/mandos/release : revision 237.7.335

1

#!/usr/bin/python

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

37

from future_builtins import *

41

38

42

39

try:

43

40

import SocketServer as socketserver

47

44

import argparse

48

45

import datetime

49

46

import errno

47

import gnutls.crypto

48

import gnutls.connection

49

import gnutls.errors

50

import gnutls.library.functions

51

import gnutls.library.constants

52

import gnutls.library.types

50

53

try:

51

54

import ConfigParser as configparser

52

55

except ImportError:

79

82

80

83

import dbus

81

84

import dbus.service

82

from gi.repository import GLib

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

89

import avahi

83

90

from dbus.mainloop.glib import DBusGMainLoop

84

91

import ctypes

85

92

import ctypes.util

97

104

if sys.version_info.major == 2:

98

105

str = unicode

99

106

100

version = "1.7.7"

107

version = "1.6.9"

101

108

stored_state_file = "clients.pickle"

102

109

103

110

logger = logging.getLogger()

118

125

return interface_index

119

126

120

127

121

def copy_function(func):

122

"""Make a copy of a function"""

123

if sys.version_info.major == 2:

124

return types.FunctionType(func.func_code,

125

func.func_globals,

126

func.func_name,

127

func.func_defaults,

128

func.func_closure)

129

else:

130

return types.FunctionType(func.__code__,

131

func.__globals__,

132

func.__name__,

133

func.__defaults__,

134

func.__closure__)

135

136

137

128

def initlogger(debug, level=logging.WARNING):

138

129

"""init logger and add loglevel"""

139

130

166

157

167

158

def __init__(self):

168

159

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

169

self.gpg = "gpg"

170

try:

171

output = subprocess.check_output(["gpgconf"])

172

for line in output.splitlines():

173

name, text, path = line.split(b":")

174

if name == "gpg":

175

self.gpg = path

176

break

177

except OSError as e:

178

if e.errno != errno.ENOENT:

179

raise

180

160

self.gnupgargs = ['--batch',

181

'--homedir', self.tempdir,

161

'--home', self.tempdir,

182

162

'--force-mdc',

183

'--quiet']

184

# Only GPG version 1 has the --no-use-agent option.

185

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

186

self.gnupgargs.append("--no-use-agent")

163

'--quiet',

164

'--no-use-agent']

187

165

188

166

def __enter__(self):

189

167

return self

225

203

dir=self.tempdir) as passfile:

226

204

passfile.write(passphrase)

227

205

passfile.flush()

228

proc = subprocess.Popen([self.gpg, '--symmetric',

206

proc = subprocess.Popen(['gpg', '--symmetric',

229

207

'--passphrase-file',

230

208

passfile.name]

231

209

+ self.gnupgargs,

243

221

dir = self.tempdir) as passfile:

244

222

passfile.write(passphrase)

245

223

passfile.flush()

246

proc = subprocess.Popen([self.gpg, '--decrypt',

224

proc = subprocess.Popen(['gpg', '--decrypt',

247

225

'--passphrase-file',

248

226

passfile.name]

249

227

+ self.gnupgargs,

255

233

raise PGPError(err)

256

234

return decrypted_plaintext

257

235

258

# Pretend that we have an Avahi module

259

class Avahi(object):

260

"""This isn't so much a class as it is a module-like namespace.

261

It is instantiated once, and simulates having an Avahi module."""

262

IF_UNSPEC = -1 # avahi-common/address.h

263

PROTO_UNSPEC = -1 # avahi-common/address.h

264

PROTO_INET = 0 # avahi-common/address.h

265

PROTO_INET6 = 1 # avahi-common/address.h

266

DBUS_NAME = "org.freedesktop.Avahi"

267

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

268

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

269

DBUS_PATH_SERVER = "/"

270

def string_array_to_txt_array(self, t):

271

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

272

for s in t), signature="ay")

273

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

274

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

275

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

276

SERVER_INVALID = 0 # avahi-common/defs.h

277

SERVER_REGISTERING = 1 # avahi-common/defs.h

278

SERVER_RUNNING = 2 # avahi-common/defs.h

279

SERVER_COLLISION = 3 # avahi-common/defs.h

280

SERVER_FAILURE = 4 # avahi-common/defs.h

281

avahi = Avahi()

282

236

283

237

class AvahiError(Exception):

284

238

def __init__(self, value, *args, **kwargs):

481

435

.format(self.name)))

482

436

return ret

483

437

484

# Pretend that we have a GnuTLS module

485

class GnuTLS(object):

486

"""This isn't so much a class as it is a module-like namespace.

487

It is instantiated once, and simulates having a GnuTLS module."""

488

489

_library = ctypes.cdll.LoadLibrary(

490

ctypes.util.find_library("gnutls"))

491

_need_version = b"3.3.0"

492

def __init__(self):

493

# Need to use class name "GnuTLS" here, since this method is

494

# called before the assignment to the "gnutls" global variable

495

# happens.

496

if GnuTLS.check_version(self._need_version) is None:

497

raise GnuTLS.Error("Needs GnuTLS {} or later"

498

.format(self._need_version))

499

500

# Unless otherwise indicated, the constants and types below are

501

# all from the gnutls/gnutls.h C header file.

502

503

# Constants

504

E_SUCCESS = 0

505

E_INTERRUPTED = -52

506

E_AGAIN = -28

507

CRT_OPENPGP = 2

508

CLIENT = 2

509

SHUT_RDWR = 0

510

CRD_CERTIFICATE = 1

511

E_NO_CERTIFICATE_FOUND = -49

512

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

513

514

# Types

515

class session_int(ctypes.Structure):

516

_fields_ = []

517

session_t = ctypes.POINTER(session_int)

518

class certificate_credentials_st(ctypes.Structure):

519

_fields_ = []

520

certificate_credentials_t = ctypes.POINTER(

521

certificate_credentials_st)

522

certificate_type_t = ctypes.c_int

523

class datum_t(ctypes.Structure):

524

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

525

('size', ctypes.c_uint)]

526

class openpgp_crt_int(ctypes.Structure):

527

_fields_ = []

528

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

529

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

530

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

531

credentials_type_t = ctypes.c_int

532

transport_ptr_t = ctypes.c_void_p

533

close_request_t = ctypes.c_int

534

535

# Exceptions

536

class Error(Exception):

537

# We need to use the class name "GnuTLS" here, since this

538

# exception might be raised from within GnuTLS.__init__,

539

# which is called before the assignment to the "gnutls"

540

# global variable has happened.

541

def __init__(self, message = None, code = None, args=()):

542

# Default usage is by a message string, but if a return

543

# code is passed, convert it to a string with

544

# gnutls.strerror()

545

self.code = code

546

if message is None and code is not None:

547

message = GnuTLS.strerror(code)

548

return super(GnuTLS.Error, self).__init__(

549

message, *args)

550

551

class CertificateSecurityError(Error):

552

pass

553

554

# Classes

555

class Credentials(object):

556

def __init__(self):

557

self._c_object = gnutls.certificate_credentials_t()

558

gnutls.certificate_allocate_credentials(

559

ctypes.byref(self._c_object))

560

self.type = gnutls.CRD_CERTIFICATE

561

562

def __del__(self):

563

gnutls.certificate_free_credentials(self._c_object)

564

565

class ClientSession(object):

566

def __init__(self, socket, credentials = None):

567

self._c_object = gnutls.session_t()

568

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

569

gnutls.set_default_priority(self._c_object)

570

gnutls.transport_set_ptr(self._c_object, socket.fileno())

571

gnutls.handshake_set_private_extensions(self._c_object,

572

True)

573

self.socket = socket

574

if credentials is None:

575

credentials = gnutls.Credentials()

576

gnutls.credentials_set(self._c_object, credentials.type,

577

ctypes.cast(credentials._c_object,

578

ctypes.c_void_p))

579

self.credentials = credentials

580

581

def __del__(self):

582

gnutls.deinit(self._c_object)

583

584

def handshake(self):

585

return gnutls.handshake(self._c_object)

586

587

def send(self, data):

588

data = bytes(data)

589

data_len = len(data)

590

while data_len > 0:

591

data_len -= gnutls.record_send(self._c_object,

592

data[-data_len:],

593

data_len)

594

595

def bye(self):

596

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

597

598

# Error handling functions

599

def _error_code(result):

600

"""A function to raise exceptions on errors, suitable

601

for the 'restype' attribute on ctypes functions"""

602

if result >= 0:

603

return result

604

if result == gnutls.E_NO_CERTIFICATE_FOUND:

605

raise gnutls.CertificateSecurityError(code = result)

606

raise gnutls.Error(code = result)

607

608

def _retry_on_error(result, func, arguments):

609

"""A function to retry on some errors, suitable

610

for the 'errcheck' attribute on ctypes functions"""

611

while result < 0:

612

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

613

return _error_code(result)

614

result = func(*arguments)

615

return result

616

617

# Unless otherwise indicated, the function declarations below are

618

# all from the gnutls/gnutls.h C header file.

619

620

# Functions

621

priority_set_direct = _library.gnutls_priority_set_direct

622

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

623

ctypes.POINTER(ctypes.c_char_p)]

624

priority_set_direct.restype = _error_code

625

626

init = _library.gnutls_init

627

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

628

init.restype = _error_code

629

630

set_default_priority = _library.gnutls_set_default_priority

631

set_default_priority.argtypes = [session_t]

632

set_default_priority.restype = _error_code

633

634

record_send = _library.gnutls_record_send

635

record_send.argtypes = [session_t, ctypes.c_void_p,

636

ctypes.c_size_t]

637

record_send.restype = ctypes.c_ssize_t

638

record_send.errcheck = _retry_on_error

639

640

certificate_allocate_credentials = (

641

_library.gnutls_certificate_allocate_credentials)

642

certificate_allocate_credentials.argtypes = [

643

ctypes.POINTER(certificate_credentials_t)]

644

certificate_allocate_credentials.restype = _error_code

645

646

certificate_free_credentials = (

647

_library.gnutls_certificate_free_credentials)

648

certificate_free_credentials.argtypes = [certificate_credentials_t]

649

certificate_free_credentials.restype = None

650

651

handshake_set_private_extensions = (

652

_library.gnutls_handshake_set_private_extensions)

653

handshake_set_private_extensions.argtypes = [session_t,

654

ctypes.c_int]

655

handshake_set_private_extensions.restype = None

656

657

credentials_set = _library.gnutls_credentials_set

658

credentials_set.argtypes = [session_t, credentials_type_t,

659

ctypes.c_void_p]

660

credentials_set.restype = _error_code

661

662

strerror = _library.gnutls_strerror

663

strerror.argtypes = [ctypes.c_int]

664

strerror.restype = ctypes.c_char_p

665

666

certificate_type_get = _library.gnutls_certificate_type_get

667

certificate_type_get.argtypes = [session_t]

668

certificate_type_get.restype = _error_code

669

670

certificate_get_peers = _library.gnutls_certificate_get_peers

671

certificate_get_peers.argtypes = [session_t,

672

ctypes.POINTER(ctypes.c_uint)]

673

certificate_get_peers.restype = ctypes.POINTER(datum_t)

674

675

global_set_log_level = _library.gnutls_global_set_log_level

676

global_set_log_level.argtypes = [ctypes.c_int]

677

global_set_log_level.restype = None

678

679

global_set_log_function = _library.gnutls_global_set_log_function

680

global_set_log_function.argtypes = [log_func]

681

global_set_log_function.restype = None

682

683

deinit = _library.gnutls_deinit

684

deinit.argtypes = [session_t]

685

deinit.restype = None

686

687

handshake = _library.gnutls_handshake

688

handshake.argtypes = [session_t]

689

handshake.restype = _error_code

690

handshake.errcheck = _retry_on_error

691

692

transport_set_ptr = _library.gnutls_transport_set_ptr

693

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

694

transport_set_ptr.restype = None

695

696

bye = _library.gnutls_bye

697

bye.argtypes = [session_t, close_request_t]

698

bye.restype = _error_code

699

bye.errcheck = _retry_on_error

700

701

check_version = _library.gnutls_check_version

702

check_version.argtypes = [ctypes.c_char_p]

703

check_version.restype = ctypes.c_char_p

704

705

# All the function declarations below are from gnutls/openpgp.h

706

707

openpgp_crt_init = _library.gnutls_openpgp_crt_init

708

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

709

openpgp_crt_init.restype = _error_code

710

711

openpgp_crt_import = _library.gnutls_openpgp_crt_import

712

openpgp_crt_import.argtypes = [openpgp_crt_t,

713

ctypes.POINTER(datum_t),

714

openpgp_crt_fmt_t]

715

openpgp_crt_import.restype = _error_code

716

717

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

718

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

719

ctypes.POINTER(ctypes.c_uint)]

720

openpgp_crt_verify_self.restype = _error_code

721

722

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

723

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

724

openpgp_crt_deinit.restype = None

725

726

openpgp_crt_get_fingerprint = (

727

_library.gnutls_openpgp_crt_get_fingerprint)

728

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

729

ctypes.c_void_p,

730

ctypes.POINTER(

731

ctypes.c_size_t)]

732

openpgp_crt_get_fingerprint.restype = _error_code

733

734

# Remove non-public functions

735

del _error_code, _retry_on_error

736

# Create the global "gnutls" object, simulating a module

737

gnutls = GnuTLS()

738

739

438

def call_pipe(connection, # : multiprocessing.Connection

740

439

func, *args, **kwargs):

741

440

"""This function is meant to be called by multiprocessing.Process

756

455

checker: subprocess.Popen(); a running checker process used

757

456

to see if the client lives.

758

457

'None' if no process is running.

759

checker_callback_tag: a GLib event source tag, or None

458

checker_callback_tag: a gobject event source tag, or None

760

459

checker_command: string; External command which is run to check

761

460

if client lives. %() expansions are done at

762

461

runtime with vars(self) as dict, so that for

763

462

instance %(name)s can be used in the command.

764

checker_initiator_tag: a GLib event source tag, or None

463

checker_initiator_tag: a gobject event source tag, or None

765

464

created: datetime.datetime(); (UTC) object creation

766

465

client_structure: Object describing what attributes a client has

767

466

and is used for storing the client at exit

768

467

current_checker_command: string; current running checker_command

769

disable_initiator_tag: a GLib event source tag, or None

468

disable_initiator_tag: a gobject event source tag, or None

770

469

enabled: bool()

771

470

fingerprint: string (40 or 32 hexadecimal digits); used to

772

471

uniquely identify the client

835

534

client["fingerprint"] = (section["fingerprint"].upper()

836

535

.replace(" ", ""))

837

536

if "secret" in section:

838

client["secret"] = codecs.decode(section["secret"]

839

.encode("utf-8"),

840

"base64")

537

client["secret"] = section["secret"].decode("base64")

841

538

elif "secfile" in section:

842

539

with open(os.path.expanduser(os.path.expandvars

843

540

(section["secfile"])),

896

593

self.changedstate = multiprocessing_manager.Condition(

897

594

multiprocessing_manager.Lock())

898

595

self.client_structure = [attr

899

for attr in self.__dict__.keys()

596

for attr in self.__dict__.iterkeys()

900

597

if not attr.startswith("_")]

901

598

self.client_structure.append("client_structure")

902

599

928

625

if not quiet:

929

626

logger.info("Disabling client %s", self.name)

930

627

if getattr(self, "disable_initiator_tag", None) is not None:

931

GLib.source_remove(self.disable_initiator_tag)

628

gobject.source_remove(self.disable_initiator_tag)

932

629

self.disable_initiator_tag = None

933

630

self.expires = None

934

631

if getattr(self, "checker_initiator_tag", None) is not None:

935

GLib.source_remove(self.checker_initiator_tag)

632

gobject.source_remove(self.checker_initiator_tag)

936

633

self.checker_initiator_tag = None

937

634

self.stop_checker()

938

635

self.enabled = False

939

636

if not quiet:

940

637

self.send_changedstate()

941

# Do not run this again if called by a GLib.timeout_add

638

# Do not run this again if called by a gobject.timeout_add

942

639

return False

943

640

944

641

def __del__(self):

948

645

# Schedule a new checker to be started an 'interval' from now,

949

646

# and every interval from then on.

950

647

if self.checker_initiator_tag is not None:

951

GLib.source_remove(self.checker_initiator_tag)

952

self.checker_initiator_tag = GLib.timeout_add(

648

gobject.source_remove(self.checker_initiator_tag)

649

self.checker_initiator_tag = gobject.timeout_add(

953

650

int(self.interval.total_seconds() * 1000),

954

651

self.start_checker)

955

652

# Schedule a disable() when 'timeout' has passed

956

653

if self.disable_initiator_tag is not None:

957

GLib.source_remove(self.disable_initiator_tag)

958

self.disable_initiator_tag = GLib.timeout_add(

654

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = gobject.timeout_add(

959

656

int(self.timeout.total_seconds() * 1000), self.disable)

960

657

# Also start a new checker *right now*.

961

658

self.start_checker()

997

694

if timeout is None:

998

695

timeout = self.timeout

999

696

if self.disable_initiator_tag is not None:

1000

GLib.source_remove(self.disable_initiator_tag)

697

gobject.source_remove(self.disable_initiator_tag)

1001

698

self.disable_initiator_tag = None

1002

699

if getattr(self, "enabled", False):

1003

self.disable_initiator_tag = GLib.timeout_add(

700

self.disable_initiator_tag = gobject.timeout_add(

1004

701

int(timeout.total_seconds() * 1000), self.disable)

1005

702

self.expires = datetime.datetime.utcnow() + timeout

1006

703

1061

758

args = (pipe[1], subprocess.call, command),

1062

759

kwargs = popen_args)

1063

760

self.checker.start()

1064

self.checker_callback_tag = GLib.io_add_watch(

1065

pipe[0].fileno(), GLib.IO_IN,

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

1066

763

self.checker_callback, pipe[0], command)

1067

# Re-run this periodically if run by GLib.timeout_add

764

# Re-run this periodically if run by gobject.timeout_add

1068

765

return True

1069

766

1070

767

def stop_checker(self):

1071

768

"""Force the checker process, if any, to stop."""

1072

769

if self.checker_callback_tag:

1073

GLib.source_remove(self.checker_callback_tag)

770

gobject.source_remove(self.checker_callback_tag)

1074

771

self.checker_callback_tag = None

1075

772

if getattr(self, "checker", None) is None:

1076

773

return

1550

1247

interface_names.add(alt_interface)

1551

1248

# Is this a D-Bus signal?

1552

1249

if getattr(attribute, "_dbus_is_signal", False):

1553

# Extract the original non-method undecorated

1554

# function by black magic

1555

1250

if sys.version_info.major == 2:

1251

# Extract the original non-method undecorated

1252

# function by black magic

1556

1253

nonmethod_func = (dict(

1557

1254

zip(attribute.func_code.co_freevars,

1558

1255

attribute.__closure__))

1559

1256

["func"].cell_contents)

1560

1257

else:

1561

nonmethod_func = (dict(

1562

zip(attribute.__code__.co_freevars,

1563

attribute.__closure__))

1564

["func"].cell_contents)

1258

nonmethod_func = attribute

1565

1259

# Create a new, but exactly alike, function

1566

1260

# object, and decorate it to be a new D-Bus signal

1567

1261

# with the alternate D-Bus interface name

1568

new_function = copy_function(nonmethod_func)

1262

if sys.version_info.major == 2:

1263

new_function = types.FunctionType(

1264

nonmethod_func.func_code,

1265

nonmethod_func.func_globals,

1266

nonmethod_func.func_name,

1267

nonmethod_func.func_defaults,

1268

nonmethod_func.func_closure)

1269

else:

1270

new_function = types.FunctionType(

1271

nonmethod_func.__code__,

1272

nonmethod_func.__globals__,

1273

nonmethod_func.__name__,

1274

nonmethod_func.__defaults__,

1275

nonmethod_func.__closure__)

1569

1276

new_function = (dbus.service.signal(

1570

1277

alt_interface,

1571

1278

attribute._dbus_signature)(new_function))

1610

1317

alt_interface,

1611

1318

attribute._dbus_in_signature,

1612

1319

attribute._dbus_out_signature)

1613

(copy_function(attribute)))

1320

(types.FunctionType(attribute.func_code,

1321

attribute.func_globals,

1322

attribute.func_name,

1323

attribute.func_defaults,

1324

attribute.func_closure)))

1614

1325

# Copy annotations, if any

1615

1326

try:

1616

1327

attr[attrname]._dbus_annotations = dict(

1628

1339

attribute._dbus_access,

1629

1340

attribute._dbus_get_args_options

1630

1341

["byte_arrays"])

1631

(copy_function(attribute)))

1342

(types.FunctionType(

1343

attribute.func_code,

1344

attribute.func_globals,

1345

attribute.func_name,

1346

attribute.func_defaults,

1347

attribute.func_closure)))

1632

1348

# Copy annotations, if any

1633

1349

try:

1634

1350

attr[attrname]._dbus_annotations = dict(

1643

1359

# to the class.

1644

1360

attr[attrname] = (

1645

1361

dbus_interface_annotations(alt_interface)

1646

(copy_function(attribute)))

1362

(types.FunctionType(attribute.func_code,

1363

attribute.func_globals,

1364

attribute.func_name,

1365

attribute.func_defaults,

1366

attribute.func_closure)))

1647

1367

if deprecate:

1648

1368

# Deprecate all alternate interfaces

1649

1369

iname="_AlternateDBusNames_interface_annotation{}"

1662

1382

if interface_names:

1663

1383

# Replace the class with a new subclass of it with

1664

1384

# methods, signals, etc. as created above.

1665

if sys.version_info.major == 2:

1666

cls = type(b"{}Alternate".format(cls.__name__),

1667

(cls, ), attr)

1668

else:

1669

cls = type("{}Alternate".format(cls.__name__),

1670

(cls, ), attr)

1385

cls = type(b"{}Alternate".format(cls.__name__),

1386

(cls, ), attr)

1671

1387

return cls

1672

1388

1673

1389

return wrapper

1831

1547

1832

1548

def approve(self, value=True):

1833

1549

self.approved = value

1834

GLib.timeout_add(int(self.approval_duration.total_seconds()

1835

* 1000), self._reset_approved)

1550

gobject.timeout_add(int(self.approval_duration.total_seconds()

1551

* 1000), self._reset_approved)

1836

1552

self.send_changedstate()

1837

1553

1838

1554

## D-Bus methods, signals & properties

2048

1764

if (getattr(self, "disable_initiator_tag", None)

2049

1765

is None):

2050

1766

return

2051

GLib.source_remove(self.disable_initiator_tag)

2052

self.disable_initiator_tag = GLib.timeout_add(

1767

gobject.source_remove(self.disable_initiator_tag)

1768

self.disable_initiator_tag = gobject.timeout_add(

2053

1769

int((self.expires - now).total_seconds() * 1000),

2054

1770

self.disable)

2055

1771

2075

1791

return

2076

1792

if self.enabled:

2077

1793

# Reschedule checker run

2078

GLib.source_remove(self.checker_initiator_tag)

2079

self.checker_initiator_tag = GLib.timeout_add(

1794

gobject.source_remove(self.checker_initiator_tag)

1795

self.checker_initiator_tag = gobject.timeout_add(

2080

1796

value, self.start_checker)

2081

1797

self.start_checker() # Start one now, too

2082

1798

2164

1880

logger.debug("Pipe FD: %d",

2165

1881

self.server.child_pipe.fileno())

2166

1882

2167

session = gnutls.ClientSession(self.request)

1883

session = gnutls.connection.ClientSession(

1884

self.request, gnutls.connection .X509Credentials())

1885

1886

# Note: gnutls.connection.X509Credentials is really a

1887

# generic GnuTLS certificate credentials object so long as

1888

# no X.509 keys are added to it. Therefore, we can use it

1889

# here despite using OpenPGP certificates.

2168

1890

2169

1891

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

2170

1892

# "+AES-256-CBC", "+SHA1",

2174

1896

priority = self.server.gnutls_priority

2175

1897

if priority is None:

2176

1898

priority = "NORMAL"

2177

gnutls.priority_set_direct(session._c_object, priority,

2178

None)

1899

gnutls.library.functions.gnutls_priority_set_direct(

1900

session._c_object, priority, None)

2179

1901

2180

1902

# Start communication using the Mandos protocol

2181

1903

# Get protocol number

2191

1913

# Start GnuTLS connection

2192

1914

try:

2193

1915

session.handshake()

2194

except gnutls.Error as error:

1916

except gnutls.errors.GNUTLSError as error:

2195

1917

logger.warning("Handshake failed: %s", error)

2196

1918

# Do not run session.bye() here: the session is not

2197

1919

# established. Just abandon the request.

2203

1925

try:

2204

1926

fpr = self.fingerprint(

2205

1927

self.peer_certificate(session))

2206

except (TypeError, gnutls.Error) as error:

1928

except (TypeError,

1929

gnutls.errors.GNUTLSError) as error:

2207

1930

logger.warning("Bad certificate: %s", error)

2208

1931

return

2209

1932

logger.debug("Fingerprint: %s", fpr)

2267

1990

else:

2268

1991

delay -= time2 - time

2269

1992

2270

try:

2271

session.send(client.secret)

2272

except gnutls.Error as error:

2273

logger.warning("gnutls send failed",

2274

exc_info = error)

2275

return

1993

sent_size = 0

1994

while sent_size < len(client.secret):

1995

try:

1996

sent = session.send(client.secret[sent_size:])

1997

except gnutls.errors.GNUTLSError as error:

1998

logger.warning("gnutls send failed",

1999

exc_info=error)

2000

return

2001

logger.debug("Sent: %d, remaining: %d", sent,

2002

len(client.secret) - (sent_size

2003

+ sent))

2004

sent_size += sent

2276

2005

2277

2006

logger.info("Sending secret to %s", client.name)

2278

2007

# bump the timeout using extended_timeout

2286

2015

client.approvals_pending -= 1

2287

2016

try:

2288

2017

session.bye()

2289

except gnutls.Error as error:

2018

except gnutls.errors.GNUTLSError as error:

2290

2019

logger.warning("GnuTLS bye failed",

2291

2020

exc_info=error)

2292

2021

2294

2023

def peer_certificate(session):

2295

2024

"Return the peer's OpenPGP certificate as a bytestring"

2296

2025

# If not an OpenPGP certificate...

2297

if (gnutls.certificate_type_get(session._c_object)

2298

!= gnutls.CRT_OPENPGP):

2299

# ...return invalid data

2300

return b""

2026

if (gnutls.library.functions.gnutls_certificate_type_get(

2027

session._c_object)

2028

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

2029

# ...do the normal thing

2030

return session.peer_certificate

2301

2031

list_size = ctypes.c_uint(1)

2302

cert_list = (gnutls.certificate_get_peers

2032

cert_list = (gnutls.library.functions

2033

.gnutls_certificate_get_peers

2303

2034

(session._c_object, ctypes.byref(list_size)))

2304

2035

if not bool(cert_list) and list_size.value != 0:

2305

raise gnutls.Error("error getting peer certificate")

2036

raise gnutls.errors.GNUTLSError("error getting peer"

2037

" certificate")

2306

2038

if list_size.value == 0:

2307

2039

return None

2308

2040

cert = cert_list[0]

2312

2044

def fingerprint(openpgp):

2313

2045

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2314

2046

# New GnuTLS "datum" with the OpenPGP public key

2315

datum = gnutls.datum_t(

2047

datum = gnutls.library.types.gnutls_datum_t(

2316

2048

ctypes.cast(ctypes.c_char_p(openpgp),

2317

2049

ctypes.POINTER(ctypes.c_ubyte)),

2318

2050

ctypes.c_uint(len(openpgp)))

2319

2051

# New empty GnuTLS certificate

2320

crt = gnutls.openpgp_crt_t()

2321

gnutls.openpgp_crt_init(ctypes.byref(crt))

2052

crt = gnutls.library.types.gnutls_openpgp_crt_t()

2053

gnutls.library.functions.gnutls_openpgp_crt_init(

2054

ctypes.byref(crt))

2322

2055

# Import the OpenPGP public key into the certificate

2323

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2324

gnutls.OPENPGP_FMT_RAW)

2056

gnutls.library.functions.gnutls_openpgp_crt_import(

2057

crt, ctypes.byref(datum),

2058

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

2325

2059

# Verify the self signature in the key

2326

2060

crtverify = ctypes.c_uint()

2327

gnutls.openpgp_crt_verify_self(crt, 0,

2328

ctypes.byref(crtverify))

2061

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

2062

crt, 0, ctypes.byref(crtverify))

2329

2063

if crtverify.value != 0:

2330

gnutls.openpgp_crt_deinit(crt)

2331

raise gnutls.CertificateSecurityError("Verify failed")

2064

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2065

raise gnutls.errors.CertificateSecurityError(

2066

"Verify failed")

2332

2067

# New buffer for the fingerprint

2333

2068

buf = ctypes.create_string_buffer(20)

2334

2069

buf_len = ctypes.c_size_t()

2335

2070

# Get the fingerprint from the certificate into the buffer

2336

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2337

ctypes.byref(buf_len))

2071

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

2072

crt, ctypes.byref(buf), ctypes.byref(buf_len))

2338

2073

# Deinit the certificate

2339

gnutls.openpgp_crt_deinit(crt)

2074

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2340

2075

# Convert the buffer to a Python bytestring

2341

2076

fpr = ctypes.string_at(buf, buf_len.value)

2342

2077

# Convert the bytestring to hexadecimal notation

2486

2221

gnutls_priority GnuTLS priority string

2487

2222

use_dbus: Boolean; to emit D-Bus signals or not

2488

2223

2489

Assumes a GLib.MainLoop event loop.

2224

Assumes a gobject.MainLoop event loop.

2490

2225

"""

2491

2226

2492

2227

def __init__(self, server_address, RequestHandlerClass,

2517

2252

2518

2253

def add_pipe(self, parent_pipe, proc):

2519

2254

# Call "handle_ipc" for both data and EOF events

2520

GLib.io_add_watch(

2255

gobject.io_add_watch(

2521

2256

parent_pipe.fileno(),

2522

GLib.IO_IN | GLib.IO_HUP,

2257

gobject.IO_IN | gobject.IO_HUP,

2523

2258

functools.partial(self.handle_ipc,

2524

2259

parent_pipe = parent_pipe,

2525

2260

proc = proc))

2529

2264

proc = None,

2530

2265

client_object=None):

2531

2266

# error, or the other end of multiprocessing.Pipe has closed

2532

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2267

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2533

2268

# Wait for other process to exit

2534

2269

proc.join()

2535

2270

return False

2542

2277

fpr = request[1]

2543

2278

address = request[2]

2544

2279

2545

for c in self.clients.values():

2280

for c in self.clients.itervalues():

2546

2281

if c.fingerprint == fpr:

2547

2282

client = c

2548

2283

break

2556

2291

parent_pipe.send(False)

2557

2292

return False

2558

2293

2559

GLib.io_add_watch(

2294

gobject.io_add_watch(

2560

2295

parent_pipe.fileno(),

2561

GLib.IO_IN | GLib.IO_HUP,

2296

gobject.IO_IN | gobject.IO_HUP,

2562

2297

functools.partial(self.handle_ipc,

2563

2298

parent_pipe = parent_pipe,

2564

2299

proc = proc,

2946

2681

logger.error("Could not open file %r", pidfilename,

2947

2682

exc_info=e)

2948

2683

2949

for name, group in (("_mandos", "_mandos"),

2950

("mandos", "mandos"),

2951

("nobody", "nogroup")):

2684

for name in ("_mandos", "mandos", "nobody"):

2952

2685

try:

2953

2686

uid = pwd.getpwnam(name).pw_uid

2954

gid = pwd.getpwnam(group).pw_gid

2687

gid = pwd.getpwnam(name).pw_gid

2955

2688

break

2956

2689

except KeyError:

2957

2690

continue

2961

2694

try:

2962

2695

os.setgid(gid)

2963

2696

os.setuid(uid)

2964

if debug:

2965

logger.debug("Did setuid/setgid to {}:{}".format(uid,

2966

gid))

2967

2697

except OSError as error:

2968

logger.warning("Failed to setuid/setgid to {}:{}: {}"

2969

.format(uid, gid, os.strerror(error.errno)))

2970

2698

if error.errno != errno.EPERM:

2971

2699

raise

2972

2700

2975

2703

2976

2704

# "Use a log level over 10 to enable all debugging options."

2977

2705

# - GnuTLS manual

2978

gnutls.global_set_log_level(11)

2706

gnutls.library.functions.gnutls_global_set_log_level(11)

2979

2707

2980

@gnutls.log_func

2708

@gnutls.library.types.gnutls_log_func

2981

2709

def debug_gnutls(level, string):

2982

2710

logger.debug("GnuTLS: %s", string[:-1])

2983

2711

2984

gnutls.global_set_log_function(debug_gnutls)

2712

gnutls.library.functions.gnutls_global_set_log_function(

2713

debug_gnutls)

2985

2714

2986

2715

# Redirect stdin so all checkers get /dev/null

2987

2716

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2994

2723

# Close all input and output, do double fork, etc.

2995

2724

daemon()

2996

2725

2997

# multiprocessing will use threads, so before we use GLib we need

2998

# to inform GLib that threads will be used.

2999

GLib.threads_init()

2726

# multiprocessing will use threads, so before we use gobject we

2727

# need to inform gobject that threads will be used.

2728

gobject.threads_init()

3000

2729

3001

2730

global main_loop

3002

2731

# From the Avahi example code

3003

2732

DBusGMainLoop(set_as_default=True)

3004

main_loop = GLib.MainLoop()

2733

main_loop = gobject.MainLoop()

3005

2734

bus = dbus.SystemBus()

3006

2735

# End of Avahi example code

3007

2736

if use_dbus:

3051

2780

if server_settings["restore"]:

3052

2781

try:

3053

2782

with open(stored_state_path, "rb") as stored_state:

3054

if sys.version_info.major == 2:

3055

clients_data, old_client_settings = pickle.load(

3056

stored_state)

3057

else:

3058

bytes_clients_data, bytes_old_client_settings = (

3059

pickle.load(stored_state, encoding = "bytes"))

3060

### Fix bytes to strings

3061

## clients_data

3062

# .keys()

3063

clients_data = { (key.decode("utf-8")

3064

if isinstance(key, bytes)

3065

else key): value

3066

for key, value in

3067

bytes_clients_data.items() }

3068

del bytes_clients_data

3069

for key in clients_data:

3070

value = { (k.decode("utf-8")

3071

if isinstance(k, bytes) else k): v

3072

for k, v in

3073

clients_data[key].items() }

3074

clients_data[key] = value

3075

# .client_structure

3076

value["client_structure"] = [

3077

(s.decode("utf-8")

3078

if isinstance(s, bytes)

3079

else s) for s in

3080

value["client_structure"] ]

3081

# .name & .host

3082

for k in ("name", "host"):

3083

if isinstance(value[k], bytes):

3084

value[k] = value[k].decode("utf-8")

3085

## old_client_settings

3086

# .keys()

3087

old_client_settings = {

3088

(key.decode("utf-8")

3089

if isinstance(key, bytes)

3090

else key): value

3091

for key, value in

3092

bytes_old_client_settings.items() }

3093

del bytes_old_client_settings

3094

# .host

3095

for value in old_client_settings.values():

3096

if isinstance(value["host"], bytes):

3097

value["host"] = (value["host"]

3098

.decode("utf-8"))

2783

clients_data, old_client_settings = pickle.load(

2784

stored_state)

3099

2785

os.remove(stored_state_path)

3100

2786

except IOError as e:

3101

2787

if e.errno == errno.ENOENT:

3202

2888

del pidfile

3203

2889

del pidfilename

3204

2890

3205

for termsig in (signal.SIGHUP, signal.SIGTERM):

3206

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3207

lambda: main_loop.quit() and False)

2891

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2892

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

3208

2893

3209

2894

if use_dbus:

3210

2895

3241

2926

def GetAllClients(self):

3242

2927

"D-Bus method"

3243

2928

return dbus.Array(c.dbus_object_path for c in

3244

tcp_server.clients.values())

2929

tcp_server.clients.itervalues())

3245

2930

3246

2931

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3247

2932

"true"})

3252

2937

return dbus.Dictionary(

3253

2938

{ c.dbus_object_path: c.GetAll(

3254

2939

"se.recompile.Mandos.Client")

3255

for c in tcp_server.clients.values() },

2940

for c in tcp_server.clients.itervalues() },

3256

2941

signature="oa{sv}")

3257

2942

3258

2943

@dbus.service.method(_interface, in_signature="o")

3259

2944

def RemoveClient(self, object_path):

3260

2945

"D-Bus method"

3261

for c in tcp_server.clients.values():

2946

for c in tcp_server.clients.itervalues():

3262

2947

if c.dbus_object_path == object_path:

3263

2948

del tcp_server.clients[c.name]

3264

2949

c.remove_from_connection()

3309

2994

3310

2995

mandos_dbus_service = MandosDBusService()

3311

2996

3312

# Save modules to variables to exempt the modules from being

3313

# unloaded before the function registered with atexit() is run.

3314

mp = multiprocessing

3315

wn = wnull

3316

2997

def cleanup():

3317

2998

"Cleanup function; run on exit"

3318

2999

if zeroconf:

3319

3000

service.cleanup()

3320

3001

3321

mp.active_children()

3322

wn.close()

3002

multiprocessing.active_children()

3003

wnull.close()

3323

3004

if not (tcp_server.clients or client_settings):

3324

3005

return

3325

3006

3328

3009

# removed/edited, old secret will thus be unrecovable.

3329

3010

clients = {}

3330

3011

with PGPEngine() as pgp:

3331

for client in tcp_server.clients.values():

3012

for client in tcp_server.clients.itervalues():

3332

3013

key = client_settings[client.name]["secret"]

3333

3014

client.encrypted_secret = pgp.encrypt(client.secret,

3334

3015

key)

3358

3039

prefix='clients-',

3359

3040

dir=os.path.dirname(stored_state_path),

3360

3041

delete=False) as stored_state:

3361

pickle.dump((clients, client_settings), stored_state,

3362

protocol = 2)

3042

pickle.dump((clients, client_settings), stored_state)

3363

3043

tempname = stored_state.name

3364

3044

os.rename(tempname, stored_state_path)

3365

3045

except (IOError, OSError) as e:

3384

3064

# Don't signal the disabling

3385

3065

client.disable(quiet=True)

3386

3066

# Emit D-Bus signal for removal

3387

if use_dbus:

3388

mandos_dbus_service.client_removed_signal(client)

3067

mandos_dbus_service.client_removed_signal(client)

3389

3068

client_settings.clear()

3390

3069

3391

3070

atexit.register(cleanup)

3392

3071

3393

for client in tcp_server.clients.values():

3072

for client in tcp_server.clients.itervalues():

3394

3073

if use_dbus:

3395

3074

# Emit D-Bus signal for adding

3396

3075

mandos_dbus_service.client_added_signal(client)

3425

3104

sys.exit(1)

3426

3105

# End of Avahi example code

3427

3106

3428

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3429

lambda *args, **kwargs:

3430

(tcp_server.handle_request

3431

(*args[2:], **kwargs) or True))

3107

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

3108

lambda *args, **kwargs:

3109

(tcp_server.handle_request

3110

(*args[2:], **kwargs) or True))

3432

3111

3433

3112

logger.debug("Starting main loop")

3434

3113

main_loop.run()