183
265
.replace(b"\n", b"\\n")
184
266
.replace(b"\0", b"\\x00"))
187
269
def encrypt(self, data, password):
188
270
passphrase = self.password_encode(password)
189
with tempfile.NamedTemporaryFile(dir=self.tempdir
271
with tempfile.NamedTemporaryFile(
272
dir=self.tempdir) as passfile:
191
273
passfile.write(passphrase)
193
proc = subprocess.Popen(['gpg', '--symmetric',
275
proc = subprocess.Popen([self.gpg, "--symmetric",
196
278
+ self.gnupgargs,
197
stdin = subprocess.PIPE,
198
stdout = subprocess.PIPE,
199
stderr = subprocess.PIPE)
200
ciphertext, err = proc.communicate(input = data)
279
stdin=subprocess.PIPE,
280
stdout=subprocess.PIPE,
281
stderr=subprocess.PIPE)
282
ciphertext, err = proc.communicate(input=data)
201
283
if proc.returncode != 0:
202
284
raise PGPError(err)
203
285
return ciphertext
205
287
def decrypt(self, data, password):
206
288
passphrase = self.password_encode(password)
207
with tempfile.NamedTemporaryFile(dir = self.tempdir
289
with tempfile.NamedTemporaryFile(
290
dir=self.tempdir) as passfile:
209
291
passfile.write(passphrase)
211
proc = subprocess.Popen(['gpg', '--decrypt',
293
proc = subprocess.Popen([self.gpg, "--decrypt",
214
296
+ self.gnupgargs,
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
decrypted_plaintext, err = proc.communicate(input
297
stdin=subprocess.PIPE,
298
stdout=subprocess.PIPE,
299
stderr=subprocess.PIPE)
300
decrypted_plaintext, err = proc.communicate(input=data)
220
301
if proc.returncode != 0:
221
302
raise PGPError(err)
222
303
return decrypted_plaintext
306
# Pretend that we have an Avahi module
308
"""This isn't so much a class as it is a module-like namespace."""
309
IF_UNSPEC = -1 # avahi-common/address.h
310
PROTO_UNSPEC = -1 # avahi-common/address.h
311
PROTO_INET = 0 # avahi-common/address.h
312
PROTO_INET6 = 1 # avahi-common/address.h
313
DBUS_NAME = "org.freedesktop.Avahi"
314
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
315
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
DBUS_PATH_SERVER = "/"
319
def string_array_to_txt_array(t):
320
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
for s in t), signature="ay")
322
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
323
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
324
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
325
SERVER_INVALID = 0 # avahi-common/defs.h
326
SERVER_REGISTERING = 1 # avahi-common/defs.h
327
SERVER_RUNNING = 2 # avahi-common/defs.h
328
SERVER_COLLISION = 3 # avahi-common/defs.h
329
SERVER_FAILURE = 4 # avahi-common/defs.h
225
332
class AvahiError(Exception):
226
333
def __init__(self, value, *args, **kwargs):
227
334
self.value = value
228
335
return super(AvahiError, self).__init__(value, *args,
231
339
class AvahiServiceError(AvahiError):
234
343
class AvahiGroupError(AvahiError):
238
class AvahiService(object):
239
348
"""An Avahi (Zeroconf) service.
242
351
interface: integer; avahi.IF_UNSPEC or an interface index.
243
352
Used to optionally bind to the specified interface.
244
name: string; Example: 'Mandos'
245
type: string; Example: '_mandos._tcp'.
353
name: string; Example: "Mandos"
354
type: string; Example: "_mandos._tcp".
246
355
See <https://www.iana.org/assignments/service-names-port-numbers>
247
356
port: integer; what port to announce
248
357
TXT: list of strings; TXT record for the service
386
517
follow_name_owner_changes=True),
387
518
avahi.DBUS_INTERFACE_SERVER)
388
519
self.server.connect_to_signal("StateChanged",
389
self.server_state_changed)
520
self.server_state_changed)
390
521
self.server_state_changed(self.server.GetState())
393
524
class AvahiServiceToSyslog(AvahiService):
525
def rename(self, *args, **kwargs):
395
526
"""Add the new name to the syslog messages"""
396
ret = AvahiService.rename(self)
397
syslogger.setFormatter(logging.Formatter
398
('Mandos ({}) [%(process)d]:'
399
' %(levelname)s: %(message)s'
527
ret = super(AvahiServiceToSyslog, self).rename(*args,
529
syslogger.setFormatter(logging.Formatter(
530
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
404
class Client(object):
535
# Pretend that we have a GnuTLS module
537
"""This isn't so much a class as it is a module-like namespace."""
539
library = ctypes.util.find_library("gnutls")
541
library = ctypes.util.find_library("gnutls-deb0")
542
_library = ctypes.cdll.LoadLibrary(library)
545
# Unless otherwise indicated, the constants and types below are
546
# all from the gnutls/gnutls.h C header file.
557
E_NO_CERTIFICATE_FOUND = -49
562
KEYID_USE_SHA256 = 1 # gnutls/x509.h
563
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
566
class _session_int(ctypes.Structure):
568
session_t = ctypes.POINTER(_session_int)
570
class certificate_credentials_st(ctypes.Structure):
572
certificate_credentials_t = ctypes.POINTER(
573
certificate_credentials_st)
574
certificate_type_t = ctypes.c_int
576
class datum_t(ctypes.Structure):
577
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
578
("size", ctypes.c_uint)]
580
class _openpgp_crt_int(ctypes.Structure):
582
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
583
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
584
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
585
credentials_type_t = ctypes.c_int
586
transport_ptr_t = ctypes.c_void_p
587
close_request_t = ctypes.c_int
590
class Error(Exception):
591
def __init__(self, message=None, code=None, args=()):
592
# Default usage is by a message string, but if a return
593
# code is passed, convert it to a string with
596
if message is None and code is not None:
597
message = gnutls.strerror(code).decode(
598
"utf-8", errors="replace")
599
return super(gnutls.Error, self).__init__(
602
class CertificateSecurityError(Error):
606
def __init__(self, cls):
609
def from_param(self, obj):
610
if not isinstance(obj, self.cls):
611
raise TypeError("Not of type {}: {!r}"
612
.format(self.cls.__name__, obj))
613
return ctypes.byref(obj.from_param(obj))
615
class CastToVoidPointer:
616
def __init__(self, cls):
619
def from_param(self, obj):
620
if not isinstance(obj, self.cls):
621
raise TypeError("Not of type {}: {!r}"
622
.format(self.cls.__name__, obj))
623
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
625
class With_from_param:
627
def from_param(cls, obj):
628
return obj._as_parameter_
631
class Credentials(With_from_param):
633
self._as_parameter_ = gnutls.certificate_credentials_t()
634
gnutls.certificate_allocate_credentials(self)
635
self.type = gnutls.CRD_CERTIFICATE
638
gnutls.certificate_free_credentials(self)
640
class ClientSession(With_from_param):
641
def __init__(self, socket, credentials=None):
642
self._as_parameter_ = gnutls.session_t()
643
gnutls_flags = gnutls.CLIENT
644
if gnutls.check_version(b"3.5.6"):
645
gnutls_flags |= gnutls.NO_TICKETS
647
gnutls_flags |= gnutls.ENABLE_RAWPK
648
gnutls.init(self, gnutls_flags)
650
gnutls.set_default_priority(self)
651
gnutls.transport_set_ptr(self, socket.fileno())
652
gnutls.handshake_set_private_extensions(self, True)
654
if credentials is None:
655
credentials = gnutls.Credentials()
656
gnutls.credentials_set(self, credentials.type,
658
self.credentials = credentials
664
return gnutls.handshake(self)
666
def send(self, data):
670
data_len -= gnutls.record_send(self, data[-data_len:],
674
return gnutls.bye(self, gnutls.SHUT_RDWR)
676
# Error handling functions
677
def _error_code(result):
678
"""A function to raise exceptions on errors, suitable
679
for the "restype" attribute on ctypes functions"""
680
if result >= gnutls.E_SUCCESS:
682
if result == gnutls.E_NO_CERTIFICATE_FOUND:
683
raise gnutls.CertificateSecurityError(code=result)
684
raise gnutls.Error(code=result)
686
def _retry_on_error(result, func, arguments,
687
_error_code=_error_code):
688
"""A function to retry on some errors, suitable
689
for the "errcheck" attribute on ctypes functions"""
690
while result < gnutls.E_SUCCESS:
691
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
692
return _error_code(result)
693
result = func(*arguments)
696
# Unless otherwise indicated, the function declarations below are
697
# all from the gnutls/gnutls.h C header file.
700
priority_set_direct = _library.gnutls_priority_set_direct
701
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
702
ctypes.POINTER(ctypes.c_char_p)]
703
priority_set_direct.restype = _error_code
705
init = _library.gnutls_init
706
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
707
init.restype = _error_code
709
set_default_priority = _library.gnutls_set_default_priority
710
set_default_priority.argtypes = [ClientSession]
711
set_default_priority.restype = _error_code
713
record_send = _library.gnutls_record_send
714
record_send.argtypes = [ClientSession, ctypes.c_void_p,
716
record_send.restype = ctypes.c_ssize_t
717
record_send.errcheck = _retry_on_error
719
certificate_allocate_credentials = (
720
_library.gnutls_certificate_allocate_credentials)
721
certificate_allocate_credentials.argtypes = [
722
PointerTo(Credentials)]
723
certificate_allocate_credentials.restype = _error_code
725
certificate_free_credentials = (
726
_library.gnutls_certificate_free_credentials)
727
certificate_free_credentials.argtypes = [Credentials]
728
certificate_free_credentials.restype = None
730
handshake_set_private_extensions = (
731
_library.gnutls_handshake_set_private_extensions)
732
handshake_set_private_extensions.argtypes = [ClientSession,
734
handshake_set_private_extensions.restype = None
736
credentials_set = _library.gnutls_credentials_set
737
credentials_set.argtypes = [ClientSession, credentials_type_t,
738
CastToVoidPointer(Credentials)]
739
credentials_set.restype = _error_code
741
strerror = _library.gnutls_strerror
742
strerror.argtypes = [ctypes.c_int]
743
strerror.restype = ctypes.c_char_p
745
certificate_type_get = _library.gnutls_certificate_type_get
746
certificate_type_get.argtypes = [ClientSession]
747
certificate_type_get.restype = _error_code
749
certificate_get_peers = _library.gnutls_certificate_get_peers
750
certificate_get_peers.argtypes = [ClientSession,
751
ctypes.POINTER(ctypes.c_uint)]
752
certificate_get_peers.restype = ctypes.POINTER(datum_t)
754
global_set_log_level = _library.gnutls_global_set_log_level
755
global_set_log_level.argtypes = [ctypes.c_int]
756
global_set_log_level.restype = None
758
global_set_log_function = _library.gnutls_global_set_log_function
759
global_set_log_function.argtypes = [log_func]
760
global_set_log_function.restype = None
762
deinit = _library.gnutls_deinit
763
deinit.argtypes = [ClientSession]
764
deinit.restype = None
766
handshake = _library.gnutls_handshake
767
handshake.argtypes = [ClientSession]
768
handshake.restype = ctypes.c_int
769
handshake.errcheck = _retry_on_error
771
transport_set_ptr = _library.gnutls_transport_set_ptr
772
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
773
transport_set_ptr.restype = None
775
bye = _library.gnutls_bye
776
bye.argtypes = [ClientSession, close_request_t]
777
bye.restype = ctypes.c_int
778
bye.errcheck = _retry_on_error
780
check_version = _library.gnutls_check_version
781
check_version.argtypes = [ctypes.c_char_p]
782
check_version.restype = ctypes.c_char_p
784
_need_version = b"3.3.0"
785
if check_version(_need_version) is None:
786
raise self.Error("Needs GnuTLS {} or later"
787
.format(_need_version))
789
_tls_rawpk_version = b"3.6.6"
790
has_rawpk = bool(check_version(_tls_rawpk_version))
794
class pubkey_st(ctypes.Structure):
796
pubkey_t = ctypes.POINTER(pubkey_st)
798
x509_crt_fmt_t = ctypes.c_int
800
# All the function declarations below are from
802
pubkey_init = _library.gnutls_pubkey_init
803
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
804
pubkey_init.restype = _error_code
806
pubkey_import = _library.gnutls_pubkey_import
807
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
809
pubkey_import.restype = _error_code
811
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
812
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
813
ctypes.POINTER(ctypes.c_ubyte),
814
ctypes.POINTER(ctypes.c_size_t)]
815
pubkey_get_key_id.restype = _error_code
817
pubkey_deinit = _library.gnutls_pubkey_deinit
818
pubkey_deinit.argtypes = [pubkey_t]
819
pubkey_deinit.restype = None
821
# All the function declarations below are from
824
openpgp_crt_init = _library.gnutls_openpgp_crt_init
825
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
826
openpgp_crt_init.restype = _error_code
828
openpgp_crt_import = _library.gnutls_openpgp_crt_import
829
openpgp_crt_import.argtypes = [openpgp_crt_t,
830
ctypes.POINTER(datum_t),
832
openpgp_crt_import.restype = _error_code
834
openpgp_crt_verify_self = \
835
_library.gnutls_openpgp_crt_verify_self
836
openpgp_crt_verify_self.argtypes = [
839
ctypes.POINTER(ctypes.c_uint),
841
openpgp_crt_verify_self.restype = _error_code
843
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
844
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
845
openpgp_crt_deinit.restype = None
847
openpgp_crt_get_fingerprint = (
848
_library.gnutls_openpgp_crt_get_fingerprint)
849
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
853
openpgp_crt_get_fingerprint.restype = _error_code
855
if check_version(b"3.6.4"):
856
certificate_type_get2 = _library.gnutls_certificate_type_get2
857
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
858
certificate_type_get2.restype = _error_code
860
# Remove non-public functions
861
del _error_code, _retry_on_error
864
def call_pipe(connection, # : multiprocessing.Connection
865
func, *args, **kwargs):
866
"""This function is meant to be called by multiprocessing.Process
868
This function runs func(*args, **kwargs), and writes the resulting
869
return value on the provided multiprocessing.Connection.
871
connection.send(func(*args, **kwargs))
405
876
"""A representation of a client host served by this server.
408
approved: bool(); 'None' if not yet approved/disapproved
879
approved: bool(); None if not yet approved/disapproved
409
880
approval_delay: datetime.timedelta(); Time to wait for approval
410
881
approval_duration: datetime.timedelta(); Duration of one approval
411
checker: subprocess.Popen(); a running checker process used
412
to see if the client lives.
413
'None' if no process is running.
414
checker_callback_tag: a gobject event source tag, or None
882
checker: multiprocessing.Process(); a running checker process used
883
to see if the client lives. None if no process is
885
checker_callback_tag: a GLib event source tag, or None
415
886
checker_command: string; External command which is run to check
416
887
if client lives. %() expansions are done at
417
888
runtime with vars(self) as dict, so that for
418
889
instance %(name)s can be used in the command.
419
checker_initiator_tag: a gobject event source tag, or None
890
checker_initiator_tag: a GLib event source tag, or None
420
891
created: datetime.datetime(); (UTC) object creation
421
892
client_structure: Object describing what attributes a client has
422
893
and is used for storing the client at exit
423
894
current_checker_command: string; current running checker_command
424
disable_initiator_tag: a gobject event source tag, or None
895
disable_initiator_tag: a GLib event source tag, or None
426
897
fingerprint: string (40 or 32 hexadecimal digits); used to
427
uniquely identify the client
898
uniquely identify an OpenPGP client
899
key_id: string (64 hexadecimal digits); used to uniquely identify
900
a client using raw public keys
428
901
host: string; available for use by the checker command
429
902
interval: datetime.timedelta(); How often to start a new checker
430
903
last_approval_request: datetime.datetime(); (UTC) or None
582
1060
logger.info("Disabling client %s", self.name)
583
1061
if getattr(self, "disable_initiator_tag", None) is not None:
584
gobject.source_remove(self.disable_initiator_tag)
1062
GLib.source_remove(self.disable_initiator_tag)
585
1063
self.disable_initiator_tag = None
586
1064
self.expires = None
587
1065
if getattr(self, "checker_initiator_tag", None) is not None:
588
gobject.source_remove(self.checker_initiator_tag)
1066
GLib.source_remove(self.checker_initiator_tag)
589
1067
self.checker_initiator_tag = None
590
1068
self.stop_checker()
591
1069
self.enabled = False
593
1071
self.send_changedstate()
594
# Do not run this again if called by a gobject.timeout_add
1072
# Do not run this again if called by a GLib.timeout_add
597
1075
def __del__(self):
600
1078
def init_checker(self):
601
1079
# Schedule a new checker to be started an 'interval' from now,
602
1080
# and every interval from then on.
603
1081
if self.checker_initiator_tag is not None:
604
gobject.source_remove(self.checker_initiator_tag)
605
self.checker_initiator_tag = (gobject.timeout_add
607
.total_seconds() * 1000),
1082
GLib.source_remove(self.checker_initiator_tag)
1083
self.checker_initiator_tag = GLib.timeout_add(
1084
random.randrange(int(self.interval.total_seconds() * 1000
609
1087
# Schedule a disable() when 'timeout' has passed
610
1088
if self.disable_initiator_tag is not None:
611
gobject.source_remove(self.disable_initiator_tag)
612
self.disable_initiator_tag = (gobject.timeout_add
614
.total_seconds() * 1000),
1089
GLib.source_remove(self.disable_initiator_tag)
1090
self.disable_initiator_tag = GLib.timeout_add(
1091
int(self.timeout.total_seconds() * 1000), self.disable)
616
1092
# Also start a new checker *right now*.
617
1093
self.start_checker()
619
def checker_callback(self, pid, condition, command):
1095
def checker_callback(self, source, condition, connection,
620
1097
"""The checker has completed, so take appropriate actions."""
1098
# Read return code from connection (see call_pipe)
1099
returncode = connection.recv()
1101
if self.checker is not None:
621
1103
self.checker_callback_tag = None
622
1104
self.checker = None
623
if os.WIFEXITED(condition):
624
self.last_checker_status = os.WEXITSTATUS(condition)
1107
self.last_checker_status = returncode
1108
self.last_checker_signal = None
625
1109
if self.last_checker_status == 0:
626
1110
logger.info("Checker for %(name)s succeeded",
628
1112
self.checked_ok()
630
logger.info("Checker for %(name)s failed",
1114
logger.info("Checker for %(name)s failed", vars(self))
633
1116
self.last_checker_status = -1
1117
self.last_checker_signal = -returncode
634
1118
logger.warning("Checker for %(name)s crashed?",
637
1122
def checked_ok(self):
638
1123
"""Assert that the client has been seen, alive and well."""
639
1124
self.last_checked_ok = datetime.datetime.utcnow()
640
1125
self.last_checker_status = 0
1126
self.last_checker_signal = None
641
1127
self.bump_timeout()
643
1129
def bump_timeout(self, timeout=None):
644
1130
"""Bump up the timeout for this client."""
645
1131
if timeout is None:
646
1132
timeout = self.timeout
647
1133
if self.disable_initiator_tag is not None:
648
gobject.source_remove(self.disable_initiator_tag)
1134
GLib.source_remove(self.disable_initiator_tag)
649
1135
self.disable_initiator_tag = None
650
1136
if getattr(self, "enabled", False):
651
self.disable_initiator_tag = (gobject.timeout_add
652
(int(timeout.total_seconds()
653
* 1000), self.disable))
1137
self.disable_initiator_tag = GLib.timeout_add(
1138
int(timeout.total_seconds() * 1000), self.disable)
654
1139
self.expires = datetime.datetime.utcnow() + timeout
656
1141
def need_approval(self):
657
1142
self.last_approval_request = datetime.datetime.utcnow()
659
1144
def start_checker(self):
660
1145
"""Start a new checker subprocess if one is not running.
662
1147
If a checker already exists, leave it running and do
664
1149
# The reason for not killing a running checker is that if we
669
1154
# checkers alone, the checker would have to take more time
670
1155
# than 'timeout' for the client to be disabled, which is as it
673
# If a checker exists, make sure it is not a zombie
675
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
676
except AttributeError:
678
except OSError as error:
679
if error.errno != errno.ECHILD:
683
logger.warning("Checker was a zombie")
684
gobject.source_remove(self.checker_callback_tag)
685
self.checker_callback(pid, status,
686
self.current_checker_command)
1158
if self.checker is not None and not self.checker.is_alive():
1159
logger.warning("Checker was not alive; joining")
687
1162
# Start a new checker if needed
688
1163
if self.checker is None:
689
1164
# Escape attributes for the shell
690
escaped_attrs = { attr:
691
re.escape(str(getattr(self, attr)))
692
for attr in self.runtime_expansions }
1166
attr: shlex.quote(str(getattr(self, attr)))
1167
for attr in self.runtime_expansions}
694
1169
command = self.checker_command % escaped_attrs
695
1170
except TypeError as error:
696
1171
logger.error('Could not format string "%s"',
697
self.checker_command, exc_info=error)
698
return True # Try again later
1172
self.checker_command,
1174
return True # Try again later
699
1175
self.current_checker_command = command
701
logger.info("Starting checker %r for %s",
703
# We don't need to redirect stdout and stderr, since
704
# in normal mode, that is already done by daemon(),
705
# and in debug mode we don't want to. (Stdin is
706
# always replaced by /dev/null.)
707
# The exception is when not debugging but nevertheless
708
# running in the foreground; use the previously
711
if (not self.server_settings["debug"]
712
and self.server_settings["foreground"]):
713
popen_args.update({"stdout": wnull,
715
self.checker = subprocess.Popen(command,
719
except OSError as error:
720
logger.error("Failed to start subprocess",
723
self.checker_callback_tag = (gobject.child_watch_add
725
self.checker_callback,
727
# The checker may have completed before the gobject
728
# watch was added. Check for this.
730
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
731
except OSError as error:
732
if error.errno == errno.ECHILD:
733
# This should never happen
734
logger.error("Child process vanished",
739
gobject.source_remove(self.checker_callback_tag)
740
self.checker_callback(pid, status, command)
741
# Re-run this periodically if run by gobject.timeout_add
1176
logger.info("Starting checker %r for %s", command,
1178
# We don't need to redirect stdout and stderr, since
1179
# in normal mode, that is already done by daemon(),
1180
# and in debug mode we don't want to. (Stdin is
1181
# always replaced by /dev/null.)
1182
# The exception is when not debugging but nevertheless
1183
# running in the foreground; use the previously
1185
popen_args = {"close_fds": True,
1188
if (not self.server_settings["debug"]
1189
and self.server_settings["foreground"]):
1190
popen_args.update({"stdout": wnull,
1192
pipe = multiprocessing.Pipe(duplex=False)
1193
self.checker = multiprocessing.Process(
1195
args=(pipe[1], subprocess.call, command),
1197
self.checker.start()
1198
self.checker_callback_tag = GLib.io_add_watch(
1199
GLib.IOChannel.unix_new(pipe[0].fileno()),
1200
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1201
self.checker_callback, pipe[0], command)
1202
# Re-run this periodically if run by GLib.timeout_add
744
1205
def stop_checker(self):
745
1206
"""Force the checker process, if any, to stop."""
746
1207
if self.checker_callback_tag:
747
gobject.source_remove(self.checker_callback_tag)
1208
GLib.source_remove(self.checker_callback_tag)
748
1209
self.checker_callback_tag = None
749
1210
if getattr(self, "checker", None) is None:
751
1212
logger.debug("Stopping checker for %(name)s", vars(self))
753
self.checker.terminate()
755
#if self.checker.poll() is None:
756
# self.checker.kill()
757
except OSError as error:
758
if error.errno != errno.ESRCH: # No such process
1213
self.checker.terminate()
760
1214
self.checker = None
763
def dbus_service_property(dbus_interface, signature="v",
764
access="readwrite", byte_arrays=False):
1217
def dbus_service_property(dbus_interface,
765
1221
"""Decorators for marking methods of a DBusObjectWithProperties to
766
1222
become properties on the D-Bus.
768
1224
The decorated method will be called with no arguments by "Get"
769
1225
and with one argument by "Set".
771
1227
The parameters, where they are supported, are the same as
772
1228
dbus.service.method, except there is only "signature", since the
773
1229
type from Get() and the type sent to Set() is the same.
847
class DBusObjectWithProperties(dbus.service.Object):
848
"""A D-Bus object with properties.
850
Classes inheriting from this can use the dbus_service_property
851
decorator to expose methods as D-Bus properties. It exposes the
852
standard Get(), Set(), and GetAll() methods on the D-Bus.
1312
class DBusObjectWithAnnotations(dbus.service.Object):
1313
"""A D-Bus object with annotations.
1315
Classes inheriting from this can use the dbus_annotations
1316
decorator to add annotations to methods or signals.
856
1320
def _is_dbus_thing(thing):
857
1321
"""Returns a function testing if an attribute is a D-Bus thing
859
1323
If called like _is_dbus_thing("method") it returns a function
860
1324
suitable for use as predicate to inspect.getmembers().
862
1326
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
865
1329
def _get_all_dbus_things(self, thing):
866
1330
"""Returns a generator of (name, attribute) pairs
868
return ((getattr(athing.__get__(self), "_dbus_name",
1332
return ((getattr(athing.__get__(self), "_dbus_name", name),
870
1333
athing.__get__(self))
871
1334
for cls in self.__class__.__mro__
872
1335
for name, athing in
873
inspect.getmembers(cls,
874
self._is_dbus_thing(thing)))
1336
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1338
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1340
path_keyword="object_path",
1341
connection_keyword="connection")
1342
def Introspect(self, object_path, connection):
1343
"""Overloading of standard D-Bus method.
1345
Inserts annotation tags on methods and signals.
1347
xmlstring = dbus.service.Object.Introspect(self, object_path,
1350
document = xml.dom.minidom.parseString(xmlstring)
1352
for if_tag in document.getElementsByTagName("interface"):
1353
# Add annotation tags
1354
for typ in ("method", "signal"):
1355
for tag in if_tag.getElementsByTagName(typ):
1357
for name, prop in (self.
1358
_get_all_dbus_things(typ)):
1359
if (name == tag.getAttribute("name")
1360
and prop._dbus_interface
1361
== if_tag.getAttribute("name")):
1362
annots.update(getattr(
1363
prop, "_dbus_annotations", {}))
1364
for name, value in annots.items():
1365
ann_tag = document.createElement(
1367
ann_tag.setAttribute("name", name)
1368
ann_tag.setAttribute("value", value)
1369
tag.appendChild(ann_tag)
1370
# Add interface annotation tags
1371
for annotation, value in dict(
1372
itertools.chain.from_iterable(
1373
annotations().items()
1374
for name, annotations
1375
in self._get_all_dbus_things("interface")
1376
if name == if_tag.getAttribute("name")
1378
ann_tag = document.createElement("annotation")
1379
ann_tag.setAttribute("name", annotation)
1380
ann_tag.setAttribute("value", value)
1381
if_tag.appendChild(ann_tag)
1382
# Fix argument name for the Introspect method itself
1383
if (if_tag.getAttribute("name")
1384
== dbus.INTROSPECTABLE_IFACE):
1385
for cn in if_tag.getElementsByTagName("method"):
1386
if cn.getAttribute("name") == "Introspect":
1387
for arg in cn.getElementsByTagName("arg"):
1388
if (arg.getAttribute("direction")
1390
arg.setAttribute("name",
1392
xmlstring = document.toxml("utf-8")
1394
except (AttributeError, xml.dom.DOMException,
1395
xml.parsers.expat.ExpatError) as error:
1396
logger.error("Failed to override Introspection method",
1401
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1402
"""A D-Bus object with properties.
1404
Classes inheriting from this can use the dbus_service_property
1405
decorator to expose methods as D-Bus properties. It exposes the
1406
standard Get(), Set(), and GetAll() methods on the D-Bus.
876
1409
def _get_dbus_property(self, interface_name, property_name):
877
1410
"""Returns a bound method if one exists which is a D-Bus
878
1411
property with the specified name and interface.
880
for cls in self.__class__.__mro__:
881
for name, value in (inspect.getmembers
883
self._is_dbus_thing("property"))):
1413
for cls in self.__class__.__mro__:
1414
for name, value in inspect.getmembers(
1415
cls, self._is_dbus_thing("property")):
884
1416
if (value._dbus_name == property_name
885
1417
and value._dbus_interface == interface_name):
886
1418
return value.__get__(self)
888
1420
# No such property
889
raise DBusPropertyNotFound(self.dbus_object_path + ":"
890
+ interface_name + "."
893
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1421
raise DBusPropertyNotFound("{}:{}.{}".format(
1422
self.dbus_object_path, interface_name, property_name))
1425
def _get_all_interface_names(cls):
1426
"""Get a sequence of all interfaces supported by an object"""
1427
return (name for name in set(getattr(getattr(x, attr),
1428
"_dbus_interface", None)
1429
for x in (inspect.getmro(cls))
1431
if name is not None)
1433
@dbus.service.method(dbus.PROPERTIES_IFACE,
894
1435
out_signature="v")
895
1436
def Get(self, interface_name, property_name):
896
1437
"""Standard D-Bus property Get() method, see D-Bus standard.
1028
1565
return xmlstring
1569
dbus.OBJECT_MANAGER_IFACE
1570
except AttributeError:
1571
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1574
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1575
"""A D-Bus object with an ObjectManager.
1577
Classes inheriting from this exposes the standard
1578
GetManagedObjects call and the InterfacesAdded and
1579
InterfacesRemoved signals on the standard
1580
"org.freedesktop.DBus.ObjectManager" interface.
1582
Note: No signals are sent automatically; they must be sent
1585
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1586
out_signature="a{oa{sa{sv}}}")
1587
def GetManagedObjects(self):
1588
"""This function must be overridden"""
1589
raise NotImplementedError()
1591
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1592
signature="oa{sa{sv}}")
1593
def InterfacesAdded(self, object_path, interfaces_and_properties):
1596
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1597
def InterfacesRemoved(self, object_path, interfaces):
1600
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1602
path_keyword="object_path",
1603
connection_keyword="connection")
1604
def Introspect(self, object_path, connection):
1605
"""Overloading of standard D-Bus method.
1607
Override return argument name of GetManagedObjects to be
1608
"objpath_interfaces_and_properties"
1610
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1614
document = xml.dom.minidom.parseString(xmlstring)
1616
for if_tag in document.getElementsByTagName("interface"):
1617
# Fix argument name for the GetManagedObjects method
1618
if (if_tag.getAttribute("name")
1619
== dbus.OBJECT_MANAGER_IFACE):
1620
for cn in if_tag.getElementsByTagName("method"):
1621
if (cn.getAttribute("name")
1622
== "GetManagedObjects"):
1623
for arg in cn.getElementsByTagName("arg"):
1624
if (arg.getAttribute("direction")
1628
"objpath_interfaces"
1630
xmlstring = document.toxml("utf-8")
1632
except (AttributeError, xml.dom.DOMException,
1633
xml.parsers.expat.ExpatError) as error:
1634
logger.error("Failed to override Introspection method",
1031
1639
def datetime_to_dbus(dt, variant_level=0):
1032
1640
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1034
return dbus.String("", variant_level = variant_level)
1035
return dbus.String(dt.isoformat(),
1036
variant_level=variant_level)
1642
return dbus.String("", variant_level=variant_level)
1643
return dbus.String(dt.isoformat(), variant_level=variant_level)
1039
1646
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1389
2007
server to mandos-client
1393
2011
# Rejected - signal
1394
2012
@dbus.service.signal(_interface, signature="s")
1395
2013
def Rejected(self, reason):
1399
2017
# NeedApproval - signal
1400
2018
@dbus.service.signal(_interface, signature="tb")
1401
2019
def NeedApproval(self, timeout, default):
1403
2021
return self.need_approval()
1407
2025
# Approve - method
1408
2026
@dbus.service.method(_interface, in_signature="b")
1409
2027
def Approve(self, value):
1410
2028
self.approve(value)
1412
2030
# CheckedOK - method
1413
2031
@dbus.service.method(_interface)
1414
2032
def CheckedOK(self):
1415
2033
self.checked_ok()
1417
2035
# Enable - method
2036
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1418
2037
@dbus.service.method(_interface)
1419
2038
def Enable(self):
1423
2042
# StartChecker - method
2043
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1424
2044
@dbus.service.method(_interface)
1425
2045
def StartChecker(self):
1427
2047
self.start_checker()
1429
2049
# Disable - method
2050
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1430
2051
@dbus.service.method(_interface)
1431
2052
def Disable(self):
1435
2056
# StopChecker - method
2057
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1436
2058
@dbus.service.method(_interface)
1437
2059
def StopChecker(self):
1438
2060
self.stop_checker()
1442
2064
# ApprovalPending - property
1443
2065
@dbus_service_property(_interface, signature="b", access="read")
1444
2066
def ApprovalPending_dbus_property(self):
1445
2067
return dbus.Boolean(bool(self.approvals_pending))
1447
2069
# ApprovedByDefault - property
1448
@dbus_service_property(_interface, signature="b",
2070
@dbus_service_property(_interface,
1449
2072
access="readwrite")
1450
2073
def ApprovedByDefault_dbus_property(self, value=None):
1451
2074
if value is None: # get
1452
2075
return dbus.Boolean(self.approved_by_default)
1453
2076
self.approved_by_default = bool(value)
1455
2078
# ApprovalDelay - property
1456
@dbus_service_property(_interface, signature="t",
2079
@dbus_service_property(_interface,
1457
2081
access="readwrite")
1458
2082
def ApprovalDelay_dbus_property(self, value=None):
1459
2083
if value is None: # get
1460
2084
return dbus.UInt64(self.approval_delay.total_seconds()
1462
2086
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1464
2088
# ApprovalDuration - property
1465
@dbus_service_property(_interface, signature="t",
2089
@dbus_service_property(_interface,
1466
2091
access="readwrite")
1467
2092
def ApprovalDuration_dbus_property(self, value=None):
1468
2093
if value is None: # get
1469
2094
return dbus.UInt64(self.approval_duration.total_seconds()
1471
2096
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1473
2098
# Name - property
2100
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1474
2101
@dbus_service_property(_interface, signature="s", access="read")
1475
2102
def Name_dbus_property(self):
1476
2103
return dbus.String(self.name)
2107
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2108
@dbus_service_property(_interface, signature="s", access="read")
2109
def KeyID_dbus_property(self):
2110
return dbus.String(self.key_id)
1478
2112
# Fingerprint - property
2114
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1479
2115
@dbus_service_property(_interface, signature="s", access="read")
1480
2116
def Fingerprint_dbus_property(self):
1481
2117
return dbus.String(self.fingerprint)
1483
2119
# Host - property
1484
@dbus_service_property(_interface, signature="s",
2120
@dbus_service_property(_interface,
1485
2122
access="readwrite")
1486
2123
def Host_dbus_property(self, value=None):
1487
2124
if value is None: # get
1488
2125
return dbus.String(self.host)
1489
2126
self.host = str(value)
1491
2128
# Created - property
2130
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1492
2131
@dbus_service_property(_interface, signature="s", access="read")
1493
2132
def Created_dbus_property(self):
1494
2133
return datetime_to_dbus(self.created)
1496
2135
# LastEnabled - property
1497
2136
@dbus_service_property(_interface, signature="s", access="read")
1498
2137
def LastEnabled_dbus_property(self):
1499
2138
return datetime_to_dbus(self.last_enabled)
1501
2140
# Enabled - property
1502
@dbus_service_property(_interface, signature="b",
2141
@dbus_service_property(_interface,
1503
2143
access="readwrite")
1504
2144
def Enabled_dbus_property(self, value=None):
1505
2145
if value is None: # get
1602
2246
self.start_checker()
1604
2248
self.stop_checker()
1606
2250
# ObjectPath - property
2252
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",
2253
"org.freedesktop.DBus.Deprecated": "true"})
1607
2254
@dbus_service_property(_interface, signature="o", access="read")
1608
2255
def ObjectPath_dbus_property(self):
1609
return self.dbus_object_path # is already a dbus.ObjectPath
2256
return self.dbus_object_path # is already a dbus.ObjectPath
1611
2258
# Secret = property
1612
@dbus_service_property(_interface, signature="ay",
1613
access="write", byte_arrays=True)
2260
{"org.freedesktop.DBus.Property.EmitsChangedSignal":
2262
@dbus_service_property(_interface,
1614
2266
def Secret_dbus_property(self, value):
1615
2267
self.secret = bytes(value)
1620
class ProxyClient(object):
1621
def __init__(self, child_pipe, fpr, address):
2273
def __init__(self, child_pipe, key_id, fpr, address):
1622
2274
self._pipe = child_pipe
1623
self._pipe.send(('init', fpr, address))
2275
self._pipe.send(("init", key_id, fpr, address))
1624
2276
if not self._pipe.recv():
2277
raise KeyError(key_id or fpr)
1627
2279
def __getattribute__(self, name):
1629
2281
return super(ProxyClient, self).__getattribute__(name)
1630
self._pipe.send(('getattr', name))
2282
self._pipe.send(("getattr", name))
1631
2283
data = self._pipe.recv()
1632
if data[0] == 'data':
2284
if data[0] == "data":
1634
if data[0] == 'function':
2286
if data[0] == "function":
1635
2288
def func(*args, **kwargs):
1636
self._pipe.send(('funcall', name, args, kwargs))
2289
self._pipe.send(("funcall", name, args, kwargs))
1637
2290
return self._pipe.recv()[1]
1640
2294
def __setattr__(self, name, value):
1642
2296
return super(ProxyClient, self).__setattr__(name, value)
1643
self._pipe.send(('setattr', name, value))
2297
self._pipe.send(("setattr", name, value))
1646
2300
class ClientHandler(socketserver.BaseRequestHandler, object):
1647
2301
"""A class to handle client connections.
1649
2303
Instantiated once for each connection to handle it.
1650
2304
Note: This will run in its own forked process."""
1652
2306
def handle(self):
1653
2307
with contextlib.closing(self.server.child_pipe) as child_pipe:
1654
2308
logger.info("TCP connection from: %s",
1655
2309
str(self.client_address))
1656
2310
logger.debug("Pipe FD: %d",
1657
2311
self.server.child_pipe.fileno())
1659
session = (gnutls.connection
1660
.ClientSession(self.request,
1662
.X509Credentials()))
1664
# Note: gnutls.connection.X509Credentials is really a
1665
# generic GnuTLS certificate credentials object so long as
1666
# no X.509 keys are added to it. Therefore, we can use it
1667
# here despite using OpenPGP certificates.
1669
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1670
# "+AES-256-CBC", "+SHA1",
1671
# "+COMP-NULL", "+CTYPE-OPENPGP",
2313
session = gnutls.ClientSession(self.request)
2315
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2316
# "+AES-256-CBC", "+SHA1",
2317
# "+COMP-NULL", "+CTYPE-OPENPGP",
1673
2319
# Use a fallback default, since this MUST be set.
1674
2320
priority = self.server.gnutls_priority
1675
2321
if priority is None:
1676
2322
priority = "NORMAL"
1677
(gnutls.library.functions
1678
.gnutls_priority_set_direct(session._c_object,
2323
gnutls.priority_set_direct(session,
2324
priority.encode("utf-8"), None)
1681
2326
# Start communication using the Mandos protocol
1682
2327
# Get protocol number
1683
2328
line = self.request.makefile().readline()
1770
2428
delay -= time2 - time
1773
while sent_size < len(client.secret):
1775
sent = session.send(client.secret[sent_size:])
1776
except gnutls.errors.GNUTLSError as error:
1777
logger.warning("gnutls send failed",
1780
logger.debug("Sent: %d, remaining: %d",
1781
sent, len(client.secret)
1782
- (sent_size + sent))
2431
session.send(client.secret)
2432
except gnutls.Error as error:
2433
logger.warning("gnutls send failed",
1785
2437
logger.info("Sending secret to %s", client.name)
1786
2438
# bump the timeout using extended_timeout
1787
2439
client.bump_timeout(client.extended_timeout)
1788
2440
if self.server.use_dbus:
1789
2441
# Emit D-Bus signal
1790
2442
client.GotSecret()
1793
2445
if approval_required:
1794
2446
client.approvals_pending -= 1
1797
except gnutls.errors.GNUTLSError as error:
2449
except gnutls.Error as error:
1798
2450
logger.warning("GnuTLS bye failed",
1799
2451
exc_info=error)
1802
2454
def peer_certificate(session):
1803
"Return the peer's OpenPGP certificate as a bytestring"
1804
# If not an OpenPGP certificate...
1805
if (gnutls.library.functions
1806
.gnutls_certificate_type_get(session._c_object)
1807
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1808
# ...do the normal thing
1809
return session.peer_certificate
2455
"Return the peer's certificate as a bytestring"
2457
cert_type = gnutls.certificate_type_get2(
2458
session, gnutls.CTYPE_PEERS)
2459
except AttributeError:
2460
cert_type = gnutls.certificate_type_get(session)
2461
if gnutls.has_rawpk:
2462
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2464
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2465
# If not a valid certificate type...
2466
if cert_type not in valid_cert_types:
2467
logger.info("Cert type %r not in %r", cert_type,
2469
# ...return invalid data
1810
2471
list_size = ctypes.c_uint(1)
1811
cert_list = (gnutls.library.functions
1812
.gnutls_certificate_get_peers
1813
(session._c_object, ctypes.byref(list_size)))
2472
cert_list = (gnutls.certificate_get_peers
2473
(session, ctypes.byref(list_size)))
1814
2474
if not bool(cert_list) and list_size.value != 0:
1815
raise gnutls.errors.GNUTLSError("error getting peer"
2475
raise gnutls.Error("error getting peer certificate")
1817
2476
if list_size.value == 0:
1819
2478
cert = cert_list[0]
1820
2479
return ctypes.string_at(cert.data, cert.size)
2482
def key_id(certificate):
2483
"Convert a certificate bytestring to a hexdigit key ID"
2484
# New GnuTLS "datum" with the public key
2485
datum = gnutls.datum_t(
2486
ctypes.cast(ctypes.c_char_p(certificate),
2487
ctypes.POINTER(ctypes.c_ubyte)),
2488
ctypes.c_uint(len(certificate)))
2489
# XXX all these need to be created in the gnutls "module"
2490
# New empty GnuTLS certificate
2491
pubkey = gnutls.pubkey_t()
2492
gnutls.pubkey_init(ctypes.byref(pubkey))
2493
# Import the raw public key into the certificate
2494
gnutls.pubkey_import(pubkey,
2495
ctypes.byref(datum),
2496
gnutls.X509_FMT_DER)
2497
# New buffer for the key ID
2498
buf = ctypes.create_string_buffer(32)
2499
buf_len = ctypes.c_size_t(len(buf))
2500
# Get the key ID from the raw public key into the buffer
2501
gnutls.pubkey_get_key_id(
2503
gnutls.KEYID_USE_SHA256,
2504
ctypes.cast(ctypes.byref(buf),
2505
ctypes.POINTER(ctypes.c_ubyte)),
2506
ctypes.byref(buf_len))
2507
# Deinit the certificate
2508
gnutls.pubkey_deinit(pubkey)
2510
# Convert the buffer to a Python bytestring
2511
key_id = ctypes.string_at(buf, buf_len.value)
2512
# Convert the bytestring to hexadecimal notation
2513
hex_key_id = binascii.hexlify(key_id).upper()
1823
2517
def fingerprint(openpgp):
1824
2518
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1825
2519
# New GnuTLS "datum" with the OpenPGP public key
1826
datum = (gnutls.library.types
1827
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1830
ctypes.c_uint(len(openpgp))))
2520
datum = gnutls.datum_t(
2521
ctypes.cast(ctypes.c_char_p(openpgp),
2522
ctypes.POINTER(ctypes.c_ubyte)),
2523
ctypes.c_uint(len(openpgp)))
1831
2524
# New empty GnuTLS certificate
1832
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1833
(gnutls.library.functions
1834
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2525
crt = gnutls.openpgp_crt_t()
2526
gnutls.openpgp_crt_init(ctypes.byref(crt))
1835
2527
# Import the OpenPGP public key into the certificate
1836
(gnutls.library.functions
1837
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1838
gnutls.library.constants
1839
.GNUTLS_OPENPGP_FMT_RAW))
2528
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2529
gnutls.OPENPGP_FMT_RAW)
1840
2530
# Verify the self signature in the key
1841
2531
crtverify = ctypes.c_uint()
1842
(gnutls.library.functions
1843
.gnutls_openpgp_crt_verify_self(crt, 0,
1844
ctypes.byref(crtverify)))
2532
gnutls.openpgp_crt_verify_self(crt, 0,
2533
ctypes.byref(crtverify))
1845
2534
if crtverify.value != 0:
1846
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1847
raise (gnutls.errors.CertificateSecurityError
2535
gnutls.openpgp_crt_deinit(crt)
2536
raise gnutls.CertificateSecurityError(code
1849
2538
# New buffer for the fingerprint
1850
2539
buf = ctypes.create_string_buffer(20)
1851
2540
buf_len = ctypes.c_size_t()
1852
2541
# Get the fingerprint from the certificate into the buffer
1853
(gnutls.library.functions
1854
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1855
ctypes.byref(buf_len)))
2542
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2543
ctypes.byref(buf_len))
1856
2544
# Deinit the certificate
1857
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2545
gnutls.openpgp_crt_deinit(crt)
1858
2546
# Convert the buffer to a Python bytestring
1859
2547
fpr = ctypes.string_at(buf, buf_len.value)
1860
2548
# Convert the bytestring to hexadecimal notation
1943
2637
# socket_wrapper(), if socketfd was set.
1944
2638
socketserver.TCPServer.__init__(self, server_address,
1945
2639
RequestHandlerClass)
1947
2641
def server_bind(self):
1948
2642
"""This overrides the normal server_bind() function
1949
2643
to bind to an interface if one was specified, and also NOT to
1950
2644
bind to an address or port if they were not specified."""
2645
global SO_BINDTODEVICE
1951
2646
if self.interface is not None:
1952
2647
if SO_BINDTODEVICE is None:
1953
logger.error("SO_BINDTODEVICE does not exist;"
1954
" cannot bind to interface %s",
1958
self.socket.setsockopt(socket.SOL_SOCKET,
1960
(self.interface + "\0")
1962
except socket.error as error:
1963
if error.errno == errno.EPERM:
1964
logger.error("No permission to bind to"
1965
" interface %s", self.interface)
1966
elif error.errno == errno.ENOPROTOOPT:
1967
logger.error("SO_BINDTODEVICE not available;"
1968
" cannot bind to interface %s",
1970
elif error.errno == errno.ENODEV:
1971
logger.error("Interface %s does not exist,"
1972
" cannot bind", self.interface)
2648
# Fall back to a hard-coded value which seems to be
2650
logger.warning("SO_BINDTODEVICE not found, trying 25")
2651
SO_BINDTODEVICE = 25
2653
self.socket.setsockopt(
2654
socket.SOL_SOCKET, SO_BINDTODEVICE,
2655
(self.interface + "\0").encode("utf-8"))
2656
except socket.error as error:
2657
if error.errno == errno.EPERM:
2658
logger.error("No permission to bind to"
2659
" interface %s", self.interface)
2660
elif error.errno == errno.ENOPROTOOPT:
2661
logger.error("SO_BINDTODEVICE not available;"
2662
" cannot bind to interface %s",
2664
elif error.errno == errno.ENODEV:
2665
logger.error("Interface %s does not exist,"
2666
" cannot bind", self.interface)
1975
2669
# Only bind(2) the socket if we really need to.
1976
2670
if self.server_address[0] or self.server_address[1]:
2671
if self.server_address[1]:
2672
self.allow_reuse_address = True
1977
2673
if not self.server_address[0]:
1978
2674
if self.address_family == socket.AF_INET6:
1979
any_address = "::" # in6addr_any
2675
any_address = "::" # in6addr_any
1981
any_address = "0.0.0.0" # INADDR_ANY
2677
any_address = "0.0.0.0" # INADDR_ANY
1982
2678
self.server_address = (any_address,
1983
2679
self.server_address[1])
1984
2680
elif not self.server_address[1]:
1985
self.server_address = (self.server_address[0],
2681
self.server_address = (self.server_address[0], 0)
1987
2682
# if self.interface:
1988
2683
# self.server_address = (self.server_address[0],
2014
2714
self.gnutls_priority = gnutls_priority
2015
2715
IPv6_TCPServer.__init__(self, server_address,
2016
2716
RequestHandlerClass,
2017
interface = interface,
2018
use_ipv6 = use_ipv6,
2019
socketfd = socketfd)
2717
interface=interface,
2020
2721
def server_activate(self):
2021
2722
if self.enabled:
2022
2723
return socketserver.TCPServer.server_activate(self)
2024
2725
def enable(self):
2025
2726
self.enabled = True
2027
2728
def add_pipe(self, parent_pipe, proc):
2028
2729
# Call "handle_ipc" for both data and EOF events
2029
gobject.io_add_watch(parent_pipe.fileno(),
2030
gobject.IO_IN | gobject.IO_HUP,
2031
functools.partial(self.handle_ipc,
2036
def handle_ipc(self, source, condition, parent_pipe=None,
2037
proc = None, client_object=None):
2731
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2732
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2733
functools.partial(self.handle_ipc,
2734
parent_pipe=parent_pipe,
2737
def handle_ipc(self, source, condition,
2740
client_object=None):
2038
2741
# error, or the other end of multiprocessing.Pipe has closed
2039
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2742
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2040
2743
# Wait for other process to exit
2044
2747
# Read a request from the child
2045
2748
request = parent_pipe.recv()
2046
2749
command = request[0]
2048
if command == 'init':
2050
address = request[2]
2052
for c in self.clients.itervalues():
2053
if c.fingerprint == fpr:
2751
if command == "init":
2752
key_id = request[1].decode("ascii")
2753
fpr = request[2].decode("ascii")
2754
address = request[3]
2756
for c in self.clients.values():
2757
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2758
"27AE41E4649B934CA495991B7852B855"):
2760
if key_id and c.key_id == key_id:
2763
if fpr and c.fingerprint == fpr:
2057
logger.info("Client not found for fingerprint: %s, ad"
2058
"dress: %s", fpr, address)
2767
logger.info("Client not found for key ID: %s, address"
2768
": %s", key_id or fpr, address)
2059
2769
if self.use_dbus:
2060
2770
# Emit D-Bus signal
2061
mandos_dbus_service.ClientNotFound(fpr,
2771
mandos_dbus_service.ClientNotFound(key_id or fpr,
2063
2773
parent_pipe.send(False)
2066
gobject.io_add_watch(parent_pipe.fileno(),
2067
gobject.IO_IN | gobject.IO_HUP,
2068
functools.partial(self.handle_ipc,
2777
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2778
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2779
functools.partial(self.handle_ipc,
2780
parent_pipe=parent_pipe,
2782
client_object=client))
2074
2783
parent_pipe.send(True)
2075
2784
# remove the old hook in favor of the new above hook on
2078
if command == 'funcall':
2787
if command == "funcall":
2079
2788
funcname = request[1]
2080
2789
args = request[2]
2081
2790
kwargs = request[3]
2083
parent_pipe.send(('data', getattr(client_object,
2792
parent_pipe.send(("data", getattr(client_object,
2084
2793
funcname)(*args,
2087
if command == 'getattr':
2796
if command == "getattr":
2088
2797
attrname = request[1]
2089
if callable(client_object.__getattribute__(attrname)):
2090
parent_pipe.send(('function',))
2798
if isinstance(client_object.__getattribute__(attrname),
2799
collections.abc.Callable):
2800
parent_pipe.send(("function", ))
2092
parent_pipe.send(('data', client_object
2093
.__getattribute__(attrname)))
2095
if command == 'setattr':
2803
"data", client_object.__getattribute__(attrname)))
2805
if command == "setattr":
2096
2806
attrname = request[1]
2097
2807
value = request[2]
2098
2808
setattr(client_object, attrname, value)
2103
2813
def rfc3339_duration_to_delta(duration):
2104
2814
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2106
>>> rfc3339_duration_to_delta("P7D")
2107
datetime.timedelta(7)
2108
>>> rfc3339_duration_to_delta("PT60S")
2109
datetime.timedelta(0, 60)
2110
>>> rfc3339_duration_to_delta("PT60M")
2111
datetime.timedelta(0, 3600)
2112
>>> rfc3339_duration_to_delta("PT24H")
2113
datetime.timedelta(1)
2114
>>> rfc3339_duration_to_delta("P1W")
2115
datetime.timedelta(7)
2116
>>> rfc3339_duration_to_delta("PT5M30S")
2117
datetime.timedelta(0, 330)
2118
>>> rfc3339_duration_to_delta("P1DT3M20S")
2119
datetime.timedelta(1, 200)
2816
>>> timedelta = datetime.timedelta
2817
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2819
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2821
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2823
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2825
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2827
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2829
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2122
2834
# Parsing an RFC 3339 duration with regular expressions is not
2123
2835
# possible - there would have to be multiple places for the same
2124
2836
# values, like seconds. The current code, while more esoteric, is
2125
2837
# cleaner without depending on a parsing library. If Python had a
2126
2838
# built-in library for parsing we would use it, but we'd like to
2127
2839
# avoid excessive use of external libraries.
2129
2841
# New type for defining tokens, syntax, and semantics all-in-one
2130
Token = collections.namedtuple("Token",
2131
("regexp", # To match token; if
2132
# "value" is not None,
2133
# must have a "group"
2135
"value", # datetime.timedelta or
2137
"followers")) # Tokens valid after
2842
Token = collections.namedtuple("Token", (
2843
"regexp", # To match token; if "value" is not None, must have
2844
# a "group" containing digits
2845
"value", # datetime.timedelta or None
2846
"followers")) # Tokens valid after this token
2139
2847
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2140
2848
# the "duration" ABNF definition in RFC 3339, Appendix A.
2141
2849
token_end = Token(re.compile(r"$"), None, frozenset())
2142
2850
token_second = Token(re.compile(r"(\d+)S"),
2143
2851
datetime.timedelta(seconds=1),
2144
frozenset((token_end,)))
2852
frozenset((token_end, )))
2145
2853
token_minute = Token(re.compile(r"(\d+)M"),
2146
2854
datetime.timedelta(minutes=1),
2147
2855
frozenset((token_second, token_end)))
3187
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2476
3189
except OSError as error:
3190
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3191
.format(uid, gid, os.strerror(error.errno)))
2477
3192
if error.errno != errno.EPERM:
2481
3196
# Enable all possible GnuTLS debugging
2483
3198
# "Use a log level over 10 to enable all debugging options."
2484
3199
# - GnuTLS manual
2485
gnutls.library.functions.gnutls_global_set_log_level(11)
2487
@gnutls.library.types.gnutls_log_func
3200
gnutls.global_set_log_level(11)
2488
3203
def debug_gnutls(level, string):
2489
logger.debug("GnuTLS: %s", string[:-1])
2491
(gnutls.library.functions
2492
.gnutls_global_set_log_function(debug_gnutls))
3204
logger.debug("GnuTLS: %s",
3205
string[:-1].decode("utf-8",
3208
gnutls.global_set_log_function(debug_gnutls)
2494
3210
# Redirect stdin so all checkers get /dev/null
2495
3211
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2496
3212
os.dup2(null, sys.stdin.fileno())
2500
3216
# Need to fork before connecting to D-Bus
2501
3217
if not foreground:
2502
3218
# Close all input and output, do double fork, etc.
2505
# multiprocessing will use threads, so before we use gobject we
2506
# need to inform gobject that threads will be used.
2507
gobject.threads_init()
3221
if gi.version_info < (3, 10, 2):
3222
# multiprocessing will use threads, so before we use GLib we
3223
# need to inform GLib that threads will be used.
2509
3226
global main_loop
2510
3227
# From the Avahi example code
2511
3228
DBusGMainLoop(set_as_default=True)
2512
main_loop = gobject.MainLoop()
3229
main_loop = GLib.MainLoop()
2513
3230
bus = dbus.SystemBus()
2514
3231
# End of Avahi example code
2517
3234
bus_name = dbus.service.BusName("se.recompile.Mandos",
2518
bus, do_not_queue=True)
2519
old_bus_name = (dbus.service.BusName
2520
("se.bsnet.fukt.Mandos", bus,
2522
except dbus.exceptions.NameExistsException as e:
3237
old_bus_name = dbus.service.BusName(
3238
"se.bsnet.fukt.Mandos", bus,
3240
except dbus.exceptions.DBusException as e:
2523
3241
logger.error("Disabling D-Bus:", exc_info=e)
2524
3242
use_dbus = False
2525
3243
server_settings["use_dbus"] = False
2526
3244
tcp_server.use_dbus = False
2528
3246
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2529
service = AvahiServiceToSyslog(name =
2530
server_settings["servicename"],
2531
servicetype = "_mandos._tcp",
2532
protocol = protocol, bus = bus)
3247
service = AvahiServiceToSyslog(
3248
name=server_settings["servicename"],
3249
servicetype="_mandos._tcp",
2533
3252
if server_settings["interface"]:
2534
service.interface = (if_nametoindex
2535
(server_settings["interface"]
3253
service.interface = if_nametoindex(
3254
server_settings["interface"].encode("utf-8"))
2538
3256
global multiprocessing_manager
2539
3257
multiprocessing_manager = multiprocessing.Manager()
2541
3259
client_class = Client
2543
client_class = functools.partial(ClientDBus, bus = bus)
3261
client_class = functools.partial(ClientDBus, bus=bus)
2545
3263
client_settings = Client.config_parser(client_config)
2546
3264
old_client_settings = {}
2547
3265
clients_data = {}
2549
3267
# This is used to redirect stdout and stderr for checker processes
2551
wnull = open(os.devnull, "w") # A writable /dev/null
3269
wnull = open(os.devnull, "w") # A writable /dev/null
2552
3270
# Only used if server is running in foreground but not in debug
2554
3272
if debug or not foreground:
2557
3275
# Get client data and settings from last running state.
2558
3276
if server_settings["restore"]:
2560
3278
with open(stored_state_path, "rb") as stored_state:
2561
clients_data, old_client_settings = (pickle.load
3279
if sys.version_info.major == 2:
3280
clients_data, old_client_settings = pickle.load(
3283
bytes_clients_data, bytes_old_client_settings = (
3284
pickle.load(stored_state, encoding="bytes"))
3285
# Fix bytes to strings
3288
clients_data = {(key.decode("utf-8")
3289
if isinstance(key, bytes)
3292
bytes_clients_data.items()}
3293
del bytes_clients_data
3294
for key in clients_data:
3295
value = {(k.decode("utf-8")
3296
if isinstance(k, bytes) else k): v
3298
clients_data[key].items()}
3299
clients_data[key] = value
3301
value["client_structure"] = [
3303
if isinstance(s, bytes)
3305
value["client_structure"]]
3306
# .name, .host, and .checker_command
3307
for k in ("name", "host", "checker_command"):
3308
if isinstance(value[k], bytes):
3309
value[k] = value[k].decode("utf-8")
3310
if "key_id" not in value:
3311
value["key_id"] = ""
3312
elif "fingerprint" not in value:
3313
value["fingerprint"] = ""
3314
# old_client_settings
3316
old_client_settings = {
3317
(key.decode("utf-8")
3318
if isinstance(key, bytes)
3321
bytes_old_client_settings.items()}
3322
del bytes_old_client_settings
3323
# .host and .checker_command
3324
for value in old_client_settings.values():
3325
for attribute in ("host", "checker_command"):
3326
if isinstance(value[attribute], bytes):
3327
value[attribute] = (value[attribute]
2563
3329
os.remove(stored_state_path)
2564
3330
except IOError as e:
2565
3331
if e.errno == errno.ENOENT:
2566
logger.warning("Could not load persistent state: {}"
2567
.format(os.strerror(e.errno)))
3332
logger.warning("Could not load persistent state:"
3333
" {}".format(os.strerror(e.errno)))
2569
3335
logger.critical("Could not load persistent state:",
2572
3338
except EOFError as e:
2573
3339
logger.warning("Could not load persistent state: "
2574
"EOFError:", exc_info=e)
2576
3343
with PGPEngine() as pgp:
2577
3344
for client_name, client in clients_data.items():
2578
3345
# Skip removed clients
2579
3346
if client_name not in client_settings:
2582
3349
# Decide which value to use after restoring saved state.
2583
3350
# We have three different values: Old config file,
2584
3351
# new config file, and saved state.
2642
3409
for client_name in (set(client_settings)
2643
3410
- set(old_client_settings)):
2644
3411
clients_data[client_name] = client_settings[client_name]
2646
3413
# Create all client objects
2647
3414
for client_name, client in clients_data.items():
2648
3415
tcp_server.clients[client_name] = client_class(
2649
name = client_name, settings = client,
2650
server_settings = server_settings)
3418
server_settings=server_settings)
2652
3420
if not tcp_server.clients:
2653
3421
logger.warning("No clients defined")
2655
3423
if not foreground:
2656
3424
if pidfile is not None:
2660
pidfile.write("{}\n".format(pid).encode("utf-8"))
3428
print(pid, file=pidfile)
2661
3429
except IOError:
2662
3430
logger.error("Could not write to file %r with PID %d",
2663
3431
pidfilename, pid)
2665
3433
del pidfilename
2667
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2668
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3435
for termsig in (signal.SIGHUP, signal.SIGTERM):
3436
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3437
lambda: main_loop.quit() and False)
2671
@alternate_dbus_interfaces({"se.recompile.Mandos":
2672
"se.bsnet.fukt.Mandos"})
2673
class MandosDBusService(DBusObjectWithProperties):
3441
@alternate_dbus_interfaces(
3442
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3443
class MandosDBusService(DBusObjectWithObjectManager):
2674
3444
"""A D-Bus proxy object"""
2675
3446
def __init__(self):
2676
3447
dbus.service.Object.__init__(self, bus, "/")
2677
3449
_interface = "se.recompile.Mandos"
2679
@dbus_interface_annotations(_interface)
2681
return { "org.freedesktop.DBus.Property"
2682
".EmitsChangedSignal":
2685
3451
@dbus.service.signal(_interface, signature="o")
2686
3452
def ClientAdded(self, objpath):
2690
3456
@dbus.service.signal(_interface, signature="ss")
2691
def ClientNotFound(self, fingerprint, address):
3457
def ClientNotFound(self, key_id, address):
3461
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2695
3463
@dbus.service.signal(_interface, signature="os")
2696
3464
def ClientRemoved(self, objpath, name):
3468
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2700
3470
@dbus.service.method(_interface, out_signature="ao")
2701
3471
def GetAllClients(self):
2703
return dbus.Array(c.dbus_object_path
2705
tcp_server.clients.itervalues())
3473
return dbus.Array(c.dbus_object_path for c in
3474
tcp_server.clients.values())
3476
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2707
3478
@dbus.service.method(_interface,
2708
3479
out_signature="a{oa{sv}}")
2709
3480
def GetAllClientsWithProperties(self):
2711
3482
return dbus.Dictionary(
2712
((c.dbus_object_path, c.GetAll(""))
2713
for c in tcp_server.clients.itervalues()),
3483
{c.dbus_object_path: c.GetAll(
3484
"se.recompile.Mandos.Client")
3485
for c in tcp_server.clients.values()},
2714
3486
signature="oa{sv}")
2716
3488
@dbus.service.method(_interface, in_signature="o")
2717
3489
def RemoveClient(self, object_path):
2719
for c in tcp_server.clients.itervalues():
3491
for c in tcp_server.clients.values():
2720
3492
if c.dbus_object_path == object_path:
2721
3493
del tcp_server.clients[c.name]
2722
3494
c.remove_from_connection()
2723
# Don't signal anything except ClientRemoved
3495
# Don't signal the disabling
2724
3496
c.disable(quiet=True)
2726
self.ClientRemoved(object_path, c.name)
3497
# Emit D-Bus signal for removal
3498
self.client_removed_signal(c)
2728
3500
raise KeyError(object_path)
3504
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3505
out_signature="a{oa{sa{sv}}}")
3506
def GetManagedObjects(self):
3508
return dbus.Dictionary(
3509
{client.dbus_object_path:
3511
{interface: client.GetAll(interface)
3513
client._get_all_interface_names()})
3514
for client in tcp_server.clients.values()})
3516
def client_added_signal(self, client):
3517
"""Send the new standard signal and the old signal"""
3519
# New standard signal
3520
self.InterfacesAdded(
3521
client.dbus_object_path,
3523
{interface: client.GetAll(interface)
3525
client._get_all_interface_names()}))
3527
self.ClientAdded(client.dbus_object_path)
3529
def client_removed_signal(self, client):
3530
"""Send the new standard signal and the old signal"""
3532
# New standard signal
3533
self.InterfacesRemoved(
3534
client.dbus_object_path,
3535
client._get_all_interface_names())
3537
self.ClientRemoved(client.dbus_object_path,
2732
3540
mandos_dbus_service = MandosDBusService()
3542
# Save modules to variables to exempt the modules from being
3543
# unloaded before the function registered with atexit() is run.
3544
mp = multiprocessing
2735
3548
"Cleanup function; run on exit"
2737
3550
service.cleanup()
2739
multiprocessing.active_children()
3552
mp.active_children()
2741
3554
if not (tcp_server.clients or client_settings):
2744
3557
# Store client before exiting. Secrets are encrypted with key
2745
3558
# based on what config file has. If config file is
2746
3559
# removed/edited, old secret will thus be unrecovable.
2748
3561
with PGPEngine() as pgp:
2749
for client in tcp_server.clients.itervalues():
3562
for client in tcp_server.clients.values():
2750
3563
key = client_settings[client.name]["secret"]
2751
3564
client.encrypted_secret = pgp.encrypt(client.secret,
2753
3566
client_dict = {}
2755
3568
# A list of attributes that can not be pickled
2757
exclude = { "bus", "changedstate", "secret",
2758
"checker", "server_settings" }
2759
for name, typ in (inspect.getmembers
2760
(dbus.service.Object)):
3570
exclude = {"bus", "changedstate", "secret",
3571
"checker", "server_settings"}
3572
for name, typ in inspect.getmembers(dbus.service
2761
3574
exclude.add(name)
2763
3576
client_dict["encrypted_secret"] = (client
2764
3577
.encrypted_secret)
2765
3578
for attr in client.client_structure:
2766
3579
if attr not in exclude:
2767
3580
client_dict[attr] = getattr(client, attr)
2769
3582
clients[client.name] = client_dict
2770
3583
del client_settings[client.name]["secret"]
2773
with (tempfile.NamedTemporaryFile
2774
(mode='wb', suffix=".pickle", prefix='clients-',
2775
dir=os.path.dirname(stored_state_path),
2776
delete=False)) as stored_state:
2777
pickle.dump((clients, client_settings), stored_state)
2778
tempname=stored_state.name
3586
with tempfile.NamedTemporaryFile(
3590
dir=os.path.dirname(stored_state_path),
3591
delete=False) as stored_state:
3592
pickle.dump((clients, client_settings), stored_state,
3594
tempname = stored_state.name
2779
3595
os.rename(tempname, stored_state_path)
2780
3596
except (IOError, OSError) as e: