183
236
.replace(b"\n", b"\\n")
184
237
.replace(b"\0", b"\\x00"))
187
240
def encrypt(self, data, password):
188
241
passphrase = self.password_encode(password)
189
with tempfile.NamedTemporaryFile(dir=self.tempdir
242
with tempfile.NamedTemporaryFile(
243
dir=self.tempdir) as passfile:
191
244
passfile.write(passphrase)
193
proc = subprocess.Popen(['gpg', '--symmetric',
246
proc = subprocess.Popen([self.gpg, '--symmetric',
194
247
'--passphrase-file',
196
249
+ self.gnupgargs,
197
stdin = subprocess.PIPE,
198
stdout = subprocess.PIPE,
199
stderr = subprocess.PIPE)
200
ciphertext, err = proc.communicate(input = data)
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
201
254
if proc.returncode != 0:
202
255
raise PGPError(err)
203
256
return ciphertext
205
258
def decrypt(self, data, password):
206
259
passphrase = self.password_encode(password)
207
with tempfile.NamedTemporaryFile(dir = self.tempdir
260
with tempfile.NamedTemporaryFile(
261
dir=self.tempdir) as passfile:
209
262
passfile.write(passphrase)
211
proc = subprocess.Popen(['gpg', '--decrypt',
264
proc = subprocess.Popen([self.gpg, '--decrypt',
212
265
'--passphrase-file',
214
267
+ self.gnupgargs,
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
decrypted_plaintext, err = proc.communicate(input
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
220
272
if proc.returncode != 0:
221
273
raise PGPError(err)
222
274
return decrypted_plaintext
277
# Pretend that we have an Avahi module
279
"""This isn't so much a class as it is a module-like namespace."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
290
def string_array_to_txt_array(t):
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
225
303
class AvahiError(Exception):
226
304
def __init__(self, value, *args, **kwargs):
227
305
self.value = value
228
306
return super(AvahiError, self).__init__(value, *args,
231
310
class AvahiServiceError(AvahiError):
234
314
class AvahiGroupError(AvahiError):
238
318
class AvahiService(object):
239
319
"""An Avahi (Zeroconf) service.
242
322
interface: integer; avahi.IF_UNSPEC or an interface index.
243
323
Used to optionally bind to the specified interface.
392
488
follow_name_owner_changes=True),
393
489
avahi.DBUS_INTERFACE_SERVER)
394
490
self.server.connect_to_signal("StateChanged",
395
self.server_state_changed)
491
self.server_state_changed)
396
492
self.server_state_changed(self.server.GetState())
399
495
class AvahiServiceToSyslog(AvahiService):
400
496
def rename(self, *args, **kwargs):
401
497
"""Add the new name to the syslog messages"""
402
ret = AvahiService.rename(self, *args, **kwargs)
403
syslogger.setFormatter(logging.Formatter
404
('Mandos ({}) [%(process)d]:'
405
' %(levelname)s: %(message)s'
498
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
499
syslogger.setFormatter(logging.Formatter(
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
505
# Pretend that we have a GnuTLS module
506
class gnutls(object):
507
"""This isn't so much a class as it is a module-like namespace."""
509
library = ctypes.util.find_library("gnutls")
511
library = ctypes.util.find_library("gnutls-deb0")
512
_library = ctypes.cdll.LoadLibrary(library)
515
# Unless otherwise indicated, the constants and types below are
516
# all from the gnutls/gnutls.h C header file.
527
E_NO_CERTIFICATE_FOUND = -49
532
KEYID_USE_SHA256 = 1 # gnutls/x509.h
533
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
536
class session_int(ctypes.Structure):
538
session_t = ctypes.POINTER(session_int)
540
class certificate_credentials_st(ctypes.Structure):
542
certificate_credentials_t = ctypes.POINTER(
543
certificate_credentials_st)
544
certificate_type_t = ctypes.c_int
546
class datum_t(ctypes.Structure):
547
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
548
('size', ctypes.c_uint)]
550
class openpgp_crt_int(ctypes.Structure):
552
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
553
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
554
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
555
credentials_type_t = ctypes.c_int
556
transport_ptr_t = ctypes.c_void_p
557
close_request_t = ctypes.c_int
560
class Error(Exception):
561
def __init__(self, message=None, code=None, args=()):
562
# Default usage is by a message string, but if a return
563
# code is passed, convert it to a string with
566
if message is None and code is not None:
567
message = gnutls.strerror(code)
568
return super(gnutls.Error, self).__init__(
571
class CertificateSecurityError(Error):
575
class Credentials(object):
577
self._c_object = gnutls.certificate_credentials_t()
578
gnutls.certificate_allocate_credentials(
579
ctypes.byref(self._c_object))
580
self.type = gnutls.CRD_CERTIFICATE
583
gnutls.certificate_free_credentials(self._c_object)
585
class ClientSession(object):
586
def __init__(self, socket, credentials=None):
587
self._c_object = gnutls.session_t()
588
gnutls_flags = gnutls.CLIENT
589
if gnutls.check_version(b"3.5.6"):
590
gnutls_flags |= gnutls.NO_TICKETS
592
gnutls_flags |= gnutls.ENABLE_RAWPK
593
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
595
gnutls.set_default_priority(self._c_object)
596
gnutls.transport_set_ptr(self._c_object, socket.fileno())
597
gnutls.handshake_set_private_extensions(self._c_object,
600
if credentials is None:
601
credentials = gnutls.Credentials()
602
gnutls.credentials_set(self._c_object, credentials.type,
603
ctypes.cast(credentials._c_object,
605
self.credentials = credentials
608
gnutls.deinit(self._c_object)
611
return gnutls.handshake(self._c_object)
613
def send(self, data):
617
data_len -= gnutls.record_send(self._c_object,
622
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
624
# Error handling functions
625
def _error_code(result):
626
"""A function to raise exceptions on errors, suitable
627
for the 'restype' attribute on ctypes functions"""
630
if result == gnutls.E_NO_CERTIFICATE_FOUND:
631
raise gnutls.CertificateSecurityError(code=result)
632
raise gnutls.Error(code=result)
634
def _retry_on_error(result, func, arguments):
635
"""A function to retry on some errors, suitable
636
for the 'errcheck' attribute on ctypes functions"""
638
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
639
return _error_code(result)
640
result = func(*arguments)
643
# Unless otherwise indicated, the function declarations below are
644
# all from the gnutls/gnutls.h C header file.
647
priority_set_direct = _library.gnutls_priority_set_direct
648
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
649
ctypes.POINTER(ctypes.c_char_p)]
650
priority_set_direct.restype = _error_code
652
init = _library.gnutls_init
653
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
654
init.restype = _error_code
656
set_default_priority = _library.gnutls_set_default_priority
657
set_default_priority.argtypes = [session_t]
658
set_default_priority.restype = _error_code
660
record_send = _library.gnutls_record_send
661
record_send.argtypes = [session_t, ctypes.c_void_p,
663
record_send.restype = ctypes.c_ssize_t
664
record_send.errcheck = _retry_on_error
666
certificate_allocate_credentials = (
667
_library.gnutls_certificate_allocate_credentials)
668
certificate_allocate_credentials.argtypes = [
669
ctypes.POINTER(certificate_credentials_t)]
670
certificate_allocate_credentials.restype = _error_code
672
certificate_free_credentials = (
673
_library.gnutls_certificate_free_credentials)
674
certificate_free_credentials.argtypes = [
675
certificate_credentials_t]
676
certificate_free_credentials.restype = None
678
handshake_set_private_extensions = (
679
_library.gnutls_handshake_set_private_extensions)
680
handshake_set_private_extensions.argtypes = [session_t,
682
handshake_set_private_extensions.restype = None
684
credentials_set = _library.gnutls_credentials_set
685
credentials_set.argtypes = [session_t, credentials_type_t,
687
credentials_set.restype = _error_code
689
strerror = _library.gnutls_strerror
690
strerror.argtypes = [ctypes.c_int]
691
strerror.restype = ctypes.c_char_p
693
certificate_type_get = _library.gnutls_certificate_type_get
694
certificate_type_get.argtypes = [session_t]
695
certificate_type_get.restype = _error_code
697
certificate_get_peers = _library.gnutls_certificate_get_peers
698
certificate_get_peers.argtypes = [session_t,
699
ctypes.POINTER(ctypes.c_uint)]
700
certificate_get_peers.restype = ctypes.POINTER(datum_t)
702
global_set_log_level = _library.gnutls_global_set_log_level
703
global_set_log_level.argtypes = [ctypes.c_int]
704
global_set_log_level.restype = None
706
global_set_log_function = _library.gnutls_global_set_log_function
707
global_set_log_function.argtypes = [log_func]
708
global_set_log_function.restype = None
710
deinit = _library.gnutls_deinit
711
deinit.argtypes = [session_t]
712
deinit.restype = None
714
handshake = _library.gnutls_handshake
715
handshake.argtypes = [session_t]
716
handshake.restype = _error_code
717
handshake.errcheck = _retry_on_error
719
transport_set_ptr = _library.gnutls_transport_set_ptr
720
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
721
transport_set_ptr.restype = None
723
bye = _library.gnutls_bye
724
bye.argtypes = [session_t, close_request_t]
725
bye.restype = _error_code
726
bye.errcheck = _retry_on_error
728
check_version = _library.gnutls_check_version
729
check_version.argtypes = [ctypes.c_char_p]
730
check_version.restype = ctypes.c_char_p
732
_need_version = b"3.3.0"
733
if check_version(_need_version) is None:
734
raise self.Error("Needs GnuTLS {} or later"
735
.format(_need_version))
737
_tls_rawpk_version = b"3.6.6"
738
has_rawpk = bool(check_version(_tls_rawpk_version))
742
class pubkey_st(ctypes.Structure):
744
pubkey_t = ctypes.POINTER(pubkey_st)
746
x509_crt_fmt_t = ctypes.c_int
748
# All the function declarations below are from gnutls/abstract.h
749
pubkey_init = _library.gnutls_pubkey_init
750
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
751
pubkey_init.restype = _error_code
753
pubkey_import = _library.gnutls_pubkey_import
754
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
756
pubkey_import.restype = _error_code
758
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
759
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
760
ctypes.POINTER(ctypes.c_ubyte),
761
ctypes.POINTER(ctypes.c_size_t)]
762
pubkey_get_key_id.restype = _error_code
764
pubkey_deinit = _library.gnutls_pubkey_deinit
765
pubkey_deinit.argtypes = [pubkey_t]
766
pubkey_deinit.restype = None
768
# All the function declarations below are from gnutls/openpgp.h
770
openpgp_crt_init = _library.gnutls_openpgp_crt_init
771
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
772
openpgp_crt_init.restype = _error_code
774
openpgp_crt_import = _library.gnutls_openpgp_crt_import
775
openpgp_crt_import.argtypes = [openpgp_crt_t,
776
ctypes.POINTER(datum_t),
778
openpgp_crt_import.restype = _error_code
780
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
781
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
782
ctypes.POINTER(ctypes.c_uint)]
783
openpgp_crt_verify_self.restype = _error_code
785
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
786
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
787
openpgp_crt_deinit.restype = None
789
openpgp_crt_get_fingerprint = (
790
_library.gnutls_openpgp_crt_get_fingerprint)
791
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
795
openpgp_crt_get_fingerprint.restype = _error_code
797
if check_version(b"3.6.4"):
798
certificate_type_get2 = _library.gnutls_certificate_type_get2
799
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
800
certificate_type_get2.restype = _error_code
802
# Remove non-public functions
803
del _error_code, _retry_on_error
806
def call_pipe(connection, # : multiprocessing.Connection
807
func, *args, **kwargs):
808
"""This function is meant to be called by multiprocessing.Process
810
This function runs func(*args, **kwargs), and writes the resulting
811
return value on the provided multiprocessing.Connection.
813
connection.send(func(*args, **kwargs))
410
817
class Client(object):
411
818
"""A representation of a client host served by this server.
414
821
approved: bool(); 'None' if not yet approved/disapproved
415
822
approval_delay: datetime.timedelta(); Time to wait for approval
416
823
approval_duration: datetime.timedelta(); Duration of one approval
417
checker: subprocess.Popen(); a running checker process used
418
to see if the client lives.
419
'None' if no process is running.
420
checker_callback_tag: a gobject event source tag, or None
824
checker: multiprocessing.Process(); a running checker process used
825
to see if the client lives. 'None' if no process is
827
checker_callback_tag: a GLib event source tag, or None
421
828
checker_command: string; External command which is run to check
422
829
if client lives. %() expansions are done at
423
830
runtime with vars(self) as dict, so that for
424
831
instance %(name)s can be used in the command.
425
checker_initiator_tag: a gobject event source tag, or None
832
checker_initiator_tag: a GLib event source tag, or None
426
833
created: datetime.datetime(); (UTC) object creation
427
834
client_structure: Object describing what attributes a client has
428
835
and is used for storing the client at exit
429
836
current_checker_command: string; current running checker_command
430
disable_initiator_tag: a gobject event source tag, or None
837
disable_initiator_tag: a GLib event source tag, or None
432
839
fingerprint: string (40 or 32 hexadecimal digits); used to
433
uniquely identify the client
840
uniquely identify an OpenPGP client
841
key_id: string (64 hexadecimal digits); used to uniquely identify
842
a client using raw public keys
434
843
host: string; available for use by the checker command
435
844
interval: datetime.timedelta(); How often to start a new checker
436
845
last_approval_request: datetime.datetime(); (UTC) or None
588
1002
logger.info("Disabling client %s", self.name)
589
1003
if getattr(self, "disable_initiator_tag", None) is not None:
590
gobject.source_remove(self.disable_initiator_tag)
1004
GLib.source_remove(self.disable_initiator_tag)
591
1005
self.disable_initiator_tag = None
592
1006
self.expires = None
593
1007
if getattr(self, "checker_initiator_tag", None) is not None:
594
gobject.source_remove(self.checker_initiator_tag)
1008
GLib.source_remove(self.checker_initiator_tag)
595
1009
self.checker_initiator_tag = None
596
1010
self.stop_checker()
597
1011
self.enabled = False
599
1013
self.send_changedstate()
600
# Do not run this again if called by a gobject.timeout_add
1014
# Do not run this again if called by a GLib.timeout_add
603
1017
def __del__(self):
606
1020
def init_checker(self):
607
1021
# Schedule a new checker to be started an 'interval' from now,
608
1022
# and every interval from then on.
609
1023
if self.checker_initiator_tag is not None:
610
gobject.source_remove(self.checker_initiator_tag)
611
self.checker_initiator_tag = (gobject.timeout_add
613
.total_seconds() * 1000),
1024
GLib.source_remove(self.checker_initiator_tag)
1025
self.checker_initiator_tag = GLib.timeout_add(
1026
int(self.interval.total_seconds() * 1000),
615
1028
# Schedule a disable() when 'timeout' has passed
616
1029
if self.disable_initiator_tag is not None:
617
gobject.source_remove(self.disable_initiator_tag)
618
self.disable_initiator_tag = (gobject.timeout_add
620
.total_seconds() * 1000),
1030
GLib.source_remove(self.disable_initiator_tag)
1031
self.disable_initiator_tag = GLib.timeout_add(
1032
int(self.timeout.total_seconds() * 1000), self.disable)
622
1033
# Also start a new checker *right now*.
623
1034
self.start_checker()
625
def checker_callback(self, pid, condition, command):
1036
def checker_callback(self, source, condition, connection,
626
1038
"""The checker has completed, so take appropriate actions."""
1039
# Read return code from connection (see call_pipe)
1040
returncode = connection.recv()
627
1043
self.checker_callback_tag = None
628
1044
self.checker = None
629
if os.WIFEXITED(condition):
630
self.last_checker_status = os.WEXITSTATUS(condition)
1047
self.last_checker_status = returncode
1048
self.last_checker_signal = None
631
1049
if self.last_checker_status == 0:
632
1050
logger.info("Checker for %(name)s succeeded",
634
1052
self.checked_ok()
636
logger.info("Checker for %(name)s failed",
1054
logger.info("Checker for %(name)s failed", vars(self))
639
1056
self.last_checker_status = -1
1057
self.last_checker_signal = -returncode
640
1058
logger.warning("Checker for %(name)s crashed?",
643
1062
def checked_ok(self):
644
1063
"""Assert that the client has been seen, alive and well."""
645
1064
self.last_checked_ok = datetime.datetime.utcnow()
646
1065
self.last_checker_status = 0
1066
self.last_checker_signal = None
647
1067
self.bump_timeout()
649
1069
def bump_timeout(self, timeout=None):
650
1070
"""Bump up the timeout for this client."""
651
1071
if timeout is None:
652
1072
timeout = self.timeout
653
1073
if self.disable_initiator_tag is not None:
654
gobject.source_remove(self.disable_initiator_tag)
1074
GLib.source_remove(self.disable_initiator_tag)
655
1075
self.disable_initiator_tag = None
656
1076
if getattr(self, "enabled", False):
657
self.disable_initiator_tag = (gobject.timeout_add
658
(int(timeout.total_seconds()
659
* 1000), self.disable))
1077
self.disable_initiator_tag = GLib.timeout_add(
1078
int(timeout.total_seconds() * 1000), self.disable)
660
1079
self.expires = datetime.datetime.utcnow() + timeout
662
1081
def need_approval(self):
663
1082
self.last_approval_request = datetime.datetime.utcnow()
665
1084
def start_checker(self):
666
1085
"""Start a new checker subprocess if one is not running.
668
1087
If a checker already exists, leave it running and do
670
1089
# The reason for not killing a running checker is that if we
675
1094
# checkers alone, the checker would have to take more time
676
1095
# than 'timeout' for the client to be disabled, which is as it
679
# If a checker exists, make sure it is not a zombie
681
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
682
except AttributeError:
684
except OSError as error:
685
if error.errno != errno.ECHILD:
689
logger.warning("Checker was a zombie")
690
gobject.source_remove(self.checker_callback_tag)
691
self.checker_callback(pid, status,
692
self.current_checker_command)
1098
if self.checker is not None and not self.checker.is_alive():
1099
logger.warning("Checker was not alive; joining")
693
1102
# Start a new checker if needed
694
1103
if self.checker is None:
695
1104
# Escape attributes for the shell
696
escaped_attrs = { attr:
697
re.escape(str(getattr(self, attr)))
698
for attr in self.runtime_expansions }
1106
attr: re.escape(str(getattr(self, attr)))
1107
for attr in self.runtime_expansions}
700
1109
command = self.checker_command % escaped_attrs
701
1110
except TypeError as error:
702
1111
logger.error('Could not format string "%s"',
703
self.checker_command, exc_info=error)
704
return True # Try again later
1112
self.checker_command,
1114
return True # Try again later
705
1115
self.current_checker_command = command
707
logger.info("Starting checker %r for %s",
709
# We don't need to redirect stdout and stderr, since
710
# in normal mode, that is already done by daemon(),
711
# and in debug mode we don't want to. (Stdin is
712
# always replaced by /dev/null.)
713
# The exception is when not debugging but nevertheless
714
# running in the foreground; use the previously
717
if (not self.server_settings["debug"]
718
and self.server_settings["foreground"]):
719
popen_args.update({"stdout": wnull,
721
self.checker = subprocess.Popen(command,
725
except OSError as error:
726
logger.error("Failed to start subprocess",
729
self.checker_callback_tag = (gobject.child_watch_add
731
self.checker_callback,
733
# The checker may have completed before the gobject
734
# watch was added. Check for this.
736
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
737
except OSError as error:
738
if error.errno == errno.ECHILD:
739
# This should never happen
740
logger.error("Child process vanished",
745
gobject.source_remove(self.checker_callback_tag)
746
self.checker_callback(pid, status, command)
747
# Re-run this periodically if run by gobject.timeout_add
1116
logger.info("Starting checker %r for %s", command,
1118
# We don't need to redirect stdout and stderr, since
1119
# in normal mode, that is already done by daemon(),
1120
# and in debug mode we don't want to. (Stdin is
1121
# always replaced by /dev/null.)
1122
# The exception is when not debugging but nevertheless
1123
# running in the foreground; use the previously
1125
popen_args = {"close_fds": True,
1128
if (not self.server_settings["debug"]
1129
and self.server_settings["foreground"]):
1130
popen_args.update({"stdout": wnull,
1132
pipe = multiprocessing.Pipe(duplex=False)
1133
self.checker = multiprocessing.Process(
1135
args=(pipe[1], subprocess.call, command),
1137
self.checker.start()
1138
self.checker_callback_tag = GLib.io_add_watch(
1139
pipe[0].fileno(), GLib.IO_IN,
1140
self.checker_callback, pipe[0], command)
1141
# Re-run this periodically if run by GLib.timeout_add
750
1144
def stop_checker(self):
751
1145
"""Force the checker process, if any, to stop."""
752
1146
if self.checker_callback_tag:
753
gobject.source_remove(self.checker_callback_tag)
1147
GLib.source_remove(self.checker_callback_tag)
754
1148
self.checker_callback_tag = None
755
1149
if getattr(self, "checker", None) is None:
757
1151
logger.debug("Stopping checker for %(name)s", vars(self))
759
self.checker.terminate()
761
#if self.checker.poll() is None:
762
# self.checker.kill()
763
except OSError as error:
764
if error.errno != errno.ESRCH: # No such process
1152
self.checker.terminate()
766
1153
self.checker = None
769
def dbus_service_property(dbus_interface, signature="v",
770
access="readwrite", byte_arrays=False):
1156
def dbus_service_property(dbus_interface,
771
1160
"""Decorators for marking methods of a DBusObjectWithProperties to
772
1161
become properties on the D-Bus.
774
1163
The decorated method will be called with no arguments by "Get"
775
1164
and with one argument by "Set".
777
1166
The parameters, where they are supported, are the same as
778
1167
dbus.service.method, except there is only "signature", since the
779
1168
type from Get() and the type sent to Set() is the same.
853
class DBusObjectWithProperties(dbus.service.Object):
854
"""A D-Bus object with properties.
856
Classes inheriting from this can use the dbus_service_property
857
decorator to expose methods as D-Bus properties. It exposes the
858
standard Get(), Set(), and GetAll() methods on the D-Bus.
1251
class DBusObjectWithAnnotations(dbus.service.Object):
1252
"""A D-Bus object with annotations.
1254
Classes inheriting from this can use the dbus_annotations
1255
decorator to add annotations to methods or signals.
862
1259
def _is_dbus_thing(thing):
863
1260
"""Returns a function testing if an attribute is a D-Bus thing
865
1262
If called like _is_dbus_thing("method") it returns a function
866
1263
suitable for use as predicate to inspect.getmembers().
868
1265
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
871
1268
def _get_all_dbus_things(self, thing):
872
1269
"""Returns a generator of (name, attribute) pairs
874
return ((getattr(athing.__get__(self), "_dbus_name",
1271
return ((getattr(athing.__get__(self), "_dbus_name", name),
876
1272
athing.__get__(self))
877
1273
for cls in self.__class__.__mro__
878
1274
for name, athing in
879
inspect.getmembers(cls,
880
self._is_dbus_thing(thing)))
1275
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1277
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1279
path_keyword='object_path',
1280
connection_keyword='connection')
1281
def Introspect(self, object_path, connection):
1282
"""Overloading of standard D-Bus method.
1284
Inserts annotation tags on methods and signals.
1286
xmlstring = dbus.service.Object.Introspect(self, object_path,
1289
document = xml.dom.minidom.parseString(xmlstring)
1291
for if_tag in document.getElementsByTagName("interface"):
1292
# Add annotation tags
1293
for typ in ("method", "signal"):
1294
for tag in if_tag.getElementsByTagName(typ):
1296
for name, prop in (self.
1297
_get_all_dbus_things(typ)):
1298
if (name == tag.getAttribute("name")
1299
and prop._dbus_interface
1300
== if_tag.getAttribute("name")):
1301
annots.update(getattr(
1302
prop, "_dbus_annotations", {}))
1303
for name, value in annots.items():
1304
ann_tag = document.createElement(
1306
ann_tag.setAttribute("name", name)
1307
ann_tag.setAttribute("value", value)
1308
tag.appendChild(ann_tag)
1309
# Add interface annotation tags
1310
for annotation, value in dict(
1311
itertools.chain.from_iterable(
1312
annotations().items()
1313
for name, annotations
1314
in self._get_all_dbus_things("interface")
1315
if name == if_tag.getAttribute("name")
1317
ann_tag = document.createElement("annotation")
1318
ann_tag.setAttribute("name", annotation)
1319
ann_tag.setAttribute("value", value)
1320
if_tag.appendChild(ann_tag)
1321
# Fix argument name for the Introspect method itself
1322
if (if_tag.getAttribute("name")
1323
== dbus.INTROSPECTABLE_IFACE):
1324
for cn in if_tag.getElementsByTagName("method"):
1325
if cn.getAttribute("name") == "Introspect":
1326
for arg in cn.getElementsByTagName("arg"):
1327
if (arg.getAttribute("direction")
1329
arg.setAttribute("name",
1331
xmlstring = document.toxml("utf-8")
1333
except (AttributeError, xml.dom.DOMException,
1334
xml.parsers.expat.ExpatError) as error:
1335
logger.error("Failed to override Introspection method",
1340
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1341
"""A D-Bus object with properties.
1343
Classes inheriting from this can use the dbus_service_property
1344
decorator to expose methods as D-Bus properties. It exposes the
1345
standard Get(), Set(), and GetAll() methods on the D-Bus.
882
1348
def _get_dbus_property(self, interface_name, property_name):
883
1349
"""Returns a bound method if one exists which is a D-Bus
884
1350
property with the specified name and interface.
886
for cls in self.__class__.__mro__:
887
for name, value in (inspect.getmembers
889
self._is_dbus_thing("property"))):
1352
for cls in self.__class__.__mro__:
1353
for name, value in inspect.getmembers(
1354
cls, self._is_dbus_thing("property")):
890
1355
if (value._dbus_name == property_name
891
1356
and value._dbus_interface == interface_name):
892
1357
return value.__get__(self)
894
1359
# No such property
895
raise DBusPropertyNotFound(self.dbus_object_path + ":"
896
+ interface_name + "."
899
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1360
raise DBusPropertyNotFound("{}:{}.{}".format(
1361
self.dbus_object_path, interface_name, property_name))
1364
def _get_all_interface_names(cls):
1365
"""Get a sequence of all interfaces supported by an object"""
1366
return (name for name in set(getattr(getattr(x, attr),
1367
"_dbus_interface", None)
1368
for x in (inspect.getmro(cls))
1370
if name is not None)
1372
@dbus.service.method(dbus.PROPERTIES_IFACE,
900
1374
out_signature="v")
901
1375
def Get(self, interface_name, property_name):
902
1376
"""Standard D-Bus property Get() method, see D-Bus standard.
1042
1505
return xmlstring
1509
dbus.OBJECT_MANAGER_IFACE
1510
except AttributeError:
1511
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1514
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1515
"""A D-Bus object with an ObjectManager.
1517
Classes inheriting from this exposes the standard
1518
GetManagedObjects call and the InterfacesAdded and
1519
InterfacesRemoved signals on the standard
1520
"org.freedesktop.DBus.ObjectManager" interface.
1522
Note: No signals are sent automatically; they must be sent
1525
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1526
out_signature="a{oa{sa{sv}}}")
1527
def GetManagedObjects(self):
1528
"""This function must be overridden"""
1529
raise NotImplementedError()
1531
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1532
signature="oa{sa{sv}}")
1533
def InterfacesAdded(self, object_path, interfaces_and_properties):
1536
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1537
def InterfacesRemoved(self, object_path, interfaces):
1540
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1542
path_keyword='object_path',
1543
connection_keyword='connection')
1544
def Introspect(self, object_path, connection):
1545
"""Overloading of standard D-Bus method.
1547
Override return argument name of GetManagedObjects to be
1548
"objpath_interfaces_and_properties"
1550
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1554
document = xml.dom.minidom.parseString(xmlstring)
1556
for if_tag in document.getElementsByTagName("interface"):
1557
# Fix argument name for the GetManagedObjects method
1558
if (if_tag.getAttribute("name")
1559
== dbus.OBJECT_MANAGER_IFACE):
1560
for cn in if_tag.getElementsByTagName("method"):
1561
if (cn.getAttribute("name")
1562
== "GetManagedObjects"):
1563
for arg in cn.getElementsByTagName("arg"):
1564
if (arg.getAttribute("direction")
1568
"objpath_interfaces"
1570
xmlstring = document.toxml("utf-8")
1572
except (AttributeError, xml.dom.DOMException,
1573
xml.parsers.expat.ExpatError) as error:
1574
logger.error("Failed to override Introspection method",
1045
1579
def datetime_to_dbus(dt, variant_level=0):
1046
1580
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1048
return dbus.String("", variant_level = variant_level)
1049
return dbus.String(dt.isoformat(),
1050
variant_level=variant_level)
1582
return dbus.String("", variant_level=variant_level)
1583
return dbus.String(dt.isoformat(), variant_level=variant_level)
1053
1586
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1413
1947
server to mandos-client
1417
1951
# Rejected - signal
1418
1952
@dbus.service.signal(_interface, signature="s")
1419
1953
def Rejected(self, reason):
1423
1957
# NeedApproval - signal
1424
1958
@dbus.service.signal(_interface, signature="tb")
1425
1959
def NeedApproval(self, timeout, default):
1427
1961
return self.need_approval()
1431
1965
# Approve - method
1432
1966
@dbus.service.method(_interface, in_signature="b")
1433
1967
def Approve(self, value):
1434
1968
self.approve(value)
1436
1970
# CheckedOK - method
1437
1971
@dbus.service.method(_interface)
1438
1972
def CheckedOK(self):
1439
1973
self.checked_ok()
1441
1975
# Enable - method
1976
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1442
1977
@dbus.service.method(_interface)
1443
1978
def Enable(self):
1447
1982
# StartChecker - method
1983
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1448
1984
@dbus.service.method(_interface)
1449
1985
def StartChecker(self):
1451
1987
self.start_checker()
1453
1989
# Disable - method
1990
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1454
1991
@dbus.service.method(_interface)
1455
1992
def Disable(self):
1459
1996
# StopChecker - method
1997
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1460
1998
@dbus.service.method(_interface)
1461
1999
def StopChecker(self):
1462
2000
self.stop_checker()
1466
2004
# ApprovalPending - property
1467
2005
@dbus_service_property(_interface, signature="b", access="read")
1468
2006
def ApprovalPending_dbus_property(self):
1469
2007
return dbus.Boolean(bool(self.approvals_pending))
1471
2009
# ApprovedByDefault - property
1472
@dbus_service_property(_interface, signature="b",
2010
@dbus_service_property(_interface,
1473
2012
access="readwrite")
1474
2013
def ApprovedByDefault_dbus_property(self, value=None):
1475
2014
if value is None: # get
1476
2015
return dbus.Boolean(self.approved_by_default)
1477
2016
self.approved_by_default = bool(value)
1479
2018
# ApprovalDelay - property
1480
@dbus_service_property(_interface, signature="t",
2019
@dbus_service_property(_interface,
1481
2021
access="readwrite")
1482
2022
def ApprovalDelay_dbus_property(self, value=None):
1483
2023
if value is None: # get
1484
2024
return dbus.UInt64(self.approval_delay.total_seconds()
1486
2026
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1488
2028
# ApprovalDuration - property
1489
@dbus_service_property(_interface, signature="t",
2029
@dbus_service_property(_interface,
1490
2031
access="readwrite")
1491
2032
def ApprovalDuration_dbus_property(self, value=None):
1492
2033
if value is None: # get
1493
2034
return dbus.UInt64(self.approval_duration.total_seconds()
1495
2036
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1497
2038
# Name - property
2040
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1498
2041
@dbus_service_property(_interface, signature="s", access="read")
1499
2042
def Name_dbus_property(self):
1500
2043
return dbus.String(self.name)
2047
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2048
@dbus_service_property(_interface, signature="s", access="read")
2049
def KeyID_dbus_property(self):
2050
return dbus.String(self.key_id)
1502
2052
# Fingerprint - property
2054
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1503
2055
@dbus_service_property(_interface, signature="s", access="read")
1504
2056
def Fingerprint_dbus_property(self):
1505
2057
return dbus.String(self.fingerprint)
1507
2059
# Host - property
1508
@dbus_service_property(_interface, signature="s",
2060
@dbus_service_property(_interface,
1509
2062
access="readwrite")
1510
2063
def Host_dbus_property(self, value=None):
1511
2064
if value is None: # get
1512
2065
return dbus.String(self.host)
1513
2066
self.host = str(value)
1515
2068
# Created - property
2070
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1516
2071
@dbus_service_property(_interface, signature="s", access="read")
1517
2072
def Created_dbus_property(self):
1518
2073
return datetime_to_dbus(self.created)
1520
2075
# LastEnabled - property
1521
2076
@dbus_service_property(_interface, signature="s", access="read")
1522
2077
def LastEnabled_dbus_property(self):
1523
2078
return datetime_to_dbus(self.last_enabled)
1525
2080
# Enabled - property
1526
@dbus_service_property(_interface, signature="b",
2081
@dbus_service_property(_interface,
1527
2083
access="readwrite")
1528
2084
def Enabled_dbus_property(self, value=None):
1529
2085
if value is None: # get
1794
2367
delay -= time2 - time
1797
while sent_size < len(client.secret):
1799
sent = session.send(client.secret[sent_size:])
1800
except gnutls.errors.GNUTLSError as error:
1801
logger.warning("gnutls send failed",
1804
logger.debug("Sent: %d, remaining: %d",
1805
sent, len(client.secret)
1806
- (sent_size + sent))
2370
session.send(client.secret)
2371
except gnutls.Error as error:
2372
logger.warning("gnutls send failed",
1809
2376
logger.info("Sending secret to %s", client.name)
1810
2377
# bump the timeout using extended_timeout
1811
2378
client.bump_timeout(client.extended_timeout)
1812
2379
if self.server.use_dbus:
1813
2380
# Emit D-Bus signal
1814
2381
client.GotSecret()
1817
2384
if approval_required:
1818
2385
client.approvals_pending -= 1
1821
except gnutls.errors.GNUTLSError as error:
2388
except gnutls.Error as error:
1822
2389
logger.warning("GnuTLS bye failed",
1823
2390
exc_info=error)
1826
2393
def peer_certificate(session):
1827
"Return the peer's OpenPGP certificate as a bytestring"
1828
# If not an OpenPGP certificate...
1829
if (gnutls.library.functions
1830
.gnutls_certificate_type_get(session._c_object)
1831
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1832
# ...do the normal thing
1833
return session.peer_certificate
2394
"Return the peer's certificate as a bytestring"
2396
cert_type = gnutls.certificate_type_get2(session._c_object,
2398
except AttributeError:
2399
cert_type = gnutls.certificate_type_get(session._c_object)
2400
if gnutls.has_rawpk:
2401
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2403
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2404
# If not a valid certificate type...
2405
if cert_type not in valid_cert_types:
2406
logger.info("Cert type %r not in %r", cert_type,
2408
# ...return invalid data
1834
2410
list_size = ctypes.c_uint(1)
1835
cert_list = (gnutls.library.functions
1836
.gnutls_certificate_get_peers
2411
cert_list = (gnutls.certificate_get_peers
1837
2412
(session._c_object, ctypes.byref(list_size)))
1838
2413
if not bool(cert_list) and list_size.value != 0:
1839
raise gnutls.errors.GNUTLSError("error getting peer"
2414
raise gnutls.Error("error getting peer certificate")
1841
2415
if list_size.value == 0:
1843
2417
cert = cert_list[0]
1844
2418
return ctypes.string_at(cert.data, cert.size)
2421
def key_id(certificate):
2422
"Convert a certificate bytestring to a hexdigit key ID"
2423
# New GnuTLS "datum" with the public key
2424
datum = gnutls.datum_t(
2425
ctypes.cast(ctypes.c_char_p(certificate),
2426
ctypes.POINTER(ctypes.c_ubyte)),
2427
ctypes.c_uint(len(certificate)))
2428
# XXX all these need to be created in the gnutls "module"
2429
# New empty GnuTLS certificate
2430
pubkey = gnutls.pubkey_t()
2431
gnutls.pubkey_init(ctypes.byref(pubkey))
2432
# Import the raw public key into the certificate
2433
gnutls.pubkey_import(pubkey,
2434
ctypes.byref(datum),
2435
gnutls.X509_FMT_DER)
2436
# New buffer for the key ID
2437
buf = ctypes.create_string_buffer(32)
2438
buf_len = ctypes.c_size_t(len(buf))
2439
# Get the key ID from the raw public key into the buffer
2440
gnutls.pubkey_get_key_id(pubkey,
2441
gnutls.KEYID_USE_SHA256,
2442
ctypes.cast(ctypes.byref(buf),
2443
ctypes.POINTER(ctypes.c_ubyte)),
2444
ctypes.byref(buf_len))
2445
# Deinit the certificate
2446
gnutls.pubkey_deinit(pubkey)
2448
# Convert the buffer to a Python bytestring
2449
key_id = ctypes.string_at(buf, buf_len.value)
2450
# Convert the bytestring to hexadecimal notation
2451
hex_key_id = binascii.hexlify(key_id).upper()
1847
2455
def fingerprint(openpgp):
1848
2456
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1849
2457
# New GnuTLS "datum" with the OpenPGP public key
1850
datum = (gnutls.library.types
1851
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1854
ctypes.c_uint(len(openpgp))))
2458
datum = gnutls.datum_t(
2459
ctypes.cast(ctypes.c_char_p(openpgp),
2460
ctypes.POINTER(ctypes.c_ubyte)),
2461
ctypes.c_uint(len(openpgp)))
1855
2462
# New empty GnuTLS certificate
1856
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1857
(gnutls.library.functions
1858
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2463
crt = gnutls.openpgp_crt_t()
2464
gnutls.openpgp_crt_init(ctypes.byref(crt))
1859
2465
# Import the OpenPGP public key into the certificate
1860
(gnutls.library.functions
1861
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1862
gnutls.library.constants
1863
.GNUTLS_OPENPGP_FMT_RAW))
2466
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2467
gnutls.OPENPGP_FMT_RAW)
1864
2468
# Verify the self signature in the key
1865
2469
crtverify = ctypes.c_uint()
1866
(gnutls.library.functions
1867
.gnutls_openpgp_crt_verify_self(crt, 0,
1868
ctypes.byref(crtverify)))
2470
gnutls.openpgp_crt_verify_self(crt, 0,
2471
ctypes.byref(crtverify))
1869
2472
if crtverify.value != 0:
1870
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1871
raise (gnutls.errors.CertificateSecurityError
2473
gnutls.openpgp_crt_deinit(crt)
2474
raise gnutls.CertificateSecurityError(code
1873
2476
# New buffer for the fingerprint
1874
2477
buf = ctypes.create_string_buffer(20)
1875
2478
buf_len = ctypes.c_size_t()
1876
2479
# Get the fingerprint from the certificate into the buffer
1877
(gnutls.library.functions
1878
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1879
ctypes.byref(buf_len)))
2480
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2481
ctypes.byref(buf_len))
1880
2482
# Deinit the certificate
1881
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2483
gnutls.openpgp_crt_deinit(crt)
1882
2484
# Convert the buffer to a Python bytestring
1883
2485
fpr = ctypes.string_at(buf, buf_len.value)
1884
2486
# Convert the bytestring to hexadecimal notation
1967
2575
# socket_wrapper(), if socketfd was set.
1968
2576
socketserver.TCPServer.__init__(self, server_address,
1969
2577
RequestHandlerClass)
1971
2579
def server_bind(self):
1972
2580
"""This overrides the normal server_bind() function
1973
2581
to bind to an interface if one was specified, and also NOT to
1974
2582
bind to an address or port if they were not specified."""
2583
global SO_BINDTODEVICE
1975
2584
if self.interface is not None:
1976
2585
if SO_BINDTODEVICE is None:
1977
logger.error("SO_BINDTODEVICE does not exist;"
1978
" cannot bind to interface %s",
1982
self.socket.setsockopt(socket.SOL_SOCKET,
1984
(self.interface + "\0")
1986
except socket.error as error:
1987
if error.errno == errno.EPERM:
1988
logger.error("No permission to bind to"
1989
" interface %s", self.interface)
1990
elif error.errno == errno.ENOPROTOOPT:
1991
logger.error("SO_BINDTODEVICE not available;"
1992
" cannot bind to interface %s",
1994
elif error.errno == errno.ENODEV:
1995
logger.error("Interface %s does not exist,"
1996
" cannot bind", self.interface)
2586
# Fall back to a hard-coded value which seems to be
2588
logger.warning("SO_BINDTODEVICE not found, trying 25")
2589
SO_BINDTODEVICE = 25
2591
self.socket.setsockopt(
2592
socket.SOL_SOCKET, SO_BINDTODEVICE,
2593
(self.interface + "\0").encode("utf-8"))
2594
except socket.error as error:
2595
if error.errno == errno.EPERM:
2596
logger.error("No permission to bind to"
2597
" interface %s", self.interface)
2598
elif error.errno == errno.ENOPROTOOPT:
2599
logger.error("SO_BINDTODEVICE not available;"
2600
" cannot bind to interface %s",
2602
elif error.errno == errno.ENODEV:
2603
logger.error("Interface %s does not exist,"
2604
" cannot bind", self.interface)
1999
2607
# Only bind(2) the socket if we really need to.
2000
2608
if self.server_address[0] or self.server_address[1]:
2609
if self.server_address[1]:
2610
self.allow_reuse_address = True
2001
2611
if not self.server_address[0]:
2002
2612
if self.address_family == socket.AF_INET6:
2003
any_address = "::" # in6addr_any
2613
any_address = "::" # in6addr_any
2005
any_address = "0.0.0.0" # INADDR_ANY
2615
any_address = "0.0.0.0" # INADDR_ANY
2006
2616
self.server_address = (any_address,
2007
2617
self.server_address[1])
2008
2618
elif not self.server_address[1]:
2009
self.server_address = (self.server_address[0],
2619
self.server_address = (self.server_address[0], 0)
2011
2620
# if self.interface:
2012
2621
# self.server_address = (self.server_address[0],
2038
2652
self.gnutls_priority = gnutls_priority
2039
2653
IPv6_TCPServer.__init__(self, server_address,
2040
2654
RequestHandlerClass,
2041
interface = interface,
2042
use_ipv6 = use_ipv6,
2043
socketfd = socketfd)
2655
interface=interface,
2044
2659
def server_activate(self):
2045
2660
if self.enabled:
2046
2661
return socketserver.TCPServer.server_activate(self)
2048
2663
def enable(self):
2049
2664
self.enabled = True
2051
2666
def add_pipe(self, parent_pipe, proc):
2052
2667
# Call "handle_ipc" for both data and EOF events
2053
gobject.io_add_watch(parent_pipe.fileno(),
2054
gobject.IO_IN | gobject.IO_HUP,
2055
functools.partial(self.handle_ipc,
2060
def handle_ipc(self, source, condition, parent_pipe=None,
2061
proc = None, client_object=None):
2669
parent_pipe.fileno(),
2670
GLib.IO_IN | GLib.IO_HUP,
2671
functools.partial(self.handle_ipc,
2672
parent_pipe=parent_pipe,
2675
def handle_ipc(self, source, condition,
2678
client_object=None):
2062
2679
# error, or the other end of multiprocessing.Pipe has closed
2063
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2680
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2064
2681
# Wait for other process to exit
2068
2685
# Read a request from the child
2069
2686
request = parent_pipe.recv()
2070
2687
command = request[0]
2072
2689
if command == 'init':
2074
address = request[2]
2076
for c in self.clients.itervalues():
2077
if c.fingerprint == fpr:
2690
key_id = request[1].decode("ascii")
2691
fpr = request[2].decode("ascii")
2692
address = request[3]
2694
for c in self.clients.values():
2695
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2697
if key_id and c.key_id == key_id:
2700
if fpr and c.fingerprint == fpr:
2081
logger.info("Client not found for fingerprint: %s, ad"
2082
"dress: %s", fpr, address)
2704
logger.info("Client not found for key ID: %s, address"
2705
": %s", key_id or fpr, address)
2083
2706
if self.use_dbus:
2084
2707
# Emit D-Bus signal
2085
mandos_dbus_service.ClientNotFound(fpr,
2708
mandos_dbus_service.ClientNotFound(key_id or fpr,
2087
2710
parent_pipe.send(False)
2090
gobject.io_add_watch(parent_pipe.fileno(),
2091
gobject.IO_IN | gobject.IO_HUP,
2092
functools.partial(self.handle_ipc,
2714
parent_pipe.fileno(),
2715
GLib.IO_IN | GLib.IO_HUP,
2716
functools.partial(self.handle_ipc,
2717
parent_pipe=parent_pipe,
2719
client_object=client))
2098
2720
parent_pipe.send(True)
2099
2721
# remove the old hook in favor of the new above hook on
3128
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2500
3130
except OSError as error:
3131
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3132
.format(uid, gid, os.strerror(error.errno)))
2501
3133
if error.errno != errno.EPERM:
2505
3137
# Enable all possible GnuTLS debugging
2507
3139
# "Use a log level over 10 to enable all debugging options."
2508
3140
# - GnuTLS manual
2509
gnutls.library.functions.gnutls_global_set_log_level(11)
2511
@gnutls.library.types.gnutls_log_func
3141
gnutls.global_set_log_level(11)
2512
3144
def debug_gnutls(level, string):
2513
3145
logger.debug("GnuTLS: %s", string[:-1])
2515
(gnutls.library.functions
2516
.gnutls_global_set_log_function(debug_gnutls))
3147
gnutls.global_set_log_function(debug_gnutls)
2518
3149
# Redirect stdin so all checkers get /dev/null
2519
3150
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2520
3151
os.dup2(null, sys.stdin.fileno())
2524
3155
# Need to fork before connecting to D-Bus
2525
3156
if not foreground:
2526
3157
# Close all input and output, do double fork, etc.
2529
# multiprocessing will use threads, so before we use gobject we
2530
# need to inform gobject that threads will be used.
2531
gobject.threads_init()
3160
# multiprocessing will use threads, so before we use GLib we need
3161
# to inform GLib that threads will be used.
2533
3164
global main_loop
2534
3165
# From the Avahi example code
2535
3166
DBusGMainLoop(set_as_default=True)
2536
main_loop = gobject.MainLoop()
3167
main_loop = GLib.MainLoop()
2537
3168
bus = dbus.SystemBus()
2538
3169
# End of Avahi example code
2541
3172
bus_name = dbus.service.BusName("se.recompile.Mandos",
2542
bus, do_not_queue=True)
2543
old_bus_name = (dbus.service.BusName
2544
("se.bsnet.fukt.Mandos", bus,
2546
except dbus.exceptions.NameExistsException as e:
3175
old_bus_name = dbus.service.BusName(
3176
"se.bsnet.fukt.Mandos", bus,
3178
except dbus.exceptions.DBusException as e:
2547
3179
logger.error("Disabling D-Bus:", exc_info=e)
2548
3180
use_dbus = False
2549
3181
server_settings["use_dbus"] = False
2550
3182
tcp_server.use_dbus = False
2552
3184
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2553
service = AvahiServiceToSyslog(name =
2554
server_settings["servicename"],
2555
servicetype = "_mandos._tcp",
2556
protocol = protocol, bus = bus)
3185
service = AvahiServiceToSyslog(
3186
name=server_settings["servicename"],
3187
servicetype="_mandos._tcp",
2557
3190
if server_settings["interface"]:
2558
service.interface = (if_nametoindex
2559
(server_settings["interface"]
3191
service.interface = if_nametoindex(
3192
server_settings["interface"].encode("utf-8"))
2562
3194
global multiprocessing_manager
2563
3195
multiprocessing_manager = multiprocessing.Manager()
2565
3197
client_class = Client
2567
client_class = functools.partial(ClientDBus, bus = bus)
3199
client_class = functools.partial(ClientDBus, bus=bus)
2569
3201
client_settings = Client.config_parser(client_config)
2570
3202
old_client_settings = {}
2571
3203
clients_data = {}
2573
3205
# This is used to redirect stdout and stderr for checker processes
2575
wnull = open(os.devnull, "w") # A writable /dev/null
3207
wnull = open(os.devnull, "w") # A writable /dev/null
2576
3208
# Only used if server is running in foreground but not in debug
2578
3210
if debug or not foreground:
2581
3213
# Get client data and settings from last running state.
2582
3214
if server_settings["restore"]:
2584
3216
with open(stored_state_path, "rb") as stored_state:
2585
clients_data, old_client_settings = (pickle.load
3217
if sys.version_info.major == 2:
3218
clients_data, old_client_settings = pickle.load(
3221
bytes_clients_data, bytes_old_client_settings = (
3222
pickle.load(stored_state, encoding="bytes"))
3223
# Fix bytes to strings
3226
clients_data = {(key.decode("utf-8")
3227
if isinstance(key, bytes)
3230
bytes_clients_data.items()}
3231
del bytes_clients_data
3232
for key in clients_data:
3233
value = {(k.decode("utf-8")
3234
if isinstance(k, bytes) else k): v
3236
clients_data[key].items()}
3237
clients_data[key] = value
3239
value["client_structure"] = [
3241
if isinstance(s, bytes)
3243
value["client_structure"]]
3245
for k in ("name", "host"):
3246
if isinstance(value[k], bytes):
3247
value[k] = value[k].decode("utf-8")
3248
if "key_id" not in value:
3249
value["key_id"] = ""
3250
elif "fingerprint" not in value:
3251
value["fingerprint"] = ""
3252
# old_client_settings
3254
old_client_settings = {
3255
(key.decode("utf-8")
3256
if isinstance(key, bytes)
3259
bytes_old_client_settings.items()}
3260
del bytes_old_client_settings
3262
for value in old_client_settings.values():
3263
if isinstance(value["host"], bytes):
3264
value["host"] = (value["host"]
2587
3266
os.remove(stored_state_path)
2588
3267
except IOError as e:
2589
3268
if e.errno == errno.ENOENT:
2590
logger.warning("Could not load persistent state: {}"
2591
.format(os.strerror(e.errno)))
3269
logger.warning("Could not load persistent state:"
3270
" {}".format(os.strerror(e.errno)))
2593
3272
logger.critical("Could not load persistent state:",
2596
3275
except EOFError as e:
2597
3276
logger.warning("Could not load persistent state: "
2598
"EOFError:", exc_info=e)
2600
3280
with PGPEngine() as pgp:
2601
3281
for client_name, client in clients_data.items():
2602
3282
# Skip removed clients
2603
3283
if client_name not in client_settings:
2606
3286
# Decide which value to use after restoring saved state.
2607
3287
# We have three different values: Old config file,
2608
3288
# new config file, and saved state.
2666
3346
for client_name in (set(client_settings)
2667
3347
- set(old_client_settings)):
2668
3348
clients_data[client_name] = client_settings[client_name]
2670
3350
# Create all client objects
2671
3351
for client_name, client in clients_data.items():
2672
3352
tcp_server.clients[client_name] = client_class(
2673
name = client_name, settings = client,
2674
server_settings = server_settings)
3355
server_settings=server_settings)
2676
3357
if not tcp_server.clients:
2677
3358
logger.warning("No clients defined")
2679
3360
if not foreground:
2680
3361
if pidfile is not None:
2684
pidfile.write("{}\n".format(pid).encode("utf-8"))
3365
print(pid, file=pidfile)
2685
3366
except IOError:
2686
3367
logger.error("Could not write to file %r with PID %d",
2687
3368
pidfilename, pid)
2689
3370
del pidfilename
2691
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2692
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3372
for termsig in (signal.SIGHUP, signal.SIGTERM):
3373
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3374
lambda: main_loop.quit() and False)
2695
@alternate_dbus_interfaces({"se.recompile.Mandos":
2696
"se.bsnet.fukt.Mandos"})
2697
class MandosDBusService(DBusObjectWithProperties):
3378
@alternate_dbus_interfaces(
3379
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3380
class MandosDBusService(DBusObjectWithObjectManager):
2698
3381
"""A D-Bus proxy object"""
2699
3383
def __init__(self):
2700
3384
dbus.service.Object.__init__(self, bus, "/")
2701
3386
_interface = "se.recompile.Mandos"
2703
@dbus_interface_annotations(_interface)
2705
return { "org.freedesktop.DBus.Property"
2706
".EmitsChangedSignal":
2709
3388
@dbus.service.signal(_interface, signature="o")
2710
3389
def ClientAdded(self, objpath):
2714
3393
@dbus.service.signal(_interface, signature="ss")
2715
def ClientNotFound(self, fingerprint, address):
3394
def ClientNotFound(self, key_id, address):
3398
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2719
3400
@dbus.service.signal(_interface, signature="os")
2720
3401
def ClientRemoved(self, objpath, name):
3405
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2724
3407
@dbus.service.method(_interface, out_signature="ao")
2725
3408
def GetAllClients(self):
2727
return dbus.Array(c.dbus_object_path
2729
tcp_server.clients.itervalues())
3410
return dbus.Array(c.dbus_object_path for c in
3411
tcp_server.clients.values())
3413
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2731
3415
@dbus.service.method(_interface,
2732
3416
out_signature="a{oa{sv}}")
2733
3417
def GetAllClientsWithProperties(self):
2735
3419
return dbus.Dictionary(
2736
{ c.dbus_object_path: c.GetAll("")
2737
for c in tcp_server.clients.itervalues() },
3420
{c.dbus_object_path: c.GetAll(
3421
"se.recompile.Mandos.Client")
3422
for c in tcp_server.clients.values()},
2738
3423
signature="oa{sv}")
2740
3425
@dbus.service.method(_interface, in_signature="o")
2741
3426
def RemoveClient(self, object_path):
2743
for c in tcp_server.clients.itervalues():
3428
for c in tcp_server.clients.values():
2744
3429
if c.dbus_object_path == object_path:
2745
3430
del tcp_server.clients[c.name]
2746
3431
c.remove_from_connection()
2747
# Don't signal anything except ClientRemoved
3432
# Don't signal the disabling
2748
3433
c.disable(quiet=True)
2750
self.ClientRemoved(object_path, c.name)
3434
# Emit D-Bus signal for removal
3435
self.client_removed_signal(c)
2752
3437
raise KeyError(object_path)
3441
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3442
out_signature="a{oa{sa{sv}}}")
3443
def GetManagedObjects(self):
3445
return dbus.Dictionary(
3446
{client.dbus_object_path:
3448
{interface: client.GetAll(interface)
3450
client._get_all_interface_names()})
3451
for client in tcp_server.clients.values()})
3453
def client_added_signal(self, client):
3454
"""Send the new standard signal and the old signal"""
3456
# New standard signal
3457
self.InterfacesAdded(
3458
client.dbus_object_path,
3460
{interface: client.GetAll(interface)
3462
client._get_all_interface_names()}))
3464
self.ClientAdded(client.dbus_object_path)
3466
def client_removed_signal(self, client):
3467
"""Send the new standard signal and the old signal"""
3469
# New standard signal
3470
self.InterfacesRemoved(
3471
client.dbus_object_path,
3472
client._get_all_interface_names())
3474
self.ClientRemoved(client.dbus_object_path,
2756
3477
mandos_dbus_service = MandosDBusService()
3479
# Save modules to variables to exempt the modules from being
3480
# unloaded before the function registered with atexit() is run.
3481
mp = multiprocessing
2759
3485
"Cleanup function; run on exit"
2761
3487
service.cleanup()
2763
multiprocessing.active_children()
3489
mp.active_children()
2765
3491
if not (tcp_server.clients or client_settings):
2768
3494
# Store client before exiting. Secrets are encrypted with key
2769
3495
# based on what config file has. If config file is
2770
3496
# removed/edited, old secret will thus be unrecovable.
2772
3498
with PGPEngine() as pgp:
2773
for client in tcp_server.clients.itervalues():
3499
for client in tcp_server.clients.values():
2774
3500
key = client_settings[client.name]["secret"]
2775
3501
client.encrypted_secret = pgp.encrypt(client.secret,
2777
3503
client_dict = {}
2779
3505
# A list of attributes that can not be pickled
2781
exclude = { "bus", "changedstate", "secret",
2782
"checker", "server_settings" }
2783
for name, typ in (inspect.getmembers
2784
(dbus.service.Object)):
3507
exclude = {"bus", "changedstate", "secret",
3508
"checker", "server_settings"}
3509
for name, typ in inspect.getmembers(dbus.service
2785
3511
exclude.add(name)
2787
3513
client_dict["encrypted_secret"] = (client
2788
3514
.encrypted_secret)
2789
3515
for attr in client.client_structure:
2790
3516
if attr not in exclude:
2791
3517
client_dict[attr] = getattr(client, attr)
2793
3519
clients[client.name] = client_dict
2794
3520
del client_settings[client.name]["secret"]
2797
with (tempfile.NamedTemporaryFile
2798
(mode='wb', suffix=".pickle", prefix='clients-',
2799
dir=os.path.dirname(stored_state_path),
2800
delete=False)) as stored_state:
2801
pickle.dump((clients, client_settings), stored_state)
2802
tempname=stored_state.name
3523
with tempfile.NamedTemporaryFile(
3527
dir=os.path.dirname(stored_state_path),
3528
delete=False) as stored_state:
3529
pickle.dump((clients, client_settings), stored_state,
3531
tempname = stored_state.name
2803
3532
os.rename(tempname, stored_state_path)
2804
3533
except (IOError, OSError) as e: