2
2
# -*- mode: python; coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
14
# Copyright © 2008-2016 Teddy Hogeborn
15
15
# Copyright © 2008-2016 Björn Påhlsson
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
19
19
# the Free Software Foundation, either version 3 of the License, or
86
86
import xml.dom.minidom
89
# Try to find the value of SO_BINDTODEVICE:
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
92
# newer, and it is also the most natural place for it:
93
90
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
94
91
except AttributeError:
96
# This is where SO_BINDTODEVICE was up to and including Python
98
93
from IN import SO_BINDTODEVICE
99
94
except ImportError:
100
# In Python 2.7 it seems to have been removed entirely.
101
# Try running the C preprocessor:
103
cc = subprocess.Popen(["cc", "--language=c", "-E",
105
stdin=subprocess.PIPE,
106
stdout=subprocess.PIPE)
107
stdout = cc.communicate(
108
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
109
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
110
except (OSError, ValueError, IndexError):
112
SO_BINDTODEVICE = None
95
SO_BINDTODEVICE = None
114
97
if sys.version_info.major == 2:
118
101
stored_state_file = "clients.pickle"
120
103
logger = logging.getLogger()
246
227
'--passphrase-file',
248
229
+ self.gnupgargs,
249
stdin=subprocess.PIPE,
250
stdout=subprocess.PIPE,
251
stderr=subprocess.PIPE)
252
ciphertext, err = proc.communicate(input=data)
230
stdin = subprocess.PIPE,
231
stdout = subprocess.PIPE,
232
stderr = subprocess.PIPE)
233
ciphertext, err = proc.communicate(input = data)
253
234
if proc.returncode != 0:
254
235
raise PGPError(err)
255
236
return ciphertext
257
238
def decrypt(self, data, password):
258
239
passphrase = self.password_encode(password)
259
240
with tempfile.NamedTemporaryFile(
260
dir=self.tempdir) as passfile:
241
dir = self.tempdir) as passfile:
261
242
passfile.write(passphrase)
263
244
proc = subprocess.Popen([self.gpg, '--decrypt',
264
245
'--passphrase-file',
266
247
+ self.gnupgargs,
267
stdin=subprocess.PIPE,
268
stdout=subprocess.PIPE,
269
stderr=subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input=data)
248
stdin = subprocess.PIPE,
249
stdout = subprocess.PIPE,
250
stderr = subprocess.PIPE)
251
decrypted_plaintext, err = proc.communicate(input = data)
271
252
if proc.returncode != 0:
272
253
raise PGPError(err)
273
254
return decrypted_plaintext
276
256
# Pretend that we have an Avahi module
277
257
class Avahi(object):
278
258
"""This isn't so much a class as it is a module-like namespace.
279
259
It is instantiated once, and simulates having an Avahi module."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
260
IF_UNSPEC = -1 # avahi-common/address.h
261
PROTO_UNSPEC = -1 # avahi-common/address.h
262
PROTO_INET = 0 # avahi-common/address.h
263
PROTO_INET6 = 1 # avahi-common/address.h
284
264
DBUS_NAME = "org.freedesktop.Avahi"
285
265
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
266
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
267
DBUS_PATH_SERVER = "/"
289
268
def string_array_to_txt_array(self, t):
290
269
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
291
270
for s in t), signature="ay")
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
293
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
294
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
295
SERVER_INVALID = 0 # avahi-common/defs.h
296
SERVER_REGISTERING = 1 # avahi-common/defs.h
297
SERVER_RUNNING = 2 # avahi-common/defs.h
298
SERVER_COLLISION = 3 # avahi-common/defs.h
299
SERVER_FAILURE = 4 # avahi-common/defs.h
271
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
272
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
273
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
274
SERVER_INVALID = 0 # avahi-common/defs.h
275
SERVER_REGISTERING = 1 # avahi-common/defs.h
276
SERVER_RUNNING = 2 # avahi-common/defs.h
277
SERVER_COLLISION = 3 # avahi-common/defs.h
278
SERVER_FAILURE = 4 # avahi-common/defs.h
303
281
class AvahiError(Exception):
304
282
def __init__(self, value, *args, **kwargs):
305
283
self.value = value
532
508
CRD_CERTIFICATE = 1
533
509
E_NO_CERTIFICATE_FOUND = -49
534
510
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
537
513
class session_int(ctypes.Structure):
539
515
session_t = ctypes.POINTER(session_int)
541
516
class certificate_credentials_st(ctypes.Structure):
543
518
certificate_credentials_t = ctypes.POINTER(
544
519
certificate_credentials_st)
545
520
certificate_type_t = ctypes.c_int
547
521
class datum_t(ctypes.Structure):
548
522
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
549
523
('size', ctypes.c_uint)]
551
524
class openpgp_crt_int(ctypes.Structure):
553
526
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
554
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
527
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
555
528
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
556
529
credentials_type_t = ctypes.c_int
557
530
transport_ptr_t = ctypes.c_void_p
558
531
close_request_t = ctypes.c_int
561
534
class Error(Exception):
562
535
# We need to use the class name "GnuTLS" here, since this
563
536
# exception might be raised from within GnuTLS.__init__,
564
537
# which is called before the assignment to the "gnutls"
565
538
# global variable has happened.
566
def __init__(self, message=None, code=None, args=()):
539
def __init__(self, message = None, code = None, args=()):
567
540
# Default usage is by a message string, but if a return
568
541
# code is passed, convert it to a string with
569
542
# gnutls.strerror()
638
611
return _error_code(result)
639
612
result = func(*arguments)
642
615
# Unless otherwise indicated, the function declarations below are
643
616
# all from the gnutls/gnutls.h C header file.
646
619
priority_set_direct = _library.gnutls_priority_set_direct
647
620
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
648
621
ctypes.POINTER(ctypes.c_char_p)]
649
622
priority_set_direct.restype = _error_code
651
624
init = _library.gnutls_init
652
625
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
653
626
init.restype = _error_code
655
628
set_default_priority = _library.gnutls_set_default_priority
656
629
set_default_priority.argtypes = [session_t]
657
630
set_default_priority.restype = _error_code
659
632
record_send = _library.gnutls_record_send
660
633
record_send.argtypes = [session_t, ctypes.c_void_p,
662
635
record_send.restype = ctypes.c_ssize_t
663
636
record_send.errcheck = _retry_on_error
665
638
certificate_allocate_credentials = (
666
639
_library.gnutls_certificate_allocate_credentials)
667
640
certificate_allocate_credentials.argtypes = [
668
641
ctypes.POINTER(certificate_credentials_t)]
669
642
certificate_allocate_credentials.restype = _error_code
671
644
certificate_free_credentials = (
672
645
_library.gnutls_certificate_free_credentials)
673
certificate_free_credentials.argtypes = [
674
certificate_credentials_t]
646
certificate_free_credentials.argtypes = [certificate_credentials_t]
675
647
certificate_free_credentials.restype = None
677
649
handshake_set_private_extensions = (
678
650
_library.gnutls_handshake_set_private_extensions)
679
651
handshake_set_private_extensions.argtypes = [session_t,
681
653
handshake_set_private_extensions.restype = None
683
655
credentials_set = _library.gnutls_credentials_set
684
656
credentials_set.argtypes = [session_t, credentials_type_t,
686
658
credentials_set.restype = _error_code
688
660
strerror = _library.gnutls_strerror
689
661
strerror.argtypes = [ctypes.c_int]
690
662
strerror.restype = ctypes.c_char_p
692
664
certificate_type_get = _library.gnutls_certificate_type_get
693
665
certificate_type_get.argtypes = [session_t]
694
666
certificate_type_get.restype = _error_code
696
668
certificate_get_peers = _library.gnutls_certificate_get_peers
697
669
certificate_get_peers.argtypes = [session_t,
698
670
ctypes.POINTER(ctypes.c_uint)]
699
671
certificate_get_peers.restype = ctypes.POINTER(datum_t)
701
673
global_set_log_level = _library.gnutls_global_set_log_level
702
674
global_set_log_level.argtypes = [ctypes.c_int]
703
675
global_set_log_level.restype = None
705
677
global_set_log_function = _library.gnutls_global_set_log_function
706
678
global_set_log_function.argtypes = [log_func]
707
679
global_set_log_function.restype = None
709
681
deinit = _library.gnutls_deinit
710
682
deinit.argtypes = [session_t]
711
683
deinit.restype = None
713
685
handshake = _library.gnutls_handshake
714
686
handshake.argtypes = [session_t]
715
687
handshake.restype = _error_code
716
688
handshake.errcheck = _retry_on_error
718
690
transport_set_ptr = _library.gnutls_transport_set_ptr
719
691
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
720
692
transport_set_ptr.restype = None
722
694
bye = _library.gnutls_bye
723
695
bye.argtypes = [session_t, close_request_t]
724
696
bye.restype = _error_code
725
697
bye.errcheck = _retry_on_error
727
699
check_version = _library.gnutls_check_version
728
700
check_version.argtypes = [ctypes.c_char_p]
729
701
check_version.restype = ctypes.c_char_p
731
703
# All the function declarations below are from gnutls/openpgp.h
733
705
openpgp_crt_init = _library.gnutls_openpgp_crt_init
734
706
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
735
707
openpgp_crt_init.restype = _error_code
737
709
openpgp_crt_import = _library.gnutls_openpgp_crt_import
738
710
openpgp_crt_import.argtypes = [openpgp_crt_t,
739
711
ctypes.POINTER(datum_t),
740
712
openpgp_crt_fmt_t]
741
713
openpgp_crt_import.restype = _error_code
743
715
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
744
716
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
745
717
ctypes.POINTER(ctypes.c_uint)]
746
718
openpgp_crt_verify_self.restype = _error_code
748
720
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
749
721
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
750
722
openpgp_crt_deinit.restype = None
752
724
openpgp_crt_get_fingerprint = (
753
725
_library.gnutls_openpgp_crt_get_fingerprint)
754
726
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
1076
1046
# The exception is when not debugging but nevertheless
1077
1047
# running in the foreground; use the previously
1078
1048
# created wnull.
1079
popen_args = {"close_fds": True,
1049
popen_args = { "close_fds": True,
1082
1052
if (not self.server_settings["debug"]
1083
1053
and self.server_settings["foreground"]):
1084
1054
popen_args.update({"stdout": wnull,
1086
pipe = multiprocessing.Pipe(duplex=False)
1056
pipe = multiprocessing.Pipe(duplex = False)
1087
1057
self.checker = multiprocessing.Process(
1089
args=(pipe[1], subprocess.call, command),
1059
args = (pipe[1], subprocess.call, command),
1060
kwargs = popen_args)
1091
1061
self.checker.start()
1092
1062
self.checker_callback_tag = GLib.io_add_watch(
1093
1063
pipe[0].fileno(), GLib.IO_IN,
1094
1064
self.checker_callback, pipe[0], command)
1095
1065
# Re-run this periodically if run by GLib.timeout_add
1098
1068
def stop_checker(self):
1099
1069
"""Force the checker process, if any, to stop."""
1100
1070
if self.checker_callback_tag:
1135
1105
func._dbus_name = func.__name__
1136
1106
if func._dbus_name.endswith("_dbus_property"):
1137
1107
func._dbus_name = func._dbus_name[:-14]
1138
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1108
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1141
1111
return decorator
1144
1114
def dbus_interface_annotations(dbus_interface):
1145
1115
"""Decorator for marking functions returning interface annotations
1149
1119
@dbus_interface_annotations("org.example.Interface")
1150
1120
def _foo(self): # Function name does not matter
1151
1121
return {"org.freedesktop.DBus.Deprecated": "true",
1152
1122
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1156
1126
def decorator(func):
1157
1127
func._dbus_is_interface = True
1158
1128
func._dbus_interface = dbus_interface
1159
1129
func._dbus_name = dbus_interface
1162
1132
return decorator
1165
1135
def dbus_annotations(annotations):
1166
1136
"""Decorator to annotate D-Bus methods, signals or properties
1169
1139
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1170
1140
"org.freedesktop.DBus.Property."
1171
1141
"EmitsChangedSignal": "false"})
1227
1197
for cls in self.__class__.__mro__
1228
1198
for name, athing in
1229
1199
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1231
1201
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1233
path_keyword='object_path',
1234
connection_keyword='connection')
1202
out_signature = "s",
1203
path_keyword = 'object_path',
1204
connection_keyword = 'connection')
1235
1205
def Introspect(self, object_path, connection):
1236
1206
"""Overloading of standard D-Bus method.
1238
1208
Inserts annotation tags on methods and signals.
1240
1210
xmlstring = dbus.service.Object.Introspect(self, object_path,
1243
1213
document = xml.dom.minidom.parseString(xmlstring)
1245
1215
for if_tag in document.getElementsByTagName("interface"):
1246
1216
# Add annotation tags
1247
1217
for typ in ("method", "signal"):
1463
1433
except AttributeError:
1464
1434
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1467
1436
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1468
1437
"""A D-Bus object with an ObjectManager.
1470
1439
Classes inheriting from this exposes the standard
1471
1440
GetManagedObjects call and the InterfacesAdded and
1472
1441
InterfacesRemoved signals on the standard
1473
1442
"org.freedesktop.DBus.ObjectManager" interface.
1475
1444
Note: No signals are sent automatically; they must be sent
1478
1447
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1479
out_signature="a{oa{sa{sv}}}")
1448
out_signature = "a{oa{sa{sv}}}")
1480
1449
def GetManagedObjects(self):
1481
1450
"""This function must be overridden"""
1482
1451
raise NotImplementedError()
1484
1453
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1485
signature="oa{sa{sv}}")
1454
signature = "oa{sa{sv}}")
1486
1455
def InterfacesAdded(self, object_path, interfaces_and_properties):
1489
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1458
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1490
1459
def InterfacesRemoved(self, object_path, interfaces):
1493
1462
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1495
path_keyword='object_path',
1496
connection_keyword='connection')
1463
out_signature = "s",
1464
path_keyword = 'object_path',
1465
connection_keyword = 'connection')
1497
1466
def Introspect(self, object_path, connection):
1498
1467
"""Overloading of standard D-Bus method.
1500
1469
Override return argument name of GetManagedObjects to be
1501
1470
"objpath_interfaces_and_properties"
1541
1509
dbus.service.Object, it will add alternate D-Bus attributes with
1542
1510
interface names according to the "alt_interface_names" mapping.
1545
1513
@alternate_dbus_interfaces({"org.example.Interface":
1546
1514
"net.example.AlternateInterface"})
1547
1515
class SampleDBusObject(dbus.service.Object):
1548
1516
@dbus.service.method("org.example.Interface")
1549
1517
def SampleDBusMethod():
1552
1520
The above "SampleDBusMethod" on "SampleDBusObject" will be
1553
1521
reachable via two interfaces: "org.example.Interface" and
1554
1522
"net.example.AlternateInterface", the latter of which will have
1555
1523
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1556
1524
"true", unless "deprecate" is passed with a False value.
1558
1526
This works for methods and signals, and also for D-Bus properties
1559
1527
(from DBusObjectWithProperties) and interfaces (from the
1560
1528
dbus_interface_annotations decorator).
1563
1531
def wrapper(cls):
1564
1532
for orig_interface_name, alt_interface_name in (
1565
1533
alt_interface_names.items()):
1709
1675
"se.bsnet.fukt.Mandos"})
1710
1676
class ClientDBus(Client, DBusObjectWithProperties):
1711
1677
"""A Client class using D-Bus
1714
1680
dbus_object_path: dbus.ObjectPath
1715
1681
bus: dbus.SystemBus()
1718
1684
runtime_expansions = (Client.runtime_expansions
1719
1685
+ ("dbus_object_path", ))
1721
1687
_interface = "se.recompile.Mandos.Client"
1723
1689
# dbus.service.Object doesn't use super(), so we can't either.
1725
def __init__(self, bus=None, *args, **kwargs):
1691
def __init__(self, bus = None, *args, **kwargs):
1727
1693
Client.__init__(self, *args, **kwargs)
1728
1694
# Only now, when this client is initialized, can it show up on
1765
1731
dbus_value = transform_func(
1766
1732
type_func(value),
1767
variant_level=variant_level)
1733
variant_level = variant_level)
1768
1734
self.PropertyChanged(dbus.String(dbus_name),
1770
1736
self.PropertiesChanged(
1772
dbus.Dictionary({dbus.String(dbus_name):
1738
dbus.Dictionary({ dbus.String(dbus_name):
1775
1741
setattr(self, attrname, value)
1777
1743
return property(lambda self: getattr(self, attrname), setter)
1779
1745
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1780
1746
approvals_pending = notifychangeproperty(dbus.Boolean,
1781
1747
"ApprovalPending",
1783
1749
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1784
1750
last_enabled = notifychangeproperty(datetime_to_dbus,
1786
1752
checker = notifychangeproperty(
1787
1753
dbus.Boolean, "CheckerRunning",
1788
type_func=lambda checker: checker is not None)
1754
type_func = lambda checker: checker is not None)
1789
1755
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1790
1756
"LastCheckedOK")
1791
1757
last_checker_status = notifychangeproperty(dbus.Int16,
1796
1762
"ApprovedByDefault")
1797
1763
approval_delay = notifychangeproperty(
1798
1764
dbus.UInt64, "ApprovalDelay",
1799
type_func=lambda td: td.total_seconds() * 1000)
1765
type_func = lambda td: td.total_seconds() * 1000)
1800
1766
approval_duration = notifychangeproperty(
1801
1767
dbus.UInt64, "ApprovalDuration",
1802
type_func=lambda td: td.total_seconds() * 1000)
1768
type_func = lambda td: td.total_seconds() * 1000)
1803
1769
host = notifychangeproperty(dbus.String, "Host")
1804
1770
timeout = notifychangeproperty(
1805
1771
dbus.UInt64, "Timeout",
1806
type_func=lambda td: td.total_seconds() * 1000)
1772
type_func = lambda td: td.total_seconds() * 1000)
1807
1773
extended_timeout = notifychangeproperty(
1808
1774
dbus.UInt64, "ExtendedTimeout",
1809
type_func=lambda td: td.total_seconds() * 1000)
1775
type_func = lambda td: td.total_seconds() * 1000)
1810
1776
interval = notifychangeproperty(
1811
1777
dbus.UInt64, "Interval",
1812
type_func=lambda td: td.total_seconds() * 1000)
1778
type_func = lambda td: td.total_seconds() * 1000)
1813
1779
checker_command = notifychangeproperty(dbus.String, "Checker")
1814
1780
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1815
1781
invalidate_only=True)
1817
1783
del notifychangeproperty
1819
1785
def __del__(self, *args, **kwargs):
1821
1787
self.remove_from_connection()
1856
1822
# Emit D-Bus signal
1857
1823
self.CheckerStarted(self.current_checker_command)
1860
1826
def _reset_approved(self):
1861
1827
self.approved = None
1864
1830
def approve(self, value=True):
1865
1831
self.approved = value
1866
1832
GLib.timeout_add(int(self.approval_duration.total_seconds()
1867
1833
* 1000), self._reset_approved)
1868
1834
self.send_changedstate()
1870
# D-Bus methods, signals & properties
1836
## D-Bus methods, signals & properties
1876
1842
# CheckerCompleted - signal
1877
1843
@dbus.service.signal(_interface, signature="nxs")
1878
1844
def CheckerCompleted(self, exitcode, waitstatus, command):
1882
1848
# CheckerStarted - signal
1883
1849
@dbus.service.signal(_interface, signature="s")
1884
1850
def CheckerStarted(self, command):
1888
1854
# PropertyChanged - signal
1889
1855
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1890
1856
@dbus.service.signal(_interface, signature="sv")
1891
1857
def PropertyChanged(self, property, value):
1895
1861
# GotSecret - signal
1896
1862
@dbus.service.signal(_interface)
1897
1863
def GotSecret(self):
1900
1866
server to mandos-client
1904
1870
# Rejected - signal
1905
1871
@dbus.service.signal(_interface, signature="s")
1906
1872
def Rejected(self, reason):
1910
1876
# NeedApproval - signal
1911
1877
@dbus.service.signal(_interface, signature="tb")
1912
1878
def NeedApproval(self, timeout, default):
1914
1880
return self.need_approval()
1918
1884
# Approve - method
1919
1885
@dbus.service.method(_interface, in_signature="b")
1920
1886
def Approve(self, value):
1921
1887
self.approve(value)
1923
1889
# CheckedOK - method
1924
1890
@dbus.service.method(_interface)
1925
1891
def CheckedOK(self):
1926
1892
self.checked_ok()
1928
1894
# Enable - method
1929
1895
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1930
1896
@dbus.service.method(_interface)
1931
1897
def Enable(self):
1935
1901
# StartChecker - method
1936
1902
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1937
1903
@dbus.service.method(_interface)
1938
1904
def StartChecker(self):
1940
1906
self.start_checker()
1942
1908
# Disable - method
1943
1909
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1944
1910
@dbus.service.method(_interface)
1945
1911
def Disable(self):
1949
1915
# StopChecker - method
1950
1916
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1951
1917
@dbus.service.method(_interface)
1952
1918
def StopChecker(self):
1953
1919
self.stop_checker()
1957
1923
# ApprovalPending - property
1958
1924
@dbus_service_property(_interface, signature="b", access="read")
1959
1925
def ApprovalPending_dbus_property(self):
1960
1926
return dbus.Boolean(bool(self.approvals_pending))
1962
1928
# ApprovedByDefault - property
1963
1929
@dbus_service_property(_interface,
2044
2010
self.checked_ok()
2046
2012
return datetime_to_dbus(self.last_checked_ok)
2048
2014
# LastCheckerStatus - property
2049
2015
@dbus_service_property(_interface, signature="n", access="read")
2050
2016
def LastCheckerStatus_dbus_property(self):
2051
2017
return dbus.Int16(self.last_checker_status)
2053
2019
# Expires - property
2054
2020
@dbus_service_property(_interface, signature="s", access="read")
2055
2021
def Expires_dbus_property(self):
2056
2022
return datetime_to_dbus(self.expires)
2058
2024
# LastApprovalRequest - property
2059
2025
@dbus_service_property(_interface, signature="s", access="read")
2060
2026
def LastApprovalRequest_dbus_property(self):
2061
2027
return datetime_to_dbus(self.last_approval_request)
2063
2029
# Timeout - property
2064
2030
@dbus_service_property(_interface,
2186
2152
class ClientHandler(socketserver.BaseRequestHandler, object):
2187
2153
"""A class to handle client connections.
2189
2155
Instantiated once for each connection to handle it.
2190
2156
Note: This will run in its own forked process."""
2192
2158
def handle(self):
2193
2159
with contextlib.closing(self.server.child_pipe) as child_pipe:
2194
2160
logger.info("TCP connection from: %s",
2195
2161
str(self.client_address))
2196
2162
logger.debug("Pipe FD: %d",
2197
2163
self.server.child_pipe.fileno())
2199
2165
session = gnutls.ClientSession(self.request)
2201
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2202
# "+AES-256-CBC", "+SHA1",
2203
# "+COMP-NULL", "+CTYPE-OPENPGP",
2167
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2168
# "+AES-256-CBC", "+SHA1",
2169
# "+COMP-NULL", "+CTYPE-OPENPGP",
2205
2171
# Use a fallback default, since this MUST be set.
2206
2172
priority = self.server.gnutls_priority
2207
2173
if priority is None:
2208
2174
priority = "NORMAL"
2209
gnutls.priority_set_direct(session._c_object,
2210
priority.encode("utf-8"),
2175
gnutls.priority_set_direct(session._c_object, priority,
2213
2178
# Start communication using the Mandos protocol
2214
2179
# Get protocol number
2215
2180
line = self.request.makefile().readline()
2380
2345
class MultiprocessingMixIn(object):
2381
2346
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2383
2348
def sub_process_main(self, request, address):
2385
2350
self.finish_request(request, address)
2386
2351
except Exception:
2387
2352
self.handle_error(request, address)
2388
2353
self.close_request(request)
2390
2355
def process_request(self, request, address):
2391
2356
"""Start a new process to process the request."""
2392
proc = multiprocessing.Process(target=self.sub_process_main,
2393
args=(request, address))
2357
proc = multiprocessing.Process(target = self.sub_process_main,
2358
args = (request, address))
2398
2363
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2399
2364
""" adds a pipe to the MixIn """
2401
2366
def process_request(self, request, client_address):
2402
2367
"""Overrides and wraps the original process_request().
2404
2369
This function creates a new pipe in self.pipe
2406
2371
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2408
2373
proc = MultiprocessingMixIn.process_request(self, request,
2409
2374
client_address)
2410
2375
self.child_pipe.close()
2411
2376
self.add_pipe(parent_pipe, proc)
2413
2378
def add_pipe(self, parent_pipe, proc):
2414
2379
"""Dummy function; override as necessary"""
2415
2380
raise NotImplementedError()
2464
2428
# socket_wrapper(), if socketfd was set.
2465
2429
socketserver.TCPServer.__init__(self, server_address,
2466
2430
RequestHandlerClass)
2468
2432
def server_bind(self):
2469
2433
"""This overrides the normal server_bind() function
2470
2434
to bind to an interface if one was specified, and also NOT to
2471
2435
bind to an address or port if they were not specified."""
2472
global SO_BINDTODEVICE
2473
2436
if self.interface is not None:
2474
2437
if SO_BINDTODEVICE is None:
2475
# Fall back to a hard-coded value which seems to be
2477
logger.warning("SO_BINDTODEVICE not found, trying 25")
2478
SO_BINDTODEVICE = 25
2480
self.socket.setsockopt(
2481
socket.SOL_SOCKET, SO_BINDTODEVICE,
2482
(self.interface + "\0").encode("utf-8"))
2483
except socket.error as error:
2484
if error.errno == errno.EPERM:
2485
logger.error("No permission to bind to"
2486
" interface %s", self.interface)
2487
elif error.errno == errno.ENOPROTOOPT:
2488
logger.error("SO_BINDTODEVICE not available;"
2489
" cannot bind to interface %s",
2491
elif error.errno == errno.ENODEV:
2492
logger.error("Interface %s does not exist,"
2493
" cannot bind", self.interface)
2438
logger.error("SO_BINDTODEVICE does not exist;"
2439
" cannot bind to interface %s",
2443
self.socket.setsockopt(
2444
socket.SOL_SOCKET, SO_BINDTODEVICE,
2445
(self.interface + "\0").encode("utf-8"))
2446
except socket.error as error:
2447
if error.errno == errno.EPERM:
2448
logger.error("No permission to bind to"
2449
" interface %s", self.interface)
2450
elif error.errno == errno.ENOPROTOOPT:
2451
logger.error("SO_BINDTODEVICE not available;"
2452
" cannot bind to interface %s",
2454
elif error.errno == errno.ENODEV:
2455
logger.error("Interface %s does not exist,"
2456
" cannot bind", self.interface)
2496
2459
# Only bind(2) the socket if we really need to.
2497
2460
if self.server_address[0] or self.server_address[1]:
2498
2461
if not self.server_address[0]:
2499
2462
if self.address_family == socket.AF_INET6:
2500
any_address = "::" # in6addr_any
2463
any_address = "::" # in6addr_any
2502
any_address = "0.0.0.0" # INADDR_ANY
2465
any_address = "0.0.0.0" # INADDR_ANY
2503
2466
self.server_address = (any_address,
2504
2467
self.server_address[1])
2505
2468
elif not self.server_address[1]:
2539
2502
self.gnutls_priority = gnutls_priority
2540
2503
IPv6_TCPServer.__init__(self, server_address,
2541
2504
RequestHandlerClass,
2542
interface=interface,
2505
interface = interface,
2506
use_ipv6 = use_ipv6,
2507
socketfd = socketfd)
2546
2509
def server_activate(self):
2547
2510
if self.enabled:
2548
2511
return socketserver.TCPServer.server_activate(self)
2550
2513
def enable(self):
2551
2514
self.enabled = True
2553
2516
def add_pipe(self, parent_pipe, proc):
2554
2517
# Call "handle_ipc" for both data and EOF events
2555
2518
GLib.io_add_watch(
2556
2519
parent_pipe.fileno(),
2557
2520
GLib.IO_IN | GLib.IO_HUP,
2558
2521
functools.partial(self.handle_ipc,
2559
parent_pipe=parent_pipe,
2522
parent_pipe = parent_pipe,
2562
2525
def handle_ipc(self, source, condition,
2563
2526
parent_pipe=None,
2565
2528
client_object=None):
2566
2529
# error, or the other end of multiprocessing.Pipe has closed
2567
2530
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2568
2531
# Wait for other process to exit
2572
2535
# Read a request from the child
2573
2536
request = parent_pipe.recv()
2574
2537
command = request[0]
2576
2539
if command == 'init':
2577
2540
fpr = request[1]
2578
2541
address = request[2]
2580
2543
for c in self.clients.values():
2581
2544
if c.fingerprint == fpr:
2646
2609
>>> rfc3339_duration_to_delta("P1DT3M20S")
2647
2610
datetime.timedelta(1, 200)
2650
2613
# Parsing an RFC 3339 duration with regular expressions is not
2651
2614
# possible - there would have to be multiple places for the same
2652
2615
# values, like seconds. The current code, while more esoteric, is
2653
2616
# cleaner without depending on a parsing library. If Python had a
2654
2617
# built-in library for parsing we would use it, but we'd like to
2655
2618
# avoid excessive use of external libraries.
2657
2620
# New type for defining tokens, syntax, and semantics all-in-one
2658
2621
Token = collections.namedtuple("Token", (
2659
2622
"regexp", # To match token; if "value" is not None, must have
2846
2806
parser.add_argument("--no-zeroconf", action="store_false",
2847
2807
dest="zeroconf", help="Do not use Zeroconf",
2850
2810
options = parser.parse_args()
2852
2812
if options.check:
2854
2814
fail_count, test_count = doctest.testmod()
2855
2815
sys.exit(os.EX_OK if fail_count == 0 else 1)
2857
2817
# Default values for config file for server-global settings
2858
server_defaults = {"interface": "",
2863
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2864
":+SIGN-DSA-SHA256",
2865
"servicename": "Mandos",
2871
"statedir": "/var/lib/mandos",
2872
"foreground": "False",
2818
server_defaults = { "interface": "",
2823
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2824
":+SIGN-DSA-SHA256",
2825
"servicename": "Mandos",
2831
"statedir": "/var/lib/mandos",
2832
"foreground": "False",
2876
2836
# Parse config file for server-global settings
2877
2837
server_config = configparser.SafeConfigParser(server_defaults)
2878
2838
del server_defaults
3007
2967
.format(uid, gid, os.strerror(error.errno)))
3008
2968
if error.errno != errno.EPERM:
3012
2972
# Enable all possible GnuTLS debugging
3014
2974
# "Use a log level over 10 to enable all debugging options."
3015
2975
# - GnuTLS manual
3016
2976
gnutls.global_set_log_level(11)
3018
2978
@gnutls.log_func
3019
2979
def debug_gnutls(level, string):
3020
2980
logger.debug("GnuTLS: %s", string[:-1])
3022
2982
gnutls.global_set_log_function(debug_gnutls)
3024
2984
# Redirect stdin so all checkers get /dev/null
3025
2985
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3026
2986
os.dup2(null, sys.stdin.fileno())
3030
2990
# Need to fork before connecting to D-Bus
3031
2991
if not foreground:
3032
2992
# Close all input and output, do double fork, etc.
3035
2995
# multiprocessing will use threads, so before we use GLib we need
3036
2996
# to inform GLib that threads will be used.
3037
2997
GLib.threads_init()
3039
2999
global main_loop
3040
3000
# From the Avahi example code
3041
3001
DBusGMainLoop(set_as_default=True)
3059
3019
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3060
3020
service = AvahiServiceToSyslog(
3061
name=server_settings["servicename"],
3062
servicetype="_mandos._tcp",
3021
name = server_settings["servicename"],
3022
servicetype = "_mandos._tcp",
3023
protocol = protocol,
3065
3025
if server_settings["interface"]:
3066
3026
service.interface = if_nametoindex(
3067
3027
server_settings["interface"].encode("utf-8"))
3069
3029
global multiprocessing_manager
3070
3030
multiprocessing_manager = multiprocessing.Manager()
3072
3032
client_class = Client
3074
client_class = functools.partial(ClientDBus, bus=bus)
3034
client_class = functools.partial(ClientDBus, bus = bus)
3076
3036
client_settings = Client.config_parser(client_config)
3077
3037
old_client_settings = {}
3078
3038
clients_data = {}
3080
3040
# This is used to redirect stdout and stderr for checker processes
3082
wnull = open(os.devnull, "w") # A writable /dev/null
3042
wnull = open(os.devnull, "w") # A writable /dev/null
3083
3043
# Only used if server is running in foreground but not in debug
3085
3045
if debug or not foreground:
3088
3048
# Get client data and settings from last running state.
3089
3049
if server_settings["restore"]:
3091
3051
with open(stored_state_path, "rb") as stored_state:
3092
if sys.version_info.major == 2:
3052
if sys.version_info.major == 2:
3093
3053
clients_data, old_client_settings = pickle.load(
3096
3056
bytes_clients_data, bytes_old_client_settings = (
3097
pickle.load(stored_state, encoding="bytes"))
3098
# Fix bytes to strings
3057
pickle.load(stored_state, encoding = "bytes"))
3058
### Fix bytes to strings
3101
clients_data = {(key.decode("utf-8")
3102
if isinstance(key, bytes)
3105
bytes_clients_data.items()}
3061
clients_data = { (key.decode("utf-8")
3062
if isinstance(key, bytes)
3065
bytes_clients_data.items() }
3106
3066
del bytes_clients_data
3107
3067
for key in clients_data:
3108
value = {(k.decode("utf-8")
3109
if isinstance(k, bytes) else k): v
3111
clients_data[key].items()}
3068
value = { (k.decode("utf-8")
3069
if isinstance(k, bytes) else k): v
3071
clients_data[key].items() }
3112
3072
clients_data[key] = value
3113
3073
# .client_structure
3114
3074
value["client_structure"] = [
3115
3075
(s.decode("utf-8")
3116
3076
if isinstance(s, bytes)
3117
3077
else s) for s in
3118
value["client_structure"]]
3078
value["client_structure"] ]
3119
3079
# .name & .host
3120
3080
for k in ("name", "host"):
3121
3081
if isinstance(value[k], bytes):
3122
3082
value[k] = value[k].decode("utf-8")
3123
# old_client_settings
3083
## old_client_settings
3125
3085
old_client_settings = {
3126
3086
(key.decode("utf-8")
3127
3087
if isinstance(key, bytes)
3128
3088
else key): value
3129
3089
for key, value in
3130
bytes_old_client_settings.items()}
3090
bytes_old_client_settings.items() }
3131
3091
del bytes_old_client_settings
3133
3093
for value in old_client_settings.values():
3239
3199
pidfilename, pid)
3241
3201
del pidfilename
3243
3203
for termsig in (signal.SIGHUP, signal.SIGTERM):
3244
3204
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3245
3205
lambda: main_loop.quit() and False)
3249
3209
@alternate_dbus_interfaces(
3250
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3210
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3251
3211
class MandosDBusService(DBusObjectWithObjectManager):
3252
3212
"""A D-Bus proxy object"""
3254
3214
def __init__(self):
3255
3215
dbus.service.Object.__init__(self, bus, "/")
3257
3217
_interface = "se.recompile.Mandos"
3259
3219
@dbus.service.signal(_interface, signature="o")
3260
3220
def ClientAdded(self, objpath):
3264
3224
@dbus.service.signal(_interface, signature="ss")
3265
3225
def ClientNotFound(self, fingerprint, address):
3269
3229
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3271
3231
@dbus.service.signal(_interface, signature="os")
3272
3232
def ClientRemoved(self, objpath, name):
3276
3236
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3278
3238
@dbus.service.method(_interface, out_signature="ao")
3306
3266
self.client_removed_signal(c)
3308
3268
raise KeyError(object_path)
3312
3272
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3313
out_signature="a{oa{sa{sv}}}")
3273
out_signature = "a{oa{sa{sv}}}")
3314
3274
def GetManagedObjects(self):
3315
3275
"""D-Bus method"""
3316
3276
return dbus.Dictionary(
3317
{client.dbus_object_path:
3319
{interface: client.GetAll(interface)
3321
client._get_all_interface_names()})
3322
for client in tcp_server.clients.values()})
3277
{ client.dbus_object_path:
3279
{ interface: client.GetAll(interface)
3281
client._get_all_interface_names()})
3282
for client in tcp_server.clients.values()})
3324
3284
def client_added_signal(self, client):
3325
3285
"""Send the new standard signal and the old signal"""
3372
3327
client.encrypted_secret = pgp.encrypt(client.secret,
3374
3329
client_dict = {}
3376
3331
# A list of attributes that can not be pickled
3378
exclude = {"bus", "changedstate", "secret",
3379
"checker", "server_settings"}
3333
exclude = { "bus", "changedstate", "secret",
3334
"checker", "server_settings" }
3380
3335
for name, typ in inspect.getmembers(dbus.service
3382
3337
exclude.add(name)
3384
3339
client_dict["encrypted_secret"] = (client
3385
3340
.encrypted_secret)
3386
3341
for attr in client.client_structure:
3387
3342
if attr not in exclude:
3388
3343
client_dict[attr] = getattr(client, attr)
3390
3345
clients[client.name] = client_dict
3391
3346
del client_settings[client.name]["secret"]
3394
3349
with tempfile.NamedTemporaryFile(