection method",
1583
1034
def datetime_to_dbus(dt, variant_level=0):
1584
1035
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1586
return dbus.String("", variant_level=variant_level)
1587
return dbus.String(dt.isoformat(), variant_level=variant_level)
1037
return dbus.String("", variant_level = variant_level)
1038
return dbus.String(dt.isoformat(),
1039
variant_level=variant_level)
1590
1042
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1951
1392
server to mandos-client
1955
1396
# Rejected - signal
1956
1397
@dbus.service.signal(_interface, signature="s")
1957
1398
def Rejected(self, reason):
1961
1402
# NeedApproval - signal
1962
1403
@dbus.service.signal(_interface, signature="tb")
1963
1404
def NeedApproval(self, timeout, default):
1965
1406
return self.need_approval()
1969
1410
# Approve - method
1970
1411
@dbus.service.method(_interface, in_signature="b")
1971
1412
def Approve(self, value):
1972
1413
self.approve(value)
1974
1415
# CheckedOK - method
1975
1416
@dbus.service.method(_interface)
1976
1417
def CheckedOK(self):
1977
1418
self.checked_ok()
1979
1420
# Enable - method
1980
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1981
1421
@dbus.service.method(_interface)
1982
1422
def Enable(self):
1986
1426
# StartChecker - method
1987
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1988
1427
@dbus.service.method(_interface)
1989
1428
def StartChecker(self):
1991
1430
self.start_checker()
1993
1432
# Disable - method
1994
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1995
1433
@dbus.service.method(_interface)
1996
1434
def Disable(self):
2000
1438
# StopChecker - method
2001
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2002
1439
@dbus.service.method(_interface)
2003
1440
def StopChecker(self):
2004
1441
self.stop_checker()
2008
1445
# ApprovalPending - property
2009
1446
@dbus_service_property(_interface, signature="b", access="read")
2010
1447
def ApprovalPending_dbus_property(self):
2011
1448
return dbus.Boolean(bool(self.approvals_pending))
2013
1450
# ApprovedByDefault - property
2014
@dbus_service_property(_interface,
1451
@dbus_service_property(_interface, signature="b",
2016
1452
access="readwrite")
2017
1453
def ApprovedByDefault_dbus_property(self, value=None):
2018
1454
if value is None: # get
2019
1455
return dbus.Boolean(self.approved_by_default)
2020
1456
self.approved_by_default = bool(value)
2022
1458
# ApprovalDelay - property
2023
@dbus_service_property(_interface,
1459
@dbus_service_property(_interface, signature="t",
2025
1460
access="readwrite")
2026
1461
def ApprovalDelay_dbus_property(self, value=None):
2027
1462
if value is None: # get
2028
1463
return dbus.UInt64(self.approval_delay.total_seconds()
2030
1465
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2032
1467
# ApprovalDuration - property
2033
@dbus_service_property(_interface,
1468
@dbus_service_property(_interface, signature="t",
2035
1469
access="readwrite")
2036
1470
def ApprovalDuration_dbus_property(self, value=None):
2037
1471
if value is None: # get
2038
1472
return dbus.UInt64(self.approval_duration.total_seconds()
2040
1474
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2042
1476
# Name - property
2044
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2045
1477
@dbus_service_property(_interface, signature="s", access="read")
2046
1478
def Name_dbus_property(self):
2047
1479
return dbus.String(self.name)
2051
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2052
@dbus_service_property(_interface, signature="s", access="read")
2053
def KeyID_dbus_property(self):
2054
return dbus.String(self.key_id)
2056
1481
# Fingerprint - property
2058
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2059
1482
@dbus_service_property(_interface, signature="s", access="read")
2060
1483
def Fingerprint_dbus_property(self):
2061
1484
return dbus.String(self.fingerprint)
2063
1486
# Host - property
2064
@dbus_service_property(_interface,
1487
@dbus_service_property(_interface, signature="s",
2066
1488
access="readwrite")
2067
1489
def Host_dbus_property(self, value=None):
2068
1490
if value is None: # get
2069
1491
return dbus.String(self.host)
2070
self.host = str(value)
1492
self.host = unicode(value)
2072
1494
# Created - property
2074
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2075
1495
@dbus_service_property(_interface, signature="s", access="read")
2076
1496
def Created_dbus_property(self):
2077
1497
return datetime_to_dbus(self.created)
2079
1499
# LastEnabled - property
2080
1500
@dbus_service_property(_interface, signature="s", access="read")
2081
1501
def LastEnabled_dbus_property(self):
2082
1502
return datetime_to_dbus(self.last_enabled)
2084
1504
# Enabled - property
2085
@dbus_service_property(_interface,
1505
@dbus_service_property(_interface, signature="b",
2087
1506
access="readwrite")
2088
1507
def Enabled_dbus_property(self, value=None):
2089
1508
if value is None: # get
2371
1773
delay -= time2 - time
2374
session.send(client.secret)
2375
except gnutls.Error as error:
2376
logger.warning("gnutls send failed",
1776
while sent_size < len(client.secret):
1778
sent = session.send(client.secret[sent_size:])
1779
except gnutls.errors.GNUTLSError as error:
1780
logger.warning("gnutls send failed",
1783
logger.debug("Sent: %d, remaining: %d",
1784
sent, len(client.secret)
1785
- (sent_size + sent))
2380
1788
logger.info("Sending secret to %s", client.name)
2381
1789
# bump the timeout using extended_timeout
2382
1790
client.bump_timeout(client.extended_timeout)
2383
1791
if self.server.use_dbus:
2384
1792
# Emit D-Bus signal
2385
1793
client.GotSecret()
2388
1796
if approval_required:
2389
1797
client.approvals_pending -= 1
2392
except gnutls.Error as error:
1800
except gnutls.errors.GNUTLSError as error:
2393
1801
logger.warning("GnuTLS bye failed",
2394
1802
exc_info=error)
2397
1805
def peer_certificate(session):
2398
"Return the peer's certificate as a bytestring"
2400
cert_type = gnutls.certificate_type_get2(session._c_object,
2402
except AttributeError:
2403
cert_type = gnutls.certificate_type_get(session._c_object)
2404
if gnutls.has_rawpk:
2405
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2407
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2408
# If not a valid certificate type...
2409
if cert_type not in valid_cert_types:
2410
logger.info("Cert type %r not in %r", cert_type,
2412
# ...return invalid data
1806
"Return the peer's OpenPGP certificate as a bytestring"
1807
# If not an OpenPGP certificate...
1808
if (gnutls.library.functions
1809
.gnutls_certificate_type_get(session._c_object)
1810
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1811
# ...do the normal thing
1812
return session.peer_certificate
2414
1813
list_size = ctypes.c_uint(1)
2415
cert_list = (gnutls.certificate_get_peers
1814
cert_list = (gnutls.library.functions
1815
.gnutls_certificate_get_peers
2416
1816
(session._c_object, ctypes.byref(list_size)))
2417
1817
if not bool(cert_list) and list_size.value != 0:
2418
raise gnutls.Error("error getting peer certificate")
1818
raise gnutls.errors.GNUTLSError("error getting peer"
2419
1820
if list_size.value == 0:
2421
1822
cert = cert_list[0]
2422
1823
return ctypes.string_at(cert.data, cert.size)
2425
def key_id(certificate):
2426
"Convert a certificate bytestring to a hexdigit key ID"
2427
# New GnuTLS "datum" with the public key
2428
datum = gnutls.datum_t(
2429
ctypes.cast(ctypes.c_char_p(certificate),
2430
ctypes.POINTER(ctypes.c_ubyte)),
2431
ctypes.c_uint(len(certificate)))
2432
# XXX all these need to be created in the gnutls "module"
2433
# New empty GnuTLS certificate
2434
pubkey = gnutls.pubkey_t()
2435
gnutls.pubkey_init(ctypes.byref(pubkey))
2436
# Import the raw public key into the certificate
2437
gnutls.pubkey_import(pubkey,
2438
ctypes.byref(datum),
2439
gnutls.X509_FMT_DER)
2440
# New buffer for the key ID
2441
buf = ctypes.create_string_buffer(32)
2442
buf_len = ctypes.c_size_t(len(buf))
2443
# Get the key ID from the raw public key into the buffer
2444
gnutls.pubkey_get_key_id(pubkey,
2445
gnutls.KEYID_USE_SHA256,
2446
ctypes.cast(ctypes.byref(buf),
2447
ctypes.POINTER(ctypes.c_ubyte)),
2448
ctypes.byref(buf_len))
2449
# Deinit the certificate
2450
gnutls.pubkey_deinit(pubkey)
2452
# Convert the buffer to a Python bytestring
2453
key_id = ctypes.string_at(buf, buf_len.value)
2454
# Convert the bytestring to hexadecimal notation
2455
hex_key_id = binascii.hexlify(key_id).upper()
2459
1826
def fingerprint(openpgp):
2460
1827
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2461
1828
# New GnuTLS "datum" with the OpenPGP public key
2462
datum = gnutls.datum_t(
2463
ctypes.cast(ctypes.c_char_p(openpgp),
2464
ctypes.POINTER(ctypes.c_ubyte)),
2465
ctypes.c_uint(len(openpgp)))
1829
datum = (gnutls.library.types
1830
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1833
ctypes.c_uint(len(openpgp))))
2466
1834
# New empty GnuTLS certificate
2467
crt = gnutls.openpgp_crt_t()
2468
gnutls.openpgp_crt_init(ctypes.byref(crt))
1835
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1836
(gnutls.library.functions
1837
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2469
1838
# Import the OpenPGP public key into the certificate
2470
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2471
gnutls.OPENPGP_FMT_RAW)
1839
(gnutls.library.functions
1840
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1841
gnutls.library.constants
1842
.GNUTLS_OPENPGP_FMT_RAW))
2472
1843
# Verify the self signature in the key
2473
1844
crtverify = ctypes.c_uint()
2474
gnutls.openpgp_crt_verify_self(crt, 0,
2475
ctypes.byref(crtverify))
1845
(gnutls.library.functions
1846
.gnutls_openpgp_crt_verify_self(crt, 0,
1847
ctypes.byref(crtverify)))
2476
1848
if crtverify.value != 0:
2477
gnutls.openpgp_crt_deinit(crt)
2478
raise gnutls.CertificateSecurityError(code
1849
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1850
raise (gnutls.errors.CertificateSecurityError
2480
1852
# New buffer for the fingerprint
2481
1853
buf = ctypes.create_string_buffer(20)
2482
1854
buf_len = ctypes.c_size_t()
2483
1855
# Get the fingerprint from the certificate into the buffer
2484
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2485
ctypes.byref(buf_len))
1856
(gnutls.library.functions
1857
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1858
ctypes.byref(buf_len)))
2486
1859
# Deinit the certificate
2487
gnutls.openpgp_crt_deinit(crt)
1860
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2488
1861
# Convert the buffer to a Python bytestring
2489
1862
fpr = ctypes.string_at(buf, buf_len.value)
2490
1863
# Convert the bytestring to hexadecimal notation
2579
1946
# socket_wrapper(), if socketfd was set.
2580
1947
socketserver.TCPServer.__init__(self, server_address,
2581
1948
RequestHandlerClass)
2583
1950
def server_bind(self):
2584
1951
"""This overrides the normal server_bind() function
2585
1952
to bind to an interface if one was specified, and also NOT to
2586
1953
bind to an address or port if they were not specified."""
2587
global SO_BINDTODEVICE
2588
1954
if self.interface is not None:
2589
1955
if SO_BINDTODEVICE is None:
2590
# Fall back to a hard-coded value which seems to be
2592
logger.warning("SO_BINDTODEVICE not found, trying 25")
2593
SO_BINDTODEVICE = 25
2595
self.socket.setsockopt(
2596
socket.SOL_SOCKET, SO_BINDTODEVICE,
2597
(self.interface + "\0").encode("utf-8"))
2598
except socket.error as error:
2599
if error.errno == errno.EPERM:
2600
logger.error("No permission to bind to"
2601
" interface %s", self.interface)
2602
elif error.errno == errno.ENOPROTOOPT:
2603
logger.error("SO_BINDTODEVICE not available;"
2604
" cannot bind to interface %s",
2606
elif error.errno == errno.ENODEV:
2607
logger.error("Interface %s does not exist,"
2608
" cannot bind", self.interface)
1956
logger.error("SO_BINDTODEVICE does not exist;"
1957
" cannot bind to interface %s",
1961
self.socket.setsockopt(socket.SOL_SOCKET,
1963
str(self.interface + '\0'))
1964
except socket.error as error:
1965
if error.errno == errno.EPERM:
1966
logger.error("No permission to bind to"
1967
" interface %s", self.interface)
1968
elif error.errno == errno.ENOPROTOOPT:
1969
logger.error("SO_BINDTODEVICE not available;"
1970
" cannot bind to interface %s",
1972
elif error.errno == errno.ENODEV:
1973
logger.error("Interface %s does not exist,"
1974
" cannot bind", self.interface)
2611
1977
# Only bind(2) the socket if we really need to.
2612
1978
if self.server_address[0] or self.server_address[1]:
2613
if self.server_address[1]:
2614
self.allow_reuse_address = True
2615
1979
if not self.server_address[0]:
2616
1980
if self.address_family == socket.AF_INET6:
2617
any_address = "::" # in6addr_any
1981
any_address = "::" # in6addr_any
2619
any_address = "0.0.0.0" # INADDR_ANY
1983
any_address = "0.0.0.0" # INADDR_ANY
2620
1984
self.server_address = (any_address,
2621
1985
self.server_address[1])
2622
1986
elif not self.server_address[1]:
2623
self.server_address = (self.server_address[0], 0)
1987
self.server_address = (self.server_address[0],
2624
1989
# if self.interface:
2625
1990
# self.server_address = (self.server_address[0],
2656
2016
self.gnutls_priority = gnutls_priority
2657
2017
IPv6_TCPServer.__init__(self, server_address,
2658
2018
RequestHandlerClass,
2659
interface=interface,
2019
interface = interface,
2020
use_ipv6 = use_ipv6,
2021
socketfd = socketfd)
2663
2022
def server_activate(self):
2664
2023
if self.enabled:
2665
2024
return socketserver.TCPServer.server_activate(self)
2667
2026
def enable(self):
2668
2027
self.enabled = True
2670
2029
def add_pipe(self, parent_pipe, proc):
2671
2030
# Call "handle_ipc" for both data and EOF events
2673
parent_pipe.fileno(),
2674
GLib.IO_IN | GLib.IO_HUP,
2675
functools.partial(self.handle_ipc,
2676
parent_pipe=parent_pipe,
2679
def handle_ipc(self, source, condition,
2682
client_object=None):
2031
gobject.io_add_watch(parent_pipe.fileno(),
2032
gobject.IO_IN | gobject.IO_HUP,
2033
functools.partial(self.handle_ipc,
2038
def handle_ipc(self, source, condition, parent_pipe=None,
2039
proc = None, client_object=None):
2683
2040
# error, or the other end of multiprocessing.Pipe has closed
2684
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2041
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2685
2042
# Wait for other process to exit
2689
2046
# Read a request from the child
2690
2047
request = parent_pipe.recv()
2691
2048
command = request[0]
2693
2050
if command == 'init':
2694
key_id = request[1].decode("ascii")
2695
fpr = request[2].decode("ascii")
2696
address = request[3]
2698
for c in self.clients.values():
2699
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2701
if key_id and c.key_id == key_id:
2704
if fpr and c.fingerprint == fpr:
2052
address = request[2]
2054
for c in self.clients.itervalues():
2055
if c.fingerprint == fpr:
2708
logger.info("Client not found for key ID: %s, address"
2709
": %s", key_id or fpr, address)
2059
logger.info("Client not found for fingerprint: %s, ad"
2060
"dress: %s", fpr, address)
2710
2061
if self.use_dbus:
2711
2062
# Emit D-Bus signal
2712
mandos_dbus_service.ClientNotFound(key_id or fpr,
2063
mandos_dbus_service.ClientNotFound(fpr,
2714
2065
parent_pipe.send(False)
2718
parent_pipe.fileno(),
2719
GLib.IO_IN | GLib.IO_HUP,
2720
functools.partial(self.handle_ipc,
2721
parent_pipe=parent_pipe,
2723
client_object=client))
2068
gobject.io_add_watch(parent_pipe.fileno(),
2069
gobject.IO_IN | gobject.IO_HUP,
2070
functools.partial(self.handle_ipc,
2724
2076
parent_pipe.send(True)
2725
2077
# remove the old hook in favor of the new above hook on
3131
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3133
2477
except OSError as error:
3134
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3135
.format(uid, gid, os.strerror(error.errno)))
3136
2478
if error.errno != errno.EPERM:
3140
2482
# Enable all possible GnuTLS debugging
3142
2484
# "Use a log level over 10 to enable all debugging options."
3143
2485
# - GnuTLS manual
3144
gnutls.global_set_log_level(11)
2486
gnutls.library.functions.gnutls_global_set_log_level(11)
2488
@gnutls.library.types.gnutls_log_func
3147
2489
def debug_gnutls(level, string):
3148
2490
logger.debug("GnuTLS: %s", string[:-1])
3150
gnutls.global_set_log_function(debug_gnutls)
2492
(gnutls.library.functions
2493
.gnutls_global_set_log_function(debug_gnutls))
3152
2495
# Redirect stdin so all checkers get /dev/null
3153
2496
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3154
2497
os.dup2(null, sys.stdin.fileno())
3158
2501
# Need to fork before connecting to D-Bus
3159
2502
if not foreground:
3160
2503
# Close all input and output, do double fork, etc.
3163
if gi.version_info < (3, 10, 2):
3164
# multiprocessing will use threads, so before we use GLib we
3165
# need to inform GLib that threads will be used.
2506
# multiprocessing will use threads, so before we use gobject we
2507
# need to inform gobject that threads will be used.
2508
gobject.threads_init()
3168
2510
global main_loop
3169
2511
# From the Avahi example code
3170
2512
DBusGMainLoop(set_as_default=True)
3171
main_loop = GLib.MainLoop()
2513
main_loop = gobject.MainLoop()
3172
2514
bus = dbus.SystemBus()
3173
2515
# End of Avahi example code
3176
2518
bus_name = dbus.service.BusName("se.recompile.Mandos",
3179
old_bus_name = dbus.service.BusName(
3180
"se.bsnet.fukt.Mandos", bus,
3182
except dbus.exceptions.DBusException as e:
2519
bus, do_not_queue=True)
2520
old_bus_name = (dbus.service.BusName
2521
("se.bsnet.fukt.Mandos", bus,
2523
except dbus.exceptions.NameExistsException as e:
3183
2524
logger.error("Disabling D-Bus:", exc_info=e)
3184
2525
use_dbus = False
3185
2526
server_settings["use_dbus"] = False
3186
2527
tcp_server.use_dbus = False
3188
2529
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3189
service = AvahiServiceToSyslog(
3190
name=server_settings["servicename"],
3191
servicetype="_mandos._tcp",
2530
service = AvahiServiceToSyslog(name =
2531
server_settings["servicename"],
2532
servicetype = "_mandos._tcp",
2533
protocol = protocol, bus = bus)
3194
2534
if server_settings["interface"]:
3195
service.interface = if_nametoindex(
3196
server_settings["interface"].encode("utf-8"))
2535
service.interface = (if_nametoindex
2536
(str(server_settings["interface"])))
3198
2538
global multiprocessing_manager
3199
2539
multiprocessing_manager = multiprocessing.Manager()
3201
2541
client_class = Client
3203
client_class = functools.partial(ClientDBus, bus=bus)
2543
client_class = functools.partial(ClientDBus, bus = bus)
3205
2545
client_settings = Client.config_parser(client_config)
3206
2546
old_client_settings = {}
3207
2547
clients_data = {}
3209
2549
# This is used to redirect stdout and stderr for checker processes
3211
wnull = open(os.devnull, "w") # A writable /dev/null
2551
wnull = open(os.devnull, "w") # A writable /dev/null
3212
2552
# Only used if server is running in foreground but not in debug
3214
2554
if debug or not foreground:
3217
2557
# Get client data and settings from last running state.
3218
2558
if server_settings["restore"]:
3220
2560
with open(stored_state_path, "rb") as stored_state:
3221
if sys.version_info.major == 2:
3222
clients_data, old_client_settings = pickle.load(
3225
bytes_clients_data, bytes_old_client_settings = (
3226
pickle.load(stored_state, encoding="bytes"))
3227
# Fix bytes to strings
3230
clients_data = {(key.decode("utf-8")
3231
if isinstance(key, bytes)
3234
bytes_clients_data.items()}
3235
del bytes_clients_data
3236
for key in clients_data:
3237
value = {(k.decode("utf-8")
3238
if isinstance(k, bytes) else k): v
3240
clients_data[key].items()}
3241
clients_data[key] = value
3243
value["client_structure"] = [
3245
if isinstance(s, bytes)
3247
value["client_structure"]]
3249
for k in ("name", "host"):
3250
if isinstance(value[k], bytes):
3251
value[k] = value[k].decode("utf-8")
3252
if "key_id" not in value:
3253
value["key_id"] = ""
3254
elif "fingerprint" not in value:
3255
value["fingerprint"] = ""
3256
# old_client_settings
3258
old_client_settings = {
3259
(key.decode("utf-8")
3260
if isinstance(key, bytes)
3263
bytes_old_client_settings.items()}
3264
del bytes_old_client_settings
3266
for value in old_client_settings.values():
3267
if isinstance(value["host"], bytes):
3268
value["host"] = (value["host"]
2561
clients_data, old_client_settings = (pickle.load
3270
2563
os.remove(stored_state_path)
3271
2564
except IOError as e:
3272
2565
if e.errno == errno.ENOENT:
3273
logger.warning("Could not load persistent state:"
3274
" {}".format(os.strerror(e.errno)))
2566
logger.warning("Could not load persistent state: {}"
2567
.format(os.strerror(e.errno)))
3276
2569
logger.critical("Could not load persistent state:",
3279
2572
except EOFError as e:
3280
2573
logger.warning("Could not load persistent state: "
2574
"EOFError:", exc_info=e)
3284
2576
with PGPEngine() as pgp:
3285
2577
for client_name, client in clients_data.items():
3286
2578
# Skip removed clients
3287
2579
if client_name not in client_settings:
3290
2582
# Decide which value to use after restoring saved state.
3291
2583
# We have three different values: Old config file,
3292
2584
# new config file, and saved state.
3350
2642
for client_name in (set(client_settings)
3351
2643
- set(old_client_settings)):
3352
2644
clients_data[client_name] = client_settings[client_name]
3354
2646
# Create all client objects
3355
2647
for client_name, client in clients_data.items():
3356
2648
tcp_server.clients[client_name] = client_class(
3359
server_settings=server_settings)
2649
name = client_name, settings = client,
2650
server_settings = server_settings)
3361
2652
if not tcp_server.clients:
3362
2653
logger.warning("No clients defined")
3364
2655
if not foreground:
3365
2656
if pidfile is not None:
3369
print(pid, file=pidfile)
2660
pidfile.write(str(pid) + "\n".encode("utf-8"))
3370
2661
except IOError:
3371
2662
logger.error("Could not write to file %r with PID %d",
3372
2663
pidfilename, pid)
3374
2665
del pidfilename
3376
for termsig in (signal.SIGHUP, signal.SIGTERM):
3377
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3378
lambda: main_loop.quit() and False)
2667
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2668
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3382
@alternate_dbus_interfaces(
3383
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3384
class MandosDBusService(DBusObjectWithObjectManager):
2671
@alternate_dbus_interfaces({"se.recompile.Mandos":
2672
"se.bsnet.fukt.Mandos"})
2673
class MandosDBusService(DBusObjectWithProperties):
3385
2674
"""A D-Bus proxy object"""
3387
2675
def __init__(self):
3388
2676
dbus.service.Object.__init__(self, bus, "/")
3390
2677
_interface = "se.recompile.Mandos"
2679
@dbus_interface_annotations(_interface)
2681
return { "org.freedesktop.DBus.Property"
2682
".EmitsChangedSignal":
3392
2685
@dbus.service.signal(_interface, signature="o")
3393
2686
def ClientAdded(self, objpath):
3397
2690
@dbus.service.signal(_interface, signature="ss")
3398
def ClientNotFound(self, key_id, address):
2691
def ClientNotFound(self, fingerprint, address):
3402
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3404
2695
@dbus.service.signal(_interface, signature="os")
3405
2696
def ClientRemoved(self, objpath, name):
3409
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3411
2700
@dbus.service.method(_interface, out_signature="ao")
3412
2701
def GetAllClients(self):
3414
return dbus.Array(c.dbus_object_path for c in
3415
tcp_server.clients.values())
3417
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2703
return dbus.Array(c.dbus_object_path
2705
tcp_server.clients.itervalues())
3419
2707
@dbus.service.method(_interface,
3420
2708
out_signature="a{oa{sv}}")
3421
2709
def GetAllClientsWithProperties(self):
3423
2711
return dbus.Dictionary(
3424
{c.dbus_object_path: c.GetAll(
3425
"se.recompile.Mandos.Client")
3426
for c in tcp_server.clients.values()},
2712
((c.dbus_object_path, c.GetAll(""))
2713
for c in tcp_server.clients.itervalues()),
3427
2714
signature="oa{sv}")
3429
2716
@dbus.service.method(_interface, in_signature="o")
3430
2717
def RemoveClient(self, object_path):
3432
for c in tcp_server.clients.values():
2719
for c in tcp_server.clients.itervalues():
3433
2720
if c.dbus_object_path == object_path:
3434
2721
del tcp_server.clients[c.name]
3435
2722
c.remove_from_connection()
3436
# Don't signal the disabling
2723
# Don't signal anything except ClientRemoved
3437
2724
c.disable(quiet=True)
3438
# Emit D-Bus signal for removal
3439
self.client_removed_signal(c)
2726
self.ClientRemoved(object_path, c.name)
3441
2728
raise KeyError(object_path)
3445
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3446
out_signature="a{oa{sa{sv}}}")
3447
def GetManagedObjects(self):
3449
return dbus.Dictionary(
3450
{client.dbus_object_path:
3452
{interface: client.GetAll(interface)
3454
client._get_all_interface_names()})
3455
for client in tcp_server.clients.values()})
3457
def client_added_signal(self, client):
3458
"""Send the new standard signal and the old signal"""
3460
# New standard signal
3461
self.InterfacesAdded(
3462
client.dbus_object_path,
3464
{interface: client.GetAll(interface)
3466
client._get_all_interface_names()}))
3468
self.ClientAdded(client.dbus_object_path)
3470
def client_removed_signal(self, client):
3471
"""Send the new standard signal and the old signal"""
3473
# New standard signal
3474
self.InterfacesRemoved(
3475
client.dbus_object_path,
3476
client._get_all_interface_names())
3478
self.ClientRemoved(client.dbus_object_path,
3481
2732
mandos_dbus_service = MandosDBusService()
3483
# Save modules to variables to exempt the modules from being
3484
# unloaded before the function registered with atexit() is run.
3485
mp = multiprocessing
3489
2735
"Cleanup function; run on exit"
3491
2737
service.cleanup()
3493
mp.active_children()
2739
multiprocessing.active_children()
3495
2741
if not (tcp_server.clients or client_settings):
3498
2744
# Store client before exiting. Secrets are encrypted with key
3499
2745
# based on what config file has. If config file is
3500
2746
# removed/edited, old secret will thus be unrecovable.
3502
2748
with PGPEngine() as pgp:
3503
for client in tcp_server.clients.values():
2749
for client in tcp_server.clients.itervalues():
3504
2750
key = client_settings[client.name]["secret"]
3505
2751
client.encrypted_secret = pgp.encrypt(client.secret,
3507
2753
client_dict = {}
3509
2755
# A list of attributes that can not be pickled
3511
exclude = {"bus", "changedstate", "secret",
3512
"checker", "server_settings"}
3513
for name, typ in inspect.getmembers(dbus.service
2757
exclude = { "bus", "changedstate", "secret",
2758
"checker", "server_settings" }
2759
for name, typ in (inspect.getmembers
2760
(dbus.service.Object)):
3515
2761
exclude.add(name)
3517
2763
client_dict["encrypted_secret"] = (client
3518
2764
.encrypted_secret)
3519
2765
for attr in client.client_structure:
3520
2766
if attr not in exclude:
3521
2767
client_dict[attr] = getattr(client, attr)
3523
2769
clients[client.name] = client_dict
3524
2770
del client_settings[client.name]["secret"]
3527
with tempfile.NamedTemporaryFile(
3531
dir=os.path.dirname(stored_state_path),
3532
delete=False) as stored_state:
3533
pickle.dump((clients, client_settings), stored_state,
3535
tempname = stored_state.name
2773
with (tempfile.NamedTemporaryFile
2774
(mode='wb', suffix=".pickle", prefix='clients-',
2775
dir=os.path.dirname(stored_state_path),
2776
delete=False)) as stored_state:
2777
pickle.dump((clients, client_settings), stored_state)
2778
tempname=stored_state.name
3536
2779
os.rename(tempname, stored_state_path)
3537
2780
except (IOError, OSError) as e: