196
244
.replace(b"\n", b"\\n")
197
245
.replace(b"\0", b"\\x00"))
200
248
def encrypt(self, data, password):
201
249
passphrase = self.password_encode(password)
202
250
with tempfile.NamedTemporaryFile(
203
251
dir=self.tempdir) as passfile:
204
252
passfile.write(passphrase)
206
proc = subprocess.Popen(['gpg', '--symmetric',
254
proc = subprocess.Popen([self.gpg, '--symmetric',
207
255
'--passphrase-file',
209
257
+ self.gnupgargs,
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
258
stdin=subprocess.PIPE,
259
stdout=subprocess.PIPE,
260
stderr=subprocess.PIPE)
261
ciphertext, err = proc.communicate(input=data)
214
262
if proc.returncode != 0:
215
263
raise PGPError(err)
216
264
return ciphertext
218
266
def decrypt(self, data, password):
219
267
passphrase = self.password_encode(password)
220
268
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
269
dir=self.tempdir) as passfile:
222
270
passfile.write(passphrase)
224
proc = subprocess.Popen(['gpg', '--decrypt',
272
proc = subprocess.Popen([self.gpg, '--decrypt',
225
273
'--passphrase-file',
227
275
+ self.gnupgargs,
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
276
stdin=subprocess.PIPE,
277
stdout=subprocess.PIPE,
278
stderr=subprocess.PIPE)
279
decrypted_plaintext, err = proc.communicate(input=data)
232
280
if proc.returncode != 0:
233
281
raise PGPError(err)
234
282
return decrypted_plaintext
285
# Pretend that we have an Avahi module
287
"""This isn't so much a class as it is a module-like namespace."""
288
IF_UNSPEC = -1 # avahi-common/address.h
289
PROTO_UNSPEC = -1 # avahi-common/address.h
290
PROTO_INET = 0 # avahi-common/address.h
291
PROTO_INET6 = 1 # avahi-common/address.h
292
DBUS_NAME = "org.freedesktop.Avahi"
293
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
294
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
295
DBUS_PATH_SERVER = "/"
298
def string_array_to_txt_array(t):
299
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
300
for s in t), signature="ay")
301
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
302
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
303
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
304
SERVER_INVALID = 0 # avahi-common/defs.h
305
SERVER_REGISTERING = 1 # avahi-common/defs.h
306
SERVER_RUNNING = 2 # avahi-common/defs.h
307
SERVER_COLLISION = 3 # avahi-common/defs.h
308
SERVER_FAILURE = 4 # avahi-common/defs.h
237
311
class AvahiError(Exception):
238
312
def __init__(self, value, *args, **kwargs):
239
313
self.value = value
429
503
class AvahiServiceToSyslog(AvahiService):
430
504
def rename(self, *args, **kwargs):
431
505
"""Add the new name to the syslog messages"""
432
ret = AvahiService.rename(self, *args, **kwargs)
506
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
433
507
syslogger.setFormatter(logging.Formatter(
434
508
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
435
509
.format(self.name)))
513
# Pretend that we have a GnuTLS module
515
"""This isn't so much a class as it is a module-like namespace."""
517
library = ctypes.util.find_library("gnutls")
519
library = ctypes.util.find_library("gnutls-deb0")
520
_library = ctypes.cdll.LoadLibrary(library)
523
# Unless otherwise indicated, the constants and types below are
524
# all from the gnutls/gnutls.h C header file.
535
E_NO_CERTIFICATE_FOUND = -49
540
KEYID_USE_SHA256 = 1 # gnutls/x509.h
541
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
544
class session_int(ctypes.Structure):
546
session_t = ctypes.POINTER(session_int)
548
class certificate_credentials_st(ctypes.Structure):
550
certificate_credentials_t = ctypes.POINTER(
551
certificate_credentials_st)
552
certificate_type_t = ctypes.c_int
554
class datum_t(ctypes.Structure):
555
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
556
('size', ctypes.c_uint)]
558
class openpgp_crt_int(ctypes.Structure):
560
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
561
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
562
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
563
credentials_type_t = ctypes.c_int
564
transport_ptr_t = ctypes.c_void_p
565
close_request_t = ctypes.c_int
568
class Error(Exception):
569
def __init__(self, message=None, code=None, args=()):
570
# Default usage is by a message string, but if a return
571
# code is passed, convert it to a string with
574
if message is None and code is not None:
575
message = gnutls.strerror(code)
576
return super(gnutls.Error, self).__init__(
579
class CertificateSecurityError(Error):
585
self._c_object = gnutls.certificate_credentials_t()
586
gnutls.certificate_allocate_credentials(
587
ctypes.byref(self._c_object))
588
self.type = gnutls.CRD_CERTIFICATE
591
gnutls.certificate_free_credentials(self._c_object)
594
def __init__(self, socket, credentials=None):
595
self._c_object = gnutls.session_t()
596
gnutls_flags = gnutls.CLIENT
597
if gnutls.check_version(b"3.5.6"):
598
gnutls_flags |= gnutls.NO_TICKETS
600
gnutls_flags |= gnutls.ENABLE_RAWPK
601
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
603
gnutls.set_default_priority(self._c_object)
604
gnutls.transport_set_ptr(self._c_object, socket.fileno())
605
gnutls.handshake_set_private_extensions(self._c_object,
608
if credentials is None:
609
credentials = gnutls.Credentials()
610
gnutls.credentials_set(self._c_object, credentials.type,
611
ctypes.cast(credentials._c_object,
613
self.credentials = credentials
616
gnutls.deinit(self._c_object)
619
return gnutls.handshake(self._c_object)
621
def send(self, data):
625
data_len -= gnutls.record_send(self._c_object,
630
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
632
# Error handling functions
633
def _error_code(result):
634
"""A function to raise exceptions on errors, suitable
635
for the 'restype' attribute on ctypes functions"""
638
if result == gnutls.E_NO_CERTIFICATE_FOUND:
639
raise gnutls.CertificateSecurityError(code=result)
640
raise gnutls.Error(code=result)
642
def _retry_on_error(result, func, arguments):
643
"""A function to retry on some errors, suitable
644
for the 'errcheck' attribute on ctypes functions"""
646
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
647
return _error_code(result)
648
result = func(*arguments)
651
# Unless otherwise indicated, the function declarations below are
652
# all from the gnutls/gnutls.h C header file.
655
priority_set_direct = _library.gnutls_priority_set_direct
656
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
657
ctypes.POINTER(ctypes.c_char_p)]
658
priority_set_direct.restype = _error_code
660
init = _library.gnutls_init
661
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
662
init.restype = _error_code
664
set_default_priority = _library.gnutls_set_default_priority
665
set_default_priority.argtypes = [session_t]
666
set_default_priority.restype = _error_code
668
record_send = _library.gnutls_record_send
669
record_send.argtypes = [session_t, ctypes.c_void_p,
671
record_send.restype = ctypes.c_ssize_t
672
record_send.errcheck = _retry_on_error
674
certificate_allocate_credentials = (
675
_library.gnutls_certificate_allocate_credentials)
676
certificate_allocate_credentials.argtypes = [
677
ctypes.POINTER(certificate_credentials_t)]
678
certificate_allocate_credentials.restype = _error_code
680
certificate_free_credentials = (
681
_library.gnutls_certificate_free_credentials)
682
certificate_free_credentials.argtypes = [
683
certificate_credentials_t]
684
certificate_free_credentials.restype = None
686
handshake_set_private_extensions = (
687
_library.gnutls_handshake_set_private_extensions)
688
handshake_set_private_extensions.argtypes = [session_t,
690
handshake_set_private_extensions.restype = None
692
credentials_set = _library.gnutls_credentials_set
693
credentials_set.argtypes = [session_t, credentials_type_t,
695
credentials_set.restype = _error_code
697
strerror = _library.gnutls_strerror
698
strerror.argtypes = [ctypes.c_int]
699
strerror.restype = ctypes.c_char_p
701
certificate_type_get = _library.gnutls_certificate_type_get
702
certificate_type_get.argtypes = [session_t]
703
certificate_type_get.restype = _error_code
705
certificate_get_peers = _library.gnutls_certificate_get_peers
706
certificate_get_peers.argtypes = [session_t,
707
ctypes.POINTER(ctypes.c_uint)]
708
certificate_get_peers.restype = ctypes.POINTER(datum_t)
710
global_set_log_level = _library.gnutls_global_set_log_level
711
global_set_log_level.argtypes = [ctypes.c_int]
712
global_set_log_level.restype = None
714
global_set_log_function = _library.gnutls_global_set_log_function
715
global_set_log_function.argtypes = [log_func]
716
global_set_log_function.restype = None
718
deinit = _library.gnutls_deinit
719
deinit.argtypes = [session_t]
720
deinit.restype = None
722
handshake = _library.gnutls_handshake
723
handshake.argtypes = [session_t]
724
handshake.restype = _error_code
725
handshake.errcheck = _retry_on_error
727
transport_set_ptr = _library.gnutls_transport_set_ptr
728
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
729
transport_set_ptr.restype = None
731
bye = _library.gnutls_bye
732
bye.argtypes = [session_t, close_request_t]
733
bye.restype = _error_code
734
bye.errcheck = _retry_on_error
736
check_version = _library.gnutls_check_version
737
check_version.argtypes = [ctypes.c_char_p]
738
check_version.restype = ctypes.c_char_p
740
_need_version = b"3.3.0"
741
if check_version(_need_version) is None:
742
raise self.Error("Needs GnuTLS {} or later"
743
.format(_need_version))
745
_tls_rawpk_version = b"3.6.6"
746
has_rawpk = bool(check_version(_tls_rawpk_version))
750
class pubkey_st(ctypes.Structure):
752
pubkey_t = ctypes.POINTER(pubkey_st)
754
x509_crt_fmt_t = ctypes.c_int
756
# All the function declarations below are from gnutls/abstract.h
757
pubkey_init = _library.gnutls_pubkey_init
758
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
759
pubkey_init.restype = _error_code
761
pubkey_import = _library.gnutls_pubkey_import
762
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
764
pubkey_import.restype = _error_code
766
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
767
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
768
ctypes.POINTER(ctypes.c_ubyte),
769
ctypes.POINTER(ctypes.c_size_t)]
770
pubkey_get_key_id.restype = _error_code
772
pubkey_deinit = _library.gnutls_pubkey_deinit
773
pubkey_deinit.argtypes = [pubkey_t]
774
pubkey_deinit.restype = None
776
# All the function declarations below are from gnutls/openpgp.h
778
openpgp_crt_init = _library.gnutls_openpgp_crt_init
779
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
780
openpgp_crt_init.restype = _error_code
782
openpgp_crt_import = _library.gnutls_openpgp_crt_import
783
openpgp_crt_import.argtypes = [openpgp_crt_t,
784
ctypes.POINTER(datum_t),
786
openpgp_crt_import.restype = _error_code
788
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
789
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
790
ctypes.POINTER(ctypes.c_uint)]
791
openpgp_crt_verify_self.restype = _error_code
793
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
794
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
795
openpgp_crt_deinit.restype = None
797
openpgp_crt_get_fingerprint = (
798
_library.gnutls_openpgp_crt_get_fingerprint)
799
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
803
openpgp_crt_get_fingerprint.restype = _error_code
805
if check_version(b"3.6.4"):
806
certificate_type_get2 = _library.gnutls_certificate_type_get2
807
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
808
certificate_type_get2.restype = _error_code
810
# Remove non-public functions
811
del _error_code, _retry_on_error
438
814
def call_pipe(connection, # : multiprocessing.Connection
439
815
func, *args, **kwargs):
440
816
"""This function is meant to be called by multiprocessing.Process
442
818
This function runs func(*args, **kwargs), and writes the resulting
443
819
return value on the provided multiprocessing.Connection.
445
821
connection.send(func(*args, **kwargs))
446
822
connection.close()
448
class Client(object):
449
826
"""A representation of a client host served by this server.
452
829
approved: bool(); 'None' if not yet approved/disapproved
453
830
approval_delay: datetime.timedelta(); Time to wait for approval
454
831
approval_duration: datetime.timedelta(); Duration of one approval
455
checker: subprocess.Popen(); a running checker process used
456
to see if the client lives.
457
'None' if no process is running.
458
checker_callback_tag: a gobject event source tag, or None
832
checker: multiprocessing.Process(); a running checker process used
833
to see if the client lives. 'None' if no process is
835
checker_callback_tag: a GLib event source tag, or None
459
836
checker_command: string; External command which is run to check
460
837
if client lives. %() expansions are done at
461
838
runtime with vars(self) as dict, so that for
462
839
instance %(name)s can be used in the command.
463
checker_initiator_tag: a gobject event source tag, or None
840
checker_initiator_tag: a GLib event source tag, or None
464
841
created: datetime.datetime(); (UTC) object creation
465
842
client_structure: Object describing what attributes a client has
466
843
and is used for storing the client at exit
467
844
current_checker_command: string; current running checker_command
468
disable_initiator_tag: a gobject event source tag, or None
845
disable_initiator_tag: a GLib event source tag, or None
470
847
fingerprint: string (40 or 32 hexadecimal digits); used to
471
uniquely identify the client
848
uniquely identify an OpenPGP client
849
key_id: string (64 hexadecimal digits); used to uniquely identify
850
a client using raw public keys
472
851
host: string; available for use by the checker command
473
852
interval: datetime.timedelta(); How often to start a new checker
474
853
last_approval_request: datetime.datetime(); (UTC) or None
895
1281
for cls in self.__class__.__mro__
896
1282
for name, athing in
897
1283
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1285
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1287
path_keyword='object_path',
1288
connection_keyword='connection')
1289
def Introspect(self, object_path, connection):
1290
"""Overloading of standard D-Bus method.
1292
Inserts annotation tags on methods and signals.
1294
xmlstring = dbus.service.Object.Introspect(self, object_path,
1297
document = xml.dom.minidom.parseString(xmlstring)
1299
for if_tag in document.getElementsByTagName("interface"):
1300
# Add annotation tags
1301
for typ in ("method", "signal"):
1302
for tag in if_tag.getElementsByTagName(typ):
1304
for name, prop in (self.
1305
_get_all_dbus_things(typ)):
1306
if (name == tag.getAttribute("name")
1307
and prop._dbus_interface
1308
== if_tag.getAttribute("name")):
1309
annots.update(getattr(
1310
prop, "_dbus_annotations", {}))
1311
for name, value in annots.items():
1312
ann_tag = document.createElement(
1314
ann_tag.setAttribute("name", name)
1315
ann_tag.setAttribute("value", value)
1316
tag.appendChild(ann_tag)
1317
# Add interface annotation tags
1318
for annotation, value in dict(
1319
itertools.chain.from_iterable(
1320
annotations().items()
1321
for name, annotations
1322
in self._get_all_dbus_things("interface")
1323
if name == if_tag.getAttribute("name")
1325
ann_tag = document.createElement("annotation")
1326
ann_tag.setAttribute("name", annotation)
1327
ann_tag.setAttribute("value", value)
1328
if_tag.appendChild(ann_tag)
1329
# Fix argument name for the Introspect method itself
1330
if (if_tag.getAttribute("name")
1331
== dbus.INTROSPECTABLE_IFACE):
1332
for cn in if_tag.getElementsByTagName("method"):
1333
if cn.getAttribute("name") == "Introspect":
1334
for arg in cn.getElementsByTagName("arg"):
1335
if (arg.getAttribute("direction")
1337
arg.setAttribute("name",
1339
xmlstring = document.toxml("utf-8")
1341
except (AttributeError, xml.dom.DOMException,
1342
xml.parsers.expat.ExpatError) as error:
1343
logger.error("Failed to override Introspection method",
1348
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1349
"""A D-Bus object with properties.
1351
Classes inheriting from this can use the dbus_service_property
1352
decorator to expose methods as D-Bus properties. It exposes the
1353
standard Get(), Set(), and GetAll() methods on the D-Bus.
899
1356
def _get_dbus_property(self, interface_name, property_name):
900
1357
"""Returns a bound method if one exists which is a D-Bus
901
1358
property with the specified name and interface.
1059
1513
return xmlstring
1517
dbus.OBJECT_MANAGER_IFACE
1518
except AttributeError:
1519
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1522
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1523
"""A D-Bus object with an ObjectManager.
1525
Classes inheriting from this exposes the standard
1526
GetManagedObjects call and the InterfacesAdded and
1527
InterfacesRemoved signals on the standard
1528
"org.freedesktop.DBus.ObjectManager" interface.
1530
Note: No signals are sent automatically; they must be sent
1533
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1534
out_signature="a{oa{sa{sv}}}")
1535
def GetManagedObjects(self):
1536
"""This function must be overridden"""
1537
raise NotImplementedError()
1539
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1540
signature="oa{sa{sv}}")
1541
def InterfacesAdded(self, object_path, interfaces_and_properties):
1544
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1545
def InterfacesRemoved(self, object_path, interfaces):
1548
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1550
path_keyword='object_path',
1551
connection_keyword='connection')
1552
def Introspect(self, object_path, connection):
1553
"""Overloading of standard D-Bus method.
1555
Override return argument name of GetManagedObjects to be
1556
"objpath_interfaces_and_properties"
1558
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1562
document = xml.dom.minidom.parseString(xmlstring)
1564
for if_tag in document.getElementsByTagName("interface"):
1565
# Fix argument name for the GetManagedObjects method
1566
if (if_tag.getAttribute("name")
1567
== dbus.OBJECT_MANAGER_IFACE):
1568
for cn in if_tag.getElementsByTagName("method"):
1569
if (cn.getAttribute("name")
1570
== "GetManagedObjects"):
1571
for arg in cn.getElementsByTagName("arg"):
1572
if (arg.getAttribute("direction")
1576
"objpath_interfaces"
1578
xmlstring = document.toxml("utf-8")
1580
except (AttributeError, xml.dom.DOMException,
1581
xml.parsers.expat.ExpatError) as error:
1582
logger.error("Failed to override Introspection method",
1062
1587
def datetime_to_dbus(dt, variant_level=0):
1063
1588
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1065
return dbus.String("", variant_level = variant_level)
1590
return dbus.String("", variant_level=variant_level)
1066
1591
return dbus.String(dt.isoformat(), variant_level=variant_level)
1830
2375
delay -= time2 - time
1833
while sent_size < len(client.secret):
1835
sent = session.send(client.secret[sent_size:])
1836
except gnutls.errors.GNUTLSError as error:
1837
logger.warning("gnutls send failed",
1840
logger.debug("Sent: %d, remaining: %d", sent,
1841
len(client.secret) - (sent_size
2378
session.send(client.secret)
2379
except gnutls.Error as error:
2380
logger.warning("gnutls send failed",
1845
2384
logger.info("Sending secret to %s", client.name)
1846
2385
# bump the timeout using extended_timeout
1847
2386
client.bump_timeout(client.extended_timeout)
1848
2387
if self.server.use_dbus:
1849
2388
# Emit D-Bus signal
1850
2389
client.GotSecret()
1853
2392
if approval_required:
1854
2393
client.approvals_pending -= 1
1857
except gnutls.errors.GNUTLSError as error:
2396
except gnutls.Error as error:
1858
2397
logger.warning("GnuTLS bye failed",
1859
2398
exc_info=error)
1862
2401
def peer_certificate(session):
1863
"Return the peer's OpenPGP certificate as a bytestring"
1864
# If not an OpenPGP certificate...
1865
if (gnutls.library.functions.gnutls_certificate_type_get(
1867
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1868
# ...do the normal thing
1869
return session.peer_certificate
2402
"Return the peer's certificate as a bytestring"
2404
cert_type = gnutls.certificate_type_get2(session._c_object,
2406
except AttributeError:
2407
cert_type = gnutls.certificate_type_get(session._c_object)
2408
if gnutls.has_rawpk:
2409
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2411
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2412
# If not a valid certificate type...
2413
if cert_type not in valid_cert_types:
2414
logger.info("Cert type %r not in %r", cert_type,
2416
# ...return invalid data
1870
2418
list_size = ctypes.c_uint(1)
1871
cert_list = (gnutls.library.functions
1872
.gnutls_certificate_get_peers
2419
cert_list = (gnutls.certificate_get_peers
1873
2420
(session._c_object, ctypes.byref(list_size)))
1874
2421
if not bool(cert_list) and list_size.value != 0:
1875
raise gnutls.errors.GNUTLSError("error getting peer"
2422
raise gnutls.Error("error getting peer certificate")
1877
2423
if list_size.value == 0:
1879
2425
cert = cert_list[0]
1880
2426
return ctypes.string_at(cert.data, cert.size)
2429
def key_id(certificate):
2430
"Convert a certificate bytestring to a hexdigit key ID"
2431
# New GnuTLS "datum" with the public key
2432
datum = gnutls.datum_t(
2433
ctypes.cast(ctypes.c_char_p(certificate),
2434
ctypes.POINTER(ctypes.c_ubyte)),
2435
ctypes.c_uint(len(certificate)))
2436
# XXX all these need to be created in the gnutls "module"
2437
# New empty GnuTLS certificate
2438
pubkey = gnutls.pubkey_t()
2439
gnutls.pubkey_init(ctypes.byref(pubkey))
2440
# Import the raw public key into the certificate
2441
gnutls.pubkey_import(pubkey,
2442
ctypes.byref(datum),
2443
gnutls.X509_FMT_DER)
2444
# New buffer for the key ID
2445
buf = ctypes.create_string_buffer(32)
2446
buf_len = ctypes.c_size_t(len(buf))
2447
# Get the key ID from the raw public key into the buffer
2448
gnutls.pubkey_get_key_id(pubkey,
2449
gnutls.KEYID_USE_SHA256,
2450
ctypes.cast(ctypes.byref(buf),
2451
ctypes.POINTER(ctypes.c_ubyte)),
2452
ctypes.byref(buf_len))
2453
# Deinit the certificate
2454
gnutls.pubkey_deinit(pubkey)
2456
# Convert the buffer to a Python bytestring
2457
key_id = ctypes.string_at(buf, buf_len.value)
2458
# Convert the bytestring to hexadecimal notation
2459
hex_key_id = binascii.hexlify(key_id).upper()
1883
2463
def fingerprint(openpgp):
1884
2464
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1885
2465
# New GnuTLS "datum" with the OpenPGP public key
1886
datum = gnutls.library.types.gnutls_datum_t(
2466
datum = gnutls.datum_t(
1887
2467
ctypes.cast(ctypes.c_char_p(openpgp),
1888
2468
ctypes.POINTER(ctypes.c_ubyte)),
1889
2469
ctypes.c_uint(len(openpgp)))
1890
2470
# New empty GnuTLS certificate
1891
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1892
gnutls.library.functions.gnutls_openpgp_crt_init(
2471
crt = gnutls.openpgp_crt_t()
2472
gnutls.openpgp_crt_init(ctypes.byref(crt))
1894
2473
# Import the OpenPGP public key into the certificate
1895
gnutls.library.functions.gnutls_openpgp_crt_import(
1896
crt, ctypes.byref(datum),
1897
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2474
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2475
gnutls.OPENPGP_FMT_RAW)
1898
2476
# Verify the self signature in the key
1899
2477
crtverify = ctypes.c_uint()
1900
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1901
crt, 0, ctypes.byref(crtverify))
2478
gnutls.openpgp_crt_verify_self(crt, 0,
2479
ctypes.byref(crtverify))
1902
2480
if crtverify.value != 0:
1903
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1904
raise gnutls.errors.CertificateSecurityError(
2481
gnutls.openpgp_crt_deinit(crt)
2482
raise gnutls.CertificateSecurityError(code
1906
2484
# New buffer for the fingerprint
1907
2485
buf = ctypes.create_string_buffer(20)
1908
2486
buf_len = ctypes.c_size_t()
1909
2487
# Get the fingerprint from the certificate into the buffer
1910
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1911
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2488
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2489
ctypes.byref(buf_len))
1912
2490
# Deinit the certificate
1913
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2491
gnutls.openpgp_crt_deinit(crt)
1914
2492
# Convert the buffer to a Python bytestring
1915
2493
fpr = ctypes.string_at(buf, buf_len.value)
1916
2494
# Convert the bytestring to hexadecimal notation
2004
2583
# socket_wrapper(), if socketfd was set.
2005
2584
socketserver.TCPServer.__init__(self, server_address,
2006
2585
RequestHandlerClass)
2008
2587
def server_bind(self):
2009
2588
"""This overrides the normal server_bind() function
2010
2589
to bind to an interface if one was specified, and also NOT to
2011
2590
bind to an address or port if they were not specified."""
2591
global SO_BINDTODEVICE
2012
2592
if self.interface is not None:
2013
2593
if SO_BINDTODEVICE is None:
2014
logger.error("SO_BINDTODEVICE does not exist;"
2015
" cannot bind to interface %s",
2019
self.socket.setsockopt(
2020
socket.SOL_SOCKET, SO_BINDTODEVICE,
2021
(self.interface + "\0").encode("utf-8"))
2022
except socket.error as error:
2023
if error.errno == errno.EPERM:
2024
logger.error("No permission to bind to"
2025
" interface %s", self.interface)
2026
elif error.errno == errno.ENOPROTOOPT:
2027
logger.error("SO_BINDTODEVICE not available;"
2028
" cannot bind to interface %s",
2030
elif error.errno == errno.ENODEV:
2031
logger.error("Interface %s does not exist,"
2032
" cannot bind", self.interface)
2594
# Fall back to a hard-coded value which seems to be
2596
logger.warning("SO_BINDTODEVICE not found, trying 25")
2597
SO_BINDTODEVICE = 25
2599
self.socket.setsockopt(
2600
socket.SOL_SOCKET, SO_BINDTODEVICE,
2601
(self.interface + "\0").encode("utf-8"))
2602
except socket.error as error:
2603
if error.errno == errno.EPERM:
2604
logger.error("No permission to bind to"
2605
" interface %s", self.interface)
2606
elif error.errno == errno.ENOPROTOOPT:
2607
logger.error("SO_BINDTODEVICE not available;"
2608
" cannot bind to interface %s",
2610
elif error.errno == errno.ENODEV:
2611
logger.error("Interface %s does not exist,"
2612
" cannot bind", self.interface)
2035
2615
# Only bind(2) the socket if we really need to.
2036
2616
if self.server_address[0] or self.server_address[1]:
2617
if self.server_address[1]:
2618
self.allow_reuse_address = True
2037
2619
if not self.server_address[0]:
2038
2620
if self.address_family == socket.AF_INET6:
2039
any_address = "::" # in6addr_any
2621
any_address = "::" # in6addr_any
2041
any_address = "0.0.0.0" # INADDR_ANY
2623
any_address = "0.0.0.0" # INADDR_ANY
2042
2624
self.server_address = (any_address,
2043
2625
self.server_address[1])
2044
2626
elif not self.server_address[1]:
2589
3187
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2590
3188
service = AvahiServiceToSyslog(
2591
name = server_settings["servicename"],
2592
servicetype = "_mandos._tcp",
2593
protocol = protocol,
3189
name=server_settings["servicename"],
3190
servicetype="_mandos._tcp",
2595
3193
if server_settings["interface"]:
2596
3194
service.interface = if_nametoindex(
2597
3195
server_settings["interface"].encode("utf-8"))
2599
3197
global multiprocessing_manager
2600
3198
multiprocessing_manager = multiprocessing.Manager()
2602
3200
client_class = Client
2604
client_class = functools.partial(ClientDBus, bus = bus)
3202
client_class = functools.partial(ClientDBus, bus=bus)
2606
3204
client_settings = Client.config_parser(client_config)
2607
3205
old_client_settings = {}
2608
3206
clients_data = {}
2610
3208
# This is used to redirect stdout and stderr for checker processes
2612
wnull = open(os.devnull, "w") # A writable /dev/null
3210
wnull = open(os.devnull, "w") # A writable /dev/null
2613
3211
# Only used if server is running in foreground but not in debug
2615
3213
if debug or not foreground:
2618
3216
# Get client data and settings from last running state.
2619
3217
if server_settings["restore"]:
2621
3219
with open(stored_state_path, "rb") as stored_state:
2622
clients_data, old_client_settings = pickle.load(
3220
if sys.version_info.major == 2:
3221
clients_data, old_client_settings = pickle.load(
3224
bytes_clients_data, bytes_old_client_settings = (
3225
pickle.load(stored_state, encoding="bytes"))
3226
# Fix bytes to strings
3229
clients_data = {(key.decode("utf-8")
3230
if isinstance(key, bytes)
3233
bytes_clients_data.items()}
3234
del bytes_clients_data
3235
for key in clients_data:
3236
value = {(k.decode("utf-8")
3237
if isinstance(k, bytes) else k): v
3239
clients_data[key].items()}
3240
clients_data[key] = value
3242
value["client_structure"] = [
3244
if isinstance(s, bytes)
3246
value["client_structure"]]
3248
for k in ("name", "host"):
3249
if isinstance(value[k], bytes):
3250
value[k] = value[k].decode("utf-8")
3251
if "key_id" not in value:
3252
value["key_id"] = ""
3253
elif "fingerprint" not in value:
3254
value["fingerprint"] = ""
3255
# old_client_settings
3257
old_client_settings = {
3258
(key.decode("utf-8")
3259
if isinstance(key, bytes)
3262
bytes_old_client_settings.items()}
3263
del bytes_old_client_settings
3265
for value in old_client_settings.values():
3266
if isinstance(value["host"], bytes):
3267
value["host"] = (value["host"]
2624
3269
os.remove(stored_state_path)
2625
3270
except IOError as e:
2626
3271
if e.errno == errno.ENOENT:
2726
3371
pidfilename, pid)
2728
3373
del pidfilename
2730
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2731
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3375
for termsig in (signal.SIGHUP, signal.SIGTERM):
3376
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3377
lambda: main_loop.quit() and False)
2735
3381
@alternate_dbus_interfaces(
2736
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2737
class MandosDBusService(DBusObjectWithProperties):
3382
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3383
class MandosDBusService(DBusObjectWithObjectManager):
2738
3384
"""A D-Bus proxy object"""
2740
3386
def __init__(self):
2741
3387
dbus.service.Object.__init__(self, bus, "/")
2743
3389
_interface = "se.recompile.Mandos"
2745
@dbus_interface_annotations(_interface)
2748
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2751
3391
@dbus.service.signal(_interface, signature="o")
2752
3392
def ClientAdded(self, objpath):
2756
3396
@dbus.service.signal(_interface, signature="ss")
2757
def ClientNotFound(self, fingerprint, address):
3397
def ClientNotFound(self, key_id, address):
3401
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2761
3403
@dbus.service.signal(_interface, signature="os")
2762
3404
def ClientRemoved(self, objpath, name):
3408
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2766
3410
@dbus.service.method(_interface, out_signature="ao")
2767
3411
def GetAllClients(self):
2769
3413
return dbus.Array(c.dbus_object_path for c in
2770
tcp_server.clients.itervalues())
3414
tcp_server.clients.values())
3416
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2772
3418
@dbus.service.method(_interface,
2773
3419
out_signature="a{oa{sv}}")
2774
3420
def GetAllClientsWithProperties(self):
2776
3422
return dbus.Dictionary(
2777
{ c.dbus_object_path: c.GetAll("")
2778
for c in tcp_server.clients.itervalues() },
3423
{c.dbus_object_path: c.GetAll(
3424
"se.recompile.Mandos.Client")
3425
for c in tcp_server.clients.values()},
2779
3426
signature="oa{sv}")
2781
3428
@dbus.service.method(_interface, in_signature="o")
2782
3429
def RemoveClient(self, object_path):
2784
for c in tcp_server.clients.itervalues():
3431
for c in tcp_server.clients.values():
2785
3432
if c.dbus_object_path == object_path:
2786
3433
del tcp_server.clients[c.name]
2787
3434
c.remove_from_connection()
2788
# Don't signal anything except ClientRemoved
3435
# Don't signal the disabling
2789
3436
c.disable(quiet=True)
2791
self.ClientRemoved(object_path, c.name)
3437
# Emit D-Bus signal for removal
3438
self.client_removed_signal(c)
2793
3440
raise KeyError(object_path)
3444
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3445
out_signature="a{oa{sa{sv}}}")
3446
def GetManagedObjects(self):
3448
return dbus.Dictionary(
3449
{client.dbus_object_path:
3451
{interface: client.GetAll(interface)
3453
client._get_all_interface_names()})
3454
for client in tcp_server.clients.values()})
3456
def client_added_signal(self, client):
3457
"""Send the new standard signal and the old signal"""
3459
# New standard signal
3460
self.InterfacesAdded(
3461
client.dbus_object_path,
3463
{interface: client.GetAll(interface)
3465
client._get_all_interface_names()}))
3467
self.ClientAdded(client.dbus_object_path)
3469
def client_removed_signal(self, client):
3470
"""Send the new standard signal and the old signal"""
3472
# New standard signal
3473
self.InterfacesRemoved(
3474
client.dbus_object_path,
3475
client._get_all_interface_names())
3477
self.ClientRemoved(client.dbus_object_path,
2797
3480
mandos_dbus_service = MandosDBusService()
3482
# Save modules to variables to exempt the modules from being
3483
# unloaded before the function registered with atexit() is run.
3484
mp = multiprocessing
2800
3488
"Cleanup function; run on exit"
2802
3490
service.cleanup()
2804
multiprocessing.active_children()
3492
mp.active_children()
2806
3494
if not (tcp_server.clients or client_settings):
2809
3497
# Store client before exiting. Secrets are encrypted with key
2810
3498
# based on what config file has. If config file is
2811
3499
# removed/edited, old secret will thus be unrecovable.
2813
3501
with PGPEngine() as pgp:
2814
for client in tcp_server.clients.itervalues():
3502
for client in tcp_server.clients.values():
2815
3503
key = client_settings[client.name]["secret"]
2816
3504
client.encrypted_secret = pgp.encrypt(client.secret,
2818
3506
client_dict = {}
2820
3508
# A list of attributes that can not be pickled
2822
exclude = { "bus", "changedstate", "secret",
2823
"checker", "server_settings" }
3510
exclude = {"bus", "changedstate", "secret",
3511
"checker", "server_settings"}
2824
3512
for name, typ in inspect.getmembers(dbus.service
2826
3514
exclude.add(name)
2828
3516
client_dict["encrypted_secret"] = (client
2829
3517
.encrypted_secret)
2830
3518
for attr in client.client_structure:
2831
3519
if attr not in exclude:
2832
3520
client_dict[attr] = getattr(client, attr)
2834
3522
clients[client.name] = client_dict
2835
3523
del client_settings[client.name]["secret"]
2838
3526
with tempfile.NamedTemporaryFile(