196
248
.replace(b"\n", b"\\n")
197
249
.replace(b"\0", b"\\x00"))
200
252
def encrypt(self, data, password):
201
253
passphrase = self.password_encode(password)
202
254
with tempfile.NamedTemporaryFile(
203
255
dir=self.tempdir) as passfile:
204
256
passfile.write(passphrase)
206
proc = subprocess.Popen(['gpg', '--symmetric',
258
proc = subprocess.Popen([self.gpg, '--symmetric',
207
259
'--passphrase-file',
209
261
+ self.gnupgargs,
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
262
stdin=subprocess.PIPE,
263
stdout=subprocess.PIPE,
264
stderr=subprocess.PIPE)
265
ciphertext, err = proc.communicate(input=data)
214
266
if proc.returncode != 0:
215
267
raise PGPError(err)
216
268
return ciphertext
218
270
def decrypt(self, data, password):
219
271
passphrase = self.password_encode(password)
220
272
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
273
dir=self.tempdir) as passfile:
222
274
passfile.write(passphrase)
224
proc = subprocess.Popen(['gpg', '--decrypt',
276
proc = subprocess.Popen([self.gpg, '--decrypt',
225
277
'--passphrase-file',
227
279
+ self.gnupgargs,
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
280
stdin=subprocess.PIPE,
281
stdout=subprocess.PIPE,
282
stderr=subprocess.PIPE)
283
decrypted_plaintext, err = proc.communicate(input=data)
232
284
if proc.returncode != 0:
233
285
raise PGPError(err)
234
286
return decrypted_plaintext
289
# Pretend that we have an Avahi module
291
"""This isn't so much a class as it is a module-like namespace."""
292
IF_UNSPEC = -1 # avahi-common/address.h
293
PROTO_UNSPEC = -1 # avahi-common/address.h
294
PROTO_INET = 0 # avahi-common/address.h
295
PROTO_INET6 = 1 # avahi-common/address.h
296
DBUS_NAME = "org.freedesktop.Avahi"
297
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
298
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
299
DBUS_PATH_SERVER = "/"
302
def string_array_to_txt_array(t):
303
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
304
for s in t), signature="ay")
305
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
306
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
307
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
308
SERVER_INVALID = 0 # avahi-common/defs.h
309
SERVER_REGISTERING = 1 # avahi-common/defs.h
310
SERVER_RUNNING = 2 # avahi-common/defs.h
311
SERVER_COLLISION = 3 # avahi-common/defs.h
312
SERVER_FAILURE = 4 # avahi-common/defs.h
237
315
class AvahiError(Exception):
238
316
def __init__(self, value, *args, **kwargs):
239
317
self.value = value
418
507
class AvahiServiceToSyslog(AvahiService):
419
508
def rename(self, *args, **kwargs):
420
509
"""Add the new name to the syslog messages"""
421
ret = AvahiService.rename(self, *args, **kwargs)
510
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
422
511
syslogger.setFormatter(logging.Formatter(
423
512
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
424
513
.format(self.name)))
428
class Client(object):
517
# Pretend that we have a GnuTLS module
519
"""This isn't so much a class as it is a module-like namespace."""
521
library = ctypes.util.find_library("gnutls")
523
library = ctypes.util.find_library("gnutls-deb0")
524
_library = ctypes.cdll.LoadLibrary(library)
527
# Unless otherwise indicated, the constants and types below are
528
# all from the gnutls/gnutls.h C header file.
539
E_NO_CERTIFICATE_FOUND = -49
544
KEYID_USE_SHA256 = 1 # gnutls/x509.h
545
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
548
class session_int(ctypes.Structure):
550
session_t = ctypes.POINTER(session_int)
552
class certificate_credentials_st(ctypes.Structure):
554
certificate_credentials_t = ctypes.POINTER(
555
certificate_credentials_st)
556
certificate_type_t = ctypes.c_int
558
class datum_t(ctypes.Structure):
559
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
560
('size', ctypes.c_uint)]
562
class openpgp_crt_int(ctypes.Structure):
564
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
565
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
566
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
567
credentials_type_t = ctypes.c_int
568
transport_ptr_t = ctypes.c_void_p
569
close_request_t = ctypes.c_int
572
class Error(Exception):
573
def __init__(self, message=None, code=None, args=()):
574
# Default usage is by a message string, but if a return
575
# code is passed, convert it to a string with
578
if message is None and code is not None:
579
message = gnutls.strerror(code)
580
return super(gnutls.Error, self).__init__(
583
class CertificateSecurityError(Error):
589
self._c_object = gnutls.certificate_credentials_t()
590
gnutls.certificate_allocate_credentials(
591
ctypes.byref(self._c_object))
592
self.type = gnutls.CRD_CERTIFICATE
595
gnutls.certificate_free_credentials(self._c_object)
598
def __init__(self, socket, credentials=None):
599
self._c_object = gnutls.session_t()
600
gnutls_flags = gnutls.CLIENT
601
if gnutls.check_version(b"3.5.6"):
602
gnutls_flags |= gnutls.NO_TICKETS
604
gnutls_flags |= gnutls.ENABLE_RAWPK
605
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
607
gnutls.set_default_priority(self._c_object)
608
gnutls.transport_set_ptr(self._c_object, socket.fileno())
609
gnutls.handshake_set_private_extensions(self._c_object,
612
if credentials is None:
613
credentials = gnutls.Credentials()
614
gnutls.credentials_set(self._c_object, credentials.type,
615
ctypes.cast(credentials._c_object,
617
self.credentials = credentials
620
gnutls.deinit(self._c_object)
623
return gnutls.handshake(self._c_object)
625
def send(self, data):
629
data_len -= gnutls.record_send(self._c_object,
634
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
636
# Error handling functions
637
def _error_code(result):
638
"""A function to raise exceptions on errors, suitable
639
for the 'restype' attribute on ctypes functions"""
642
if result == gnutls.E_NO_CERTIFICATE_FOUND:
643
raise gnutls.CertificateSecurityError(code=result)
644
raise gnutls.Error(code=result)
646
def _retry_on_error(result, func, arguments):
647
"""A function to retry on some errors, suitable
648
for the 'errcheck' attribute on ctypes functions"""
650
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
651
return _error_code(result)
652
result = func(*arguments)
655
# Unless otherwise indicated, the function declarations below are
656
# all from the gnutls/gnutls.h C header file.
659
priority_set_direct = _library.gnutls_priority_set_direct
660
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
661
ctypes.POINTER(ctypes.c_char_p)]
662
priority_set_direct.restype = _error_code
664
init = _library.gnutls_init
665
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
666
init.restype = _error_code
668
set_default_priority = _library.gnutls_set_default_priority
669
set_default_priority.argtypes = [session_t]
670
set_default_priority.restype = _error_code
672
record_send = _library.gnutls_record_send
673
record_send.argtypes = [session_t, ctypes.c_void_p,
675
record_send.restype = ctypes.c_ssize_t
676
record_send.errcheck = _retry_on_error
678
certificate_allocate_credentials = (
679
_library.gnutls_certificate_allocate_credentials)
680
certificate_allocate_credentials.argtypes = [
681
ctypes.POINTER(certificate_credentials_t)]
682
certificate_allocate_credentials.restype = _error_code
684
certificate_free_credentials = (
685
_library.gnutls_certificate_free_credentials)
686
certificate_free_credentials.argtypes = [
687
certificate_credentials_t]
688
certificate_free_credentials.restype = None
690
handshake_set_private_extensions = (
691
_library.gnutls_handshake_set_private_extensions)
692
handshake_set_private_extensions.argtypes = [session_t,
694
handshake_set_private_extensions.restype = None
696
credentials_set = _library.gnutls_credentials_set
697
credentials_set.argtypes = [session_t, credentials_type_t,
699
credentials_set.restype = _error_code
701
strerror = _library.gnutls_strerror
702
strerror.argtypes = [ctypes.c_int]
703
strerror.restype = ctypes.c_char_p
705
certificate_type_get = _library.gnutls_certificate_type_get
706
certificate_type_get.argtypes = [session_t]
707
certificate_type_get.restype = _error_code
709
certificate_get_peers = _library.gnutls_certificate_get_peers
710
certificate_get_peers.argtypes = [session_t,
711
ctypes.POINTER(ctypes.c_uint)]
712
certificate_get_peers.restype = ctypes.POINTER(datum_t)
714
global_set_log_level = _library.gnutls_global_set_log_level
715
global_set_log_level.argtypes = [ctypes.c_int]
716
global_set_log_level.restype = None
718
global_set_log_function = _library.gnutls_global_set_log_function
719
global_set_log_function.argtypes = [log_func]
720
global_set_log_function.restype = None
722
deinit = _library.gnutls_deinit
723
deinit.argtypes = [session_t]
724
deinit.restype = None
726
handshake = _library.gnutls_handshake
727
handshake.argtypes = [session_t]
728
handshake.restype = _error_code
729
handshake.errcheck = _retry_on_error
731
transport_set_ptr = _library.gnutls_transport_set_ptr
732
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
733
transport_set_ptr.restype = None
735
bye = _library.gnutls_bye
736
bye.argtypes = [session_t, close_request_t]
737
bye.restype = _error_code
738
bye.errcheck = _retry_on_error
740
check_version = _library.gnutls_check_version
741
check_version.argtypes = [ctypes.c_char_p]
742
check_version.restype = ctypes.c_char_p
744
_need_version = b"3.3.0"
745
if check_version(_need_version) is None:
746
raise self.Error("Needs GnuTLS {} or later"
747
.format(_need_version))
749
_tls_rawpk_version = b"3.6.6"
750
has_rawpk = bool(check_version(_tls_rawpk_version))
754
class pubkey_st(ctypes.Structure):
756
pubkey_t = ctypes.POINTER(pubkey_st)
758
x509_crt_fmt_t = ctypes.c_int
760
# All the function declarations below are from gnutls/abstract.h
761
pubkey_init = _library.gnutls_pubkey_init
762
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
763
pubkey_init.restype = _error_code
765
pubkey_import = _library.gnutls_pubkey_import
766
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
768
pubkey_import.restype = _error_code
770
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
771
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
772
ctypes.POINTER(ctypes.c_ubyte),
773
ctypes.POINTER(ctypes.c_size_t)]
774
pubkey_get_key_id.restype = _error_code
776
pubkey_deinit = _library.gnutls_pubkey_deinit
777
pubkey_deinit.argtypes = [pubkey_t]
778
pubkey_deinit.restype = None
780
# All the function declarations below are from gnutls/openpgp.h
782
openpgp_crt_init = _library.gnutls_openpgp_crt_init
783
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
784
openpgp_crt_init.restype = _error_code
786
openpgp_crt_import = _library.gnutls_openpgp_crt_import
787
openpgp_crt_import.argtypes = [openpgp_crt_t,
788
ctypes.POINTER(datum_t),
790
openpgp_crt_import.restype = _error_code
792
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
793
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
794
ctypes.POINTER(ctypes.c_uint)]
795
openpgp_crt_verify_self.restype = _error_code
797
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
798
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
799
openpgp_crt_deinit.restype = None
801
openpgp_crt_get_fingerprint = (
802
_library.gnutls_openpgp_crt_get_fingerprint)
803
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
807
openpgp_crt_get_fingerprint.restype = _error_code
809
if check_version(b"3.6.4"):
810
certificate_type_get2 = _library.gnutls_certificate_type_get2
811
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
812
certificate_type_get2.restype = _error_code
814
# Remove non-public functions
815
del _error_code, _retry_on_error
818
def call_pipe(connection, # : multiprocessing.Connection
819
func, *args, **kwargs):
820
"""This function is meant to be called by multiprocessing.Process
822
This function runs func(*args, **kwargs), and writes the resulting
823
return value on the provided multiprocessing.Connection.
825
connection.send(func(*args, **kwargs))
429
830
"""A representation of a client host served by this server.
432
833
approved: bool(); 'None' if not yet approved/disapproved
433
834
approval_delay: datetime.timedelta(); Time to wait for approval
434
835
approval_duration: datetime.timedelta(); Duration of one approval
435
checker: subprocess.Popen(); a running checker process used
436
to see if the client lives.
437
'None' if no process is running.
438
checker_callback_tag: a gobject event source tag, or None
836
checker: multiprocessing.Process(); a running checker process used
837
to see if the client lives. 'None' if no process is
839
checker_callback_tag: a GLib event source tag, or None
439
840
checker_command: string; External command which is run to check
440
841
if client lives. %() expansions are done at
441
842
runtime with vars(self) as dict, so that for
442
843
instance %(name)s can be used in the command.
443
checker_initiator_tag: a gobject event source tag, or None
844
checker_initiator_tag: a GLib event source tag, or None
444
845
created: datetime.datetime(); (UTC) object creation
445
846
client_structure: Object describing what attributes a client has
446
847
and is used for storing the client at exit
447
848
current_checker_command: string; current running checker_command
448
disable_initiator_tag: a gobject event source tag, or None
849
disable_initiator_tag: a GLib event source tag, or None
450
851
fingerprint: string (40 or 32 hexadecimal digits); used to
451
uniquely identify the client
852
uniquely identify an OpenPGP client
853
key_id: string (64 hexadecimal digits); used to uniquely identify
854
a client using raw public keys
452
855
host: string; available for use by the checker command
453
856
interval: datetime.timedelta(); How often to start a new checker
454
857
last_approval_request: datetime.datetime(); (UTC) or None
604
1014
logger.info("Disabling client %s", self.name)
605
1015
if getattr(self, "disable_initiator_tag", None) is not None:
606
gobject.source_remove(self.disable_initiator_tag)
1016
GLib.source_remove(self.disable_initiator_tag)
607
1017
self.disable_initiator_tag = None
608
1018
self.expires = None
609
1019
if getattr(self, "checker_initiator_tag", None) is not None:
610
gobject.source_remove(self.checker_initiator_tag)
1020
GLib.source_remove(self.checker_initiator_tag)
611
1021
self.checker_initiator_tag = None
612
1022
self.stop_checker()
613
1023
self.enabled = False
615
1025
self.send_changedstate()
616
# Do not run this again if called by a gobject.timeout_add
1026
# Do not run this again if called by a GLib.timeout_add
619
1029
def __del__(self):
622
1032
def init_checker(self):
623
1033
# Schedule a new checker to be started an 'interval' from now,
624
1034
# and every interval from then on.
625
1035
if self.checker_initiator_tag is not None:
626
gobject.source_remove(self.checker_initiator_tag)
627
self.checker_initiator_tag = gobject.timeout_add(
1036
GLib.source_remove(self.checker_initiator_tag)
1037
self.checker_initiator_tag = GLib.timeout_add(
628
1038
int(self.interval.total_seconds() * 1000),
629
1039
self.start_checker)
630
1040
# Schedule a disable() when 'timeout' has passed
631
1041
if self.disable_initiator_tag is not None:
632
gobject.source_remove(self.disable_initiator_tag)
633
self.disable_initiator_tag = gobject.timeout_add(
1042
GLib.source_remove(self.disable_initiator_tag)
1043
self.disable_initiator_tag = GLib.timeout_add(
634
1044
int(self.timeout.total_seconds() * 1000), self.disable)
635
1045
# Also start a new checker *right now*.
636
1046
self.start_checker()
638
def checker_callback(self, pid, condition, command):
1048
def checker_callback(self, source, condition, connection,
639
1050
"""The checker has completed, so take appropriate actions."""
1051
# Read return code from connection (see call_pipe)
1052
returncode = connection.recv()
1054
if self.checker is not None:
640
1056
self.checker_callback_tag = None
641
1057
self.checker = None
642
if os.WIFEXITED(condition):
643
self.last_checker_status = os.WEXITSTATUS(condition)
1060
self.last_checker_status = returncode
1061
self.last_checker_signal = None
644
1062
if self.last_checker_status == 0:
645
1063
logger.info("Checker for %(name)s succeeded",
716
1127
return True # Try again later
717
1128
self.current_checker_command = command
719
logger.info("Starting checker %r for %s", command,
721
# We don't need to redirect stdout and stderr, since
722
# in normal mode, that is already done by daemon(),
723
# and in debug mode we don't want to. (Stdin is
724
# always replaced by /dev/null.)
725
# The exception is when not debugging but nevertheless
726
# running in the foreground; use the previously
729
if (not self.server_settings["debug"]
730
and self.server_settings["foreground"]):
731
popen_args.update({"stdout": wnull,
733
self.checker = subprocess.Popen(command,
738
except OSError as error:
739
logger.error("Failed to start subprocess",
742
self.checker_callback_tag = gobject.child_watch_add(
743
self.checker.pid, self.checker_callback, data=command)
744
# The checker may have completed before the gobject
745
# watch was added. Check for this.
747
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
748
except OSError as error:
749
if error.errno == errno.ECHILD:
750
# This should never happen
751
logger.error("Child process vanished",
756
gobject.source_remove(self.checker_callback_tag)
757
self.checker_callback(pid, status, command)
758
# Re-run this periodically if run by gobject.timeout_add
1129
logger.info("Starting checker %r for %s", command,
1131
# We don't need to redirect stdout and stderr, since
1132
# in normal mode, that is already done by daemon(),
1133
# and in debug mode we don't want to. (Stdin is
1134
# always replaced by /dev/null.)
1135
# The exception is when not debugging but nevertheless
1136
# running in the foreground; use the previously
1138
popen_args = {"close_fds": True,
1141
if (not self.server_settings["debug"]
1142
and self.server_settings["foreground"]):
1143
popen_args.update({"stdout": wnull,
1145
pipe = multiprocessing.Pipe(duplex=False)
1146
self.checker = multiprocessing.Process(
1148
args=(pipe[1], subprocess.call, command),
1150
self.checker.start()
1151
self.checker_callback_tag = GLib.io_add_watch(
1152
GLib.IOChannel.unix_new(pipe[0].fileno()),
1153
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1154
self.checker_callback, pipe[0], command)
1155
# Re-run this periodically if run by GLib.timeout_add
761
1158
def stop_checker(self):
762
1159
"""Force the checker process, if any, to stop."""
763
1160
if self.checker_callback_tag:
764
gobject.source_remove(self.checker_callback_tag)
1161
GLib.source_remove(self.checker_callback_tag)
765
1162
self.checker_callback_tag = None
766
1163
if getattr(self, "checker", None) is None:
768
1165
logger.debug("Stopping checker for %(name)s", vars(self))
770
self.checker.terminate()
772
#if self.checker.poll() is None:
773
# self.checker.kill()
774
except OSError as error:
775
if error.errno != errno.ESRCH: # No such process
1166
self.checker.terminate()
777
1167
self.checker = None
896
1287
for cls in self.__class__.__mro__
897
1288
for name, athing in
898
1289
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1291
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1293
path_keyword='object_path',
1294
connection_keyword='connection')
1295
def Introspect(self, object_path, connection):
1296
"""Overloading of standard D-Bus method.
1298
Inserts annotation tags on methods and signals.
1300
xmlstring = dbus.service.Object.Introspect(self, object_path,
1303
document = xml.dom.minidom.parseString(xmlstring)
1305
for if_tag in document.getElementsByTagName("interface"):
1306
# Add annotation tags
1307
for typ in ("method", "signal"):
1308
for tag in if_tag.getElementsByTagName(typ):
1310
for name, prop in (self.
1311
_get_all_dbus_things(typ)):
1312
if (name == tag.getAttribute("name")
1313
and prop._dbus_interface
1314
== if_tag.getAttribute("name")):
1315
annots.update(getattr(
1316
prop, "_dbus_annotations", {}))
1317
for name, value in annots.items():
1318
ann_tag = document.createElement(
1320
ann_tag.setAttribute("name", name)
1321
ann_tag.setAttribute("value", value)
1322
tag.appendChild(ann_tag)
1323
# Add interface annotation tags
1324
for annotation, value in dict(
1325
itertools.chain.from_iterable(
1326
annotations().items()
1327
for name, annotations
1328
in self._get_all_dbus_things("interface")
1329
if name == if_tag.getAttribute("name")
1331
ann_tag = document.createElement("annotation")
1332
ann_tag.setAttribute("name", annotation)
1333
ann_tag.setAttribute("value", value)
1334
if_tag.appendChild(ann_tag)
1335
# Fix argument name for the Introspect method itself
1336
if (if_tag.getAttribute("name")
1337
== dbus.INTROSPECTABLE_IFACE):
1338
for cn in if_tag.getElementsByTagName("method"):
1339
if cn.getAttribute("name") == "Introspect":
1340
for arg in cn.getElementsByTagName("arg"):
1341
if (arg.getAttribute("direction")
1343
arg.setAttribute("name",
1345
xmlstring = document.toxml("utf-8")
1347
except (AttributeError, xml.dom.DOMException,
1348
xml.parsers.expat.ExpatError) as error:
1349
logger.error("Failed to override Introspection method",
1354
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1355
"""A D-Bus object with properties.
1357
Classes inheriting from this can use the dbus_service_property
1358
decorator to expose methods as D-Bus properties. It exposes the
1359
standard Get(), Set(), and GetAll() methods on the D-Bus.
900
1362
def _get_dbus_property(self, interface_name, property_name):
901
1363
"""Returns a bound method if one exists which is a D-Bus
902
1364
property with the specified name and interface.
1060
1518
return xmlstring
1522
dbus.OBJECT_MANAGER_IFACE
1523
except AttributeError:
1524
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1527
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1528
"""A D-Bus object with an ObjectManager.
1530
Classes inheriting from this exposes the standard
1531
GetManagedObjects call and the InterfacesAdded and
1532
InterfacesRemoved signals on the standard
1533
"org.freedesktop.DBus.ObjectManager" interface.
1535
Note: No signals are sent automatically; they must be sent
1538
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1539
out_signature="a{oa{sa{sv}}}")
1540
def GetManagedObjects(self):
1541
"""This function must be overridden"""
1542
raise NotImplementedError()
1544
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1545
signature="oa{sa{sv}}")
1546
def InterfacesAdded(self, object_path, interfaces_and_properties):
1549
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1550
def InterfacesRemoved(self, object_path, interfaces):
1553
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1555
path_keyword='object_path',
1556
connection_keyword='connection')
1557
def Introspect(self, object_path, connection):
1558
"""Overloading of standard D-Bus method.
1560
Override return argument name of GetManagedObjects to be
1561
"objpath_interfaces_and_properties"
1563
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1567
document = xml.dom.minidom.parseString(xmlstring)
1569
for if_tag in document.getElementsByTagName("interface"):
1570
# Fix argument name for the GetManagedObjects method
1571
if (if_tag.getAttribute("name")
1572
== dbus.OBJECT_MANAGER_IFACE):
1573
for cn in if_tag.getElementsByTagName("method"):
1574
if (cn.getAttribute("name")
1575
== "GetManagedObjects"):
1576
for arg in cn.getElementsByTagName("arg"):
1577
if (arg.getAttribute("direction")
1581
"objpath_interfaces"
1583
xmlstring = document.toxml("utf-8")
1585
except (AttributeError, xml.dom.DOMException,
1586
xml.parsers.expat.ExpatError) as error:
1587
logger.error("Failed to override Introspection method",
1063
1592
def datetime_to_dbus(dt, variant_level=0):
1064
1593
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1066
return dbus.String("", variant_level = variant_level)
1595
return dbus.String("", variant_level=variant_level)
1067
1596
return dbus.String(dt.isoformat(), variant_level=variant_level)
1819
2380
delay -= time2 - time
1822
while sent_size < len(client.secret):
1824
sent = session.send(client.secret[sent_size:])
1825
except gnutls.errors.GNUTLSError as error:
1826
logger.warning("gnutls send failed",
1829
logger.debug("Sent: %d, remaining: %d", sent,
1830
len(client.secret) - (sent_size
2383
session.send(client.secret)
2384
except gnutls.Error as error:
2385
logger.warning("gnutls send failed",
1834
2389
logger.info("Sending secret to %s", client.name)
1835
2390
# bump the timeout using extended_timeout
1836
2391
client.bump_timeout(client.extended_timeout)
1837
2392
if self.server.use_dbus:
1838
2393
# Emit D-Bus signal
1839
2394
client.GotSecret()
1842
2397
if approval_required:
1843
2398
client.approvals_pending -= 1
1846
except gnutls.errors.GNUTLSError as error:
2401
except gnutls.Error as error:
1847
2402
logger.warning("GnuTLS bye failed",
1848
2403
exc_info=error)
1851
2406
def peer_certificate(session):
1852
"Return the peer's OpenPGP certificate as a bytestring"
1853
# If not an OpenPGP certificate...
1854
if (gnutls.library.functions.gnutls_certificate_type_get(
1856
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1857
# ...do the normal thing
1858
return session.peer_certificate
2407
"Return the peer's certificate as a bytestring"
2409
cert_type = gnutls.certificate_type_get2(session._c_object,
2411
except AttributeError:
2412
cert_type = gnutls.certificate_type_get(session._c_object)
2413
if gnutls.has_rawpk:
2414
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2416
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2417
# If not a valid certificate type...
2418
if cert_type not in valid_cert_types:
2419
logger.info("Cert type %r not in %r", cert_type,
2421
# ...return invalid data
1859
2423
list_size = ctypes.c_uint(1)
1860
cert_list = (gnutls.library.functions
1861
.gnutls_certificate_get_peers
2424
cert_list = (gnutls.certificate_get_peers
1862
2425
(session._c_object, ctypes.byref(list_size)))
1863
2426
if not bool(cert_list) and list_size.value != 0:
1864
raise gnutls.errors.GNUTLSError("error getting peer"
2427
raise gnutls.Error("error getting peer certificate")
1866
2428
if list_size.value == 0:
1868
2430
cert = cert_list[0]
1869
2431
return ctypes.string_at(cert.data, cert.size)
2434
def key_id(certificate):
2435
"Convert a certificate bytestring to a hexdigit key ID"
2436
# New GnuTLS "datum" with the public key
2437
datum = gnutls.datum_t(
2438
ctypes.cast(ctypes.c_char_p(certificate),
2439
ctypes.POINTER(ctypes.c_ubyte)),
2440
ctypes.c_uint(len(certificate)))
2441
# XXX all these need to be created in the gnutls "module"
2442
# New empty GnuTLS certificate
2443
pubkey = gnutls.pubkey_t()
2444
gnutls.pubkey_init(ctypes.byref(pubkey))
2445
# Import the raw public key into the certificate
2446
gnutls.pubkey_import(pubkey,
2447
ctypes.byref(datum),
2448
gnutls.X509_FMT_DER)
2449
# New buffer for the key ID
2450
buf = ctypes.create_string_buffer(32)
2451
buf_len = ctypes.c_size_t(len(buf))
2452
# Get the key ID from the raw public key into the buffer
2453
gnutls.pubkey_get_key_id(pubkey,
2454
gnutls.KEYID_USE_SHA256,
2455
ctypes.cast(ctypes.byref(buf),
2456
ctypes.POINTER(ctypes.c_ubyte)),
2457
ctypes.byref(buf_len))
2458
# Deinit the certificate
2459
gnutls.pubkey_deinit(pubkey)
2461
# Convert the buffer to a Python bytestring
2462
key_id = ctypes.string_at(buf, buf_len.value)
2463
# Convert the bytestring to hexadecimal notation
2464
hex_key_id = binascii.hexlify(key_id).upper()
1872
2468
def fingerprint(openpgp):
1873
2469
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1874
2470
# New GnuTLS "datum" with the OpenPGP public key
1875
datum = gnutls.library.types.gnutls_datum_t(
2471
datum = gnutls.datum_t(
1876
2472
ctypes.cast(ctypes.c_char_p(openpgp),
1877
2473
ctypes.POINTER(ctypes.c_ubyte)),
1878
2474
ctypes.c_uint(len(openpgp)))
1879
2475
# New empty GnuTLS certificate
1880
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1881
gnutls.library.functions.gnutls_openpgp_crt_init(
2476
crt = gnutls.openpgp_crt_t()
2477
gnutls.openpgp_crt_init(ctypes.byref(crt))
1883
2478
# Import the OpenPGP public key into the certificate
1884
gnutls.library.functions.gnutls_openpgp_crt_import(
1885
crt, ctypes.byref(datum),
1886
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2479
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2480
gnutls.OPENPGP_FMT_RAW)
1887
2481
# Verify the self signature in the key
1888
2482
crtverify = ctypes.c_uint()
1889
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1890
crt, 0, ctypes.byref(crtverify))
2483
gnutls.openpgp_crt_verify_self(crt, 0,
2484
ctypes.byref(crtverify))
1891
2485
if crtverify.value != 0:
1892
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1893
raise gnutls.errors.CertificateSecurityError(
2486
gnutls.openpgp_crt_deinit(crt)
2487
raise gnutls.CertificateSecurityError(code
1895
2489
# New buffer for the fingerprint
1896
2490
buf = ctypes.create_string_buffer(20)
1897
2491
buf_len = ctypes.c_size_t()
1898
2492
# Get the fingerprint from the certificate into the buffer
1899
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1900
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2493
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2494
ctypes.byref(buf_len))
1901
2495
# Deinit the certificate
1902
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2496
gnutls.openpgp_crt_deinit(crt)
1903
2497
# Convert the buffer to a Python bytestring
1904
2498
fpr = ctypes.string_at(buf, buf_len.value)
1905
2499
# Convert the bytestring to hexadecimal notation
1993
2588
# socket_wrapper(), if socketfd was set.
1994
2589
socketserver.TCPServer.__init__(self, server_address,
1995
2590
RequestHandlerClass)
1997
2592
def server_bind(self):
1998
2593
"""This overrides the normal server_bind() function
1999
2594
to bind to an interface if one was specified, and also NOT to
2000
2595
bind to an address or port if they were not specified."""
2596
global SO_BINDTODEVICE
2001
2597
if self.interface is not None:
2002
2598
if SO_BINDTODEVICE is None:
2003
logger.error("SO_BINDTODEVICE does not exist;"
2004
" cannot bind to interface %s",
2008
self.socket.setsockopt(
2009
socket.SOL_SOCKET, SO_BINDTODEVICE,
2010
(self.interface + "\0").encode("utf-8"))
2011
except socket.error as error:
2012
if error.errno == errno.EPERM:
2013
logger.error("No permission to bind to"
2014
" interface %s", self.interface)
2015
elif error.errno == errno.ENOPROTOOPT:
2016
logger.error("SO_BINDTODEVICE not available;"
2017
" cannot bind to interface %s",
2019
elif error.errno == errno.ENODEV:
2020
logger.error("Interface %s does not exist,"
2021
" cannot bind", self.interface)
2599
# Fall back to a hard-coded value which seems to be
2601
logger.warning("SO_BINDTODEVICE not found, trying 25")
2602
SO_BINDTODEVICE = 25
2604
self.socket.setsockopt(
2605
socket.SOL_SOCKET, SO_BINDTODEVICE,
2606
(self.interface + "\0").encode("utf-8"))
2607
except socket.error as error:
2608
if error.errno == errno.EPERM:
2609
logger.error("No permission to bind to"
2610
" interface %s", self.interface)
2611
elif error.errno == errno.ENOPROTOOPT:
2612
logger.error("SO_BINDTODEVICE not available;"
2613
" cannot bind to interface %s",
2615
elif error.errno == errno.ENODEV:
2616
logger.error("Interface %s does not exist,"
2617
" cannot bind", self.interface)
2024
2620
# Only bind(2) the socket if we really need to.
2025
2621
if self.server_address[0] or self.server_address[1]:
2622
if self.server_address[1]:
2623
self.allow_reuse_address = True
2026
2624
if not self.server_address[0]:
2027
2625
if self.address_family == socket.AF_INET6:
2028
any_address = "::" # in6addr_any
2626
any_address = "::" # in6addr_any
2030
any_address = "0.0.0.0" # INADDR_ANY
2628
any_address = "0.0.0.0" # INADDR_ANY
2031
2629
self.server_address = (any_address,
2032
2630
self.server_address[1])
2033
2631
elif not self.server_address[1]:
2067
2665
self.gnutls_priority = gnutls_priority
2068
2666
IPv6_TCPServer.__init__(self, server_address,
2069
2667
RequestHandlerClass,
2070
interface = interface,
2071
use_ipv6 = use_ipv6,
2072
socketfd = socketfd)
2668
interface=interface,
2074
2672
def server_activate(self):
2075
2673
if self.enabled:
2076
2674
return socketserver.TCPServer.server_activate(self)
2078
2676
def enable(self):
2079
2677
self.enabled = True
2081
2679
def add_pipe(self, parent_pipe, proc):
2082
2680
# Call "handle_ipc" for both data and EOF events
2083
gobject.io_add_watch(
2084
parent_pipe.fileno(),
2085
gobject.IO_IN | gobject.IO_HUP,
2682
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2683
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2086
2684
functools.partial(self.handle_ipc,
2087
parent_pipe = parent_pipe,
2685
parent_pipe=parent_pipe,
2090
2688
def handle_ipc(self, source, condition,
2091
2689
parent_pipe=None,
2093
2691
client_object=None):
2094
2692
# error, or the other end of multiprocessing.Pipe has closed
2095
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2693
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2096
2694
# Wait for other process to exit
2100
2698
# Read a request from the child
2101
2699
request = parent_pipe.recv()
2102
2700
command = request[0]
2104
2702
if command == 'init':
2106
address = request[2]
2108
for c in self.clients.itervalues():
2109
if c.fingerprint == fpr:
2703
key_id = request[1].decode("ascii")
2704
fpr = request[2].decode("ascii")
2705
address = request[3]
2707
for c in self.clients.values():
2708
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2710
if key_id and c.key_id == key_id:
2713
if fpr and c.fingerprint == fpr:
2113
logger.info("Client not found for fingerprint: %s, ad"
2114
"dress: %s", fpr, address)
2717
logger.info("Client not found for key ID: %s, address"
2718
": %s", key_id or fpr, address)
2115
2719
if self.use_dbus:
2116
2720
# Emit D-Bus signal
2117
mandos_dbus_service.ClientNotFound(fpr,
2721
mandos_dbus_service.ClientNotFound(key_id or fpr,
2119
2723
parent_pipe.send(False)
2122
gobject.io_add_watch(
2123
parent_pipe.fileno(),
2124
gobject.IO_IN | gobject.IO_HUP,
2727
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2728
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2125
2729
functools.partial(self.handle_ipc,
2126
parent_pipe = parent_pipe,
2128
client_object = client))
2730
parent_pipe=parent_pipe,
2732
client_object=client))
2129
2733
parent_pipe.send(True)
2130
2734
# remove the old hook in favor of the new above hook on
2577
3192
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2578
3193
service = AvahiServiceToSyslog(
2579
name = server_settings["servicename"],
2580
servicetype = "_mandos._tcp",
2581
protocol = protocol,
3194
name=server_settings["servicename"],
3195
servicetype="_mandos._tcp",
2583
3198
if server_settings["interface"]:
2584
3199
service.interface = if_nametoindex(
2585
3200
server_settings["interface"].encode("utf-8"))
2587
3202
global multiprocessing_manager
2588
3203
multiprocessing_manager = multiprocessing.Manager()
2590
3205
client_class = Client
2592
client_class = functools.partial(ClientDBus, bus = bus)
3207
client_class = functools.partial(ClientDBus, bus=bus)
2594
3209
client_settings = Client.config_parser(client_config)
2595
3210
old_client_settings = {}
2596
3211
clients_data = {}
2598
3213
# This is used to redirect stdout and stderr for checker processes
2600
wnull = open(os.devnull, "w") # A writable /dev/null
3215
wnull = open(os.devnull, "w") # A writable /dev/null
2601
3216
# Only used if server is running in foreground but not in debug
2603
3218
if debug or not foreground:
2606
3221
# Get client data and settings from last running state.
2607
3222
if server_settings["restore"]:
2609
3224
with open(stored_state_path, "rb") as stored_state:
2610
clients_data, old_client_settings = pickle.load(
3225
if sys.version_info.major == 2:
3226
clients_data, old_client_settings = pickle.load(
3229
bytes_clients_data, bytes_old_client_settings = (
3230
pickle.load(stored_state, encoding="bytes"))
3231
# Fix bytes to strings
3234
clients_data = {(key.decode("utf-8")
3235
if isinstance(key, bytes)
3238
bytes_clients_data.items()}
3239
del bytes_clients_data
3240
for key in clients_data:
3241
value = {(k.decode("utf-8")
3242
if isinstance(k, bytes) else k): v
3244
clients_data[key].items()}
3245
clients_data[key] = value
3247
value["client_structure"] = [
3249
if isinstance(s, bytes)
3251
value["client_structure"]]
3252
# .name, .host, and .checker_command
3253
for k in ("name", "host", "checker_command"):
3254
if isinstance(value[k], bytes):
3255
value[k] = value[k].decode("utf-8")
3256
if "key_id" not in value:
3257
value["key_id"] = ""
3258
elif "fingerprint" not in value:
3259
value["fingerprint"] = ""
3260
# old_client_settings
3262
old_client_settings = {
3263
(key.decode("utf-8")
3264
if isinstance(key, bytes)
3267
bytes_old_client_settings.items()}
3268
del bytes_old_client_settings
3269
# .host and .checker_command
3270
for value in old_client_settings.values():
3271
for attribute in ("host", "checker_command"):
3272
if isinstance(value[attribute], bytes):
3273
value[attribute] = (value[attribute]
2612
3275
os.remove(stored_state_path)
2613
3276
except IOError as e:
2614
3277
if e.errno == errno.ENOENT:
2714
3377
pidfilename, pid)
2716
3379
del pidfilename
2718
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2719
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3381
for termsig in (signal.SIGHUP, signal.SIGTERM):
3382
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3383
lambda: main_loop.quit() and False)
2723
3387
@alternate_dbus_interfaces(
2724
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2725
class MandosDBusService(DBusObjectWithProperties):
3388
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3389
class MandosDBusService(DBusObjectWithObjectManager):
2726
3390
"""A D-Bus proxy object"""
2728
3392
def __init__(self):
2729
3393
dbus.service.Object.__init__(self, bus, "/")
2731
3395
_interface = "se.recompile.Mandos"
2733
@dbus_interface_annotations(_interface)
2736
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2739
3397
@dbus.service.signal(_interface, signature="o")
2740
3398
def ClientAdded(self, objpath):
2744
3402
@dbus.service.signal(_interface, signature="ss")
2745
def ClientNotFound(self, fingerprint, address):
3403
def ClientNotFound(self, key_id, address):
3407
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2749
3409
@dbus.service.signal(_interface, signature="os")
2750
3410
def ClientRemoved(self, objpath, name):
3414
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2754
3416
@dbus.service.method(_interface, out_signature="ao")
2755
3417
def GetAllClients(self):
2757
3419
return dbus.Array(c.dbus_object_path for c in
2758
tcp_server.clients.itervalues())
3420
tcp_server.clients.values())
3422
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2760
3424
@dbus.service.method(_interface,
2761
3425
out_signature="a{oa{sv}}")
2762
3426
def GetAllClientsWithProperties(self):
2764
3428
return dbus.Dictionary(
2765
{ c.dbus_object_path: c.GetAll("")
2766
for c in tcp_server.clients.itervalues() },
3429
{c.dbus_object_path: c.GetAll(
3430
"se.recompile.Mandos.Client")
3431
for c in tcp_server.clients.values()},
2767
3432
signature="oa{sv}")
2769
3434
@dbus.service.method(_interface, in_signature="o")
2770
3435
def RemoveClient(self, object_path):
2772
for c in tcp_server.clients.itervalues():
3437
for c in tcp_server.clients.values():
2773
3438
if c.dbus_object_path == object_path:
2774
3439
del tcp_server.clients[c.name]
2775
3440
c.remove_from_connection()
2776
# Don't signal anything except ClientRemoved
3441
# Don't signal the disabling
2777
3442
c.disable(quiet=True)
2779
self.ClientRemoved(object_path, c.name)
3443
# Emit D-Bus signal for removal
3444
self.client_removed_signal(c)
2781
3446
raise KeyError(object_path)
3450
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3451
out_signature="a{oa{sa{sv}}}")
3452
def GetManagedObjects(self):
3454
return dbus.Dictionary(
3455
{client.dbus_object_path:
3457
{interface: client.GetAll(interface)
3459
client._get_all_interface_names()})
3460
for client in tcp_server.clients.values()})
3462
def client_added_signal(self, client):
3463
"""Send the new standard signal and the old signal"""
3465
# New standard signal
3466
self.InterfacesAdded(
3467
client.dbus_object_path,
3469
{interface: client.GetAll(interface)
3471
client._get_all_interface_names()}))
3473
self.ClientAdded(client.dbus_object_path)
3475
def client_removed_signal(self, client):
3476
"""Send the new standard signal and the old signal"""
3478
# New standard signal
3479
self.InterfacesRemoved(
3480
client.dbus_object_path,
3481
client._get_all_interface_names())
3483
self.ClientRemoved(client.dbus_object_path,
2785
3486
mandos_dbus_service = MandosDBusService()
3488
# Save modules to variables to exempt the modules from being
3489
# unloaded before the function registered with atexit() is run.
3490
mp = multiprocessing
2788
3494
"Cleanup function; run on exit"
2790
3496
service.cleanup()
2792
multiprocessing.active_children()
3498
mp.active_children()
2794
3500
if not (tcp_server.clients or client_settings):
2797
3503
# Store client before exiting. Secrets are encrypted with key
2798
3504
# based on what config file has. If config file is
2799
3505
# removed/edited, old secret will thus be unrecovable.
2801
3507
with PGPEngine() as pgp:
2802
for client in tcp_server.clients.itervalues():
3508
for client in tcp_server.clients.values():
2803
3509
key = client_settings[client.name]["secret"]
2804
3510
client.encrypted_secret = pgp.encrypt(client.secret,
2806
3512
client_dict = {}
2808
3514
# A list of attributes that can not be pickled
2810
exclude = { "bus", "changedstate", "secret",
2811
"checker", "server_settings" }
3516
exclude = {"bus", "changedstate", "secret",
3517
"checker", "server_settings"}
2812
3518
for name, typ in inspect.getmembers(dbus.service
2814
3520
exclude.add(name)
2816
3522
client_dict["encrypted_secret"] = (client
2817
3523
.encrypted_secret)
2818
3524
for attr in client.client_structure:
2819
3525
if attr not in exclude:
2820
3526
client_dict[attr] = getattr(client, attr)
2822
3528
clients[client.name] = client_dict
2823
3529
del client_settings[client.name]["secret"]
2826
3532
with tempfile.NamedTemporaryFile(