2
# -*- mode: python; coding: utf-8 -*-
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
17
# This file is part of Mandos.
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
32
# Contact the authors at <mandos@recompile.se>.
34
35
from __future__ import (division, absolute_import, print_function,
81
83
import dbus.service
83
from gi.repository import GObject
85
import gobject as GObject
85
from gi.repository import GLib
86
86
from dbus.mainloop.glib import DBusGMainLoop
89
89
import xml.dom.minidom
92
if sys.version_info.major == 2:
95
# Show warnings by default
96
if not sys.warnoptions:
98
warnings.simplefilter("default")
100
# Try to find the value of SO_BINDTODEVICE:
102
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
103
# newer, and it is also the most natural place for it:
93
104
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
94
105
except AttributeError:
107
# This is where SO_BINDTODEVICE was up to and including Python
96
109
from IN import SO_BINDTODEVICE
97
110
except ImportError:
98
SO_BINDTODEVICE = None
111
# In Python 2.7 it seems to have been removed entirely.
112
# Try running the C preprocessor:
114
cc = subprocess.Popen(["cc", "--language=c", "-E",
116
stdin=subprocess.PIPE,
117
stdout=subprocess.PIPE)
118
stdout = cc.communicate(
119
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
120
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
121
except (OSError, ValueError, IndexError):
123
SO_BINDTODEVICE = None
100
125
if sys.version_info.major == 2:
128
if sys.version_info < (3, 2):
129
configparser.Configparser = configparser.SafeConfigParser
104
132
stored_state_file = "clients.pickle"
106
134
logger = logging.getLogger()
135
logging.captureWarnings(True) # Show warnings via the logging system
110
139
if_nametoindex = ctypes.cdll.LoadLibrary(
111
140
ctypes.util.find_library("c")).if_nametoindex
112
141
except (OSError, AttributeError):
114
143
def if_nametoindex(interface):
115
144
"Get an interface index the hard way, i.e. using fcntl()"
116
145
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
230
261
'--passphrase-file',
232
263
+ self.gnupgargs,
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
ciphertext, err = proc.communicate(input = data)
264
stdin=subprocess.PIPE,
265
stdout=subprocess.PIPE,
266
stderr=subprocess.PIPE)
267
ciphertext, err = proc.communicate(input=data)
237
268
if proc.returncode != 0:
238
269
raise PGPError(err)
239
270
return ciphertext
241
272
def decrypt(self, data, password):
242
273
passphrase = self.password_encode(password)
243
274
with tempfile.NamedTemporaryFile(
244
dir = self.tempdir) as passfile:
275
dir=self.tempdir) as passfile:
245
276
passfile.write(passphrase)
247
278
proc = subprocess.Popen([self.gpg, '--decrypt',
248
279
'--passphrase-file',
250
281
+ self.gnupgargs,
251
stdin = subprocess.PIPE,
252
stdout = subprocess.PIPE,
253
stderr = subprocess.PIPE)
254
decrypted_plaintext, err = proc.communicate(input = data)
282
stdin=subprocess.PIPE,
283
stdout=subprocess.PIPE,
284
stderr=subprocess.PIPE)
285
decrypted_plaintext, err = proc.communicate(input=data)
255
286
if proc.returncode != 0:
256
287
raise PGPError(err)
257
288
return decrypted_plaintext
259
291
# Pretend that we have an Avahi module
261
"""This isn't so much a class as it is a module-like namespace.
262
It is instantiated once, and simulates having an Avahi module."""
263
IF_UNSPEC = -1 # avahi-common/address.h
264
PROTO_UNSPEC = -1 # avahi-common/address.h
265
PROTO_INET = 0 # avahi-common/address.h
266
PROTO_INET6 = 1 # avahi-common/address.h
293
"""This isn't so much a class as it is a module-like namespace."""
294
IF_UNSPEC = -1 # avahi-common/address.h
295
PROTO_UNSPEC = -1 # avahi-common/address.h
296
PROTO_INET = 0 # avahi-common/address.h
297
PROTO_INET6 = 1 # avahi-common/address.h
267
298
DBUS_NAME = "org.freedesktop.Avahi"
268
299
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
269
300
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
270
301
DBUS_PATH_SERVER = "/"
271
def string_array_to_txt_array(self, t):
304
def string_array_to_txt_array(t):
272
305
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
273
306
for s in t), signature="ay")
274
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
275
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
276
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
277
SERVER_INVALID = 0 # avahi-common/defs.h
278
SERVER_REGISTERING = 1 # avahi-common/defs.h
279
SERVER_RUNNING = 2 # avahi-common/defs.h
280
SERVER_COLLISION = 3 # avahi-common/defs.h
281
SERVER_FAILURE = 4 # avahi-common/defs.h
307
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
308
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
309
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
310
SERVER_INVALID = 0 # avahi-common/defs.h
311
SERVER_REGISTERING = 1 # avahi-common/defs.h
312
SERVER_RUNNING = 2 # avahi-common/defs.h
313
SERVER_COLLISION = 3 # avahi-common/defs.h
314
SERVER_FAILURE = 4 # avahi-common/defs.h
284
317
class AvahiError(Exception):
285
318
def __init__(self, value, *args, **kwargs):
476
509
class AvahiServiceToSyslog(AvahiService):
477
510
def rename(self, *args, **kwargs):
478
511
"""Add the new name to the syslog messages"""
479
ret = AvahiService.rename(self, *args, **kwargs)
512
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
480
513
syslogger.setFormatter(logging.Formatter(
481
514
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
482
515
.format(self.name)))
485
519
# Pretend that we have a GnuTLS module
486
class GnuTLS(object):
487
"""This isn't so much a class as it is a module-like namespace.
488
It is instantiated once, and simulates having a GnuTLS module."""
490
_library = ctypes.cdll.LoadLibrary(
491
ctypes.util.find_library("gnutls"))
492
_need_version = b"3.3.0"
494
# Need to use class name "GnuTLS" here, since this method is
495
# called before the assignment to the "gnutls" global variable
497
if GnuTLS.check_version(self._need_version) is None:
498
raise GnuTLS.Error("Needs GnuTLS {} or later"
499
.format(self._need_version))
521
"""This isn't so much a class as it is a module-like namespace."""
523
library = ctypes.util.find_library("gnutls")
525
library = ctypes.util.find_library("gnutls-deb0")
526
_library = ctypes.cdll.LoadLibrary(library)
501
529
# Unless otherwise indicated, the constants and types below are
502
530
# all from the gnutls/gnutls.h C header file.
506
534
E_INTERRUPTED = -52
511
540
CRD_CERTIFICATE = 1
512
541
E_NO_CERTIFICATE_FOUND = -49
546
KEYID_USE_SHA256 = 1 # gnutls/x509.h
513
547
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
516
550
class session_int(ctypes.Structure):
518
552
session_t = ctypes.POINTER(session_int)
519
554
class certificate_credentials_st(ctypes.Structure):
521
556
certificate_credentials_t = ctypes.POINTER(
522
557
certificate_credentials_st)
523
558
certificate_type_t = ctypes.c_int
524
560
class datum_t(ctypes.Structure):
525
561
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
526
562
('size', ctypes.c_uint)]
527
564
class openpgp_crt_int(ctypes.Structure):
529
566
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
530
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
567
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
531
568
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
532
569
credentials_type_t = ctypes.c_int
533
570
transport_ptr_t = ctypes.c_void_p
534
571
close_request_t = ctypes.c_int
537
574
class Error(Exception):
538
# We need to use the class name "GnuTLS" here, since this
539
# exception might be raised from within GnuTLS.__init__,
540
# which is called before the assignment to the "gnutls"
541
# global variable has happened.
542
def __init__(self, message = None, code = None, args=()):
575
def __init__(self, message=None, code=None, args=()):
543
576
# Default usage is by a message string, but if a return
544
577
# code is passed, convert it to a string with
545
578
# gnutls.strerror()
547
580
if message is None and code is not None:
548
message = GnuTLS.strerror(code)
549
return super(GnuTLS.Error, self).__init__(
581
message = gnutls.strerror(code)
582
return super(gnutls.Error, self).__init__(
552
585
class CertificateSecurityError(Error):
556
class Credentials(object):
557
590
def __init__(self):
558
591
self._c_object = gnutls.certificate_credentials_t()
559
592
gnutls.certificate_allocate_credentials(
560
593
ctypes.byref(self._c_object))
561
594
self.type = gnutls.CRD_CERTIFICATE
563
596
def __del__(self):
564
597
gnutls.certificate_free_credentials(self._c_object)
566
class ClientSession(object):
567
def __init__(self, socket, credentials = None):
600
def __init__(self, socket, credentials=None):
568
601
self._c_object = gnutls.session_t()
569
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
602
gnutls_flags = gnutls.CLIENT
603
if gnutls.check_version(b"3.5.6"):
604
gnutls_flags |= gnutls.NO_TICKETS
606
gnutls_flags |= gnutls.ENABLE_RAWPK
607
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
570
609
gnutls.set_default_priority(self._c_object)
571
610
gnutls.transport_set_ptr(self._c_object, socket.fileno())
572
611
gnutls.handshake_set_private_extensions(self._c_object,
614
653
return _error_code(result)
615
654
result = func(*arguments)
618
657
# Unless otherwise indicated, the function declarations below are
619
658
# all from the gnutls/gnutls.h C header file.
622
661
priority_set_direct = _library.gnutls_priority_set_direct
623
662
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
624
663
ctypes.POINTER(ctypes.c_char_p)]
625
664
priority_set_direct.restype = _error_code
627
666
init = _library.gnutls_init
628
667
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
629
668
init.restype = _error_code
631
670
set_default_priority = _library.gnutls_set_default_priority
632
671
set_default_priority.argtypes = [session_t]
633
672
set_default_priority.restype = _error_code
635
674
record_send = _library.gnutls_record_send
636
675
record_send.argtypes = [session_t, ctypes.c_void_p,
638
677
record_send.restype = ctypes.c_ssize_t
639
678
record_send.errcheck = _retry_on_error
641
680
certificate_allocate_credentials = (
642
681
_library.gnutls_certificate_allocate_credentials)
643
682
certificate_allocate_credentials.argtypes = [
644
683
ctypes.POINTER(certificate_credentials_t)]
645
684
certificate_allocate_credentials.restype = _error_code
647
686
certificate_free_credentials = (
648
687
_library.gnutls_certificate_free_credentials)
649
certificate_free_credentials.argtypes = [certificate_credentials_t]
688
certificate_free_credentials.argtypes = [
689
certificate_credentials_t]
650
690
certificate_free_credentials.restype = None
652
692
handshake_set_private_extensions = (
653
693
_library.gnutls_handshake_set_private_extensions)
654
694
handshake_set_private_extensions.argtypes = [session_t,
656
696
handshake_set_private_extensions.restype = None
658
698
credentials_set = _library.gnutls_credentials_set
659
699
credentials_set.argtypes = [session_t, credentials_type_t,
661
701
credentials_set.restype = _error_code
663
703
strerror = _library.gnutls_strerror
664
704
strerror.argtypes = [ctypes.c_int]
665
705
strerror.restype = ctypes.c_char_p
667
707
certificate_type_get = _library.gnutls_certificate_type_get
668
708
certificate_type_get.argtypes = [session_t]
669
709
certificate_type_get.restype = _error_code
671
711
certificate_get_peers = _library.gnutls_certificate_get_peers
672
712
certificate_get_peers.argtypes = [session_t,
673
713
ctypes.POINTER(ctypes.c_uint)]
674
714
certificate_get_peers.restype = ctypes.POINTER(datum_t)
676
716
global_set_log_level = _library.gnutls_global_set_log_level
677
717
global_set_log_level.argtypes = [ctypes.c_int]
678
718
global_set_log_level.restype = None
680
720
global_set_log_function = _library.gnutls_global_set_log_function
681
721
global_set_log_function.argtypes = [log_func]
682
722
global_set_log_function.restype = None
684
724
deinit = _library.gnutls_deinit
685
725
deinit.argtypes = [session_t]
686
726
deinit.restype = None
688
728
handshake = _library.gnutls_handshake
689
729
handshake.argtypes = [session_t]
690
730
handshake.restype = _error_code
691
731
handshake.errcheck = _retry_on_error
693
733
transport_set_ptr = _library.gnutls_transport_set_ptr
694
734
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
695
735
transport_set_ptr.restype = None
697
737
bye = _library.gnutls_bye
698
738
bye.argtypes = [session_t, close_request_t]
699
739
bye.restype = _error_code
700
740
bye.errcheck = _retry_on_error
702
742
check_version = _library.gnutls_check_version
703
743
check_version.argtypes = [ctypes.c_char_p]
704
744
check_version.restype = ctypes.c_char_p
706
# All the function declarations below are from gnutls/openpgp.h
708
openpgp_crt_init = _library.gnutls_openpgp_crt_init
709
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
710
openpgp_crt_init.restype = _error_code
712
openpgp_crt_import = _library.gnutls_openpgp_crt_import
713
openpgp_crt_import.argtypes = [openpgp_crt_t,
714
ctypes.POINTER(datum_t),
716
openpgp_crt_import.restype = _error_code
718
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
719
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
720
ctypes.POINTER(ctypes.c_uint)]
721
openpgp_crt_verify_self.restype = _error_code
723
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
724
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
725
openpgp_crt_deinit.restype = None
727
openpgp_crt_get_fingerprint = (
728
_library.gnutls_openpgp_crt_get_fingerprint)
729
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
733
openpgp_crt_get_fingerprint.restype = _error_code
746
_need_version = b"3.3.0"
747
if check_version(_need_version) is None:
748
raise self.Error("Needs GnuTLS {} or later"
749
.format(_need_version))
751
_tls_rawpk_version = b"3.6.6"
752
has_rawpk = bool(check_version(_tls_rawpk_version))
756
class pubkey_st(ctypes.Structure):
758
pubkey_t = ctypes.POINTER(pubkey_st)
760
x509_crt_fmt_t = ctypes.c_int
762
# All the function declarations below are from gnutls/abstract.h
763
pubkey_init = _library.gnutls_pubkey_init
764
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
765
pubkey_init.restype = _error_code
767
pubkey_import = _library.gnutls_pubkey_import
768
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
770
pubkey_import.restype = _error_code
772
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
773
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
774
ctypes.POINTER(ctypes.c_ubyte),
775
ctypes.POINTER(ctypes.c_size_t)]
776
pubkey_get_key_id.restype = _error_code
778
pubkey_deinit = _library.gnutls_pubkey_deinit
779
pubkey_deinit.argtypes = [pubkey_t]
780
pubkey_deinit.restype = None
782
# All the function declarations below are from gnutls/openpgp.h
784
openpgp_crt_init = _library.gnutls_openpgp_crt_init
785
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
786
openpgp_crt_init.restype = _error_code
788
openpgp_crt_import = _library.gnutls_openpgp_crt_import
789
openpgp_crt_import.argtypes = [openpgp_crt_t,
790
ctypes.POINTER(datum_t),
792
openpgp_crt_import.restype = _error_code
794
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
795
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
796
ctypes.POINTER(ctypes.c_uint)]
797
openpgp_crt_verify_self.restype = _error_code
799
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
800
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
801
openpgp_crt_deinit.restype = None
803
openpgp_crt_get_fingerprint = (
804
_library.gnutls_openpgp_crt_get_fingerprint)
805
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
809
openpgp_crt_get_fingerprint.restype = _error_code
811
if check_version(b"3.6.4"):
812
certificate_type_get2 = _library.gnutls_certificate_type_get2
813
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
814
certificate_type_get2.restype = _error_code
735
816
# Remove non-public functions
736
817
del _error_code, _retry_on_error
737
# Create the global "gnutls" object, simulating a module
740
820
def call_pipe(connection, # : multiprocessing.Connection
741
821
func, *args, **kwargs):
742
822
"""This function is meant to be called by multiprocessing.Process
744
824
This function runs func(*args, **kwargs), and writes the resulting
745
825
return value on the provided multiprocessing.Connection.
747
827
connection.send(func(*args, **kwargs))
748
828
connection.close()
750
class Client(object):
751
832
"""A representation of a client host served by this server.
754
835
approved: bool(); 'None' if not yet approved/disapproved
755
836
approval_delay: datetime.timedelta(); Time to wait for approval
756
837
approval_duration: datetime.timedelta(); Duration of one approval
757
checker: subprocess.Popen(); a running checker process used
758
to see if the client lives.
759
'None' if no process is running.
760
checker_callback_tag: a GObject event source tag, or None
838
checker: multiprocessing.Process(); a running checker process used
839
to see if the client lives. 'None' if no process is
841
checker_callback_tag: a GLib event source tag, or None
761
842
checker_command: string; External command which is run to check
762
843
if client lives. %() expansions are done at
763
844
runtime with vars(self) as dict, so that for
764
845
instance %(name)s can be used in the command.
765
checker_initiator_tag: a GObject event source tag, or None
846
checker_initiator_tag: a GLib event source tag, or None
766
847
created: datetime.datetime(); (UTC) object creation
767
848
client_structure: Object describing what attributes a client has
768
849
and is used for storing the client at exit
769
850
current_checker_command: string; current running checker_command
770
disable_initiator_tag: a GObject event source tag, or None
851
disable_initiator_tag: a GLib event source tag, or None
772
853
fingerprint: string (40 or 32 hexadecimal digits); used to
773
uniquely identify the client
854
uniquely identify an OpenPGP client
855
key_id: string (64 hexadecimal digits); used to uniquely identify
856
a client using raw public keys
774
857
host: string; available for use by the checker command
775
858
interval: datetime.timedelta(); How often to start a new checker
776
859
last_approval_request: datetime.datetime(); (UTC) or None
930
1016
logger.info("Disabling client %s", self.name)
931
1017
if getattr(self, "disable_initiator_tag", None) is not None:
932
GObject.source_remove(self.disable_initiator_tag)
1018
GLib.source_remove(self.disable_initiator_tag)
933
1019
self.disable_initiator_tag = None
934
1020
self.expires = None
935
1021
if getattr(self, "checker_initiator_tag", None) is not None:
936
GObject.source_remove(self.checker_initiator_tag)
1022
GLib.source_remove(self.checker_initiator_tag)
937
1023
self.checker_initiator_tag = None
938
1024
self.stop_checker()
939
1025
self.enabled = False
941
1027
self.send_changedstate()
942
# Do not run this again if called by a GObject.timeout_add
1028
# Do not run this again if called by a GLib.timeout_add
945
1031
def __del__(self):
948
1034
def init_checker(self):
949
1035
# Schedule a new checker to be started an 'interval' from now,
950
1036
# and every interval from then on.
951
1037
if self.checker_initiator_tag is not None:
952
GObject.source_remove(self.checker_initiator_tag)
953
self.checker_initiator_tag = GObject.timeout_add(
1038
GLib.source_remove(self.checker_initiator_tag)
1039
self.checker_initiator_tag = GLib.timeout_add(
954
1040
int(self.interval.total_seconds() * 1000),
955
1041
self.start_checker)
956
1042
# Schedule a disable() when 'timeout' has passed
957
1043
if self.disable_initiator_tag is not None:
958
GObject.source_remove(self.disable_initiator_tag)
959
self.disable_initiator_tag = GObject.timeout_add(
1044
GLib.source_remove(self.disable_initiator_tag)
1045
self.disable_initiator_tag = GLib.timeout_add(
960
1046
int(self.timeout.total_seconds() * 1000), self.disable)
961
1047
# Also start a new checker *right now*.
962
1048
self.start_checker()
964
1050
def checker_callback(self, source, condition, connection,
966
1052
"""The checker has completed, so take appropriate actions."""
967
self.checker_callback_tag = None
969
1053
# Read return code from connection (see call_pipe)
970
1054
returncode = connection.recv()
971
1055
connection.close()
1056
if self.checker is not None:
1058
self.checker_callback_tag = None
973
1061
if returncode >= 0:
974
1062
self.last_checker_status = returncode
975
1063
self.last_checker_signal = None
1431
1520
exc_info=error)
1432
1521
return xmlstring
1435
1525
dbus.OBJECT_MANAGER_IFACE
1436
1526
except AttributeError:
1437
1527
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1439
1530
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1440
1531
"""A D-Bus object with an ObjectManager.
1442
1533
Classes inheriting from this exposes the standard
1443
1534
GetManagedObjects call and the InterfacesAdded and
1444
1535
InterfacesRemoved signals on the standard
1445
1536
"org.freedesktop.DBus.ObjectManager" interface.
1447
1538
Note: No signals are sent automatically; they must be sent
1450
1541
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1451
out_signature = "a{oa{sa{sv}}}")
1542
out_signature="a{oa{sa{sv}}}")
1452
1543
def GetManagedObjects(self):
1453
1544
"""This function must be overridden"""
1454
1545
raise NotImplementedError()
1456
1547
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1457
signature = "oa{sa{sv}}")
1548
signature="oa{sa{sv}}")
1458
1549
def InterfacesAdded(self, object_path, interfaces_and_properties):
1461
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1552
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1462
1553
def InterfacesRemoved(self, object_path, interfaces):
1465
1556
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1466
out_signature = "s",
1467
path_keyword = 'object_path',
1468
connection_keyword = 'connection')
1558
path_keyword='object_path',
1559
connection_keyword='connection')
1469
1560
def Introspect(self, object_path, connection):
1470
1561
"""Overloading of standard D-Bus method.
1472
1563
Override return argument name of GetManagedObjects to be
1473
1564
"objpath_interfaces_and_properties"
2348
class MultiprocessingMixIn(object):
2507
class MultiprocessingMixIn:
2349
2508
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2351
2510
def sub_process_main(self, request, address):
2353
2512
self.finish_request(request, address)
2354
2513
except Exception:
2355
2514
self.handle_error(request, address)
2356
2515
self.close_request(request)
2358
2517
def process_request(self, request, address):
2359
2518
"""Start a new process to process the request."""
2360
proc = multiprocessing.Process(target = self.sub_process_main,
2361
args = (request, address))
2519
proc = multiprocessing.Process(target=self.sub_process_main,
2520
args=(request, address))
2366
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2525
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2367
2526
""" adds a pipe to the MixIn """
2369
2528
def process_request(self, request, client_address):
2370
2529
"""Overrides and wraps the original process_request().
2372
2531
This function creates a new pipe in self.pipe
2374
2533
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2376
2535
proc = MultiprocessingMixIn.process_request(self, request,
2377
2536
client_address)
2378
2537
self.child_pipe.close()
2379
2538
self.add_pipe(parent_pipe, proc)
2381
2540
def add_pipe(self, parent_pipe, proc):
2382
2541
"""Dummy function; override as necessary"""
2383
2542
raise NotImplementedError()
2386
2545
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2387
socketserver.TCPServer, object):
2546
socketserver.TCPServer):
2388
2547
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2391
2550
enabled: Boolean; whether this server is activated yet
2392
2551
interface: None or a network interface name (string)
2393
2552
use_ipv6: Boolean; to use IPv6 or not
2396
2555
def __init__(self, server_address, RequestHandlerClass,
2397
2556
interface=None,
2431
2591
# socket_wrapper(), if socketfd was set.
2432
2592
socketserver.TCPServer.__init__(self, server_address,
2433
2593
RequestHandlerClass)
2435
2595
def server_bind(self):
2436
2596
"""This overrides the normal server_bind() function
2437
2597
to bind to an interface if one was specified, and also NOT to
2438
2598
bind to an address or port if they were not specified."""
2599
global SO_BINDTODEVICE
2439
2600
if self.interface is not None:
2440
2601
if SO_BINDTODEVICE is None:
2441
logger.error("SO_BINDTODEVICE does not exist;"
2442
" cannot bind to interface %s",
2446
self.socket.setsockopt(
2447
socket.SOL_SOCKET, SO_BINDTODEVICE,
2448
(self.interface + "\0").encode("utf-8"))
2449
except socket.error as error:
2450
if error.errno == errno.EPERM:
2451
logger.error("No permission to bind to"
2452
" interface %s", self.interface)
2453
elif error.errno == errno.ENOPROTOOPT:
2454
logger.error("SO_BINDTODEVICE not available;"
2455
" cannot bind to interface %s",
2457
elif error.errno == errno.ENODEV:
2458
logger.error("Interface %s does not exist,"
2459
" cannot bind", self.interface)
2602
# Fall back to a hard-coded value which seems to be
2604
logger.warning("SO_BINDTODEVICE not found, trying 25")
2605
SO_BINDTODEVICE = 25
2607
self.socket.setsockopt(
2608
socket.SOL_SOCKET, SO_BINDTODEVICE,
2609
(self.interface + "\0").encode("utf-8"))
2610
except socket.error as error:
2611
if error.errno == errno.EPERM:
2612
logger.error("No permission to bind to"
2613
" interface %s", self.interface)
2614
elif error.errno == errno.ENOPROTOOPT:
2615
logger.error("SO_BINDTODEVICE not available;"
2616
" cannot bind to interface %s",
2618
elif error.errno == errno.ENODEV:
2619
logger.error("Interface %s does not exist,"
2620
" cannot bind", self.interface)
2462
2623
# Only bind(2) the socket if we really need to.
2463
2624
if self.server_address[0] or self.server_address[1]:
2625
if self.server_address[1]:
2626
self.allow_reuse_address = True
2464
2627
if not self.server_address[0]:
2465
2628
if self.address_family == socket.AF_INET6:
2466
any_address = "::" # in6addr_any
2629
any_address = "::" # in6addr_any
2468
any_address = "0.0.0.0" # INADDR_ANY
2631
any_address = "0.0.0.0" # INADDR_ANY
2469
2632
self.server_address = (any_address,
2470
2633
self.server_address[1])
2471
2634
elif not self.server_address[1]:
2505
2668
self.gnutls_priority = gnutls_priority
2506
2669
IPv6_TCPServer.__init__(self, server_address,
2507
2670
RequestHandlerClass,
2508
interface = interface,
2509
use_ipv6 = use_ipv6,
2510
socketfd = socketfd)
2671
interface=interface,
2512
2675
def server_activate(self):
2513
2676
if self.enabled:
2514
2677
return socketserver.TCPServer.server_activate(self)
2516
2679
def enable(self):
2517
2680
self.enabled = True
2519
2682
def add_pipe(self, parent_pipe, proc):
2520
2683
# Call "handle_ipc" for both data and EOF events
2521
GObject.io_add_watch(
2522
parent_pipe.fileno(),
2523
GObject.IO_IN | GObject.IO_HUP,
2685
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2686
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2524
2687
functools.partial(self.handle_ipc,
2525
parent_pipe = parent_pipe,
2688
parent_pipe=parent_pipe,
2528
2691
def handle_ipc(self, source, condition,
2529
2692
parent_pipe=None,
2531
2694
client_object=None):
2532
2695
# error, or the other end of multiprocessing.Pipe has closed
2533
if condition & (GObject.IO_ERR | GObject.IO_HUP):
2696
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2534
2697
# Wait for other process to exit
2538
2701
# Read a request from the child
2539
2702
request = parent_pipe.recv()
2540
2703
command = request[0]
2542
2705
if command == 'init':
2544
address = request[2]
2706
key_id = request[1].decode("ascii")
2707
fpr = request[2].decode("ascii")
2708
address = request[3]
2546
2710
for c in self.clients.values():
2547
if c.fingerprint == fpr:
2711
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2713
if key_id and c.key_id == key_id:
2716
if fpr and c.fingerprint == fpr:
2551
logger.info("Client not found for fingerprint: %s, ad"
2552
"dress: %s", fpr, address)
2720
logger.info("Client not found for key ID: %s, address"
2721
": %s", key_id or fpr, address)
2553
2722
if self.use_dbus:
2554
2723
# Emit D-Bus signal
2555
mandos_dbus_service.ClientNotFound(fpr,
2724
mandos_dbus_service.ClientNotFound(key_id or fpr,
2557
2726
parent_pipe.send(False)
2560
GObject.io_add_watch(
2561
parent_pipe.fileno(),
2562
GObject.IO_IN | GObject.IO_HUP,
2730
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2731
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2563
2732
functools.partial(self.handle_ipc,
2564
parent_pipe = parent_pipe,
2566
client_object = client))
2733
parent_pipe=parent_pipe,
2735
client_object=client))
2567
2736
parent_pipe.send(True)
2568
2737
# remove the old hook in favor of the new above hook on
2586
2755
parent_pipe.send((
2587
2756
'data', client_object.__getattribute__(attrname)))
2589
2758
if command == 'setattr':
2590
2759
attrname = request[1]
2591
2760
value = request[2]
2592
2761
setattr(client_object, attrname, value)
2597
2766
def rfc3339_duration_to_delta(duration):
2598
2767
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2600
>>> rfc3339_duration_to_delta("P7D")
2601
datetime.timedelta(7)
2602
>>> rfc3339_duration_to_delta("PT60S")
2603
datetime.timedelta(0, 60)
2604
>>> rfc3339_duration_to_delta("PT60M")
2605
datetime.timedelta(0, 3600)
2606
>>> rfc3339_duration_to_delta("PT24H")
2607
datetime.timedelta(1)
2608
>>> rfc3339_duration_to_delta("P1W")
2609
datetime.timedelta(7)
2610
>>> rfc3339_duration_to_delta("PT5M30S")
2611
datetime.timedelta(0, 330)
2612
>>> rfc3339_duration_to_delta("P1DT3M20S")
2613
datetime.timedelta(1, 200)
2769
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2771
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2773
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2775
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2777
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2779
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2781
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2616
2785
# Parsing an RFC 3339 duration with regular expressions is not
2617
2786
# possible - there would have to be multiple places for the same
2618
2787
# values, like seconds. The current code, while more esoteric, is
2619
2788
# cleaner without depending on a parsing library. If Python had a
2620
2789
# built-in library for parsing we would use it, but we'd like to
2621
2790
# avoid excessive use of external libraries.
2623
2792
# New type for defining tokens, syntax, and semantics all-in-one
2624
2793
Token = collections.namedtuple("Token", (
2625
2794
"regexp", # To match token; if "value" is not None, must have
2809
2981
parser.add_argument("--no-zeroconf", action="store_false",
2810
2982
dest="zeroconf", help="Do not use Zeroconf",
2813
2985
options = parser.parse_args()
2817
fail_count, test_count = doctest.testmod()
2818
sys.exit(os.EX_OK if fail_count == 0 else 1)
2820
2987
# Default values for config file for server-global settings
2821
server_defaults = { "interface": "",
2826
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2827
":+SIGN-DSA-SHA256",
2828
"servicename": "Mandos",
2834
"statedir": "/var/lib/mandos",
2835
"foreground": "False",
2988
if gnutls.has_rawpk:
2989
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2990
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2992
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2993
":+SIGN-DSA-SHA256")
2994
server_defaults = {"interface": "",
2998
"priority": priority,
2999
"servicename": "Mandos",
3005
"statedir": "/var/lib/mandos",
3006
"foreground": "False",
2839
3011
# Parse config file for server-global settings
2840
server_config = configparser.SafeConfigParser(server_defaults)
3012
server_config = configparser.ConfigParser(server_defaults)
2841
3013
del server_defaults
2842
3014
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2843
# Convert the SafeConfigParser object to a dict
3015
# Convert the ConfigParser object to a dict
2844
3016
server_settings = server_config.defaults()
2845
3017
# Use the appropriate methods on the non-string config options
2846
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3018
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3019
"foreground", "zeroconf"):
2847
3020
server_settings[option] = server_config.getboolean("DEFAULT",
2849
3022
if server_settings["port"]:
3022
3195
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3023
3196
service = AvahiServiceToSyslog(
3024
name = server_settings["servicename"],
3025
servicetype = "_mandos._tcp",
3026
protocol = protocol,
3197
name=server_settings["servicename"],
3198
servicetype="_mandos._tcp",
3028
3201
if server_settings["interface"]:
3029
3202
service.interface = if_nametoindex(
3030
3203
server_settings["interface"].encode("utf-8"))
3032
3205
global multiprocessing_manager
3033
3206
multiprocessing_manager = multiprocessing.Manager()
3035
3208
client_class = Client
3037
client_class = functools.partial(ClientDBus, bus = bus)
3210
client_class = functools.partial(ClientDBus, bus=bus)
3039
3212
client_settings = Client.config_parser(client_config)
3040
3213
old_client_settings = {}
3041
3214
clients_data = {}
3043
3216
# This is used to redirect stdout and stderr for checker processes
3045
wnull = open(os.devnull, "w") # A writable /dev/null
3218
wnull = open(os.devnull, "w") # A writable /dev/null
3046
3219
# Only used if server is running in foreground but not in debug
3048
3221
if debug or not foreground:
3051
3224
# Get client data and settings from last running state.
3052
3225
if server_settings["restore"]:
3054
3227
with open(stored_state_path, "rb") as stored_state:
3055
if sys.version_info.major == 2:
3228
if sys.version_info.major == 2:
3056
3229
clients_data, old_client_settings = pickle.load(
3059
3232
bytes_clients_data, bytes_old_client_settings = (
3060
pickle.load(stored_state, encoding = "bytes"))
3061
### Fix bytes to strings
3233
pickle.load(stored_state, encoding="bytes"))
3234
# Fix bytes to strings
3064
clients_data = { (key.decode("utf-8")
3065
if isinstance(key, bytes)
3068
bytes_clients_data.items() }
3237
clients_data = {(key.decode("utf-8")
3238
if isinstance(key, bytes)
3241
bytes_clients_data.items()}
3069
3242
del bytes_clients_data
3070
3243
for key in clients_data:
3071
value = { (k.decode("utf-8")
3072
if isinstance(k, bytes) else k): v
3074
clients_data[key].items() }
3244
value = {(k.decode("utf-8")
3245
if isinstance(k, bytes) else k): v
3247
clients_data[key].items()}
3075
3248
clients_data[key] = value
3076
3249
# .client_structure
3077
3250
value["client_structure"] = [
3078
3251
(s.decode("utf-8")
3079
3252
if isinstance(s, bytes)
3080
3253
else s) for s in
3081
value["client_structure"] ]
3083
for k in ("name", "host"):
3254
value["client_structure"]]
3255
# .name, .host, and .checker_command
3256
for k in ("name", "host", "checker_command"):
3084
3257
if isinstance(value[k], bytes):
3085
3258
value[k] = value[k].decode("utf-8")
3086
## old_client_settings
3259
if "key_id" not in value:
3260
value["key_id"] = ""
3261
elif "fingerprint" not in value:
3262
value["fingerprint"] = ""
3263
# old_client_settings
3088
3265
old_client_settings = {
3089
3266
(key.decode("utf-8")
3090
3267
if isinstance(key, bytes)
3091
3268
else key): value
3092
3269
for key, value in
3093
bytes_old_client_settings.items() }
3270
bytes_old_client_settings.items()}
3094
3271
del bytes_old_client_settings
3272
# .host and .checker_command
3096
3273
for value in old_client_settings.values():
3097
if isinstance(value["host"], bytes):
3098
value["host"] = (value["host"]
3274
for attribute in ("host", "checker_command"):
3275
if isinstance(value[attribute], bytes):
3276
value[attribute] = (value[attribute]
3100
3278
os.remove(stored_state_path)
3101
3279
except IOError as e:
3102
3280
if e.errno == errno.ENOENT: