65
import cPickle as pickle
70
import cPickle as pickle
66
73
import multiprocessing
74
82
import dbus.service
83
from gi.repository import GLib
77
84
from dbus.mainloop.glib import DBusGMainLoop
80
87
import xml.dom.minidom
90
# Try to find the value of SO_BINDTODEVICE:
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
93
# newer, and it is also the most natural place for it:
84
94
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
95
except AttributeError:
97
# This is where SO_BINDTODEVICE was up to and including Python
87
99
from IN import SO_BINDTODEVICE
88
100
except ImportError:
89
SO_BINDTODEVICE = None
101
# In Python 2.7 it seems to have been removed entirely.
102
# Try running the C preprocessor:
104
cc = subprocess.Popen(["cc", "--language=c", "-E",
106
stdin=subprocess.PIPE,
107
stdout=subprocess.PIPE)
108
stdout = cc.communicate(
109
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
110
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
111
except (OSError, ValueError, IndexError):
113
SO_BINDTODEVICE = None
115
if sys.version_info.major == 2:
92
119
stored_state_file = "clients.pickle"
94
121
logger = logging.getLogger()
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
125
if_nametoindex = ctypes.cdll.LoadLibrary(
126
ctypes.util.find_library("c")).if_nametoindex
101
127
except (OSError, AttributeError):
102
129
def if_nametoindex(interface):
103
130
"Get an interface index the hard way, i.e. using fcntl()"
104
131
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
105
132
with contextlib.closing(socket.socket()) as s:
106
133
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
107
struct.pack(str("16s16x"),
109
interface_index = struct.unpack(str("I"),
134
struct.pack(b"16s16x", interface))
135
interface_index = struct.unpack("I", ifreq[16:20])[0]
111
136
return interface_index
139
def copy_function(func):
140
"""Make a copy of a function"""
141
if sys.version_info.major == 2:
142
return types.FunctionType(func.func_code,
148
return types.FunctionType(func.__code__,
114
155
def initlogger(debug, level=logging.WARNING):
115
156
"""init logger and add loglevel"""
118
syslogger = (logging.handlers.SysLogHandler
120
logging.handlers.SysLogHandler.LOG_DAEMON,
121
address = str("/dev/log")))
159
syslogger = (logging.handlers.SysLogHandler(
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
122
162
syslogger.setFormatter(logging.Formatter
123
163
('Mandos [%(process)d]: %(levelname)s:'
125
165
logger.addHandler(syslogger)
128
168
console = logging.StreamHandler()
129
169
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
182
236
.replace(b"\n", b"\\n")
183
237
.replace(b"\0", b"\\x00"))
186
240
def encrypt(self, data, password):
187
241
passphrase = self.password_encode(password)
188
with tempfile.NamedTemporaryFile(dir=self.tempdir
242
with tempfile.NamedTemporaryFile(
243
dir=self.tempdir) as passfile:
190
244
passfile.write(passphrase)
192
proc = subprocess.Popen(['gpg', '--symmetric',
246
proc = subprocess.Popen([self.gpg, '--symmetric',
193
247
'--passphrase-file',
195
249
+ self.gnupgargs,
196
stdin = subprocess.PIPE,
197
stdout = subprocess.PIPE,
198
stderr = subprocess.PIPE)
199
ciphertext, err = proc.communicate(input = data)
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
200
254
if proc.returncode != 0:
201
255
raise PGPError(err)
202
256
return ciphertext
204
258
def decrypt(self, data, password):
205
259
passphrase = self.password_encode(password)
206
with tempfile.NamedTemporaryFile(dir = self.tempdir
260
with tempfile.NamedTemporaryFile(
261
dir=self.tempdir) as passfile:
208
262
passfile.write(passphrase)
210
proc = subprocess.Popen(['gpg', '--decrypt',
264
proc = subprocess.Popen([self.gpg, '--decrypt',
211
265
'--passphrase-file',
213
267
+ self.gnupgargs,
214
stdin = subprocess.PIPE,
215
stdout = subprocess.PIPE,
216
stderr = subprocess.PIPE)
217
decrypted_plaintext, err = proc.communicate(input
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
219
272
if proc.returncode != 0:
220
273
raise PGPError(err)
221
274
return decrypted_plaintext
277
# Pretend that we have an Avahi module
279
"""This isn't so much a class as it is a module-like namespace."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
290
def string_array_to_txt_array(t):
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
224
303
class AvahiError(Exception):
225
304
def __init__(self, value, *args, **kwargs):
226
305
self.value = value
227
super(AvahiError, self).__init__(value, *args, **kwargs)
228
def __unicode__(self):
229
return unicode(repr(self.value))
306
return super(AvahiError, self).__init__(value, *args,
231
310
class AvahiServiceError(AvahiError):
234
314
class AvahiGroupError(AvahiError):
238
318
class AvahiService(object):
239
319
"""An Avahi (Zeroconf) service.
242
322
interface: integer; avahi.IF_UNSPEC or an interface index.
243
323
Used to optionally bind to the specified interface.
386
488
follow_name_owner_changes=True),
387
489
avahi.DBUS_INTERFACE_SERVER)
388
490
self.server.connect_to_signal("StateChanged",
389
self.server_state_changed)
491
self.server_state_changed)
390
492
self.server_state_changed(self.server.GetState())
393
495
class AvahiServiceToSyslog(AvahiService):
496
def rename(self, *args, **kwargs):
395
497
"""Add the new name to the syslog messages"""
396
ret = AvahiService.rename(self)
397
syslogger.setFormatter(logging.Formatter
398
('Mandos ({0}) [%(process)d]:'
399
' %(levelname)s: %(message)s'
498
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
499
syslogger.setFormatter(logging.Formatter(
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
404
def timedelta_to_milliseconds(td):
405
"Convert a datetime.timedelta() to milliseconds"
406
return ((td.days * 24 * 60 * 60 * 1000)
407
+ (td.seconds * 1000)
408
+ (td.microseconds // 1000))
505
# Pretend that we have a GnuTLS module
506
class gnutls(object):
507
"""This isn't so much a class as it is a module-like namespace."""
509
library = ctypes.util.find_library("gnutls")
511
library = ctypes.util.find_library("gnutls-deb0")
512
_library = ctypes.cdll.LoadLibrary(library)
515
# Unless otherwise indicated, the constants and types below are
516
# all from the gnutls/gnutls.h C header file.
527
E_NO_CERTIFICATE_FOUND = -49
532
KEYID_USE_SHA256 = 1 # gnutls/x509.h
533
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
536
class session_int(ctypes.Structure):
538
session_t = ctypes.POINTER(session_int)
540
class certificate_credentials_st(ctypes.Structure):
542
certificate_credentials_t = ctypes.POINTER(
543
certificate_credentials_st)
544
certificate_type_t = ctypes.c_int
546
class datum_t(ctypes.Structure):
547
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
548
('size', ctypes.c_uint)]
550
class openpgp_crt_int(ctypes.Structure):
552
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
553
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
554
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
555
credentials_type_t = ctypes.c_int
556
transport_ptr_t = ctypes.c_void_p
557
close_request_t = ctypes.c_int
560
class Error(Exception):
561
def __init__(self, message=None, code=None, args=()):
562
# Default usage is by a message string, but if a return
563
# code is passed, convert it to a string with
566
if message is None and code is not None:
567
message = gnutls.strerror(code)
568
return super(gnutls.Error, self).__init__(
571
class CertificateSecurityError(Error):
575
class Credentials(object):
577
self._c_object = gnutls.certificate_credentials_t()
578
gnutls.certificate_allocate_credentials(
579
ctypes.byref(self._c_object))
580
self.type = gnutls.CRD_CERTIFICATE
583
gnutls.certificate_free_credentials(self._c_object)
585
class ClientSession(object):
586
def __init__(self, socket, credentials=None):
587
self._c_object = gnutls.session_t()
588
gnutls_flags = gnutls.CLIENT
589
if gnutls.check_version(b"3.5.6"):
590
gnutls_flags |= gnutls.NO_TICKETS
592
gnutls_flags |= gnutls.ENABLE_RAWPK
593
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
595
gnutls.set_default_priority(self._c_object)
596
gnutls.transport_set_ptr(self._c_object, socket.fileno())
597
gnutls.handshake_set_private_extensions(self._c_object,
600
if credentials is None:
601
credentials = gnutls.Credentials()
602
gnutls.credentials_set(self._c_object, credentials.type,
603
ctypes.cast(credentials._c_object,
605
self.credentials = credentials
608
gnutls.deinit(self._c_object)
611
return gnutls.handshake(self._c_object)
613
def send(self, data):
617
data_len -= gnutls.record_send(self._c_object,
622
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
624
# Error handling functions
625
def _error_code(result):
626
"""A function to raise exceptions on errors, suitable
627
for the 'restype' attribute on ctypes functions"""
630
if result == gnutls.E_NO_CERTIFICATE_FOUND:
631
raise gnutls.CertificateSecurityError(code=result)
632
raise gnutls.Error(code=result)
634
def _retry_on_error(result, func, arguments):
635
"""A function to retry on some errors, suitable
636
for the 'errcheck' attribute on ctypes functions"""
638
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
639
return _error_code(result)
640
result = func(*arguments)
643
# Unless otherwise indicated, the function declarations below are
644
# all from the gnutls/gnutls.h C header file.
647
priority_set_direct = _library.gnutls_priority_set_direct
648
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
649
ctypes.POINTER(ctypes.c_char_p)]
650
priority_set_direct.restype = _error_code
652
init = _library.gnutls_init
653
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
654
init.restype = _error_code
656
set_default_priority = _library.gnutls_set_default_priority
657
set_default_priority.argtypes = [session_t]
658
set_default_priority.restype = _error_code
660
record_send = _library.gnutls_record_send
661
record_send.argtypes = [session_t, ctypes.c_void_p,
663
record_send.restype = ctypes.c_ssize_t
664
record_send.errcheck = _retry_on_error
666
certificate_allocate_credentials = (
667
_library.gnutls_certificate_allocate_credentials)
668
certificate_allocate_credentials.argtypes = [
669
ctypes.POINTER(certificate_credentials_t)]
670
certificate_allocate_credentials.restype = _error_code
672
certificate_free_credentials = (
673
_library.gnutls_certificate_free_credentials)
674
certificate_free_credentials.argtypes = [
675
certificate_credentials_t]
676
certificate_free_credentials.restype = None
678
handshake_set_private_extensions = (
679
_library.gnutls_handshake_set_private_extensions)
680
handshake_set_private_extensions.argtypes = [session_t,
682
handshake_set_private_extensions.restype = None
684
credentials_set = _library.gnutls_credentials_set
685
credentials_set.argtypes = [session_t, credentials_type_t,
687
credentials_set.restype = _error_code
689
strerror = _library.gnutls_strerror
690
strerror.argtypes = [ctypes.c_int]
691
strerror.restype = ctypes.c_char_p
693
certificate_type_get = _library.gnutls_certificate_type_get
694
certificate_type_get.argtypes = [session_t]
695
certificate_type_get.restype = _error_code
697
certificate_get_peers = _library.gnutls_certificate_get_peers
698
certificate_get_peers.argtypes = [session_t,
699
ctypes.POINTER(ctypes.c_uint)]
700
certificate_get_peers.restype = ctypes.POINTER(datum_t)
702
global_set_log_level = _library.gnutls_global_set_log_level
703
global_set_log_level.argtypes = [ctypes.c_int]
704
global_set_log_level.restype = None
706
global_set_log_function = _library.gnutls_global_set_log_function
707
global_set_log_function.argtypes = [log_func]
708
global_set_log_function.restype = None
710
deinit = _library.gnutls_deinit
711
deinit.argtypes = [session_t]
712
deinit.restype = None
714
handshake = _library.gnutls_handshake
715
handshake.argtypes = [session_t]
716
handshake.restype = _error_code
717
handshake.errcheck = _retry_on_error
719
transport_set_ptr = _library.gnutls_transport_set_ptr
720
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
721
transport_set_ptr.restype = None
723
bye = _library.gnutls_bye
724
bye.argtypes = [session_t, close_request_t]
725
bye.restype = _error_code
726
bye.errcheck = _retry_on_error
728
check_version = _library.gnutls_check_version
729
check_version.argtypes = [ctypes.c_char_p]
730
check_version.restype = ctypes.c_char_p
732
_need_version = b"3.3.0"
733
if check_version(_need_version) is None:
734
raise self.Error("Needs GnuTLS {} or later"
735
.format(_need_version))
737
_tls_rawpk_version = b"3.6.6"
738
has_rawpk = bool(check_version(_tls_rawpk_version))
742
class pubkey_st(ctypes.Structure):
744
pubkey_t = ctypes.POINTER(pubkey_st)
746
x509_crt_fmt_t = ctypes.c_int
748
# All the function declarations below are from gnutls/abstract.h
749
pubkey_init = _library.gnutls_pubkey_init
750
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
751
pubkey_init.restype = _error_code
753
pubkey_import = _library.gnutls_pubkey_import
754
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
756
pubkey_import.restype = _error_code
758
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
759
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
760
ctypes.POINTER(ctypes.c_ubyte),
761
ctypes.POINTER(ctypes.c_size_t)]
762
pubkey_get_key_id.restype = _error_code
764
pubkey_deinit = _library.gnutls_pubkey_deinit
765
pubkey_deinit.argtypes = [pubkey_t]
766
pubkey_deinit.restype = None
768
# All the function declarations below are from gnutls/openpgp.h
770
openpgp_crt_init = _library.gnutls_openpgp_crt_init
771
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
772
openpgp_crt_init.restype = _error_code
774
openpgp_crt_import = _library.gnutls_openpgp_crt_import
775
openpgp_crt_import.argtypes = [openpgp_crt_t,
776
ctypes.POINTER(datum_t),
778
openpgp_crt_import.restype = _error_code
780
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
781
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
782
ctypes.POINTER(ctypes.c_uint)]
783
openpgp_crt_verify_self.restype = _error_code
785
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
786
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
787
openpgp_crt_deinit.restype = None
789
openpgp_crt_get_fingerprint = (
790
_library.gnutls_openpgp_crt_get_fingerprint)
791
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
795
openpgp_crt_get_fingerprint.restype = _error_code
797
if check_version(b"3.6.4"):
798
certificate_type_get2 = _library.gnutls_certificate_type_get2
799
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
800
certificate_type_get2.restype = _error_code
802
# Remove non-public functions
803
del _error_code, _retry_on_error
806
def call_pipe(connection, # : multiprocessing.Connection
807
func, *args, **kwargs):
808
"""This function is meant to be called by multiprocessing.Process
810
This function runs func(*args, **kwargs), and writes the resulting
811
return value on the provided multiprocessing.Connection.
813
connection.send(func(*args, **kwargs))
411
817
class Client(object):
412
818
"""A representation of a client host served by this server.
415
821
approved: bool(); 'None' if not yet approved/disapproved
416
822
approval_delay: datetime.timedelta(); Time to wait for approval
417
823
approval_duration: datetime.timedelta(); Duration of one approval
418
checker: subprocess.Popen(); a running checker process used
419
to see if the client lives.
420
'None' if no process is running.
421
checker_callback_tag: a gobject event source tag, or None
824
checker: multiprocessing.Process(); a running checker process used
825
to see if the client lives. 'None' if no process is
827
checker_callback_tag: a GLib event source tag, or None
422
828
checker_command: string; External command which is run to check
423
829
if client lives. %() expansions are done at
424
830
runtime with vars(self) as dict, so that for
425
831
instance %(name)s can be used in the command.
426
checker_initiator_tag: a gobject event source tag, or None
832
checker_initiator_tag: a GLib event source tag, or None
427
833
created: datetime.datetime(); (UTC) object creation
428
834
client_structure: Object describing what attributes a client has
429
835
and is used for storing the client at exit
430
836
current_checker_command: string; current running checker_command
431
disable_initiator_tag: a gobject event source tag, or None
837
disable_initiator_tag: a GLib event source tag, or None
433
839
fingerprint: string (40 or 32 hexadecimal digits); used to
434
uniquely identify the client
840
uniquely identify an OpenPGP client
841
key_id: string (64 hexadecimal digits); used to uniquely identify
842
a client using raw public keys
435
843
host: string; available for use by the checker command
436
844
interval: datetime.timedelta(); How often to start a new checker
437
845
last_approval_request: datetime.datetime(); (UTC) or None
604
1002
logger.info("Disabling client %s", self.name)
605
1003
if getattr(self, "disable_initiator_tag", None) is not None:
606
gobject.source_remove(self.disable_initiator_tag)
1004
GLib.source_remove(self.disable_initiator_tag)
607
1005
self.disable_initiator_tag = None
608
1006
self.expires = None
609
1007
if getattr(self, "checker_initiator_tag", None) is not None:
610
gobject.source_remove(self.checker_initiator_tag)
1008
GLib.source_remove(self.checker_initiator_tag)
611
1009
self.checker_initiator_tag = None
612
1010
self.stop_checker()
613
1011
self.enabled = False
615
1013
self.send_changedstate()
616
# Do not run this again if called by a gobject.timeout_add
1014
# Do not run this again if called by a GLib.timeout_add
619
1017
def __del__(self):
622
1020
def init_checker(self):
623
1021
# Schedule a new checker to be started an 'interval' from now,
624
1022
# and every interval from then on.
625
1023
if self.checker_initiator_tag is not None:
626
gobject.source_remove(self.checker_initiator_tag)
627
self.checker_initiator_tag = (gobject.timeout_add
628
(self.interval_milliseconds(),
1024
GLib.source_remove(self.checker_initiator_tag)
1025
self.checker_initiator_tag = GLib.timeout_add(
1026
int(self.interval.total_seconds() * 1000),
630
1028
# Schedule a disable() when 'timeout' has passed
631
1029
if self.disable_initiator_tag is not None:
632
gobject.source_remove(self.disable_initiator_tag)
633
self.disable_initiator_tag = (gobject.timeout_add
634
(self.timeout_milliseconds(),
1030
GLib.source_remove(self.disable_initiator_tag)
1031
self.disable_initiator_tag = GLib.timeout_add(
1032
int(self.timeout.total_seconds() * 1000), self.disable)
636
1033
# Also start a new checker *right now*.
637
1034
self.start_checker()
639
def checker_callback(self, pid, condition, command):
1036
def checker_callback(self, source, condition, connection,
640
1038
"""The checker has completed, so take appropriate actions."""
1039
# Read return code from connection (see call_pipe)
1040
returncode = connection.recv()
641
1043
self.checker_callback_tag = None
642
1044
self.checker = None
643
if os.WIFEXITED(condition):
644
self.last_checker_status = os.WEXITSTATUS(condition)
1047
self.last_checker_status = returncode
1048
self.last_checker_signal = None
645
1049
if self.last_checker_status == 0:
646
1050
logger.info("Checker for %(name)s succeeded",
648
1052
self.checked_ok()
650
logger.info("Checker for %(name)s failed",
1054
logger.info("Checker for %(name)s failed", vars(self))
653
1056
self.last_checker_status = -1
1057
self.last_checker_signal = -returncode
654
1058
logger.warning("Checker for %(name)s crashed?",
657
1062
def checked_ok(self):
658
1063
"""Assert that the client has been seen, alive and well."""
659
1064
self.last_checked_ok = datetime.datetime.utcnow()
660
1065
self.last_checker_status = 0
1066
self.last_checker_signal = None
661
1067
self.bump_timeout()
663
1069
def bump_timeout(self, timeout=None):
664
1070
"""Bump up the timeout for this client."""
665
1071
if timeout is None:
666
1072
timeout = self.timeout
667
1073
if self.disable_initiator_tag is not None:
668
gobject.source_remove(self.disable_initiator_tag)
1074
GLib.source_remove(self.disable_initiator_tag)
669
1075
self.disable_initiator_tag = None
670
1076
if getattr(self, "enabled", False):
671
self.disable_initiator_tag = (gobject.timeout_add
672
(timedelta_to_milliseconds
673
(timeout), self.disable))
1077
self.disable_initiator_tag = GLib.timeout_add(
1078
int(timeout.total_seconds() * 1000), self.disable)
674
1079
self.expires = datetime.datetime.utcnow() + timeout
676
1081
def need_approval(self):
677
1082
self.last_approval_request = datetime.datetime.utcnow()
679
1084
def start_checker(self):
680
1085
"""Start a new checker subprocess if one is not running.
682
1087
If a checker already exists, leave it running and do
684
1089
# The reason for not killing a running checker is that if we
689
1094
# checkers alone, the checker would have to take more time
690
1095
# than 'timeout' for the client to be disabled, which is as it
693
# If a checker exists, make sure it is not a zombie
695
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
696
except AttributeError:
698
except OSError as error:
699
if error.errno != errno.ECHILD:
703
logger.warning("Checker was a zombie")
704
gobject.source_remove(self.checker_callback_tag)
705
self.checker_callback(pid, status,
706
self.current_checker_command)
1098
if self.checker is not None and not self.checker.is_alive():
1099
logger.warning("Checker was not alive; joining")
707
1102
# Start a new checker if needed
708
1103
if self.checker is None:
709
1104
# Escape attributes for the shell
710
escaped_attrs = dict(
711
(attr, re.escape(unicode(getattr(self, attr))))
713
self.runtime_expansions)
1106
attr: re.escape(str(getattr(self, attr)))
1107
for attr in self.runtime_expansions}
715
1109
command = self.checker_command % escaped_attrs
716
1110
except TypeError as error:
717
1111
logger.error('Could not format string "%s"',
718
self.checker_command, exc_info=error)
719
return True # Try again later
1112
self.checker_command,
1114
return True # Try again later
720
1115
self.current_checker_command = command
722
logger.info("Starting checker %r for %s",
724
# We don't need to redirect stdout and stderr, since
725
# in normal mode, that is already done by daemon(),
726
# and in debug mode we don't want to. (Stdin is
727
# always replaced by /dev/null.)
728
# The exception is when not debugging but nevertheless
729
# running in the foreground; use the previously
732
if (not self.server_settings["debug"]
733
and self.server_settings["foreground"]):
734
popen_args.update({"stdout": wnull,
736
self.checker = subprocess.Popen(command,
740
except OSError as error:
741
logger.error("Failed to start subprocess",
744
self.checker_callback_tag = (gobject.child_watch_add
746
self.checker_callback,
748
# The checker may have completed before the gobject
749
# watch was added. Check for this.
751
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
752
except OSError as error:
753
if error.errno == errno.ECHILD:
754
# This should never happen
755
logger.error("Child process vanished",
760
gobject.source_remove(self.checker_callback_tag)
761
self.checker_callback(pid, status, command)
762
# Re-run this periodically if run by gobject.timeout_add
1116
logger.info("Starting checker %r for %s", command,
1118
# We don't need to redirect stdout and stderr, since
1119
# in normal mode, that is already done by daemon(),
1120
# and in debug mode we don't want to. (Stdin is
1121
# always replaced by /dev/null.)
1122
# The exception is when not debugging but nevertheless
1123
# running in the foreground; use the previously
1125
popen_args = {"close_fds": True,
1128
if (not self.server_settings["debug"]
1129
and self.server_settings["foreground"]):
1130
popen_args.update({"stdout": wnull,
1132
pipe = multiprocessing.Pipe(duplex=False)
1133
self.checker = multiprocessing.Process(
1135
args=(pipe[1], subprocess.call, command),
1137
self.checker.start()
1138
self.checker_callback_tag = GLib.io_add_watch(
1139
pipe[0].fileno(), GLib.IO_IN,
1140
self.checker_callback, pipe[0], command)
1141
# Re-run this periodically if run by GLib.timeout_add
765
1144
def stop_checker(self):
766
1145
"""Force the checker process, if any, to stop."""
767
1146
if self.checker_callback_tag:
768
gobject.source_remove(self.checker_callback_tag)
1147
GLib.source_remove(self.checker_callback_tag)
769
1148
self.checker_callback_tag = None
770
1149
if getattr(self, "checker", None) is None:
772
1151
logger.debug("Stopping checker for %(name)s", vars(self))
774
self.checker.terminate()
776
#if self.checker.poll() is None:
777
# self.checker.kill()
778
except OSError as error:
779
if error.errno != errno.ESRCH: # No such process
1152
self.checker.terminate()
781
1153
self.checker = None
784
def dbus_service_property(dbus_interface, signature="v",
785
access="readwrite", byte_arrays=False):
1156
def dbus_service_property(dbus_interface,
786
1160
"""Decorators for marking methods of a DBusObjectWithProperties to
787
1161
become properties on the D-Bus.
789
1163
The decorated method will be called with no arguments by "Get"
790
1164
and with one argument by "Set".
792
1166
The parameters, where they are supported, are the same as
793
1167
dbus.service.method, except there is only "signature", since the
794
1168
type from Get() and the type sent to Set() is the same.
870
class DBusObjectWithProperties(dbus.service.Object):
871
"""A D-Bus object with properties.
873
Classes inheriting from this can use the dbus_service_property
874
decorator to expose methods as D-Bus properties. It exposes the
875
standard Get(), Set(), and GetAll() methods on the D-Bus.
1251
class DBusObjectWithAnnotations(dbus.service.Object):
1252
"""A D-Bus object with annotations.
1254
Classes inheriting from this can use the dbus_annotations
1255
decorator to add annotations to methods or signals.
879
1259
def _is_dbus_thing(thing):
880
1260
"""Returns a function testing if an attribute is a D-Bus thing
882
1262
If called like _is_dbus_thing("method") it returns a function
883
1263
suitable for use as predicate to inspect.getmembers().
885
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1265
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
888
1268
def _get_all_dbus_things(self, thing):
889
1269
"""Returns a generator of (name, attribute) pairs
891
return ((getattr(athing.__get__(self), "_dbus_name",
1271
return ((getattr(athing.__get__(self), "_dbus_name", name),
893
1272
athing.__get__(self))
894
1273
for cls in self.__class__.__mro__
895
1274
for name, athing in
896
inspect.getmembers(cls,
897
self._is_dbus_thing(thing)))
1275
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1277
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1279
path_keyword='object_path',
1280
connection_keyword='connection')
1281
def Introspect(self, object_path, connection):
1282
"""Overloading of standard D-Bus method.
1284
Inserts annotation tags on methods and signals.
1286
xmlstring = dbus.service.Object.Introspect(self, object_path,
1289
document = xml.dom.minidom.parseString(xmlstring)
1291
for if_tag in document.getElementsByTagName("interface"):
1292
# Add annotation tags
1293
for typ in ("method", "signal"):
1294
for tag in if_tag.getElementsByTagName(typ):
1296
for name, prop in (self.
1297
_get_all_dbus_things(typ)):
1298
if (name == tag.getAttribute("name")
1299
and prop._dbus_interface
1300
== if_tag.getAttribute("name")):
1301
annots.update(getattr(
1302
prop, "_dbus_annotations", {}))
1303
for name, value in annots.items():
1304
ann_tag = document.createElement(
1306
ann_tag.setAttribute("name", name)
1307
ann_tag.setAttribute("value", value)
1308
tag.appendChild(ann_tag)
1309
# Add interface annotation tags
1310
for annotation, value in dict(
1311
itertools.chain.from_iterable(
1312
annotations().items()
1313
for name, annotations
1314
in self._get_all_dbus_things("interface")
1315
if name == if_tag.getAttribute("name")
1317
ann_tag = document.createElement("annotation")
1318
ann_tag.setAttribute("name", annotation)
1319
ann_tag.setAttribute("value", value)
1320
if_tag.appendChild(ann_tag)
1321
# Fix argument name for the Introspect method itself
1322
if (if_tag.getAttribute("name")
1323
== dbus.INTROSPECTABLE_IFACE):
1324
for cn in if_tag.getElementsByTagName("method"):
1325
if cn.getAttribute("name") == "Introspect":
1326
for arg in cn.getElementsByTagName("arg"):
1327
if (arg.getAttribute("direction")
1329
arg.setAttribute("name",
1331
xmlstring = document.toxml("utf-8")
1333
except (AttributeError, xml.dom.DOMException,
1334
xml.parsers.expat.ExpatError) as error:
1335
logger.error("Failed to override Introspection method",
1340
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1341
"""A D-Bus object with properties.
1343
Classes inheriting from this can use the dbus_service_property
1344
decorator to expose methods as D-Bus properties. It exposes the
1345
standard Get(), Set(), and GetAll() methods on the D-Bus.
899
1348
def _get_dbus_property(self, interface_name, property_name):
900
1349
"""Returns a bound method if one exists which is a D-Bus
901
1350
property with the specified name and interface.
903
for cls in self.__class__.__mro__:
904
for name, value in (inspect.getmembers
906
self._is_dbus_thing("property"))):
1352
for cls in self.__class__.__mro__:
1353
for name, value in inspect.getmembers(
1354
cls, self._is_dbus_thing("property")):
907
1355
if (value._dbus_name == property_name
908
1356
and value._dbus_interface == interface_name):
909
1357
return value.__get__(self)
911
1359
# No such property
912
raise DBusPropertyNotFound(self.dbus_object_path + ":"
913
+ interface_name + "."
916
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1360
raise DBusPropertyNotFound("{}:{}.{}".format(
1361
self.dbus_object_path, interface_name, property_name))
1364
def _get_all_interface_names(cls):
1365
"""Get a sequence of all interfaces supported by an object"""
1366
return (name for name in set(getattr(getattr(x, attr),
1367
"_dbus_interface", None)
1368
for x in (inspect.getmro(cls))
1370
if name is not None)
1372
@dbus.service.method(dbus.PROPERTIES_IFACE,
917
1374
out_signature="v")
918
1375
def Get(self, interface_name, property_name):
919
1376
"""Standard D-Bus property Get() method, see D-Bus standard.
1051
1505
return xmlstring
1509
dbus.OBJECT_MANAGER_IFACE
1510
except AttributeError:
1511
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1514
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1515
"""A D-Bus object with an ObjectManager.
1517
Classes inheriting from this exposes the standard
1518
GetManagedObjects call and the InterfacesAdded and
1519
InterfacesRemoved signals on the standard
1520
"org.freedesktop.DBus.ObjectManager" interface.
1522
Note: No signals are sent automatically; they must be sent
1525
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1526
out_signature="a{oa{sa{sv}}}")
1527
def GetManagedObjects(self):
1528
"""This function must be overridden"""
1529
raise NotImplementedError()
1531
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1532
signature="oa{sa{sv}}")
1533
def InterfacesAdded(self, object_path, interfaces_and_properties):
1536
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1537
def InterfacesRemoved(self, object_path, interfaces):
1540
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1542
path_keyword='object_path',
1543
connection_keyword='connection')
1544
def Introspect(self, object_path, connection):
1545
"""Overloading of standard D-Bus method.
1547
Override return argument name of GetManagedObjects to be
1548
"objpath_interfaces_and_properties"
1550
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1554
document = xml.dom.minidom.parseString(xmlstring)
1556
for if_tag in document.getElementsByTagName("interface"):
1557
# Fix argument name for the GetManagedObjects method
1558
if (if_tag.getAttribute("name")
1559
== dbus.OBJECT_MANAGER_IFACE):
1560
for cn in if_tag.getElementsByTagName("method"):
1561
if (cn.getAttribute("name")
1562
== "GetManagedObjects"):
1563
for arg in cn.getElementsByTagName("arg"):
1564
if (arg.getAttribute("direction")
1568
"objpath_interfaces"
1570
xmlstring = document.toxml("utf-8")
1572
except (AttributeError, xml.dom.DOMException,
1573
xml.parsers.expat.ExpatError) as error:
1574
logger.error("Failed to override Introspection method",
1054
1579
def datetime_to_dbus(dt, variant_level=0):
1055
1580
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1057
return dbus.String("", variant_level = variant_level)
1058
return dbus.String(dt.isoformat(),
1059
variant_level=variant_level)
1582
return dbus.String("", variant_level=variant_level)
1583
return dbus.String(dt.isoformat(), variant_level=variant_level)
1062
1586
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1411
1947
server to mandos-client
1415
1951
# Rejected - signal
1416
1952
@dbus.service.signal(_interface, signature="s")
1417
1953
def Rejected(self, reason):
1421
1957
# NeedApproval - signal
1422
1958
@dbus.service.signal(_interface, signature="tb")
1423
1959
def NeedApproval(self, timeout, default):
1425
1961
return self.need_approval()
1429
1965
# Approve - method
1430
1966
@dbus.service.method(_interface, in_signature="b")
1431
1967
def Approve(self, value):
1432
1968
self.approve(value)
1434
1970
# CheckedOK - method
1435
1971
@dbus.service.method(_interface)
1436
1972
def CheckedOK(self):
1437
1973
self.checked_ok()
1439
1975
# Enable - method
1976
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1440
1977
@dbus.service.method(_interface)
1441
1978
def Enable(self):
1445
1982
# StartChecker - method
1983
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1446
1984
@dbus.service.method(_interface)
1447
1985
def StartChecker(self):
1449
1987
self.start_checker()
1451
1989
# Disable - method
1990
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1452
1991
@dbus.service.method(_interface)
1453
1992
def Disable(self):
1457
1996
# StopChecker - method
1997
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1458
1998
@dbus.service.method(_interface)
1459
1999
def StopChecker(self):
1460
2000
self.stop_checker()
1464
2004
# ApprovalPending - property
1465
2005
@dbus_service_property(_interface, signature="b", access="read")
1466
2006
def ApprovalPending_dbus_property(self):
1467
2007
return dbus.Boolean(bool(self.approvals_pending))
1469
2009
# ApprovedByDefault - property
1470
@dbus_service_property(_interface, signature="b",
2010
@dbus_service_property(_interface,
1471
2012
access="readwrite")
1472
2013
def ApprovedByDefault_dbus_property(self, value=None):
1473
2014
if value is None: # get
1474
2015
return dbus.Boolean(self.approved_by_default)
1475
2016
self.approved_by_default = bool(value)
1477
2018
# ApprovalDelay - property
1478
@dbus_service_property(_interface, signature="t",
2019
@dbus_service_property(_interface,
1479
2021
access="readwrite")
1480
2022
def ApprovalDelay_dbus_property(self, value=None):
1481
2023
if value is None: # get
1482
return dbus.UInt64(self.approval_delay_milliseconds())
2024
return dbus.UInt64(self.approval_delay.total_seconds()
1483
2026
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1485
2028
# ApprovalDuration - property
1486
@dbus_service_property(_interface, signature="t",
2029
@dbus_service_property(_interface,
1487
2031
access="readwrite")
1488
2032
def ApprovalDuration_dbus_property(self, value=None):
1489
2033
if value is None: # get
1490
return dbus.UInt64(timedelta_to_milliseconds(
1491
self.approval_duration))
2034
return dbus.UInt64(self.approval_duration.total_seconds()
1492
2036
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1494
2038
# Name - property
2040
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1495
2041
@dbus_service_property(_interface, signature="s", access="read")
1496
2042
def Name_dbus_property(self):
1497
2043
return dbus.String(self.name)
2047
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2048
@dbus_service_property(_interface, signature="s", access="read")
2049
def KeyID_dbus_property(self):
2050
return dbus.String(self.key_id)
1499
2052
# Fingerprint - property
2054
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1500
2055
@dbus_service_property(_interface, signature="s", access="read")
1501
2056
def Fingerprint_dbus_property(self):
1502
2057
return dbus.String(self.fingerprint)
1504
2059
# Host - property
1505
@dbus_service_property(_interface, signature="s",
2060
@dbus_service_property(_interface,
1506
2062
access="readwrite")
1507
2063
def Host_dbus_property(self, value=None):
1508
2064
if value is None: # get
1509
2065
return dbus.String(self.host)
1510
self.host = unicode(value)
2066
self.host = str(value)
1512
2068
# Created - property
2070
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1513
2071
@dbus_service_property(_interface, signature="s", access="read")
1514
2072
def Created_dbus_property(self):
1515
2073
return datetime_to_dbus(self.created)
1517
2075
# LastEnabled - property
1518
2076
@dbus_service_property(_interface, signature="s", access="read")
1519
2077
def LastEnabled_dbus_property(self):
1520
2078
return datetime_to_dbus(self.last_enabled)
1522
2080
# Enabled - property
1523
@dbus_service_property(_interface, signature="b",
2081
@dbus_service_property(_interface,
1524
2083
access="readwrite")
1525
2084
def Enabled_dbus_property(self, value=None):
1526
2085
if value is None: # get
1574
2134
if (getattr(self, "disable_initiator_tag", None)
1577
gobject.source_remove(self.disable_initiator_tag)
1578
self.disable_initiator_tag = (
1579
gobject.timeout_add(
1580
timedelta_to_milliseconds(self.expires - now),
2137
GLib.source_remove(self.disable_initiator_tag)
2138
self.disable_initiator_tag = GLib.timeout_add(
2139
int((self.expires - now).total_seconds() * 1000),
1583
2142
# ExtendedTimeout - property
1584
@dbus_service_property(_interface, signature="t",
2143
@dbus_service_property(_interface,
1585
2145
access="readwrite")
1586
2146
def ExtendedTimeout_dbus_property(self, value=None):
1587
2147
if value is None: # get
1588
return dbus.UInt64(self.extended_timeout_milliseconds())
2148
return dbus.UInt64(self.extended_timeout.total_seconds()
1589
2150
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1591
2152
# Interval - property
1592
@dbus_service_property(_interface, signature="t",
2153
@dbus_service_property(_interface,
1593
2155
access="readwrite")
1594
2156
def Interval_dbus_property(self, value=None):
1595
2157
if value is None: # get
1596
return dbus.UInt64(self.interval_milliseconds())
2158
return dbus.UInt64(self.interval.total_seconds() * 1000)
1597
2159
self.interval = datetime.timedelta(0, 0, 0, value)
1598
2160
if getattr(self, "checker_initiator_tag", None) is None:
1600
2162
if self.enabled:
1601
2163
# Reschedule checker run
1602
gobject.source_remove(self.checker_initiator_tag)
1603
self.checker_initiator_tag = (gobject.timeout_add
1604
(value, self.start_checker))
1605
self.start_checker() # Start one now, too
2164
GLib.source_remove(self.checker_initiator_tag)
2165
self.checker_initiator_tag = GLib.timeout_add(
2166
value, self.start_checker)
2167
self.start_checker() # Start one now, too
1607
2169
# Checker - property
1608
@dbus_service_property(_interface, signature="s",
2170
@dbus_service_property(_interface,
1609
2172
access="readwrite")
1610
2173
def Checker_dbus_property(self, value=None):
1611
2174
if value is None: # get
1612
2175
return dbus.String(self.checker_command)
1613
self.checker_command = unicode(value)
2176
self.checker_command = str(value)
1615
2178
# CheckerRunning - property
1616
@dbus_service_property(_interface, signature="b",
2179
@dbus_service_property(_interface,
1617
2181
access="readwrite")
1618
2182
def CheckerRunning_dbus_property(self, value=None):
1619
2183
if value is None: # get
1792
2367
delay -= time2 - time
1795
while sent_size < len(client.secret):
1797
sent = session.send(client.secret[sent_size:])
1798
except gnutls.errors.GNUTLSError as error:
1799
logger.warning("gnutls send failed",
1802
logger.debug("Sent: %d, remaining: %d",
1803
sent, len(client.secret)
1804
- (sent_size + sent))
2370
session.send(client.secret)
2371
except gnutls.Error as error:
2372
logger.warning("gnutls send failed",
1807
2376
logger.info("Sending secret to %s", client.name)
1808
2377
# bump the timeout using extended_timeout
1809
2378
client.bump_timeout(client.extended_timeout)
1810
2379
if self.server.use_dbus:
1811
2380
# Emit D-Bus signal
1812
2381
client.GotSecret()
1815
2384
if approval_required:
1816
2385
client.approvals_pending -= 1
1819
except gnutls.errors.GNUTLSError as error:
2388
except gnutls.Error as error:
1820
2389
logger.warning("GnuTLS bye failed",
1821
2390
exc_info=error)
1824
2393
def peer_certificate(session):
1825
"Return the peer's OpenPGP certificate as a bytestring"
1826
# If not an OpenPGP certificate...
1827
if (gnutls.library.functions
1828
.gnutls_certificate_type_get(session._c_object)
1829
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1830
# ...do the normal thing
1831
return session.peer_certificate
2394
"Return the peer's certificate as a bytestring"
2396
cert_type = gnutls.certificate_type_get2(session._c_object,
2398
except AttributeError:
2399
cert_type = gnutls.certificate_type_get(session._c_object)
2400
if gnutls.has_rawpk:
2401
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2403
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2404
# If not a valid certificate type...
2405
if cert_type not in valid_cert_types:
2406
logger.info("Cert type %r not in %r", cert_type,
2408
# ...return invalid data
1832
2410
list_size = ctypes.c_uint(1)
1833
cert_list = (gnutls.library.functions
1834
.gnutls_certificate_get_peers
2411
cert_list = (gnutls.certificate_get_peers
1835
2412
(session._c_object, ctypes.byref(list_size)))
1836
2413
if not bool(cert_list) and list_size.value != 0:
1837
raise gnutls.errors.GNUTLSError("error getting peer"
2414
raise gnutls.Error("error getting peer certificate")
1839
2415
if list_size.value == 0:
1841
2417
cert = cert_list[0]
1842
2418
return ctypes.string_at(cert.data, cert.size)
2421
def key_id(certificate):
2422
"Convert a certificate bytestring to a hexdigit key ID"
2423
# New GnuTLS "datum" with the public key
2424
datum = gnutls.datum_t(
2425
ctypes.cast(ctypes.c_char_p(certificate),
2426
ctypes.POINTER(ctypes.c_ubyte)),
2427
ctypes.c_uint(len(certificate)))
2428
# XXX all these need to be created in the gnutls "module"
2429
# New empty GnuTLS certificate
2430
pubkey = gnutls.pubkey_t()
2431
gnutls.pubkey_init(ctypes.byref(pubkey))
2432
# Import the raw public key into the certificate
2433
gnutls.pubkey_import(pubkey,
2434
ctypes.byref(datum),
2435
gnutls.X509_FMT_DER)
2436
# New buffer for the key ID
2437
buf = ctypes.create_string_buffer(32)
2438
buf_len = ctypes.c_size_t(len(buf))
2439
# Get the key ID from the raw public key into the buffer
2440
gnutls.pubkey_get_key_id(pubkey,
2441
gnutls.KEYID_USE_SHA256,
2442
ctypes.cast(ctypes.byref(buf),
2443
ctypes.POINTER(ctypes.c_ubyte)),
2444
ctypes.byref(buf_len))
2445
# Deinit the certificate
2446
gnutls.pubkey_deinit(pubkey)
2448
# Convert the buffer to a Python bytestring
2449
key_id = ctypes.string_at(buf, buf_len.value)
2450
# Convert the bytestring to hexadecimal notation
2451
hex_key_id = binascii.hexlify(key_id).upper()
1845
2455
def fingerprint(openpgp):
1846
2456
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1847
2457
# New GnuTLS "datum" with the OpenPGP public key
1848
datum = (gnutls.library.types
1849
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1852
ctypes.c_uint(len(openpgp))))
2458
datum = gnutls.datum_t(
2459
ctypes.cast(ctypes.c_char_p(openpgp),
2460
ctypes.POINTER(ctypes.c_ubyte)),
2461
ctypes.c_uint(len(openpgp)))
1853
2462
# New empty GnuTLS certificate
1854
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1855
(gnutls.library.functions
1856
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2463
crt = gnutls.openpgp_crt_t()
2464
gnutls.openpgp_crt_init(ctypes.byref(crt))
1857
2465
# Import the OpenPGP public key into the certificate
1858
(gnutls.library.functions
1859
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1860
gnutls.library.constants
1861
.GNUTLS_OPENPGP_FMT_RAW))
2466
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2467
gnutls.OPENPGP_FMT_RAW)
1862
2468
# Verify the self signature in the key
1863
2469
crtverify = ctypes.c_uint()
1864
(gnutls.library.functions
1865
.gnutls_openpgp_crt_verify_self(crt, 0,
1866
ctypes.byref(crtverify)))
2470
gnutls.openpgp_crt_verify_self(crt, 0,
2471
ctypes.byref(crtverify))
1867
2472
if crtverify.value != 0:
1868
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1869
raise (gnutls.errors.CertificateSecurityError
2473
gnutls.openpgp_crt_deinit(crt)
2474
raise gnutls.CertificateSecurityError(code
1871
2476
# New buffer for the fingerprint
1872
2477
buf = ctypes.create_string_buffer(20)
1873
2478
buf_len = ctypes.c_size_t()
1874
2479
# Get the fingerprint from the certificate into the buffer
1875
(gnutls.library.functions
1876
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1877
ctypes.byref(buf_len)))
2480
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2481
ctypes.byref(buf_len))
1878
2482
# Deinit the certificate
1879
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2483
gnutls.openpgp_crt_deinit(crt)
1880
2484
# Convert the buffer to a Python bytestring
1881
2485
fpr = ctypes.string_at(buf, buf_len.value)
1882
2486
# Convert the bytestring to hexadecimal notation
1965
2575
# socket_wrapper(), if socketfd was set.
1966
2576
socketserver.TCPServer.__init__(self, server_address,
1967
2577
RequestHandlerClass)
1969
2579
def server_bind(self):
1970
2580
"""This overrides the normal server_bind() function
1971
2581
to bind to an interface if one was specified, and also NOT to
1972
2582
bind to an address or port if they were not specified."""
2583
global SO_BINDTODEVICE
1973
2584
if self.interface is not None:
1974
2585
if SO_BINDTODEVICE is None:
1975
logger.error("SO_BINDTODEVICE does not exist;"
1976
" cannot bind to interface %s",
1980
self.socket.setsockopt(socket.SOL_SOCKET,
1982
str(self.interface + '\0'))
1983
except socket.error as error:
1984
if error.errno == errno.EPERM:
1985
logger.error("No permission to bind to"
1986
" interface %s", self.interface)
1987
elif error.errno == errno.ENOPROTOOPT:
1988
logger.error("SO_BINDTODEVICE not available;"
1989
" cannot bind to interface %s",
1991
elif error.errno == errno.ENODEV:
1992
logger.error("Interface %s does not exist,"
1993
" cannot bind", self.interface)
2586
# Fall back to a hard-coded value which seems to be
2588
logger.warning("SO_BINDTODEVICE not found, trying 25")
2589
SO_BINDTODEVICE = 25
2591
self.socket.setsockopt(
2592
socket.SOL_SOCKET, SO_BINDTODEVICE,
2593
(self.interface + "\0").encode("utf-8"))
2594
except socket.error as error:
2595
if error.errno == errno.EPERM:
2596
logger.error("No permission to bind to"
2597
" interface %s", self.interface)
2598
elif error.errno == errno.ENOPROTOOPT:
2599
logger.error("SO_BINDTODEVICE not available;"
2600
" cannot bind to interface %s",
2602
elif error.errno == errno.ENODEV:
2603
logger.error("Interface %s does not exist,"
2604
" cannot bind", self.interface)
1996
2607
# Only bind(2) the socket if we really need to.
1997
2608
if self.server_address[0] or self.server_address[1]:
2609
if self.server_address[1]:
2610
self.allow_reuse_address = True
1998
2611
if not self.server_address[0]:
1999
2612
if self.address_family == socket.AF_INET6:
2000
any_address = "::" # in6addr_any
2613
any_address = "::" # in6addr_any
2002
any_address = "0.0.0.0" # INADDR_ANY
2615
any_address = "0.0.0.0" # INADDR_ANY
2003
2616
self.server_address = (any_address,
2004
2617
self.server_address[1])
2005
2618
elif not self.server_address[1]:
2006
self.server_address = (self.server_address[0],
2619
self.server_address = (self.server_address[0], 0)
2008
2620
# if self.interface:
2009
2621
# self.server_address = (self.server_address[0],
2035
2652
self.gnutls_priority = gnutls_priority
2036
2653
IPv6_TCPServer.__init__(self, server_address,
2037
2654
RequestHandlerClass,
2038
interface = interface,
2039
use_ipv6 = use_ipv6,
2040
socketfd = socketfd)
2655
interface=interface,
2041
2659
def server_activate(self):
2042
2660
if self.enabled:
2043
2661
return socketserver.TCPServer.server_activate(self)
2045
2663
def enable(self):
2046
2664
self.enabled = True
2048
2666
def add_pipe(self, parent_pipe, proc):
2049
2667
# Call "handle_ipc" for both data and EOF events
2050
gobject.io_add_watch(parent_pipe.fileno(),
2051
gobject.IO_IN | gobject.IO_HUP,
2052
functools.partial(self.handle_ipc,
2057
def handle_ipc(self, source, condition, parent_pipe=None,
2058
proc = None, client_object=None):
2669
parent_pipe.fileno(),
2670
GLib.IO_IN | GLib.IO_HUP,
2671
functools.partial(self.handle_ipc,
2672
parent_pipe=parent_pipe,
2675
def handle_ipc(self, source, condition,
2678
client_object=None):
2059
2679
# error, or the other end of multiprocessing.Pipe has closed
2060
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2680
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2061
2681
# Wait for other process to exit
2065
2685
# Read a request from the child
2066
2686
request = parent_pipe.recv()
2067
2687
command = request[0]
2069
2689
if command == 'init':
2071
address = request[2]
2073
for c in self.clients.itervalues():
2074
if c.fingerprint == fpr:
2690
key_id = request[1].decode("ascii")
2691
fpr = request[2].decode("ascii")
2692
address = request[3]
2694
for c in self.clients.values():
2695
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2697
if key_id and c.key_id == key_id:
2700
if fpr and c.fingerprint == fpr:
2078
logger.info("Client not found for fingerprint: %s, ad"
2079
"dress: %s", fpr, address)
2704
logger.info("Client not found for key ID: %s, address"
2705
": %s", key_id or fpr, address)
2080
2706
if self.use_dbus:
2081
2707
# Emit D-Bus signal
2082
mandos_dbus_service.ClientNotFound(fpr,
2708
mandos_dbus_service.ClientNotFound(key_id or fpr,
2084
2710
parent_pipe.send(False)
2087
gobject.io_add_watch(parent_pipe.fileno(),
2088
gobject.IO_IN | gobject.IO_HUP,
2089
functools.partial(self.handle_ipc,
2714
parent_pipe.fileno(),
2715
GLib.IO_IN | GLib.IO_HUP,
2716
functools.partial(self.handle_ipc,
2717
parent_pipe=parent_pipe,
2719
client_object=client))
2095
2720
parent_pipe.send(True)
2096
2721
# remove the old hook in favor of the new above hook on
3128
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2497
3130
except OSError as error:
3131
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3132
.format(uid, gid, os.strerror(error.errno)))
2498
3133
if error.errno != errno.EPERM:
2502
3137
# Enable all possible GnuTLS debugging
2504
3139
# "Use a log level over 10 to enable all debugging options."
2505
3140
# - GnuTLS manual
2506
gnutls.library.functions.gnutls_global_set_log_level(11)
2508
@gnutls.library.types.gnutls_log_func
3141
gnutls.global_set_log_level(11)
2509
3144
def debug_gnutls(level, string):
2510
3145
logger.debug("GnuTLS: %s", string[:-1])
2512
(gnutls.library.functions
2513
.gnutls_global_set_log_function(debug_gnutls))
3147
gnutls.global_set_log_function(debug_gnutls)
2515
3149
# Redirect stdin so all checkers get /dev/null
2516
3150
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2517
3151
os.dup2(null, sys.stdin.fileno())
2521
3155
# Need to fork before connecting to D-Bus
2522
3156
if not foreground:
2523
3157
# Close all input and output, do double fork, etc.
2526
# multiprocessing will use threads, so before we use gobject we
2527
# need to inform gobject that threads will be used.
2528
gobject.threads_init()
3160
# multiprocessing will use threads, so before we use GLib we need
3161
# to inform GLib that threads will be used.
2530
3164
global main_loop
2531
3165
# From the Avahi example code
2532
3166
DBusGMainLoop(set_as_default=True)
2533
main_loop = gobject.MainLoop()
3167
main_loop = GLib.MainLoop()
2534
3168
bus = dbus.SystemBus()
2535
3169
# End of Avahi example code
2538
3172
bus_name = dbus.service.BusName("se.recompile.Mandos",
2539
bus, do_not_queue=True)
2540
old_bus_name = (dbus.service.BusName
2541
("se.bsnet.fukt.Mandos", bus,
2543
except dbus.exceptions.NameExistsException as e:
3175
old_bus_name = dbus.service.BusName(
3176
"se.bsnet.fukt.Mandos", bus,
3178
except dbus.exceptions.DBusException as e:
2544
3179
logger.error("Disabling D-Bus:", exc_info=e)
2545
3180
use_dbus = False
2546
3181
server_settings["use_dbus"] = False
2547
3182
tcp_server.use_dbus = False
2549
3184
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2550
service = AvahiServiceToSyslog(name =
2551
server_settings["servicename"],
2552
servicetype = "_mandos._tcp",
2553
protocol = protocol, bus = bus)
3185
service = AvahiServiceToSyslog(
3186
name=server_settings["servicename"],
3187
servicetype="_mandos._tcp",
2554
3190
if server_settings["interface"]:
2555
service.interface = (if_nametoindex
2556
(str(server_settings["interface"])))
3191
service.interface = if_nametoindex(
3192
server_settings["interface"].encode("utf-8"))
2558
3194
global multiprocessing_manager
2559
3195
multiprocessing_manager = multiprocessing.Manager()
2561
3197
client_class = Client
2563
client_class = functools.partial(ClientDBus, bus = bus)
3199
client_class = functools.partial(ClientDBus, bus=bus)
2565
3201
client_settings = Client.config_parser(client_config)
2566
3202
old_client_settings = {}
2567
3203
clients_data = {}
2569
3205
# This is used to redirect stdout and stderr for checker processes
2571
wnull = open(os.devnull, "w") # A writable /dev/null
3207
wnull = open(os.devnull, "w") # A writable /dev/null
2572
3208
# Only used if server is running in foreground but not in debug
2574
3210
if debug or not foreground:
2577
3213
# Get client data and settings from last running state.
2578
3214
if server_settings["restore"]:
2580
3216
with open(stored_state_path, "rb") as stored_state:
2581
clients_data, old_client_settings = (pickle.load
3217
if sys.version_info.major == 2:
3218
clients_data, old_client_settings = pickle.load(
3221
bytes_clients_data, bytes_old_client_settings = (
3222
pickle.load(stored_state, encoding="bytes"))
3223
# Fix bytes to strings
3226
clients_data = {(key.decode("utf-8")
3227
if isinstance(key, bytes)
3230
bytes_clients_data.items()}
3231
del bytes_clients_data
3232
for key in clients_data:
3233
value = {(k.decode("utf-8")
3234
if isinstance(k, bytes) else k): v
3236
clients_data[key].items()}
3237
clients_data[key] = value
3239
value["client_structure"] = [
3241
if isinstance(s, bytes)
3243
value["client_structure"]]
3245
for k in ("name", "host"):
3246
if isinstance(value[k], bytes):
3247
value[k] = value[k].decode("utf-8")
3248
if "key_id" not in value:
3249
value["key_id"] = ""
3250
elif "fingerprint" not in value:
3251
value["fingerprint"] = ""
3252
# old_client_settings
3254
old_client_settings = {
3255
(key.decode("utf-8")
3256
if isinstance(key, bytes)
3259
bytes_old_client_settings.items()}
3260
del bytes_old_client_settings
3262
for value in old_client_settings.values():
3263
if isinstance(value["host"], bytes):
3264
value["host"] = (value["host"]
2583
3266
os.remove(stored_state_path)
2584
3267
except IOError as e:
2585
3268
if e.errno == errno.ENOENT:
2586
logger.warning("Could not load persistent state: {0}"
2587
.format(os.strerror(e.errno)))
3269
logger.warning("Could not load persistent state:"
3270
" {}".format(os.strerror(e.errno)))
2589
3272
logger.critical("Could not load persistent state:",
2592
3275
except EOFError as e:
2593
3276
logger.warning("Could not load persistent state: "
2594
"EOFError:", exc_info=e)
2596
3280
with PGPEngine() as pgp:
2597
for client_name, client in clients_data.iteritems():
3281
for client_name, client in clients_data.items():
2598
3282
# Skip removed clients
2599
3283
if client_name not in client_settings:
2602
3286
# Decide which value to use after restoring saved state.
2603
3287
# We have three different values: Old config file,
2604
3288
# new config file, and saved state.
2662
3346
for client_name in (set(client_settings)
2663
3347
- set(old_client_settings)):
2664
3348
clients_data[client_name] = client_settings[client_name]
2666
3350
# Create all client objects
2667
for client_name, client in clients_data.iteritems():
3351
for client_name, client in clients_data.items():
2668
3352
tcp_server.clients[client_name] = client_class(
2669
name = client_name, settings = client,
2670
server_settings = server_settings)
3355
server_settings=server_settings)
2672
3357
if not tcp_server.clients:
2673
3358
logger.warning("No clients defined")
2675
3360
if not foreground:
2676
3361
if pidfile is not None:
2680
pidfile.write(str(pid) + "\n".encode("utf-8"))
3365
print(pid, file=pidfile)
2681
3366
except IOError:
2682
3367
logger.error("Could not write to file %r with PID %d",
2683
3368
pidfilename, pid)
2685
3370
del pidfilename
2687
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2688
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3372
for termsig in (signal.SIGHUP, signal.SIGTERM):
3373
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3374
lambda: main_loop.quit() and False)
2691
@alternate_dbus_interfaces({"se.recompile.Mandos":
2692
"se.bsnet.fukt.Mandos"})
2693
class MandosDBusService(DBusObjectWithProperties):
3378
@alternate_dbus_interfaces(
3379
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3380
class MandosDBusService(DBusObjectWithObjectManager):
2694
3381
"""A D-Bus proxy object"""
2695
3383
def __init__(self):
2696
3384
dbus.service.Object.__init__(self, bus, "/")
2697
3386
_interface = "se.recompile.Mandos"
2699
@dbus_interface_annotations(_interface)
2701
return { "org.freedesktop.DBus.Property"
2702
".EmitsChangedSignal":
2705
3388
@dbus.service.signal(_interface, signature="o")
2706
3389
def ClientAdded(self, objpath):
2710
3393
@dbus.service.signal(_interface, signature="ss")
2711
def ClientNotFound(self, fingerprint, address):
3394
def ClientNotFound(self, key_id, address):
3398
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2715
3400
@dbus.service.signal(_interface, signature="os")
2716
3401
def ClientRemoved(self, objpath, name):
3405
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2720
3407
@dbus.service.method(_interface, out_signature="ao")
2721
3408
def GetAllClients(self):
2723
return dbus.Array(c.dbus_object_path
2725
tcp_server.clients.itervalues())
3410
return dbus.Array(c.dbus_object_path for c in
3411
tcp_server.clients.values())
3413
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2727
3415
@dbus.service.method(_interface,
2728
3416
out_signature="a{oa{sv}}")
2729
3417
def GetAllClientsWithProperties(self):
2731
3419
return dbus.Dictionary(
2732
((c.dbus_object_path, c.GetAll(""))
2733
for c in tcp_server.clients.itervalues()),
3420
{c.dbus_object_path: c.GetAll(
3421
"se.recompile.Mandos.Client")
3422
for c in tcp_server.clients.values()},
2734
3423
signature="oa{sv}")
2736
3425
@dbus.service.method(_interface, in_signature="o")
2737
3426
def RemoveClient(self, object_path):
2739
for c in tcp_server.clients.itervalues():
3428
for c in tcp_server.clients.values():
2740
3429
if c.dbus_object_path == object_path:
2741
3430
del tcp_server.clients[c.name]
2742
3431
c.remove_from_connection()
2743
# Don't signal anything except ClientRemoved
3432
# Don't signal the disabling
2744
3433
c.disable(quiet=True)
2746
self.ClientRemoved(object_path, c.name)
3434
# Emit D-Bus signal for removal
3435
self.client_removed_signal(c)
2748
3437
raise KeyError(object_path)
3441
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3442
out_signature="a{oa{sa{sv}}}")
3443
def GetManagedObjects(self):
3445
return dbus.Dictionary(
3446
{client.dbus_object_path:
3448
{interface: client.GetAll(interface)
3450
client._get_all_interface_names()})
3451
for client in tcp_server.clients.values()})
3453
def client_added_signal(self, client):
3454
"""Send the new standard signal and the old signal"""
3456
# New standard signal
3457
self.InterfacesAdded(
3458
client.dbus_object_path,
3460
{interface: client.GetAll(interface)
3462
client._get_all_interface_names()}))
3464
self.ClientAdded(client.dbus_object_path)
3466
def client_removed_signal(self, client):
3467
"""Send the new standard signal and the old signal"""
3469
# New standard signal
3470
self.InterfacesRemoved(
3471
client.dbus_object_path,
3472
client._get_all_interface_names())
3474
self.ClientRemoved(client.dbus_object_path,
2752
3477
mandos_dbus_service = MandosDBusService()
3479
# Save modules to variables to exempt the modules from being
3480
# unloaded before the function registered with atexit() is run.
3481
mp = multiprocessing
2755
3485
"Cleanup function; run on exit"
2757
3487
service.cleanup()
2759
multiprocessing.active_children()
3489
mp.active_children()
2761
3491
if not (tcp_server.clients or client_settings):
2764
3494
# Store client before exiting. Secrets are encrypted with key
2765
3495
# based on what config file has. If config file is
2766
3496
# removed/edited, old secret will thus be unrecovable.
2768
3498
with PGPEngine() as pgp:
2769
for client in tcp_server.clients.itervalues():
3499
for client in tcp_server.clients.values():
2770
3500
key = client_settings[client.name]["secret"]
2771
3501
client.encrypted_secret = pgp.encrypt(client.secret,
2773
3503
client_dict = {}
2775
3505
# A list of attributes that can not be pickled
2777
exclude = set(("bus", "changedstate", "secret",
2778
"checker", "server_settings"))
2779
for name, typ in (inspect.getmembers
2780
(dbus.service.Object)):
3507
exclude = {"bus", "changedstate", "secret",
3508
"checker", "server_settings"}
3509
for name, typ in inspect.getmembers(dbus.service
2781
3511
exclude.add(name)
2783
3513
client_dict["encrypted_secret"] = (client
2784
3514
.encrypted_secret)
2785
3515
for attr in client.client_structure:
2786
3516
if attr not in exclude:
2787
3517
client_dict[attr] = getattr(client, attr)
2789
3519
clients[client.name] = client_dict
2790
3520
del client_settings[client.name]["secret"]
2793
with (tempfile.NamedTemporaryFile
2794
(mode='wb', suffix=".pickle", prefix='clients-',
2795
dir=os.path.dirname(stored_state_path),
2796
delete=False)) as stored_state:
2797
pickle.dump((clients, client_settings), stored_state)
2798
tempname=stored_state.name
3523
with tempfile.NamedTemporaryFile(
3527
dir=os.path.dirname(stored_state_path),
3528
delete=False) as stored_state:
3529
pickle.dump((clients, client_settings), stored_state,
3531
tempname = stored_state.name
2799
3532
os.rename(tempname, stored_state_path)
2800
3533
except (IOError, OSError) as e: