/mandos/release : revision 237.7.433

1

#!/usr/bin/python3 -bI

2

# -*- coding: utf-8; lexical-binding: t -*-

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

31

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

39

except ImportError:

40

pass

41

42

import sys

43

import unittest

44

import argparse

45

import logging

46

import os

47

42

try:

48

43

import SocketServer as socketserver

49

44

except ImportError:

50

45

import socketserver

51

46

import socket

47

import argparse

52

48

import datetime

53

49

import errno

54

50

try:

55

51

import ConfigParser as configparser

56

52

except ImportError:

57

53

import configparser

54

import sys

58

55

import re

56

import os

59

57

import signal

60

58

import subprocess

61

59

import atexit

62

60

import stat

61

import logging

63

62

import logging.handlers

64

63

import pwd

65

64

import contextlib

77

76

import itertools

78

77

import collections

79

78

import codecs

80

import random

81

import shlex

82

79

83

80

import dbus

84

81

import dbus.service

85

import gi

86

82

from gi.repository import GLib

87

83

from dbus.mainloop.glib import DBusGMainLoop

88

84

import ctypes

90

86

import xml.dom.minidom

91

87

import inspect

92

88

93

if sys.version_info.major == 2:

94

__metaclass__ = type

95

str = unicode

96

input = raw_input

97

98

# Add collections.abc.Callable if it does not exist

99

try:

100

collections.abc.Callable

101

except AttributeError:

102

class abc:

103

Callable = collections.Callable

104

collections.abc = abc

105

del abc

106

107

# Add shlex.quote if it does not exist

108

try:

109

shlex.quote

110

except AttributeError:

111

shlex.quote = re.escape

112

113

# Add os.set_inheritable if it does not exist

114

try:

115

os.set_inheritable

116

except AttributeError:

117

def set_inheritable(fd, inheritable):

118

flags = fcntl.fcntl(fd, fcntl.F_GETFD)

119

if inheritable and ((flags & fcntl.FD_CLOEXEC) != 0):

120

fcntl.fcntl(fd, fcntl.F_SETFL, flags & ~fcntl.FD_CLOEXEC)

121

elif (not inheritable) and ((flags & fcntl.FD_CLOEXEC) == 0):

122

fcntl.fcntl(fd, fcntl.F_SETFL, flags | fcntl.FD_CLOEXEC)

123

os.set_inheritable = set_inheritable

124

del set_inheritable

125

126

# Show warnings by default

127

if not sys.warnoptions:

128

import warnings

129

warnings.simplefilter("default")

130

131

89

# Try to find the value of SO_BINDTODEVICE:

132

90

try:

133

91

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

153

111

# No value found

154

112

SO_BINDTODEVICE = None

155

113

156

if sys.version_info < (3, 2):

157

configparser.Configparser = configparser.SafeConfigParser

114

if sys.version_info.major == 2:

115

str = unicode

158

116

159

version = "1.8.17"

117

version = "1.7.13"

160

118

stored_state_file = "clients.pickle"

161

119

162

log = logging.getLogger(os.path.basename(sys.argv[0]))

163

logging.captureWarnings(True) # Show warnings via the logging system

120

logger = logging.getLogger()

164

121

syslogger = None

165

122

166

123

try:

202

159

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

203

160

address="/dev/log"))

204

161

syslogger.setFormatter(logging.Formatter

205

("Mandos [%(process)d]: %(levelname)s:"

206

" %(message)s"))

207

log.addHandler(syslogger)

162

('Mandos [%(process)d]: %(levelname)s:'

163

' %(message)s'))

164

logger.addHandler(syslogger)

208

165

209

166

if debug:

210

167

console = logging.StreamHandler()

211

console.setFormatter(logging.Formatter("%(asctime)s %(name)s"

212

" [%(process)d]:"

213

" %(levelname)s:"

214

" %(message)s"))

215

log.addHandler(console)

216

log.setLevel(level)

168

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

169

' [%(process)d]:'

170

' %(levelname)s:'

171

' %(message)s'))

172

logger.addHandler(console)

173

logger.setLevel(level)

217

174

218

175

219

176

class PGPError(Exception):

221

178

pass

222

179

223

180

224

class PGPEngine:

181

class PGPEngine(object):

225

182

"""A simple class for OpenPGP symmetric encryption & decryption"""

226

183

227

184

def __init__(self):

231

188

output = subprocess.check_output(["gpgconf"])

232

189

for line in output.splitlines():

233

190

name, text, path = line.split(b":")

234

if name == b"gpg":

191

if name == "gpg":

235

192

self.gpg = path

236

193

break

237

194

except OSError as e:

238

195

if e.errno != errno.ENOENT:

239

196

raise

240

self.gnupgargs = ["--batch",

241

"--homedir", self.tempdir,

242

"--force-mdc",

243

"--quiet"]

197

self.gnupgargs = ['--batch',

198

'--homedir', self.tempdir,

199

'--force-mdc',

200

'--quiet']

244

201

# Only GPG version 1 has the --no-use-agent option.

245

if self.gpg == b"gpg" or self.gpg.endswith(b"/gpg"):

202

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

246

203

self.gnupgargs.append("--no-use-agent")

247

204

248

205

def __enter__(self):

285

242

dir=self.tempdir) as passfile:

286

243

passfile.write(passphrase)

287

244

passfile.flush()

288

proc = subprocess.Popen([self.gpg, "--symmetric",

289

"--passphrase-file",

245

proc = subprocess.Popen([self.gpg, '--symmetric',

246

'--passphrase-file',

290

247

passfile.name]

291

248

+ self.gnupgargs,

292

249

stdin=subprocess.PIPE,

303

260

dir=self.tempdir) as passfile:

304

261

passfile.write(passphrase)

305

262

passfile.flush()

306

proc = subprocess.Popen([self.gpg, "--decrypt",

307

"--passphrase-file",

263

proc = subprocess.Popen([self.gpg, '--decrypt',

264

'--passphrase-file',

308

265

passfile.name]

309

266

+ self.gnupgargs,

310

267

stdin=subprocess.PIPE,

317

274

318

275

319

276

# Pretend that we have an Avahi module

320

class avahi:

321

"""This isn't so much a class as it is a module-like namespace."""

277

class Avahi(object):

278

"""This isn't so much a class as it is a module-like namespace.

279

It is instantiated once, and simulates having an Avahi module."""

322

280

IF_UNSPEC = -1 # avahi-common/address.h

323

281

PROTO_UNSPEC = -1 # avahi-common/address.h

324

282

PROTO_INET = 0 # avahi-common/address.h

328

286

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

329

287

DBUS_PATH_SERVER = "/"

330

288

331

@staticmethod

332

def string_array_to_txt_array(t):

289

def string_array_to_txt_array(self, t):

333

290

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

334

291

for s in t), signature="ay")

335

292

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

340

297

SERVER_RUNNING = 2 # avahi-common/defs.h

341

298

SERVER_COLLISION = 3 # avahi-common/defs.h

342

299

SERVER_FAILURE = 4 # avahi-common/defs.h

300

avahi = Avahi()

343

301

344

302

345

303

class AvahiError(Exception):

357

315

pass

358

316

359

317

360

class AvahiService:

318

class AvahiService(object):

361

319

"""An Avahi (Zeroconf) service.

362

320

363

321

Attributes:

364

322

interface: integer; avahi.IF_UNSPEC or an interface index.

365

323

Used to optionally bind to the specified interface.

366

name: string; Example: "Mandos"

367

type: string; Example: "_mandos._tcp".

324

name: string; Example: 'Mandos'

325

type: string; Example: '_mandos._tcp'.

368

326

See <https://www.iana.org/assignments/service-names-port-numbers>

369

327

port: integer; what port to announce

370

328

TXT: list of strings; TXT record for the service

407

365

def rename(self, remove=True):

408

366

"""Derived from the Avahi example code"""

409

367

if self.rename_count >= self.max_renames:

410

log.critical("No suitable Zeroconf service name found"

411

" after %i retries, exiting.",

412

self.rename_count)

368

logger.critical("No suitable Zeroconf service name found"

369

" after %i retries, exiting.",

370

self.rename_count)

413

371

raise AvahiServiceError("Too many renames")

414

372

self.name = str(

415

373

self.server.GetAlternativeServiceName(self.name))

416

374

self.rename_count += 1

417

log.info("Changing Zeroconf service name to %r ...",

418

self.name)

375

logger.info("Changing Zeroconf service name to %r ...",

376

self.name)

419

377

if remove:

420

378

self.remove()

421

379

try:

423

381

except dbus.exceptions.DBusException as error:

424

382

if (error.get_dbus_name()

425

383

== "org.freedesktop.Avahi.CollisionError"):

426

log.info("Local Zeroconf service name collision.")

384

logger.info("Local Zeroconf service name collision.")

427

385

return self.rename(remove=False)

428

386

else:

429

log.critical("D-Bus Exception", exc_info=error)

387

logger.critical("D-Bus Exception", exc_info=error)

430

388

self.cleanup()

431

389

os._exit(1)

432

390

448

406

avahi.DBUS_INTERFACE_ENTRY_GROUP)

449

407

self.entry_group_state_changed_match = (

450

408

self.group.connect_to_signal(

451

"StateChanged", self.entry_group_state_changed))

452

log.debug("Adding Zeroconf service '%s' of type '%s' ...",

453

self.name, self.type)

409

'StateChanged', self.entry_group_state_changed))

410

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

411

self.name, self.type)

454

412

self.group.AddService(

455

413

self.interface,

456

414

self.protocol,

463

421

464

422

def entry_group_state_changed(self, state, error):

465

423

"""Derived from the Avahi example code"""

466

log.debug("Avahi entry group state change: %i", state)

424

logger.debug("Avahi entry group state change: %i", state)

467

425

468

426

if state == avahi.ENTRY_GROUP_ESTABLISHED:

469

log.debug("Zeroconf service established.")

427

logger.debug("Zeroconf service established.")

470

428

elif state == avahi.ENTRY_GROUP_COLLISION:

471

log.info("Zeroconf service name collision.")

429

logger.info("Zeroconf service name collision.")

472

430

self.rename()

473

431

elif state == avahi.ENTRY_GROUP_FAILURE:

474

log.critical("Avahi: Error in group state changed %s",

475

str(error))

432

logger.critical("Avahi: Error in group state changed %s",

433

str(error))

476

434

raise AvahiGroupError("State changed: {!s}".format(error))

477

435

478

436

def cleanup(self):

488

446

489

447

def server_state_changed(self, state, error=None):

490

448

"""Derived from the Avahi example code"""

491

log.debug("Avahi server state change: %i", state)

449

logger.debug("Avahi server state change: %i", state)

492

450

bad_states = {

493

451

avahi.SERVER_INVALID: "Zeroconf server invalid",

494

452

avahi.SERVER_REGISTERING: None,

498

456

if state in bad_states:

499

457

if bad_states[state] is not None:

500

458

if error is None:

501

log.error(bad_states[state])

459

logger.error(bad_states[state])

502

460

else:

503

log.error(bad_states[state] + ": %r", error)

461

logger.error(bad_states[state] + ": %r", error)

504

462

self.cleanup()

505

463

elif state == avahi.SERVER_RUNNING:

506

464

try:

508

466

except dbus.exceptions.DBusException as error:

509

467

if (error.get_dbus_name()

510

468

== "org.freedesktop.Avahi.CollisionError"):

511

log.info("Local Zeroconf service name collision.")

469

logger.info("Local Zeroconf service name"

470

" collision.")

512

471

return self.rename(remove=False)

513

472

else:

514

log.critical("D-Bus Exception", exc_info=error)

473

logger.critical("D-Bus Exception", exc_info=error)

515

474

self.cleanup()

516

475

os._exit(1)

517

476

else:

518

477

if error is None:

519

log.debug("Unknown state: %r", state)

478

logger.debug("Unknown state: %r", state)

520

479

else:

521

log.debug("Unknown state: %r: %r", state, error)

480

logger.debug("Unknown state: %r: %r", state, error)

522

481

523

482

def activate(self):

524

483

"""Derived from the Avahi example code"""

536

495

class AvahiServiceToSyslog(AvahiService):

537

496

def rename(self, *args, **kwargs):

538

497

"""Add the new name to the syslog messages"""

539

ret = super(AvahiServiceToSyslog, self).rename(*args,

540

**kwargs)

498

ret = AvahiService.rename(self, *args, **kwargs)

541

499

syslogger.setFormatter(logging.Formatter(

542

"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"

500

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

543

501

.format(self.name)))

544

502

return ret

545

503

546

504

547

505

# Pretend that we have a GnuTLS module

548

class gnutls:

549

"""This isn't so much a class as it is a module-like namespace."""

506

class GnuTLS(object):

507

"""This isn't so much a class as it is a module-like namespace.

508

It is instantiated once, and simulates having a GnuTLS module."""

550

509

551

510

library = ctypes.util.find_library("gnutls")

552

511

if library is None:

553

512

library = ctypes.util.find_library("gnutls-deb0")

554

513

_library = ctypes.cdll.LoadLibrary(library)

555

514

del library

515

_need_version = b"3.3.0"

516

517

def __init__(self):

518

# Need to use "self" here, since this method is called before

519

# the assignment to the "gnutls" global variable happens.

520

if self.check_version(self._need_version) is None:

521

raise self.Error("Needs GnuTLS {} or later"

522

.format(self._need_version))

556

523

557

524

# Unless otherwise indicated, the constants and types below are

558

525

# all from the gnutls/gnutls.h C header file.

562

529

E_INTERRUPTED = -52

563

530

E_AGAIN = -28

564

531

CRT_OPENPGP = 2

565

CRT_RAWPK = 3

566

532

CLIENT = 2

567

533

SHUT_RDWR = 0

568

534

CRD_CERTIFICATE = 1

569

535

E_NO_CERTIFICATE_FOUND = -49

570

X509_FMT_DER = 0

571

NO_TICKETS = 1<<10

572

ENABLE_RAWPK = 1<<18

573

CTYPE_PEERS = 3

574

KEYID_USE_SHA256 = 1 # gnutls/x509.h

575

536

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

576

537

577

538

# Types

578

class _session_int(ctypes.Structure):

539

class session_int(ctypes.Structure):

579

540

_fields_ = []

580

session_t = ctypes.POINTER(_session_int)

541

session_t = ctypes.POINTER(session_int)

581

542

582

543

class certificate_credentials_st(ctypes.Structure):

583

544

_fields_ = []

586

547

certificate_type_t = ctypes.c_int

587

548

588

549

class datum_t(ctypes.Structure):

589

_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),

590

("size", ctypes.c_uint)]

550

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

551

('size', ctypes.c_uint)]

591

552

592

class _openpgp_crt_int(ctypes.Structure):

553

class openpgp_crt_int(ctypes.Structure):

593

554

_fields_ = []

594

openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)

555

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

595

556

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

596

557

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

597

558

credentials_type_t = ctypes.c_int

600

561

601

562

# Exceptions

602

563

class Error(Exception):

564

# We need to use the class name "GnuTLS" here, since this

565

# exception might be raised from within GnuTLS.__init__,

566

# which is called before the assignment to the "gnutls"

567

# global variable has happened.

603

568

def __init__(self, message=None, code=None, args=()):

604

569

# Default usage is by a message string, but if a return

605

570

# code is passed, convert it to a string with

606

571

# gnutls.strerror()

607

572

self.code = code

608

573

if message is None and code is not None:

609

message = gnutls.strerror(code).decode(

610

"utf-8", errors="replace")

611

return super(gnutls.Error, self).__init__(

574

message = GnuTLS.strerror(code)

575

return super(GnuTLS.Error, self).__init__(

612

576

message, *args)

613

577

614

578

class CertificateSecurityError(Error):

615

579

pass

616

580

617

class PointerTo:

618

def __init__(self, cls):

619

self.cls = cls

620

621

def from_param(self, obj):

622

if not isinstance(obj, self.cls):

623

raise TypeError("Not of type {}: {!r}"

624

.format(self.cls.__name__, obj))

625

return ctypes.byref(obj.from_param(obj))

626

627

class CastToVoidPointer:

628

def __init__(self, cls):

629

self.cls = cls

630

631

def from_param(self, obj):

632

if not isinstance(obj, self.cls):

633

raise TypeError("Not of type {}: {!r}"

634

.format(self.cls.__name__, obj))

635

return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)

636

637

class With_from_param:

638

@classmethod

639

def from_param(cls, obj):

640

return obj._as_parameter_

641

642

581

# Classes

643

class Credentials(With_from_param):

582

class Credentials(object):

644

583

def __init__(self):

645

self._as_parameter_ = gnutls.certificate_credentials_t()

646

gnutls.certificate_allocate_credentials(self)

584

self._c_object = gnutls.certificate_credentials_t()

585

gnutls.certificate_allocate_credentials(

586

ctypes.byref(self._c_object))

647

587

self.type = gnutls.CRD_CERTIFICATE

648

588

649

589

def __del__(self):

650

gnutls.certificate_free_credentials(self)

590

gnutls.certificate_free_credentials(self._c_object)

651

591

652

class ClientSession(With_from_param):

592

class ClientSession(object):

653

593

def __init__(self, socket, credentials=None):

654

self._as_parameter_ = gnutls.session_t()

655

gnutls_flags = gnutls.CLIENT

656

if gnutls.check_version(b"3.5.6"):

657

gnutls_flags |= gnutls.NO_TICKETS

658

if gnutls.has_rawpk:

659

gnutls_flags |= gnutls.ENABLE_RAWPK

660

gnutls.init(self, gnutls_flags)

661

del gnutls_flags

662

gnutls.set_default_priority(self)

663

gnutls.transport_set_ptr(self, socket.fileno())

664

gnutls.handshake_set_private_extensions(self, True)

594

self._c_object = gnutls.session_t()

595

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

596

gnutls.set_default_priority(self._c_object)

597

gnutls.transport_set_ptr(self._c_object, socket.fileno())

598

gnutls.handshake_set_private_extensions(self._c_object,

599

True)

665

600

self.socket = socket

666

601

if credentials is None:

667

602

credentials = gnutls.Credentials()

668

gnutls.credentials_set(self, credentials.type,

669

credentials)

603

gnutls.credentials_set(self._c_object, credentials.type,

604

ctypes.cast(credentials._c_object,

605

ctypes.c_void_p))

670

606

self.credentials = credentials

671

607

672

608

def __del__(self):

673

gnutls.deinit(self)

609

gnutls.deinit(self._c_object)

674

610

675

611

def handshake(self):

676

return gnutls.handshake(self)

612

return gnutls.handshake(self._c_object)

677

613

678

614

def send(self, data):

679

615

data = bytes(data)

680

616

data_len = len(data)

681

617

while data_len > 0:

682

data_len -= gnutls.record_send(self, data[-data_len:],

618

data_len -= gnutls.record_send(self._c_object,

619

data[-data_len:],

683

620

data_len)

684

621

685

622

def bye(self):

686

return gnutls.bye(self, gnutls.SHUT_RDWR)

623

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

687

624

688

625

# Error handling functions

689

626

def _error_code(result):

690

627

"""A function to raise exceptions on errors, suitable

691

for the "restype" attribute on ctypes functions"""

692

if result >= gnutls.E_SUCCESS:

628

for the 'restype' attribute on ctypes functions"""

629

if result >= 0:

693

630

return result

694

631

if result == gnutls.E_NO_CERTIFICATE_FOUND:

695

632

raise gnutls.CertificateSecurityError(code=result)

696

633

raise gnutls.Error(code=result)

697

634

698

def _retry_on_error(result, func, arguments,

699

_error_code=_error_code):

635

def _retry_on_error(result, func, arguments):

700

636

"""A function to retry on some errors, suitable

701

for the "errcheck" attribute on ctypes functions"""

702

while result < gnutls.E_SUCCESS:

637

for the 'errcheck' attribute on ctypes functions"""

638

while result < 0:

703

639

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

704

640

return _error_code(result)

705

641

result = func(*arguments)

710

646

711

647

# Functions

712

648

priority_set_direct = _library.gnutls_priority_set_direct

713

priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,

649

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

714

650

ctypes.POINTER(ctypes.c_char_p)]

715

651

priority_set_direct.restype = _error_code

716

652

717

653

init = _library.gnutls_init

718

init.argtypes = [PointerTo(ClientSession), ctypes.c_int]

654

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

719

655

init.restype = _error_code

720

656

721

657

set_default_priority = _library.gnutls_set_default_priority

722

set_default_priority.argtypes = [ClientSession]

658

set_default_priority.argtypes = [session_t]

723

659

set_default_priority.restype = _error_code

724

660

725

661

record_send = _library.gnutls_record_send

726

record_send.argtypes = [ClientSession, ctypes.c_void_p,

662

record_send.argtypes = [session_t, ctypes.c_void_p,

727

663

ctypes.c_size_t]

728

664

record_send.restype = ctypes.c_ssize_t

729

665

record_send.errcheck = _retry_on_error

731

667

certificate_allocate_credentials = (

732

668

_library.gnutls_certificate_allocate_credentials)

733

669

certificate_allocate_credentials.argtypes = [

734

PointerTo(Credentials)]

670

ctypes.POINTER(certificate_credentials_t)]

735

671

certificate_allocate_credentials.restype = _error_code

736

672

737

673

certificate_free_credentials = (

738

674

_library.gnutls_certificate_free_credentials)

739

certificate_free_credentials.argtypes = [Credentials]

675

certificate_free_credentials.argtypes = [

676

certificate_credentials_t]

740

677

certificate_free_credentials.restype = None

741

678

742

679

handshake_set_private_extensions = (

743

680

_library.gnutls_handshake_set_private_extensions)

744

handshake_set_private_extensions.argtypes = [ClientSession,

681

handshake_set_private_extensions.argtypes = [session_t,

745

682

ctypes.c_int]

746

683

handshake_set_private_extensions.restype = None

747

684

748

685

credentials_set = _library.gnutls_credentials_set

749

credentials_set.argtypes = [ClientSession, credentials_type_t,

750

CastToVoidPointer(Credentials)]

686

credentials_set.argtypes = [session_t, credentials_type_t,

687

ctypes.c_void_p]

751

688

credentials_set.restype = _error_code

752

689

753

690

strerror = _library.gnutls_strerror

755

692

strerror.restype = ctypes.c_char_p

756

693

757

694

certificate_type_get = _library.gnutls_certificate_type_get

758

certificate_type_get.argtypes = [ClientSession]

695

certificate_type_get.argtypes = [session_t]

759

696

certificate_type_get.restype = _error_code

760

697

761

698

certificate_get_peers = _library.gnutls_certificate_get_peers

762

certificate_get_peers.argtypes = [ClientSession,

699

certificate_get_peers.argtypes = [session_t,

763

700

ctypes.POINTER(ctypes.c_uint)]

764

701

certificate_get_peers.restype = ctypes.POINTER(datum_t)

765

702

772

709

global_set_log_function.restype = None

773

710

774

711

deinit = _library.gnutls_deinit

775

deinit.argtypes = [ClientSession]

712

deinit.argtypes = [session_t]

776

713

deinit.restype = None

777

714

778

715

handshake = _library.gnutls_handshake

779

handshake.argtypes = [ClientSession]

780

handshake.restype = ctypes.c_int

716

handshake.argtypes = [session_t]

717

handshake.restype = _error_code

781

718

handshake.errcheck = _retry_on_error

782

719

783

720

transport_set_ptr = _library.gnutls_transport_set_ptr

784

transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]

721

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

785

722

transport_set_ptr.restype = None

786

723

787

724

bye = _library.gnutls_bye

788

bye.argtypes = [ClientSession, close_request_t]

789

bye.restype = ctypes.c_int

725

bye.argtypes = [session_t, close_request_t]

726

bye.restype = _error_code

790

727

bye.errcheck = _retry_on_error

791

728

792

729

check_version = _library.gnutls_check_version

793

730

check_version.argtypes = [ctypes.c_char_p]

794

731

check_version.restype = ctypes.c_char_p

795

732

796

_need_version = b"3.3.0"

797

if check_version(_need_version) is None:

798

raise self.Error("Needs GnuTLS {} or later"

799

.format(_need_version))

800

801

_tls_rawpk_version = b"3.6.6"

802

has_rawpk = bool(check_version(_tls_rawpk_version))

803

804

if has_rawpk:

805

# Types

806

class pubkey_st(ctypes.Structure):

807

_fields = []

808

pubkey_t = ctypes.POINTER(pubkey_st)

809

810

x509_crt_fmt_t = ctypes.c_int

811

812

# All the function declarations below are from

813

# gnutls/abstract.h

814

pubkey_init = _library.gnutls_pubkey_init

815

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

816

pubkey_init.restype = _error_code

817

818

pubkey_import = _library.gnutls_pubkey_import

819

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

820

x509_crt_fmt_t]

821

pubkey_import.restype = _error_code

822

823

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

824

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

825

ctypes.POINTER(ctypes.c_ubyte),

826

ctypes.POINTER(ctypes.c_size_t)]

827

pubkey_get_key_id.restype = _error_code

828

829

pubkey_deinit = _library.gnutls_pubkey_deinit

830

pubkey_deinit.argtypes = [pubkey_t]

831

pubkey_deinit.restype = None

832

else:

833

# All the function declarations below are from

834

# gnutls/openpgp.h

835

836

openpgp_crt_init = _library.gnutls_openpgp_crt_init

837

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

838

openpgp_crt_init.restype = _error_code

839

840

openpgp_crt_import = _library.gnutls_openpgp_crt_import

841

openpgp_crt_import.argtypes = [openpgp_crt_t,

842

ctypes.POINTER(datum_t),

843

openpgp_crt_fmt_t]

844

openpgp_crt_import.restype = _error_code

845

846

openpgp_crt_verify_self = \

847

_library.gnutls_openpgp_crt_verify_self

848

openpgp_crt_verify_self.argtypes = [

849

openpgp_crt_t,

850

ctypes.c_uint,

851

ctypes.POINTER(ctypes.c_uint),

852

]

853

openpgp_crt_verify_self.restype = _error_code

854

855

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

856

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

857

openpgp_crt_deinit.restype = None

858

859

openpgp_crt_get_fingerprint = (

860

_library.gnutls_openpgp_crt_get_fingerprint)

861

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

862

ctypes.c_void_p,

863

ctypes.POINTER(

864

ctypes.c_size_t)]

865

openpgp_crt_get_fingerprint.restype = _error_code

866

867

if check_version(b"3.6.4"):

868

certificate_type_get2 = _library.gnutls_certificate_type_get2

869

certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]

870

certificate_type_get2.restype = _error_code

733

# All the function declarations below are from gnutls/openpgp.h

734

735

openpgp_crt_init = _library.gnutls_openpgp_crt_init

736

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

737

openpgp_crt_init.restype = _error_code

738

739

openpgp_crt_import = _library.gnutls_openpgp_crt_import

740

openpgp_crt_import.argtypes = [openpgp_crt_t,

741

ctypes.POINTER(datum_t),

742

openpgp_crt_fmt_t]

743

openpgp_crt_import.restype = _error_code

744

745

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

746

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

747

ctypes.POINTER(ctypes.c_uint)]

748

openpgp_crt_verify_self.restype = _error_code

749

750

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

751

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

752

openpgp_crt_deinit.restype = None

753

754

openpgp_crt_get_fingerprint = (

755

_library.gnutls_openpgp_crt_get_fingerprint)

756

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

757

ctypes.c_void_p,

758

ctypes.POINTER(

759

ctypes.c_size_t)]

760

openpgp_crt_get_fingerprint.restype = _error_code

871

761

872

762

# Remove non-public functions

873

763

del _error_code, _retry_on_error

764

# Create the global "gnutls" object, simulating a module

765

gnutls = GnuTLS()

874

766

875

767

876

768

def call_pipe(connection, # : multiprocessing.Connection

884

776

connection.close()

885

777

886

778

887

class Client:

779

class Client(object):

888

780

"""A representation of a client host served by this server.

889

781

890

782

Attributes:

891

approved: bool(); None if not yet approved/disapproved

783

approved: bool(); 'None' if not yet approved/disapproved

892

784

approval_delay: datetime.timedelta(); Time to wait for approval

893

785

approval_duration: datetime.timedelta(); Duration of one approval

894

checker: multiprocessing.Process(); a running checker process used

895

to see if the client lives. None if no process is

896

running.

786

checker: subprocess.Popen(); a running checker process used

787

to see if the client lives.

788

'None' if no process is running.

897

789

checker_callback_tag: a GLib event source tag, or None

898

790

checker_command: string; External command which is run to check

899

791

if client lives. %() expansions are done at

907

799

disable_initiator_tag: a GLib event source tag, or None

908

800

enabled: bool()

909

801

fingerprint: string (40 or 32 hexadecimal digits); used to

910

uniquely identify an OpenPGP client

911

key_id: string (64 hexadecimal digits); used to uniquely identify

912

a client using raw public keys

802

uniquely identify the client

913

803

host: string; available for use by the checker command

914

804

interval: datetime.timedelta(); How often to start a new checker

915

805

last_approval_request: datetime.datetime(); (UTC) or None

933

823

"""

934

824

935

825

runtime_expansions = ("approval_delay", "approval_duration",

936

"created", "enabled", "expires", "key_id",

826

"created", "enabled", "expires",

937

827

"fingerprint", "host", "interval",

938

828

"last_approval_request", "last_checked_ok",

939

829

"last_enabled", "name", "timeout")

969

859

client["enabled"] = config.getboolean(client_name,

970

860

"enabled")

971

861

972

# Uppercase and remove spaces from key_id and fingerprint

973

# for later comparison purposes with return value from the

974

# key_id() and fingerprint() functions

975

client["key_id"] = (section.get("key_id", "").upper()

976

.replace(" ", ""))

977

client["fingerprint"] = (section.get("fingerprint",

978

"").upper()

862

# Uppercase and remove spaces from fingerprint for later

863

# comparison purposes with return value from the

864

# fingerprint() function

865

client["fingerprint"] = (section["fingerprint"].upper()

979

866

.replace(" ", ""))

980

if not (client["key_id"] or client["fingerprint"]):

981

log.error("Skipping client %s without key_id or"

982

" fingerprint", client_name)

983

del settings[client_name]

984

continue

985

867

if "secret" in section:

986

868

client["secret"] = codecs.decode(section["secret"]

987

869

.encode("utf-8"),

1028

910

self.last_enabled = None

1029

911

self.expires = None

1030

912

1031

log.debug("Creating client %r", self.name)

1032

log.debug(" Key ID: %s", self.key_id)

1033

log.debug(" Fingerprint: %s", self.fingerprint)

913

logger.debug("Creating client %r", self.name)

914

logger.debug(" Fingerprint: %s", self.fingerprint)

1034

915

self.created = settings.get("created",

1035

916

datetime.datetime.utcnow())

1036

917

1064

945

if getattr(self, "enabled", False):

1065

946

# Already enabled

1066

947

return

948

self.expires = datetime.datetime.utcnow() + self.timeout

1067

949

self.enabled = True

1068

950

self.last_enabled = datetime.datetime.utcnow()

1069

951

self.init_checker()

1074

956

if not getattr(self, "enabled", False):

1075

957

return False

1076

958

if not quiet:

1077

log.info("Disabling client %s", self.name)

959

logger.info("Disabling client %s", self.name)

1078

960

if getattr(self, "disable_initiator_tag", None) is not None:

1079

961

GLib.source_remove(self.disable_initiator_tag)

1080

962

self.disable_initiator_tag = None

1092

974

def __del__(self):

1093

975

self.disable()

1094

976

1095

def init_checker(self, randomize_start=False):

1096

# Schedule a new checker to be started a randomly selected

1097

# time (a fraction of 'interval') from now. This spreads out

1098

# the startup of checkers over time when the server is

1099

# started.

977

def init_checker(self):

978

# Schedule a new checker to be started an 'interval' from now,

979

# and every interval from then on.

1100

980

if self.checker_initiator_tag is not None:

1101

981

GLib.source_remove(self.checker_initiator_tag)

1102

interval_milliseconds = int(self.interval.total_seconds()

1103

* 1000)

1104

if randomize_start:

1105

delay_milliseconds = random.randrange(

1106

interval_milliseconds + 1)

1107

else:

1108

delay_milliseconds = interval_milliseconds

1109

982

self.checker_initiator_tag = GLib.timeout_add(

1110

delay_milliseconds, self.start_checker, randomize_start)

1111

delay = datetime.timedelta(0, 0, 0, delay_milliseconds)

1112

# A checker might take up to an 'interval' of time, so we can

1113

# expire at the soonest one interval after a checker was

1114

# started. Since the initial checker is delayed, the expire

1115

# time might have to be extended.

1116

now = datetime.datetime.utcnow()

1117

self.expires = now + delay + self.interval

1118

# Schedule a disable() at expire time

983

int(self.interval.total_seconds() * 1000),

984

self.start_checker)

985

# Schedule a disable() when 'timeout' has passed

1119

986

if self.disable_initiator_tag is not None:

1120

987

GLib.source_remove(self.disable_initiator_tag)

1121

988

self.disable_initiator_tag = GLib.timeout_add(

1122

int((self.expires - now).total_seconds() * 1000),

1123

self.disable)

989

int(self.timeout.total_seconds() * 1000), self.disable)

990

# Also start a new checker *right now*.

991

self.start_checker()

1124

992

1125

993

def checker_callback(self, source, condition, connection,

1126

994

command):

1127

995

"""The checker has completed, so take appropriate actions."""

996

self.checker_callback_tag = None

997

self.checker = None

1128

998

# Read return code from connection (see call_pipe)

1129

999

returncode = connection.recv()

1130

1000

connection.close()

1131

if self.checker is not None:

1132

self.checker.join()

1133

self.checker_callback_tag = None

1134

self.checker = None

1135

1001

1136

1002

if returncode >= 0:

1137

1003

self.last_checker_status = returncode

1138

1004

self.last_checker_signal = None

1139

1005

if self.last_checker_status == 0:

1140

log.info("Checker for %(name)s succeeded", vars(self))

1006

logger.info("Checker for %(name)s succeeded",

1007

vars(self))

1141

1008

self.checked_ok()

1142

1009

else:

1143

log.info("Checker for %(name)s failed", vars(self))

1010

logger.info("Checker for %(name)s failed", vars(self))

1144

1011

else:

1145

1012

self.last_checker_status = -1

1146

1013

self.last_checker_signal = -returncode

1147

log.warning("Checker for %(name)s crashed?", vars(self))

1014

logger.warning("Checker for %(name)s crashed?",

1015

vars(self))

1148

1016

return False

1149

1017

1150

1018

def checked_ok(self):

1169

1037

def need_approval(self):

1170

1038

self.last_approval_request = datetime.datetime.utcnow()

1171

1039

1172

def start_checker(self, start_was_randomized=False):

1040

def start_checker(self):

1173

1041

"""Start a new checker subprocess if one is not running.

1174

1042

1175

1043

If a checker already exists, leave it running and do

1184

1052

# should be.

1185

1053

1186

1054

if self.checker is not None and not self.checker.is_alive():

1187

log.warning("Checker was not alive; joining")

1055

logger.warning("Checker was not alive; joining")

1188

1056

self.checker.join()

1189

1057

self.checker = None

1190

1058

# Start a new checker if needed

1191

1059

if self.checker is None:

1192

1060

# Escape attributes for the shell

1193

1061

escaped_attrs = {

1194

attr: shlex.quote(str(getattr(self, attr)))

1062

attr: re.escape(str(getattr(self, attr)))

1195

1063

for attr in self.runtime_expansions}

1196

1064

try:

1197

1065

command = self.checker_command % escaped_attrs

1198

1066

except TypeError as error:

1199

log.error('Could not format string "%s"',

1200

self.checker_command, exc_info=error)

1067

logger.error('Could not format string "%s"',

1068

self.checker_command,

1069

exc_info=error)

1201

1070

return True # Try again later

1202

1071

self.current_checker_command = command

1203

log.info("Starting checker %r for %s", command, self.name)

1072

logger.info("Starting checker %r for %s", command,

1073

self.name)

1204

1074

# We don't need to redirect stdout and stderr, since

1205

1075

# in normal mode, that is already done by daemon(),

1206

1076

# and in debug mode we don't want to. (Stdin is

1222

1092

kwargs=popen_args)

1223

1093

self.checker.start()

1224

1094

self.checker_callback_tag = GLib.io_add_watch(

1225

GLib.IOChannel.unix_new(pipe[0].fileno()),

1226

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

1095

pipe[0].fileno(), GLib.IO_IN,

1227

1096

self.checker_callback, pipe[0], command)

1228

if start_was_randomized:

1229

# We were started after a random delay; Schedule a new

1230

# checker to be started an 'interval' from now, and every

1231

# interval from then on.

1232

now = datetime.datetime.utcnow()

1233

self.checker_initiator_tag = GLib.timeout_add(

1234

int(self.interval.total_seconds() * 1000),

1235

self.start_checker)

1236

self.expires = max(self.expires, now + self.interval)

1237

# Don't start a new checker again after same random delay

1238

return False

1239

1097

# Re-run this periodically if run by GLib.timeout_add

1240

1098

return True

1241

1099

1246

1104

self.checker_callback_tag = None

1247

1105

if getattr(self, "checker", None) is None:

1248

1106

return

1249

log.debug("Stopping checker for %(name)s", vars(self))

1107

logger.debug("Stopping checker for %(name)s", vars(self))

1250

1108

self.checker.terminate()

1251

1109

self.checker = None

1252

1110

1279

1137

func._dbus_name = func.__name__

1280

1138

if func._dbus_name.endswith("_dbus_property"):

1281

1139

func._dbus_name = func._dbus_name[:-14]

1282

func._dbus_get_args_options = {"byte_arrays": byte_arrays}

1140

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

1283

1141

return func

1284

1142

1285

1143

return decorator

1374

1232

1375

1233

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1376

1234

out_signature="s",

1377

path_keyword="object_path",

1378

connection_keyword="connection")

1235

path_keyword='object_path',

1236

connection_keyword='connection')

1379

1237

def Introspect(self, object_path, connection):

1380

1238

"""Overloading of standard D-Bus method.

1381

1239

1430

1288

document.unlink()

1431

1289

except (AttributeError, xml.dom.DOMException,

1432

1290

xml.parsers.expat.ExpatError) as error:

1433

log.error("Failed to override Introspection method",

1434

exc_info=error)

1291

logger.error("Failed to override Introspection method",

1292

exc_info=error)

1435

1293

return xmlstring

1436

1294

1437

1295

1495

1353

raise ValueError("Byte arrays not supported for non-"

1496

1354

"'ay' signature {!r}"

1497

1355

.format(prop._dbus_signature))

1498

value = dbus.ByteArray(bytes(value))

1356

value = dbus.ByteArray(b''.join(chr(byte)

1357

for byte in value))

1499

1358

prop(value)

1500

1359

1501

1360

@dbus.service.method(dbus.PROPERTIES_IFACE,

1534

1393

1535

1394

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1536

1395

out_signature="s",

1537

path_keyword="object_path",

1538

connection_keyword="connection")

1396

path_keyword='object_path',

1397

connection_keyword='connection')

1539

1398

def Introspect(self, object_path, connection):

1540

1399

"""Overloading of standard D-Bus method.

1541

1400

1597

1456

document.unlink()

1598

1457

except (AttributeError, xml.dom.DOMException,

1599

1458

xml.parsers.expat.ExpatError) as error:

1600

log.error("Failed to override Introspection method",

1601

exc_info=error)

1459

logger.error("Failed to override Introspection method",

1460

exc_info=error)

1602

1461

return xmlstring

1603

1462

1604

1605

1463

try:

1606

1464

dbus.OBJECT_MANAGER_IFACE

1607

1465

except AttributeError:

1636

1494

1637

1495

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1638

1496

out_signature="s",

1639

path_keyword="object_path",

1640

connection_keyword="connection")

1497

path_keyword='object_path',

1498

connection_keyword='connection')

1641

1499

def Introspect(self, object_path, connection):

1642

1500

"""Overloading of standard D-Bus method.

1643

1501

1668

1526

document.unlink()

1669

1527

except (AttributeError, xml.dom.DOMException,

1670

1528

xml.parsers.expat.ExpatError) as error:

1671

log.error("Failed to override Introspection method",

1672

exc_info=error)

1529

logger.error("Failed to override Introspection method",

1530

exc_info=error)

1673

1531

return xmlstring

1674

1532

1675

1533

2139

1997

def Name_dbus_property(self):

2140

1998

return dbus.String(self.name)

2141

1999

2142

# KeyID - property

2143

@dbus_annotations(

2144

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2145

@dbus_service_property(_interface, signature="s", access="read")

2146

def KeyID_dbus_property(self):

2147

return dbus.String(self.key_id)

2148

2149

2000

# Fingerprint - property

2150

2001

@dbus_annotations(

2151

2002

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2306

2157

del _interface

2307

2158

2308

2159

2309

class ProxyClient:

2310

def __init__(self, child_pipe, key_id, fpr, address):

2160

class ProxyClient(object):

2161

def __init__(self, child_pipe, fpr, address):

2311

2162

self._pipe = child_pipe

2312

self._pipe.send(("init", key_id, fpr, address))

2163

self._pipe.send(('init', fpr, address))

2313

2164

if not self._pipe.recv():

2314

raise KeyError(key_id or fpr)

2165

raise KeyError(fpr)

2315

2166

2316

2167

def __getattribute__(self, name):

2317

if name == "_pipe":

2168

if name == '_pipe':

2318

2169

return super(ProxyClient, self).__getattribute__(name)

2319

self._pipe.send(("getattr", name))

2170

self._pipe.send(('getattr', name))

2320

2171

data = self._pipe.recv()

2321

if data[0] == "data":

2172

if data[0] == 'data':

2322

2173

return data[1]

2323

if data[0] == "function":

2174

if data[0] == 'function':

2324

2175

2325

2176

def func(*args, **kwargs):

2326

self._pipe.send(("funcall", name, args, kwargs))

2177

self._pipe.send(('funcall', name, args, kwargs))

2327

2178

return self._pipe.recv()[1]

2328

2179

2329

2180

return func

2330

2181

2331

2182

def __setattr__(self, name, value):

2332

if name == "_pipe":

2183

if name == '_pipe':

2333

2184

return super(ProxyClient, self).__setattr__(name, value)

2334

self._pipe.send(("setattr", name, value))

2185

self._pipe.send(('setattr', name, value))

2335

2186

2336

2187

2337

2188

class ClientHandler(socketserver.BaseRequestHandler, object):

2342

2193

2343

2194

def handle(self):

2344

2195

with contextlib.closing(self.server.child_pipe) as child_pipe:

2345

log.info("TCP connection from: %s",

2346

str(self.client_address))

2347

log.debug("Pipe FD: %d", self.server.child_pipe.fileno())

2196

logger.info("TCP connection from: %s",

2197

str(self.client_address))

2198

logger.debug("Pipe FD: %d",

2199

self.server.child_pipe.fileno())

2348

2200

2349

2201

session = gnutls.ClientSession(self.request)

2350

2202

2351

# priority = ":".join(("NONE", "+VERS-TLS1.1",

2203

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2352

2204

# "+AES-256-CBC", "+SHA1",

2353

2205

# "+COMP-NULL", "+CTYPE-OPENPGP",

2354

2206

# "+DHE-DSS"))

2356

2208

priority = self.server.gnutls_priority

2357

2209

if priority is None:

2358

2210

priority = "NORMAL"

2359

gnutls.priority_set_direct(session,

2360

priority.encode("utf-8"), None)

2211

gnutls.priority_set_direct(session._c_object,

2212

priority.encode("utf-8"),

2213

None)

2361

2214

2362

2215

# Start communication using the Mandos protocol

2363

2216

# Get protocol number

2364

2217

line = self.request.makefile().readline()

2365

log.debug("Protocol version: %r", line)

2218

logger.debug("Protocol version: %r", line)

2366

2219

try:

2367

2220

if int(line.strip().split()[0]) > 1:

2368

2221

raise RuntimeError(line)

2369

2222

except (ValueError, IndexError, RuntimeError) as error:

2370

log.error("Unknown protocol version: %s", error)

2223

logger.error("Unknown protocol version: %s", error)

2371

2224

return

2372

2225

2373

2226

# Start GnuTLS connection

2374

2227

try:

2375

2228

session.handshake()

2376

2229

except gnutls.Error as error:

2377

log.warning("Handshake failed: %s", error)

2230

logger.warning("Handshake failed: %s", error)

2378

2231

# Do not run session.bye() here: the session is not

2379

2232

# established. Just abandon the request.

2380

2233

return

2381

log.debug("Handshake succeeded")

2234

logger.debug("Handshake succeeded")

2382

2235

2383

2236

approval_required = False

2384

2237

try:

2385

if gnutls.has_rawpk:

2386

fpr = b""

2387

try:

2388

key_id = self.key_id(

2389

self.peer_certificate(session))

2390

except (TypeError, gnutls.Error) as error:

2391

log.warning("Bad certificate: %s", error)

2392

return

2393

log.debug("Key ID: %s",

2394

key_id.decode("utf-8",

2395

errors="replace"))

2396

2397

else:

2398

key_id = b""

2399

try:

2400

fpr = self.fingerprint(

2401

self.peer_certificate(session))

2402

except (TypeError, gnutls.Error) as error:

2403

log.warning("Bad certificate: %s", error)

2404

return

2405

log.debug("Fingerprint: %s", fpr)

2406

2407

try:

2408

client = ProxyClient(child_pipe, key_id, fpr,

2238

try:

2239

fpr = self.fingerprint(

2240

self.peer_certificate(session))

2241

except (TypeError, gnutls.Error) as error:

2242

logger.warning("Bad certificate: %s", error)

2243

return

2244

logger.debug("Fingerprint: %s", fpr)

2245

2246

try:

2247

client = ProxyClient(child_pipe, fpr,

2409

2248

self.client_address)

2410

2249

except KeyError:

2411

2250

return

2417

2256

2418

2257

while True:

2419

2258

if not client.enabled:

2420

log.info("Client %s is disabled", client.name)

2259

logger.info("Client %s is disabled",

2260

client.name)

2421

2261

if self.server.use_dbus:

2422

2262

# Emit D-Bus signal

2423

2263

client.Rejected("Disabled")

2427

2267

# We are approved or approval is disabled

2428

2268

break

2429

2269

elif client.approved is None:

2430

log.info("Client %s needs approval",

2431

client.name)

2270

logger.info("Client %s needs approval",

2271

client.name)

2432

2272

if self.server.use_dbus:

2433

2273

# Emit D-Bus signal

2434

2274

client.NeedApproval(

2435

2275

client.approval_delay.total_seconds()

2436

2276

* 1000, client.approved_by_default)

2437

2277

else:

2438

log.warning("Client %s was not approved",

2439

client.name)

2278

logger.warning("Client %s was not approved",

2279

client.name)

2440

2280

if self.server.use_dbus:

2441

2281

# Emit D-Bus signal

2442

2282

client.Rejected("Denied")

2450

2290

time2 = datetime.datetime.now()

2451

2291

if (time2 - time) >= delay:

2452

2292

if not client.approved_by_default:

2453

log.warning("Client %s timed out while"

2454

" waiting for approval",

2455

client.name)

2293

logger.warning("Client %s timed out while"

2294

" waiting for approval",

2295

client.name)

2456

2296

if self.server.use_dbus:

2457

2297

# Emit D-Bus signal

2458

2298

client.Rejected("Approval timed out")

2465

2305

try:

2466

2306

session.send(client.secret)

2467

2307

except gnutls.Error as error:

2468

log.warning("gnutls send failed", exc_info=error)

2308

logger.warning("gnutls send failed",

2309

exc_info=error)

2469

2310

return

2470

2311

2471

log.info("Sending secret to %s", client.name)

2312

logger.info("Sending secret to %s", client.name)

2472

2313

# bump the timeout using extended_timeout

2473

2314

client.bump_timeout(client.extended_timeout)

2474

2315

if self.server.use_dbus:

2481

2322

try:

2482

2323

session.bye()

2483

2324

except gnutls.Error as error:

2484

log.warning("GnuTLS bye failed", exc_info=error)

2325

logger.warning("GnuTLS bye failed",

2326

exc_info=error)

2485

2327

2486

2328

@staticmethod

2487

2329

def peer_certificate(session):

2488

"Return the peer's certificate as a bytestring"

2489

try:

2490

cert_type = gnutls.certificate_type_get2(

2491

session, gnutls.CTYPE_PEERS)

2492

except AttributeError:

2493

cert_type = gnutls.certificate_type_get(session)

2494

if gnutls.has_rawpk:

2495

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2496

else:

2497

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2498

# If not a valid certificate type...

2499

if cert_type not in valid_cert_types:

2500

log.info("Cert type %r not in %r", cert_type,

2501

valid_cert_types)

2330

"Return the peer's OpenPGP certificate as a bytestring"

2331

# If not an OpenPGP certificate...

2332

if (gnutls.certificate_type_get(session._c_object)

2333

!= gnutls.CRT_OPENPGP):

2502

2334

# ...return invalid data

2503

2335

return b""

2504

2336

list_size = ctypes.c_uint(1)

2505

2337

cert_list = (gnutls.certificate_get_peers

2506

(session, ctypes.byref(list_size)))

2338

(session._c_object, ctypes.byref(list_size)))

2507

2339

if not bool(cert_list) and list_size.value != 0:

2508

2340

raise gnutls.Error("error getting peer certificate")

2509

2341

if list_size.value == 0:

2512

2344

return ctypes.string_at(cert.data, cert.size)

2513

2345

2514

2346

@staticmethod

2515

def key_id(certificate):

2516

"Convert a certificate bytestring to a hexdigit key ID"

2517

# New GnuTLS "datum" with the public key

2518

datum = gnutls.datum_t(

2519

ctypes.cast(ctypes.c_char_p(certificate),

2520

ctypes.POINTER(ctypes.c_ubyte)),

2521

ctypes.c_uint(len(certificate)))

2522

# XXX all these need to be created in the gnutls "module"

2523

# New empty GnuTLS certificate

2524

pubkey = gnutls.pubkey_t()

2525

gnutls.pubkey_init(ctypes.byref(pubkey))

2526

# Import the raw public key into the certificate

2527

gnutls.pubkey_import(pubkey,

2528

ctypes.byref(datum),

2529

gnutls.X509_FMT_DER)

2530

# New buffer for the key ID

2531

buf = ctypes.create_string_buffer(32)

2532

buf_len = ctypes.c_size_t(len(buf))

2533

# Get the key ID from the raw public key into the buffer

2534

gnutls.pubkey_get_key_id(

2535

pubkey,

2536

gnutls.KEYID_USE_SHA256,

2537

ctypes.cast(ctypes.byref(buf),

2538

ctypes.POINTER(ctypes.c_ubyte)),

2539

ctypes.byref(buf_len))

2540

# Deinit the certificate

2541

gnutls.pubkey_deinit(pubkey)

2542

2543

# Convert the buffer to a Python bytestring

2544

key_id = ctypes.string_at(buf, buf_len.value)

2545

# Convert the bytestring to hexadecimal notation

2546

hex_key_id = binascii.hexlify(key_id).upper()

2547

return hex_key_id

2548

2549

@staticmethod

2550

2347

def fingerprint(openpgp):

2551

2348

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2552

2349

# New GnuTLS "datum" with the OpenPGP public key

2566

2363

ctypes.byref(crtverify))

2567

2364

if crtverify.value != 0:

2568

2365

gnutls.openpgp_crt_deinit(crt)

2569

raise gnutls.CertificateSecurityError(code

2570

=crtverify.value)

2366

raise gnutls.CertificateSecurityError("Verify failed")

2571

2367

# New buffer for the fingerprint

2572

2368

buf = ctypes.create_string_buffer(20)

2573

2369

buf_len = ctypes.c_size_t()

2583

2379

return hex_fpr

2584

2380

2585

2381

2586

class MultiprocessingMixIn:

2382

class MultiprocessingMixIn(object):

2587

2383

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2588

2384

2589

2385

def sub_process_main(self, request, address):

2601

2397

return proc

2602

2398

2603

2399

2604

class MultiprocessingMixInWithPipe(MultiprocessingMixIn):

2400

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2605

2401

""" adds a pipe to the MixIn """

2606

2402

2607

2403

def process_request(self, request, client_address):

2622

2418

2623

2419

2624

2420

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2625

socketserver.TCPServer):

2626

"""IPv6-capable TCP server. Accepts None as address and/or port

2421

socketserver.TCPServer, object):

2422

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2627

2423

2628

2424

Attributes:

2629

2425

enabled: Boolean; whether this server is activated yet

2680

2476

if SO_BINDTODEVICE is None:

2681

2477

# Fall back to a hard-coded value which seems to be

2682

2478

# common enough.

2683

log.warning("SO_BINDTODEVICE not found, trying 25")

2479

logger.warning("SO_BINDTODEVICE not found, trying 25")

2684

2480

SO_BINDTODEVICE = 25

2685

2481

try:

2686

2482

self.socket.setsockopt(

2688

2484

(self.interface + "\0").encode("utf-8"))

2689

2485

except socket.error as error:

2690

2486

if error.errno == errno.EPERM:

2691

log.error("No permission to bind to interface %s",

2692

self.interface)

2487

logger.error("No permission to bind to"

2488

" interface %s", self.interface)

2693

2489

elif error.errno == errno.ENOPROTOOPT:

2694

log.error("SO_BINDTODEVICE not available; cannot"

2695

" bind to interface %s", self.interface)

2490

logger.error("SO_BINDTODEVICE not available;"

2491

" cannot bind to interface %s",

2492

self.interface)

2696

2493

elif error.errno == errno.ENODEV:

2697

log.error("Interface %s does not exist, cannot"

2698

" bind", self.interface)

2494

logger.error("Interface %s does not exist,"

2495

" cannot bind", self.interface)

2699

2496

else:

2700

2497

raise

2701

2498

# Only bind(2) the socket if we really need to.

2702

2499

if self.server_address[0] or self.server_address[1]:

2703

if self.server_address[1]:

2704

self.allow_reuse_address = True

2705

2500

if not self.server_address[0]:

2706

2501

if self.address_family == socket.AF_INET6:

2707

2502

any_address = "::" # in6addr_any

2760

2555

def add_pipe(self, parent_pipe, proc):

2761

2556

# Call "handle_ipc" for both data and EOF events

2762

2557

GLib.io_add_watch(

2763

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2764

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2558

parent_pipe.fileno(),

2559

GLib.IO_IN | GLib.IO_HUP,

2765

2560

functools.partial(self.handle_ipc,

2766

2561

parent_pipe=parent_pipe,

2767

2562

proc=proc))

2780

2575

request = parent_pipe.recv()

2781

2576

command = request[0]

2782

2577

2783

if command == "init":

2784

key_id = request[1].decode("ascii")

2785

fpr = request[2].decode("ascii")

2786

address = request[3]

2578

if command == 'init':

2579

fpr = request[1]

2580

address = request[2]

2787

2581

2788

2582

for c in self.clients.values():

2789

if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"

2790

"27AE41E4649B934CA495991B7852B855"):

2791

continue

2792

if key_id and c.key_id == key_id:

2793

client = c

2794

break

2795

if fpr and c.fingerprint == fpr:

2583

if c.fingerprint == fpr:

2796

2584

client = c

2797

2585

break

2798

2586

else:

2799

log.info("Client not found for key ID: %s, address:"

2800

" %s", key_id or fpr, address)

2587

logger.info("Client not found for fingerprint: %s, ad"

2588

"dress: %s", fpr, address)

2801

2589

if self.use_dbus:

2802

2590

# Emit D-Bus signal

2803

mandos_dbus_service.ClientNotFound(key_id or fpr,

2591

mandos_dbus_service.ClientNotFound(fpr,

2804

2592

address[0])

2805

2593

parent_pipe.send(False)

2806

2594

return False

2807

2595

2808

2596

GLib.io_add_watch(

2809

GLib.IOChannel.unix_new(parent_pipe.fileno()),

2810

GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,

2597

parent_pipe.fileno(),

2598

GLib.IO_IN | GLib.IO_HUP,

2811

2599

functools.partial(self.handle_ipc,

2812

2600

parent_pipe=parent_pipe,

2813

2601

proc=proc,

2816

2604

# remove the old hook in favor of the new above hook on

2817

2605

# same fileno

2818

2606

return False

2819

if command == "funcall":

2607

if command == 'funcall':

2820

2608

funcname = request[1]

2821

2609

args = request[2]

2822

2610

kwargs = request[3]

2823

2611

2824

parent_pipe.send(("data", getattr(client_object,

2612

parent_pipe.send(('data', getattr(client_object,

2825

2613

funcname)(*args,

2826

2614

**kwargs)))

2827

2615

2828

if command == "getattr":

2616

if command == 'getattr':

2829

2617

attrname = request[1]

2830

2618

if isinstance(client_object.__getattribute__(attrname),

2831

collections.abc.Callable):

2832

parent_pipe.send(("function", ))

2619

collections.Callable):

2620

parent_pipe.send(('function', ))

2833

2621

else:

2834

2622

parent_pipe.send((

2835

"data", client_object.__getattribute__(attrname)))

2623

'data', client_object.__getattribute__(attrname)))

2836

2624

2837

if command == "setattr":

2625

if command == 'setattr':

2838

2626

attrname = request[1]

2839

2627

value = request[2]

2840

2628

setattr(client_object, attrname, value)

2845

2633

def rfc3339_duration_to_delta(duration):

2846

2634

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2847

2635

2848

>>> timedelta = datetime.timedelta

2849

>>> rfc3339_duration_to_delta("P7D") == timedelta(7)

2850

True

2851

>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)

2852

True

2853

>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)

2854

True

2855

>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)

2856

True

2857

>>> rfc3339_duration_to_delta("P1W") == timedelta(7)

2858

True

2859

>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)

2860

True

2861

>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)

2862

True

2863

>>> del timedelta

2636

>>> rfc3339_duration_to_delta("P7D")

2637

datetime.timedelta(7)

2638

>>> rfc3339_duration_to_delta("PT60S")

2639

datetime.timedelta(0, 60)

2640

>>> rfc3339_duration_to_delta("PT60M")

2641

datetime.timedelta(0, 3600)

2642

>>> rfc3339_duration_to_delta("PT24H")

2643

datetime.timedelta(1)

2644

>>> rfc3339_duration_to_delta("P1W")

2645

datetime.timedelta(7)

2646

>>> rfc3339_duration_to_delta("PT5M30S")

2647

datetime.timedelta(0, 330)

2648

>>> rfc3339_duration_to_delta("P1DT3M20S")

2649

datetime.timedelta(1, 200)

2864

2650

"""

2865

2651

2866

2652

# Parsing an RFC 3339 duration with regular expressions is not

2946

2732

def string_to_delta(interval):

2947

2733

"""Parse a string and return a datetime.timedelta

2948

2734

2949

>>> string_to_delta("7d") == datetime.timedelta(7)

2950

True

2951

>>> string_to_delta("60s") == datetime.timedelta(0, 60)

2952

True

2953

>>> string_to_delta("60m") == datetime.timedelta(0, 3600)

2954

True

2955

>>> string_to_delta("24h") == datetime.timedelta(1)

2956

True

2957

>>> string_to_delta("1w") == datetime.timedelta(7)

2958

True

2959

>>> string_to_delta("5m 30s") == datetime.timedelta(0, 330)

2960

True

2735

>>> string_to_delta('7d')

2736

datetime.timedelta(7)

2737

>>> string_to_delta('60s')

2738

datetime.timedelta(0, 60)

2739

>>> string_to_delta('60m')

2740

datetime.timedelta(0, 3600)

2741

>>> string_to_delta('24h')

2742

datetime.timedelta(1)

2743

>>> string_to_delta('1w')

2744

datetime.timedelta(7)

2745

>>> string_to_delta('5m 30s')

2746

datetime.timedelta(0, 330)

2961

2747

"""

2962

2748

2963

2749

try:

3065

2851

3066

2852

options = parser.parse_args()

3067

2853

2854

if options.check:

2855

import doctest

2856

fail_count, test_count = doctest.testmod()

2857

sys.exit(os.EX_OK if fail_count == 0 else 1)

2858

3068

2859

# Default values for config file for server-global settings

3069

if gnutls.has_rawpk:

3070

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

3071

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

3072

else:

3073

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

3074

":+SIGN-DSA-SHA256")

3075

2860

server_defaults = {"interface": "",

3076

2861

"address": "",

3077

2862

"port": "",

3078

2863

"debug": "False",

3079

"priority": priority,

2864

"priority":

2865

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2866

":+SIGN-DSA-SHA256",

3080

2867

"servicename": "Mandos",

3081

2868

"use_dbus": "True",

3082

2869

"use_ipv6": "True",

3087

2874

"foreground": "False",

3088

2875

"zeroconf": "True",

3089

2876

}

3090

del priority

3091

2877

3092

2878

# Parse config file for server-global settings

3093

server_config = configparser.ConfigParser(server_defaults)

2879

server_config = configparser.SafeConfigParser(server_defaults)

3094

2880

del server_defaults

3095

2881

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3096

# Convert the ConfigParser object to a dict

2882

# Convert the SafeConfigParser object to a dict

3097

2883

server_settings = server_config.defaults()

3098

2884

# Use the appropriate methods on the non-string config options

3099

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3100

"foreground", "zeroconf"):

2885

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

3101

2886

server_settings[option] = server_config.getboolean("DEFAULT",

3102

2887

option)

3103

2888

if server_settings["port"]:

3109

2894

# Later, stdin will, and stdout and stderr might, be dup'ed

3110

2895

# over with an opened os.devnull. But we don't want this to

3111

2896

# happen with a supplied network socket.

3112

while 0 <= server_settings["socket"] <= 2:

2897

if 0 <= server_settings["socket"] <= 2:

3113

2898

server_settings["socket"] = os.dup(server_settings

3114

2899

["socket"])

3115

os.set_inheritable(server_settings["socket"], False)

3116

2900

del server_config

3117

2901

3118

2902

# Override the settings from the config file with command line

3167

2951

3168

2952

if server_settings["servicename"] != "Mandos":

3169

2953

syslogger.setFormatter(

3170

logging.Formatter("Mandos ({}) [%(process)d]:"

3171

" %(levelname)s: %(message)s".format(

2954

logging.Formatter('Mandos ({}) [%(process)d]:'

2955

' %(levelname)s: %(message)s'.format(

3172

2956

server_settings["servicename"])))

3173

2957

3174

2958

# Parse config file with clients

3175

client_config = configparser.ConfigParser(Client.client_defaults)

2959

client_config = configparser.SafeConfigParser(Client

2960

.client_defaults)

3176

2961

client_config.read(os.path.join(server_settings["configdir"],

3177

2962

"clients.conf"))

3178

2963

3198

2983

try:

3199

2984

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

3200

2985

except IOError as e:

3201

log.error("Could not open file %r", pidfilename,

3202

exc_info=e)

2986

logger.error("Could not open file %r", pidfilename,

2987

exc_info=e)

3203

2988

3204

2989

for name, group in (("_mandos", "_mandos"),

3205

2990

("mandos", "mandos"),

3216

3001

try:

3217

3002

os.setgid(gid)

3218

3003

os.setuid(uid)

3219

log.debug("Did setuid/setgid to %s:%s", uid, gid)

3004

if debug:

3005

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3006

gid))

3220

3007

except OSError as error:

3221

log.warning("Failed to setuid/setgid to %s:%s: %s", uid, gid,

3222

os.strerror(error.errno))

3008

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3009

.format(uid, gid, os.strerror(error.errno)))

3223

3010

if error.errno != errno.EPERM:

3224

3011

raise

3225

3012

3232

3019

3233

3020

@gnutls.log_func

3234

3021

def debug_gnutls(level, string):

3235

log.debug("GnuTLS: %s",

3236

string[:-1].decode("utf-8", errors="replace"))

3022

logger.debug("GnuTLS: %s", string[:-1])

3237

3023

3238

3024

gnutls.global_set_log_function(debug_gnutls)

3239

3025

3248

3034

# Close all input and output, do double fork, etc.

3249

3035

daemon()

3250

3036

3251

if gi.version_info < (3, 10, 2):

3252

# multiprocessing will use threads, so before we use GLib we

3253

# need to inform GLib that threads will be used.

3254

GLib.threads_init()

3037

# multiprocessing will use threads, so before we use GLib we need

3038

# to inform GLib that threads will be used.

3039

GLib.threads_init()

3255

3040

3256

3041

global main_loop

3257

3042

# From the Avahi example code

3258

3043

DBusGMainLoop(set_as_default=True)

3259

3044

main_loop = GLib.MainLoop()

3260

if use_dbus or zeroconf:

3261

bus = dbus.SystemBus()

3045

bus = dbus.SystemBus()

3262

3046

# End of Avahi example code

3263

3047

if use_dbus:

3264

3048

try:

3269

3053

"se.bsnet.fukt.Mandos", bus,

3270

3054

do_not_queue=True)

3271

3055

except dbus.exceptions.DBusException as e:

3272

log.error("Disabling D-Bus:", exc_info=e)

3056

logger.error("Disabling D-Bus:", exc_info=e)

3273

3057

use_dbus = False

3274

3058

server_settings["use_dbus"] = False

3275

3059

tcp_server.use_dbus = False

3334

3118

if isinstance(s, bytes)

3335

3119

else s) for s in

3336

3120

value["client_structure"]]

3337

# .name, .host, and .checker_command

3338

for k in ("name", "host", "checker_command"):

3121

# .name & .host

3122

for k in ("name", "host"):

3339

3123

if isinstance(value[k], bytes):

3340

3124

value[k] = value[k].decode("utf-8")

3341

if "key_id" not in value:

3342

value["key_id"] = ""

3343

elif "fingerprint" not in value:

3344

value["fingerprint"] = ""

3345

3125

# old_client_settings

3346

3126

# .keys()

3347

3127

old_client_settings = {

3351

3131

for key, value in

3352

3132

bytes_old_client_settings.items()}

3353

3133

del bytes_old_client_settings

3354

# .host and .checker_command

3134

# .host

3355

3135

for value in old_client_settings.values():

3356

for attribute in ("host", "checker_command"):

3357

if isinstance(value[attribute], bytes):

3358

value[attribute] = (value[attribute]

3359

.decode("utf-8"))

3136

if isinstance(value["host"], bytes):

3137

value["host"] = (value["host"]

3138

.decode("utf-8"))

3360

3139

os.remove(stored_state_path)

3361

3140

except IOError as e:

3362

3141

if e.errno == errno.ENOENT:

3363

log.warning("Could not load persistent state:"

3364

" %s", os.strerror(e.errno))

3142

logger.warning("Could not load persistent state:"

3143

" {}".format(os.strerror(e.errno)))

3365

3144

else:

3366

log.critical("Could not load persistent state:",

3367

exc_info=e)

3145

logger.critical("Could not load persistent state:",

3146

exc_info=e)

3368

3147

raise

3369

3148

except EOFError as e:

3370

log.warning("Could not load persistent state: EOFError:",

3371

exc_info=e)

3149

logger.warning("Could not load persistent state: "

3150

"EOFError:",

3151

exc_info=e)

3372

3152

3373

3153

with PGPEngine() as pgp:

3374

3154

for client_name, client in clients_data.items():

3401

3181

if client["enabled"]:

3402

3182

if datetime.datetime.utcnow() >= client["expires"]:

3403

3183

if not client["last_checked_ok"]:

3404

log.warning("disabling client %s - Client"

3405

" never performed a successful"

3406

" checker", client_name)

3184

logger.warning(

3185

"disabling client {} - Client never "

3186

"performed a successful checker".format(

3187

client_name))

3407

3188

client["enabled"] = False

3408

3189

elif client["last_checker_status"] != 0:

3409

log.warning("disabling client %s - Client"

3410

" last checker failed with error"

3411

" code %s", client_name,

3412

client["last_checker_status"])

3190

logger.warning(

3191

"disabling client {} - Client last"

3192

" checker failed with error code"

3193

" {}".format(

3194

client_name,

3195

client["last_checker_status"]))

3413

3196

client["enabled"] = False

3414

3197

else:

3415

3198

client["expires"] = (

3416

3199

datetime.datetime.utcnow()

3417

3200

+ client["timeout"])

3418

log.debug("Last checker succeeded, keeping %s"

3419

" enabled", client_name)

3201

logger.debug("Last checker succeeded,"

3202

" keeping {} enabled".format(

3203

client_name))

3420

3204

try:

3421

3205

client["secret"] = pgp.decrypt(

3422

3206

client["encrypted_secret"],

3423

3207

client_settings[client_name]["secret"])

3424

3208

except PGPError:

3425

3209

# If decryption fails, we use secret from new settings

3426

log.debug("Failed to decrypt %s old secret",

3427

client_name)

3210

logger.debug("Failed to decrypt {} old secret".format(

3211

client_name))

3428

3212

client["secret"] = (client_settings[client_name]

3429

3213

["secret"])

3430

3214

3444

3228

server_settings=server_settings)

3445

3229

3446

3230

if not tcp_server.clients:

3447

log.warning("No clients defined")

3231

logger.warning("No clients defined")

3448

3232

3449

3233

if not foreground:

3450

3234

if pidfile is not None:

3453

3237

with pidfile:

3454

3238

print(pid, file=pidfile)

3455

3239

except IOError:

3456

log.error("Could not write to file %r with PID %d",

3457

pidfilename, pid)

3240

logger.error("Could not write to file %r with PID %d",

3241

pidfilename, pid)

3458

3242

del pidfile

3459

3243

del pidfilename

3460

3244

3480

3264

pass

3481

3265

3482

3266

@dbus.service.signal(_interface, signature="ss")

3483

def ClientNotFound(self, key_id, address):

3267

def ClientNotFound(self, fingerprint, address):

3484

3268

"D-Bus signal"

3485

3269

pass

3486

3270

3610

3394

3611

3395

try:

3612

3396

with tempfile.NamedTemporaryFile(

3613

mode="wb",

3397

mode='wb',

3614

3398

suffix=".pickle",

3615

prefix="clients-",

3399

prefix='clients-',

3616

3400

dir=os.path.dirname(stored_state_path),

3617

3401

delete=False) as stored_state:

3618

3402

pickle.dump((clients, client_settings), stored_state,

3626

3410

except NameError:

3627

3411

pass

3628

3412

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3629

log.warning("Could not save persistent state: %s",

3630

os.strerror(e.errno))

3413

logger.warning("Could not save persistent state: {}"

3414

.format(os.strerror(e.errno)))

3631

3415

else:

3632

log.warning("Could not save persistent state:",

3633

exc_info=e)

3416

logger.warning("Could not save persistent state:",

3417

exc_info=e)

3634

3418

raise

3635

3419

3636

3420

# Delete all clients, and settings from config

3653

3437

mandos_dbus_service.client_added_signal(client)

3654

3438

# Need to initiate checking of clients

3655

3439

if client.enabled:

3656

client.init_checker(randomize_start=True)

3440

client.init_checker()

3657

3441

3658

3442

tcp_server.enable()

3659

3443

tcp_server.server_activate()

3662

3446

if zeroconf:

3663

3447

service.port = tcp_server.socket.getsockname()[1]

3664

3448

if use_ipv6:

3665

log.info("Now listening on address %r, port %d, flowinfo %d,"

3666

" scope_id %d", *tcp_server.socket.getsockname())

3449

logger.info("Now listening on address %r, port %d,"

3450

" flowinfo %d, scope_id %d",

3451

*tcp_server.socket.getsockname())

3667

3452

else: # IPv4

3668

log.info("Now listening on address %r, port %d",

3669

*tcp_server.socket.getsockname())

3453

logger.info("Now listening on address %r, port %d",

3454

*tcp_server.socket.getsockname())

3670

3455

3671

3456

# service.interface = tcp_server.socket.getsockname()[3]

3672

3457

3676

3461

try:

3677

3462

service.activate()

3678

3463

except dbus.exceptions.DBusException as error:

3679

log.critical("D-Bus Exception", exc_info=error)

3464

logger.critical("D-Bus Exception", exc_info=error)

3680

3465

cleanup()

3681

3466

sys.exit(1)

3682

3467

# End of Avahi example code

3683

3468

3684

GLib.io_add_watch(

3685

GLib.IOChannel.unix_new(tcp_server.fileno()),

3686

GLib.PRIORITY_DEFAULT, GLib.IO_IN,

3687

lambda *args, **kwargs: (tcp_server.handle_request

3688

(*args[2:], **kwargs) or True))

3469

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3470

lambda *args, **kwargs:

3471

(tcp_server.handle_request

3472

(*args[2:], **kwargs) or True))

3689

3473

3690

log.debug("Starting main loop")

3474

logger.debug("Starting main loop")

3691

3475

main_loop.run()

3692

3476

except AvahiError as error:

3693

log.critical("Avahi Error", exc_info=error)

3477

logger.critical("Avahi Error", exc_info=error)

3694

3478

cleanup()

3695

3479

sys.exit(1)

3696

3480

except KeyboardInterrupt:

3697

3481

if debug:

3698

3482

print("", file=sys.stderr)

3699

log.debug("Server received KeyboardInterrupt")

3700

log.debug("Server exiting")

3483

logger.debug("Server received KeyboardInterrupt")

3484

logger.debug("Server exiting")

3701

3485

# Must run before the D-Bus bus name gets deregistered

3702

3486

cleanup()

3703

3487

3704

3705

def parse_test_args():

3706

# type: () -> argparse.Namespace

3707

parser = argparse.ArgumentParser(add_help=False)

3708

parser.add_argument("--check", action="store_true")

3709

parser.add_argument("--prefix", )

3710

args, unknown_args = parser.parse_known_args()

3711

if args.check:

3712

# Remove test options from sys.argv

3713

sys.argv[1:] = unknown_args

3714

return args

3715

3716

# Add all tests from doctest strings

3717

def load_tests(loader, tests, none):

3718

import doctest

3719

tests.addTests(doctest.DocTestSuite())

3720

return tests

3721

3722

if __name__ == "__main__":

3723

options = parse_test_args()

3724

try:

3725

if options.check:

3726

extra_test_prefix = options.prefix

3727

if extra_test_prefix is not None:

3728

if not (unittest.main(argv=[""], exit=False)

3729

.result.wasSuccessful()):

3730

sys.exit(1)

3731

class ExtraTestLoader(unittest.TestLoader):

3732

testMethodPrefix = extra_test_prefix

3733

# Call using ./scriptname --test [--verbose]

3734

unittest.main(argv=[""], testLoader=ExtraTestLoader())

3735

else:

3736

unittest.main(argv=[""])

3737

else:

3738

main()

3739

finally:

3740

logging.shutdown()

3741

3742

# Local Variables:

3743

# run-tests:

3744

# (lambda (&optional extra)

3745

# (if (not (funcall run-tests-in-test-buffer default-directory

3746

# extra))

3747

# (funcall show-test-buffer-in-test-window)

3748

# (funcall remove-test-window)

3749

# (if extra (message "Extra tests run successfully!"))))

3750

# run-tests-in-test-buffer:

3751

# (lambda (dir &optional extra)

3752

# (with-current-buffer (get-buffer-create "*Test*")

3753

# (setq buffer-read-only nil

3754

# default-directory dir)

3755

# (erase-buffer)

3756

# (compilation-mode))

3757

# (let ((process-result

3758

# (let ((inhibit-read-only t))

3759

# (process-file-shell-command

3760

# (funcall get-command-line extra) nil "*Test*"))))

3761

# (and (numberp process-result)

3762

# (= process-result 0))))

3763

# get-command-line:

3764

# (lambda (&optional extra)

3765

# (let ((quoted-script

3766

# (shell-quote-argument (funcall get-script-name))))

3767

# (format

3768

# (concat "%s --check" (if extra " --prefix=atest" ""))

3769

# quoted-script)))

3770

# get-script-name:

3771

# (lambda ()

3772

# (if (fboundp 'file-local-name)

3773

# (file-local-name (buffer-file-name))

3774

# (or (file-remote-p (buffer-file-name) 'localname)

3775

# (buffer-file-name))))

3776

# remove-test-window:

3777

# (lambda ()

3778

# (let ((test-window (get-buffer-window "*Test*")))

3779

# (if test-window (delete-window test-window))))

3780

# show-test-buffer-in-test-window:

3781

# (lambda ()

3782

# (when (not (get-buffer-window-list "*Test*"))

3783

# (setq next-error-last-buffer (get-buffer "*Test*"))

3784

# (let* ((side (if (>= (window-width) 146) 'right 'bottom))

3785

# (display-buffer-overriding-action

3786

# `((display-buffer-in-side-window) (side . ,side)

3787

# (window-height . fit-window-to-buffer)

3788

# (window-width . fit-window-to-buffer))))

3789

# (display-buffer "*Test*"))))

3790

# eval:

3791

# (progn

3792

# (let* ((run-extra-tests (lambda () (interactive)

3793

# (funcall run-tests t)))

3794

# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t

3795

# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c

3796

# (setq minor-mode-overriding-map-alist

3797

# (cons `(run-tests . ,outer-keymap)

3798

# minor-mode-overriding-map-alist)))

3799

# (add-hook 'after-save-hook run-tests 90 t))

3800

# End:

3488

3489

if __name__ == '__main__':

3490

main()