2
# -*- mode: python; coding: utf-8 -*-
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
17
# This file is part of Mandos.
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
32
# Contact the authors at <mandos@recompile.se>.
34
35
from __future__ import (division, absolute_import, print_function,
37
from future_builtins import *
39
from future_builtins import *
40
44
import SocketServer as socketserver
190
250
.replace(b"\n", b"\\n")
191
251
.replace(b"\0", b"\\x00"))
194
254
def encrypt(self, data, password):
195
255
passphrase = self.password_encode(password)
196
256
with tempfile.NamedTemporaryFile(
197
257
dir=self.tempdir) as passfile:
198
258
passfile.write(passphrase)
200
proc = subprocess.Popen(['gpg', '--symmetric',
260
proc = subprocess.Popen([self.gpg, '--symmetric',
201
261
'--passphrase-file',
203
263
+ self.gnupgargs,
204
stdin = subprocess.PIPE,
205
stdout = subprocess.PIPE,
206
stderr = subprocess.PIPE)
207
ciphertext, err = proc.communicate(input = data)
264
stdin=subprocess.PIPE,
265
stdout=subprocess.PIPE,
266
stderr=subprocess.PIPE)
267
ciphertext, err = proc.communicate(input=data)
208
268
if proc.returncode != 0:
209
269
raise PGPError(err)
210
270
return ciphertext
212
272
def decrypt(self, data, password):
213
273
passphrase = self.password_encode(password)
214
274
with tempfile.NamedTemporaryFile(
215
dir = self.tempdir) as passfile:
275
dir=self.tempdir) as passfile:
216
276
passfile.write(passphrase)
218
proc = subprocess.Popen(['gpg', '--decrypt',
278
proc = subprocess.Popen([self.gpg, '--decrypt',
219
279
'--passphrase-file',
221
281
+ self.gnupgargs,
222
stdin = subprocess.PIPE,
223
stdout = subprocess.PIPE,
224
stderr = subprocess.PIPE)
225
decrypted_plaintext, err = proc.communicate(input = data)
282
stdin=subprocess.PIPE,
283
stdout=subprocess.PIPE,
284
stderr=subprocess.PIPE)
285
decrypted_plaintext, err = proc.communicate(input=data)
226
286
if proc.returncode != 0:
227
287
raise PGPError(err)
228
288
return decrypted_plaintext
291
# Pretend that we have an Avahi module
293
"""This isn't so much a class as it is a module-like namespace."""
294
IF_UNSPEC = -1 # avahi-common/address.h
295
PROTO_UNSPEC = -1 # avahi-common/address.h
296
PROTO_INET = 0 # avahi-common/address.h
297
PROTO_INET6 = 1 # avahi-common/address.h
298
DBUS_NAME = "org.freedesktop.Avahi"
299
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
300
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
301
DBUS_PATH_SERVER = "/"
304
def string_array_to_txt_array(t):
305
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
306
for s in t), signature="ay")
307
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
308
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
309
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
310
SERVER_INVALID = 0 # avahi-common/defs.h
311
SERVER_REGISTERING = 1 # avahi-common/defs.h
312
SERVER_RUNNING = 2 # avahi-common/defs.h
313
SERVER_COLLISION = 3 # avahi-common/defs.h
314
SERVER_FAILURE = 4 # avahi-common/defs.h
231
317
class AvahiError(Exception):
232
318
def __init__(self, value, *args, **kwargs):
233
319
self.value = value
423
509
class AvahiServiceToSyslog(AvahiService):
424
510
def rename(self, *args, **kwargs):
425
511
"""Add the new name to the syslog messages"""
426
ret = AvahiService.rename(self, *args, **kwargs)
512
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
427
513
syslogger.setFormatter(logging.Formatter(
428
514
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
429
515
.format(self.name)))
432
519
# Pretend that we have a GnuTLS module
433
class GnuTLS(object):
434
"""This isn't so much a class as it is a module-like namespace.
435
It is instantiated once, and simulates having a GnuTLS module."""
437
_library = ctypes.cdll.LoadLibrary(
438
ctypes.util.find_library("gnutls"))
439
_need_version = "3.3.0"
441
# Need to use class name "GnuTLS" here, since this method is
442
# called before the assignment to the "gnutls" global variable
444
if GnuTLS.check_version(self._need_version) is None:
445
raise GnuTLS.Error("Needs GnuTLS {} or later"
446
.format(self._need_version))
521
"""This isn't so much a class as it is a module-like namespace."""
523
library = ctypes.util.find_library("gnutls")
525
library = ctypes.util.find_library("gnutls-deb0")
526
_library = ctypes.cdll.LoadLibrary(library)
448
529
# Unless otherwise indicated, the constants and types below are
449
530
# all from the gnutls/gnutls.h C header file.
456
540
CRD_CERTIFICATE = 1
457
541
E_NO_CERTIFICATE_FOUND = -49
546
KEYID_USE_SHA256 = 1 # gnutls/x509.h
458
547
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
461
550
class session_int(ctypes.Structure):
463
552
session_t = ctypes.POINTER(session_int)
464
554
class certificate_credentials_st(ctypes.Structure):
466
556
certificate_credentials_t = ctypes.POINTER(
467
557
certificate_credentials_st)
468
558
certificate_type_t = ctypes.c_int
469
560
class datum_t(ctypes.Structure):
470
561
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
471
562
('size', ctypes.c_uint)]
472
564
class openpgp_crt_int(ctypes.Structure):
474
566
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
475
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
567
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
476
568
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
477
credentials_type_t = ctypes.c_int #
569
credentials_type_t = ctypes.c_int
478
570
transport_ptr_t = ctypes.c_void_p
479
571
close_request_t = ctypes.c_int
482
574
class Error(Exception):
483
# We need to use the class name "GnuTLS" here, since this
484
# exception might be raised from within GnuTLS.__init__,
485
# which is called before the assignment to the "gnutls"
486
# global variable happens.
487
def __init__(self, message = None, code = None, args=()):
575
def __init__(self, message=None, code=None, args=()):
488
576
# Default usage is by a message string, but if a return
489
577
# code is passed, convert it to a string with
490
578
# gnutls.strerror()
491
580
if message is None and code is not None:
492
message = GnuTLS.strerror(code)
493
return super(GnuTLS.Error, self).__init__(
581
message = gnutls.strerror(code)
582
return super(gnutls.Error, self).__init__(
496
585
class CertificateSecurityError(Error):
500
class Credentials(object):
501
590
def __init__(self):
502
591
self._c_object = gnutls.certificate_credentials_t()
503
592
gnutls.certificate_allocate_credentials(
504
593
ctypes.byref(self._c_object))
505
594
self.type = gnutls.CRD_CERTIFICATE
507
596
def __del__(self):
508
597
gnutls.certificate_free_credentials(self._c_object)
510
class ClientSession(object):
511
def __init__(self, socket, credentials = None):
600
def __init__(self, socket, credentials=None):
512
601
self._c_object = gnutls.session_t()
513
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
602
gnutls_flags = gnutls.CLIENT
603
if gnutls.check_version(b"3.5.6"):
604
gnutls_flags |= gnutls.NO_TICKETS
606
gnutls_flags |= gnutls.ENABLE_RAWPK
607
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
514
609
gnutls.set_default_priority(self._c_object)
515
610
gnutls.transport_set_ptr(self._c_object, socket.fileno())
516
611
gnutls.handshake_set_private_extensions(self._c_object,
522
617
ctypes.cast(credentials._c_object,
523
618
ctypes.c_void_p))
524
619
self.credentials = credentials
526
621
def __del__(self):
527
622
gnutls.deinit(self._c_object)
529
624
def handshake(self):
530
625
return gnutls.handshake(self._c_object)
532
627
def send(self, data):
533
628
data = bytes(data)
536
return gnutls.record_send(self._c_object, data, len(data))
631
data_len -= gnutls.record_send(self._c_object,
539
636
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
541
# Error handling function
638
# Error handling functions
542
639
def _error_code(result):
543
640
"""A function to raise exceptions on errors, suitable
544
641
for the 'restype' attribute on ctypes functions"""
547
644
if result == gnutls.E_NO_CERTIFICATE_FOUND:
548
raise gnutls.CertificateSecurityError(code = result)
549
raise gnutls.Error(code = result)
645
raise gnutls.CertificateSecurityError(code=result)
646
raise gnutls.Error(code=result)
648
def _retry_on_error(result, func, arguments):
649
"""A function to retry on some errors, suitable
650
for the 'errcheck' attribute on ctypes functions"""
652
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
653
return _error_code(result)
654
result = func(*arguments)
551
657
# Unless otherwise indicated, the function declarations below are
552
658
# all from the gnutls/gnutls.h C header file.
555
661
priority_set_direct = _library.gnutls_priority_set_direct
556
662
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
557
663
ctypes.POINTER(ctypes.c_char_p)]
558
664
priority_set_direct.restype = _error_code
560
666
init = _library.gnutls_init
561
667
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
562
668
init.restype = _error_code
564
670
set_default_priority = _library.gnutls_set_default_priority
565
671
set_default_priority.argtypes = [session_t]
566
672
set_default_priority.restype = _error_code
568
674
record_send = _library.gnutls_record_send
569
675
record_send.argtypes = [session_t, ctypes.c_void_p,
571
677
record_send.restype = ctypes.c_ssize_t
678
record_send.errcheck = _retry_on_error
573
680
certificate_allocate_credentials = (
574
681
_library.gnutls_certificate_allocate_credentials)
575
682
certificate_allocate_credentials.argtypes = [
576
683
ctypes.POINTER(certificate_credentials_t)]
577
684
certificate_allocate_credentials.restype = _error_code
579
686
certificate_free_credentials = (
580
687
_library.gnutls_certificate_free_credentials)
581
certificate_free_credentials.argtypes = [certificate_credentials_t]
688
certificate_free_credentials.argtypes = [
689
certificate_credentials_t]
582
690
certificate_free_credentials.restype = None
584
692
handshake_set_private_extensions = (
585
693
_library.gnutls_handshake_set_private_extensions)
586
694
handshake_set_private_extensions.argtypes = [session_t,
588
696
handshake_set_private_extensions.restype = None
590
698
credentials_set = _library.gnutls_credentials_set
591
699
credentials_set.argtypes = [session_t, credentials_type_t,
593
701
credentials_set.restype = _error_code
595
703
strerror = _library.gnutls_strerror
596
704
strerror.argtypes = [ctypes.c_int]
597
705
strerror.restype = ctypes.c_char_p
599
707
certificate_type_get = _library.gnutls_certificate_type_get
600
708
certificate_type_get.argtypes = [session_t]
601
709
certificate_type_get.restype = _error_code
603
711
certificate_get_peers = _library.gnutls_certificate_get_peers
604
712
certificate_get_peers.argtypes = [session_t,
605
713
ctypes.POINTER(ctypes.c_uint)]
606
714
certificate_get_peers.restype = ctypes.POINTER(datum_t)
608
716
global_set_log_level = _library.gnutls_global_set_log_level
609
717
global_set_log_level.argtypes = [ctypes.c_int]
610
718
global_set_log_level.restype = None
612
720
global_set_log_function = _library.gnutls_global_set_log_function
613
721
global_set_log_function.argtypes = [log_func]
614
722
global_set_log_function.restype = None
616
724
deinit = _library.gnutls_deinit
617
725
deinit.argtypes = [session_t]
618
726
deinit.restype = None
620
728
handshake = _library.gnutls_handshake
621
729
handshake.argtypes = [session_t]
622
730
handshake.restype = _error_code
731
handshake.errcheck = _retry_on_error
624
733
transport_set_ptr = _library.gnutls_transport_set_ptr
625
734
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
626
735
transport_set_ptr.restype = None
628
737
bye = _library.gnutls_bye
629
738
bye.argtypes = [session_t, close_request_t]
630
739
bye.restype = _error_code
740
bye.errcheck = _retry_on_error
632
742
check_version = _library.gnutls_check_version
633
743
check_version.argtypes = [ctypes.c_char_p]
634
744
check_version.restype = ctypes.c_char_p
636
# All the function declarations below are from gnutls/openpgp.h
638
openpgp_crt_init = _library.gnutls_openpgp_crt_init
639
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
640
openpgp_crt_init.restype = _error_code
642
openpgp_crt_import = _library.gnutls_openpgp_crt_import
643
openpgp_crt_import.argtypes = [openpgp_crt_t,
644
ctypes.POINTER(datum_t),
646
openpgp_crt_import.restype = _error_code
648
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
649
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
650
ctypes.POINTER(ctypes.c_uint)]
651
openpgp_crt_verify_self.restype = _error_code
653
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
654
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
655
openpgp_crt_deinit.restype = None
657
openpgp_crt_get_fingerprint = (
658
_library.gnutls_openpgp_crt_get_fingerprint)
659
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
663
openpgp_crt_get_fingerprint.restype = _error_code
665
# Remove non-public function
667
# Create the global "gnutls" object, simulating a module
746
_need_version = b"3.3.0"
747
if check_version(_need_version) is None:
748
raise self.Error("Needs GnuTLS {} or later"
749
.format(_need_version))
751
_tls_rawpk_version = b"3.6.6"
752
has_rawpk = bool(check_version(_tls_rawpk_version))
756
class pubkey_st(ctypes.Structure):
758
pubkey_t = ctypes.POINTER(pubkey_st)
760
x509_crt_fmt_t = ctypes.c_int
762
# All the function declarations below are from gnutls/abstract.h
763
pubkey_init = _library.gnutls_pubkey_init
764
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
765
pubkey_init.restype = _error_code
767
pubkey_import = _library.gnutls_pubkey_import
768
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
770
pubkey_import.restype = _error_code
772
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
773
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
774
ctypes.POINTER(ctypes.c_ubyte),
775
ctypes.POINTER(ctypes.c_size_t)]
776
pubkey_get_key_id.restype = _error_code
778
pubkey_deinit = _library.gnutls_pubkey_deinit
779
pubkey_deinit.argtypes = [pubkey_t]
780
pubkey_deinit.restype = None
782
# All the function declarations below are from gnutls/openpgp.h
784
openpgp_crt_init = _library.gnutls_openpgp_crt_init
785
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
786
openpgp_crt_init.restype = _error_code
788
openpgp_crt_import = _library.gnutls_openpgp_crt_import
789
openpgp_crt_import.argtypes = [openpgp_crt_t,
790
ctypes.POINTER(datum_t),
792
openpgp_crt_import.restype = _error_code
794
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
795
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
796
ctypes.POINTER(ctypes.c_uint)]
797
openpgp_crt_verify_self.restype = _error_code
799
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
800
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
801
openpgp_crt_deinit.restype = None
803
openpgp_crt_get_fingerprint = (
804
_library.gnutls_openpgp_crt_get_fingerprint)
805
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
809
openpgp_crt_get_fingerprint.restype = _error_code
811
if check_version(b"3.6.4"):
812
certificate_type_get2 = _library.gnutls_certificate_type_get2
813
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
814
certificate_type_get2.restype = _error_code
816
# Remove non-public functions
817
del _error_code, _retry_on_error
670
820
def call_pipe(connection, # : multiprocessing.Connection
671
821
func, *args, **kwargs):
672
822
"""This function is meant to be called by multiprocessing.Process
674
824
This function runs func(*args, **kwargs), and writes the resulting
675
825
return value on the provided multiprocessing.Connection.
677
827
connection.send(func(*args, **kwargs))
678
828
connection.close()
680
class Client(object):
681
832
"""A representation of a client host served by this server.
684
835
approved: bool(); 'None' if not yet approved/disapproved
685
836
approval_delay: datetime.timedelta(); Time to wait for approval
686
837
approval_duration: datetime.timedelta(); Duration of one approval
687
checker: subprocess.Popen(); a running checker process used
688
to see if the client lives.
689
'None' if no process is running.
690
checker_callback_tag: a gobject event source tag, or None
838
checker: multiprocessing.Process(); a running checker process used
839
to see if the client lives. 'None' if no process is
841
checker_callback_tag: a GLib event source tag, or None
691
842
checker_command: string; External command which is run to check
692
843
if client lives. %() expansions are done at
693
844
runtime with vars(self) as dict, so that for
694
845
instance %(name)s can be used in the command.
695
checker_initiator_tag: a gobject event source tag, or None
846
checker_initiator_tag: a GLib event source tag, or None
696
847
created: datetime.datetime(); (UTC) object creation
697
848
client_structure: Object describing what attributes a client has
698
849
and is used for storing the client at exit
699
850
current_checker_command: string; current running checker_command
700
disable_initiator_tag: a gobject event source tag, or None
851
disable_initiator_tag: a GLib event source tag, or None
702
853
fingerprint: string (40 or 32 hexadecimal digits); used to
703
uniquely identify the client
854
uniquely identify an OpenPGP client
855
key_id: string (64 hexadecimal digits); used to uniquely identify
856
a client using raw public keys
704
857
host: string; available for use by the checker command
705
858
interval: datetime.timedelta(); How often to start a new checker
706
859
last_approval_request: datetime.datetime(); (UTC) or None
858
1016
logger.info("Disabling client %s", self.name)
859
1017
if getattr(self, "disable_initiator_tag", None) is not None:
860
gobject.source_remove(self.disable_initiator_tag)
1018
GLib.source_remove(self.disable_initiator_tag)
861
1019
self.disable_initiator_tag = None
862
1020
self.expires = None
863
1021
if getattr(self, "checker_initiator_tag", None) is not None:
864
gobject.source_remove(self.checker_initiator_tag)
1022
GLib.source_remove(self.checker_initiator_tag)
865
1023
self.checker_initiator_tag = None
866
1024
self.stop_checker()
867
1025
self.enabled = False
869
1027
self.send_changedstate()
870
# Do not run this again if called by a gobject.timeout_add
1028
# Do not run this again if called by a GLib.timeout_add
873
1031
def __del__(self):
876
1034
def init_checker(self):
877
1035
# Schedule a new checker to be started an 'interval' from now,
878
1036
# and every interval from then on.
879
1037
if self.checker_initiator_tag is not None:
880
gobject.source_remove(self.checker_initiator_tag)
881
self.checker_initiator_tag = gobject.timeout_add(
1038
GLib.source_remove(self.checker_initiator_tag)
1039
self.checker_initiator_tag = GLib.timeout_add(
882
1040
int(self.interval.total_seconds() * 1000),
883
1041
self.start_checker)
884
1042
# Schedule a disable() when 'timeout' has passed
885
1043
if self.disable_initiator_tag is not None:
886
gobject.source_remove(self.disable_initiator_tag)
887
self.disable_initiator_tag = gobject.timeout_add(
1044
GLib.source_remove(self.disable_initiator_tag)
1045
self.disable_initiator_tag = GLib.timeout_add(
888
1046
int(self.timeout.total_seconds() * 1000), self.disable)
889
1047
# Also start a new checker *right now*.
890
1048
self.start_checker()
892
1050
def checker_callback(self, source, condition, connection,
894
1052
"""The checker has completed, so take appropriate actions."""
895
self.checker_callback_tag = None
897
1053
# Read return code from connection (see call_pipe)
898
1054
returncode = connection.recv()
899
1055
connection.close()
1056
if self.checker is not None:
1058
self.checker_callback_tag = None
901
1061
if returncode >= 0:
902
1062
self.last_checker_status = returncode
903
1063
self.last_checker_signal = None
2301
class MultiprocessingMixIn(object):
2507
class MultiprocessingMixIn:
2302
2508
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2304
2510
def sub_process_main(self, request, address):
2306
2512
self.finish_request(request, address)
2307
2513
except Exception:
2308
2514
self.handle_error(request, address)
2309
2515
self.close_request(request)
2311
2517
def process_request(self, request, address):
2312
2518
"""Start a new process to process the request."""
2313
proc = multiprocessing.Process(target = self.sub_process_main,
2314
args = (request, address))
2519
proc = multiprocessing.Process(target=self.sub_process_main,
2520
args=(request, address))
2319
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2525
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2320
2526
""" adds a pipe to the MixIn """
2322
2528
def process_request(self, request, client_address):
2323
2529
"""Overrides and wraps the original process_request().
2325
2531
This function creates a new pipe in self.pipe
2327
2533
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2329
2535
proc = MultiprocessingMixIn.process_request(self, request,
2330
2536
client_address)
2331
2537
self.child_pipe.close()
2332
2538
self.add_pipe(parent_pipe, proc)
2334
2540
def add_pipe(self, parent_pipe, proc):
2335
2541
"""Dummy function; override as necessary"""
2336
2542
raise NotImplementedError()
2339
2545
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2340
socketserver.TCPServer, object):
2546
socketserver.TCPServer):
2341
2547
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2344
2550
enabled: Boolean; whether this server is activated yet
2345
2551
interface: None or a network interface name (string)
2346
2552
use_ipv6: Boolean; to use IPv6 or not
2349
2555
def __init__(self, server_address, RequestHandlerClass,
2350
2556
interface=None,
2384
2591
# socket_wrapper(), if socketfd was set.
2385
2592
socketserver.TCPServer.__init__(self, server_address,
2386
2593
RequestHandlerClass)
2388
2595
def server_bind(self):
2389
2596
"""This overrides the normal server_bind() function
2390
2597
to bind to an interface if one was specified, and also NOT to
2391
2598
bind to an address or port if they were not specified."""
2599
global SO_BINDTODEVICE
2392
2600
if self.interface is not None:
2393
2601
if SO_BINDTODEVICE is None:
2394
logger.error("SO_BINDTODEVICE does not exist;"
2395
" cannot bind to interface %s",
2399
self.socket.setsockopt(
2400
socket.SOL_SOCKET, SO_BINDTODEVICE,
2401
(self.interface + "\0").encode("utf-8"))
2402
except socket.error as error:
2403
if error.errno == errno.EPERM:
2404
logger.error("No permission to bind to"
2405
" interface %s", self.interface)
2406
elif error.errno == errno.ENOPROTOOPT:
2407
logger.error("SO_BINDTODEVICE not available;"
2408
" cannot bind to interface %s",
2410
elif error.errno == errno.ENODEV:
2411
logger.error("Interface %s does not exist,"
2412
" cannot bind", self.interface)
2602
# Fall back to a hard-coded value which seems to be
2604
logger.warning("SO_BINDTODEVICE not found, trying 25")
2605
SO_BINDTODEVICE = 25
2607
self.socket.setsockopt(
2608
socket.SOL_SOCKET, SO_BINDTODEVICE,
2609
(self.interface + "\0").encode("utf-8"))
2610
except socket.error as error:
2611
if error.errno == errno.EPERM:
2612
logger.error("No permission to bind to"
2613
" interface %s", self.interface)
2614
elif error.errno == errno.ENOPROTOOPT:
2615
logger.error("SO_BINDTODEVICE not available;"
2616
" cannot bind to interface %s",
2618
elif error.errno == errno.ENODEV:
2619
logger.error("Interface %s does not exist,"
2620
" cannot bind", self.interface)
2415
2623
# Only bind(2) the socket if we really need to.
2416
2624
if self.server_address[0] or self.server_address[1]:
2625
if self.server_address[1]:
2626
self.allow_reuse_address = True
2417
2627
if not self.server_address[0]:
2418
2628
if self.address_family == socket.AF_INET6:
2419
any_address = "::" # in6addr_any
2629
any_address = "::" # in6addr_any
2421
any_address = "0.0.0.0" # INADDR_ANY
2631
any_address = "0.0.0.0" # INADDR_ANY
2422
2632
self.server_address = (any_address,
2423
2633
self.server_address[1])
2424
2634
elif not self.server_address[1]:
2458
2668
self.gnutls_priority = gnutls_priority
2459
2669
IPv6_TCPServer.__init__(self, server_address,
2460
2670
RequestHandlerClass,
2461
interface = interface,
2462
use_ipv6 = use_ipv6,
2463
socketfd = socketfd)
2671
interface=interface,
2465
2675
def server_activate(self):
2466
2676
if self.enabled:
2467
2677
return socketserver.TCPServer.server_activate(self)
2469
2679
def enable(self):
2470
2680
self.enabled = True
2472
2682
def add_pipe(self, parent_pipe, proc):
2473
2683
# Call "handle_ipc" for both data and EOF events
2474
gobject.io_add_watch(
2475
parent_pipe.fileno(),
2476
gobject.IO_IN | gobject.IO_HUP,
2685
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2686
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2477
2687
functools.partial(self.handle_ipc,
2478
parent_pipe = parent_pipe,
2688
parent_pipe=parent_pipe,
2481
2691
def handle_ipc(self, source, condition,
2482
2692
parent_pipe=None,
2484
2694
client_object=None):
2485
2695
# error, or the other end of multiprocessing.Pipe has closed
2486
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2696
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2487
2697
# Wait for other process to exit
2491
2701
# Read a request from the child
2492
2702
request = parent_pipe.recv()
2493
2703
command = request[0]
2495
2705
if command == 'init':
2497
address = request[2]
2499
for c in self.clients.itervalues():
2500
if c.fingerprint == fpr:
2706
key_id = request[1].decode("ascii")
2707
fpr = request[2].decode("ascii")
2708
address = request[3]
2710
for c in self.clients.values():
2711
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2713
if key_id and c.key_id == key_id:
2716
if fpr and c.fingerprint == fpr:
2504
logger.info("Client not found for fingerprint: %s, ad"
2505
"dress: %s", fpr, address)
2720
logger.info("Client not found for key ID: %s, address"
2721
": %s", key_id or fpr, address)
2506
2722
if self.use_dbus:
2507
2723
# Emit D-Bus signal
2508
mandos_dbus_service.ClientNotFound(fpr,
2724
mandos_dbus_service.ClientNotFound(key_id or fpr,
2510
2726
parent_pipe.send(False)
2513
gobject.io_add_watch(
2514
parent_pipe.fileno(),
2515
gobject.IO_IN | gobject.IO_HUP,
2730
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2731
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2516
2732
functools.partial(self.handle_ipc,
2517
parent_pipe = parent_pipe,
2519
client_object = client))
2733
parent_pipe=parent_pipe,
2735
client_object=client))
2520
2736
parent_pipe.send(True)
2521
2737
# remove the old hook in favor of the new above hook on
2539
2755
parent_pipe.send((
2540
2756
'data', client_object.__getattribute__(attrname)))
2542
2758
if command == 'setattr':
2543
2759
attrname = request[1]
2544
2760
value = request[2]
2545
2761
setattr(client_object, attrname, value)
2550
2766
def rfc3339_duration_to_delta(duration):
2551
2767
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2553
>>> rfc3339_duration_to_delta("P7D")
2554
datetime.timedelta(7)
2555
>>> rfc3339_duration_to_delta("PT60S")
2556
datetime.timedelta(0, 60)
2557
>>> rfc3339_duration_to_delta("PT60M")
2558
datetime.timedelta(0, 3600)
2559
>>> rfc3339_duration_to_delta("PT24H")
2560
datetime.timedelta(1)
2561
>>> rfc3339_duration_to_delta("P1W")
2562
datetime.timedelta(7)
2563
>>> rfc3339_duration_to_delta("PT5M30S")
2564
datetime.timedelta(0, 330)
2565
>>> rfc3339_duration_to_delta("P1DT3M20S")
2566
datetime.timedelta(1, 200)
2769
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2771
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2773
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2775
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2777
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2779
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2781
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2569
2785
# Parsing an RFC 3339 duration with regular expressions is not
2570
2786
# possible - there would have to be multiple places for the same
2571
2787
# values, like seconds. The current code, while more esoteric, is
2572
2788
# cleaner without depending on a parsing library. If Python had a
2573
2789
# built-in library for parsing we would use it, but we'd like to
2574
2790
# avoid excessive use of external libraries.
2576
2792
# New type for defining tokens, syntax, and semantics all-in-one
2577
2793
Token = collections.namedtuple("Token", (
2578
2794
"regexp", # To match token; if "value" is not None, must have
2968
3195
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2969
3196
service = AvahiServiceToSyslog(
2970
name = server_settings["servicename"],
2971
servicetype = "_mandos._tcp",
2972
protocol = protocol,
3197
name=server_settings["servicename"],
3198
servicetype="_mandos._tcp",
2974
3201
if server_settings["interface"]:
2975
3202
service.interface = if_nametoindex(
2976
3203
server_settings["interface"].encode("utf-8"))
2978
3205
global multiprocessing_manager
2979
3206
multiprocessing_manager = multiprocessing.Manager()
2981
3208
client_class = Client
2983
client_class = functools.partial(ClientDBus, bus = bus)
3210
client_class = functools.partial(ClientDBus, bus=bus)
2985
3212
client_settings = Client.config_parser(client_config)
2986
3213
old_client_settings = {}
2987
3214
clients_data = {}
2989
3216
# This is used to redirect stdout and stderr for checker processes
2991
wnull = open(os.devnull, "w") # A writable /dev/null
3218
wnull = open(os.devnull, "w") # A writable /dev/null
2992
3219
# Only used if server is running in foreground but not in debug
2994
3221
if debug or not foreground:
2997
3224
# Get client data and settings from last running state.
2998
3225
if server_settings["restore"]:
3000
3227
with open(stored_state_path, "rb") as stored_state:
3001
clients_data, old_client_settings = pickle.load(
3228
if sys.version_info.major == 2:
3229
clients_data, old_client_settings = pickle.load(
3232
bytes_clients_data, bytes_old_client_settings = (
3233
pickle.load(stored_state, encoding="bytes"))
3234
# Fix bytes to strings
3237
clients_data = {(key.decode("utf-8")
3238
if isinstance(key, bytes)
3241
bytes_clients_data.items()}
3242
del bytes_clients_data
3243
for key in clients_data:
3244
value = {(k.decode("utf-8")
3245
if isinstance(k, bytes) else k): v
3247
clients_data[key].items()}
3248
clients_data[key] = value
3250
value["client_structure"] = [
3252
if isinstance(s, bytes)
3254
value["client_structure"]]
3255
# .name, .host, and .checker_command
3256
for k in ("name", "host", "checker_command"):
3257
if isinstance(value[k], bytes):
3258
value[k] = value[k].decode("utf-8")
3259
if "key_id" not in value:
3260
value["key_id"] = ""
3261
elif "fingerprint" not in value:
3262
value["fingerprint"] = ""
3263
# old_client_settings
3265
old_client_settings = {
3266
(key.decode("utf-8")
3267
if isinstance(key, bytes)
3270
bytes_old_client_settings.items()}
3271
del bytes_old_client_settings
3272
# .host and .checker_command
3273
for value in old_client_settings.values():
3274
for attribute in ("host", "checker_command"):
3275
if isinstance(value[attribute], bytes):
3276
value[attribute] = (value[attribute]
3003
3278
os.remove(stored_state_path)
3004
3279
except IOError as e:
3005
3280
if e.errno == errno.ENOENT: