2
# -*- mode: python; coding: utf-8 -*-
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
17
# This file is part of Mandos.
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
32
# Contact the authors at <mandos@recompile.se>.
34
35
from __future__ import (division, absolute_import, print_function,
37
from future_builtins import *
39
from future_builtins import *
40
44
import SocketServer as socketserver
190
250
.replace(b"\n", b"\\n")
191
251
.replace(b"\0", b"\\x00"))
194
254
def encrypt(self, data, password):
195
255
passphrase = self.password_encode(password)
196
256
with tempfile.NamedTemporaryFile(
197
257
dir=self.tempdir) as passfile:
198
258
passfile.write(passphrase)
200
proc = subprocess.Popen(['gpg', '--symmetric',
260
proc = subprocess.Popen([self.gpg, '--symmetric',
201
261
'--passphrase-file',
203
263
+ self.gnupgargs,
204
stdin = subprocess.PIPE,
205
stdout = subprocess.PIPE,
206
stderr = subprocess.PIPE)
207
ciphertext, err = proc.communicate(input = data)
264
stdin=subprocess.PIPE,
265
stdout=subprocess.PIPE,
266
stderr=subprocess.PIPE)
267
ciphertext, err = proc.communicate(input=data)
208
268
if proc.returncode != 0:
209
269
raise PGPError(err)
210
270
return ciphertext
212
272
def decrypt(self, data, password):
213
273
passphrase = self.password_encode(password)
214
274
with tempfile.NamedTemporaryFile(
215
dir = self.tempdir) as passfile:
275
dir=self.tempdir) as passfile:
216
276
passfile.write(passphrase)
218
proc = subprocess.Popen(['gpg', '--decrypt',
278
proc = subprocess.Popen([self.gpg, '--decrypt',
219
279
'--passphrase-file',
221
281
+ self.gnupgargs,
222
stdin = subprocess.PIPE,
223
stdout = subprocess.PIPE,
224
stderr = subprocess.PIPE)
225
decrypted_plaintext, err = proc.communicate(input = data)
282
stdin=subprocess.PIPE,
283
stdout=subprocess.PIPE,
284
stderr=subprocess.PIPE)
285
decrypted_plaintext, err = proc.communicate(input=data)
226
286
if proc.returncode != 0:
227
287
raise PGPError(err)
228
288
return decrypted_plaintext
291
# Pretend that we have an Avahi module
293
"""This isn't so much a class as it is a module-like namespace."""
294
IF_UNSPEC = -1 # avahi-common/address.h
295
PROTO_UNSPEC = -1 # avahi-common/address.h
296
PROTO_INET = 0 # avahi-common/address.h
297
PROTO_INET6 = 1 # avahi-common/address.h
298
DBUS_NAME = "org.freedesktop.Avahi"
299
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
300
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
301
DBUS_PATH_SERVER = "/"
304
def string_array_to_txt_array(t):
305
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
306
for s in t), signature="ay")
307
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
308
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
309
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
310
SERVER_INVALID = 0 # avahi-common/defs.h
311
SERVER_REGISTERING = 1 # avahi-common/defs.h
312
SERVER_RUNNING = 2 # avahi-common/defs.h
313
SERVER_COLLISION = 3 # avahi-common/defs.h
314
SERVER_FAILURE = 4 # avahi-common/defs.h
231
317
class AvahiError(Exception):
232
318
def __init__(self, value, *args, **kwargs):
233
319
self.value = value
423
509
class AvahiServiceToSyslog(AvahiService):
424
510
def rename(self, *args, **kwargs):
425
511
"""Add the new name to the syslog messages"""
426
ret = AvahiService.rename(self, *args, **kwargs)
512
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
427
513
syslogger.setFormatter(logging.Formatter(
428
514
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
429
515
.format(self.name)))
432
519
# Pretend that we have a GnuTLS module
433
class GnuTLS(object):
434
"""This isn't so much a class as it is a module-like namespace.
435
It is instantiated once, and simulates having a GnuTLS module."""
437
_library = ctypes.cdll.LoadLibrary(
438
ctypes.util.find_library("gnutls"))
439
_need_version = "3.3.0"
441
# Need to use class name "GnuTLS" here, since this method is
442
# called before the assignment to the "gnutls" global variable
444
if GnuTLS.check_version(self._need_version) is None:
445
raise GnuTLS.Error("Needs GnuTLS {} or later"
446
.format(self._need_version))
521
"""This isn't so much a class as it is a module-like namespace."""
523
library = ctypes.util.find_library("gnutls")
525
library = ctypes.util.find_library("gnutls-deb0")
526
_library = ctypes.cdll.LoadLibrary(library)
448
529
# Unless otherwise indicated, the constants and types below are
449
530
# all from the gnutls/gnutls.h C header file.
453
534
E_INTERRUPTED = -52
458
540
CRD_CERTIFICATE = 1
459
541
E_NO_CERTIFICATE_FOUND = -49
546
KEYID_USE_SHA256 = 1 # gnutls/x509.h
460
547
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
463
550
class session_int(ctypes.Structure):
465
552
session_t = ctypes.POINTER(session_int)
466
554
class certificate_credentials_st(ctypes.Structure):
468
556
certificate_credentials_t = ctypes.POINTER(
469
557
certificate_credentials_st)
470
558
certificate_type_t = ctypes.c_int
471
560
class datum_t(ctypes.Structure):
472
561
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
473
562
('size', ctypes.c_uint)]
474
564
class openpgp_crt_int(ctypes.Structure):
476
566
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
477
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
567
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
478
568
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
479
credentials_type_t = ctypes.c_int #
569
credentials_type_t = ctypes.c_int
480
570
transport_ptr_t = ctypes.c_void_p
481
571
close_request_t = ctypes.c_int
484
574
class Error(Exception):
485
# We need to use the class name "GnuTLS" here, since this
486
# exception might be raised from within GnuTLS.__init__,
487
# which is called before the assignment to the "gnutls"
488
# global variable has happened.
489
def __init__(self, message = None, code = None, args=()):
575
def __init__(self, message=None, code=None, args=()):
490
576
# Default usage is by a message string, but if a return
491
577
# code is passed, convert it to a string with
492
578
# gnutls.strerror()
494
580
if message is None and code is not None:
495
message = GnuTLS.strerror(code)
496
return super(GnuTLS.Error, self).__init__(
581
message = gnutls.strerror(code)
582
return super(gnutls.Error, self).__init__(
499
585
class CertificateSecurityError(Error):
503
class Credentials(object):
504
590
def __init__(self):
505
591
self._c_object = gnutls.certificate_credentials_t()
506
592
gnutls.certificate_allocate_credentials(
507
593
ctypes.byref(self._c_object))
508
594
self.type = gnutls.CRD_CERTIFICATE
510
596
def __del__(self):
511
597
gnutls.certificate_free_credentials(self._c_object)
513
class ClientSession(object):
514
def __init__(self, socket, credentials = None):
600
def __init__(self, socket, credentials=None):
515
601
self._c_object = gnutls.session_t()
516
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
602
gnutls_flags = gnutls.CLIENT
603
if gnutls.check_version(b"3.5.6"):
604
gnutls_flags |= gnutls.NO_TICKETS
606
gnutls_flags |= gnutls.ENABLE_RAWPK
607
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
517
609
gnutls.set_default_priority(self._c_object)
518
610
gnutls.transport_set_ptr(self._c_object, socket.fileno())
519
611
gnutls.handshake_set_private_extensions(self._c_object,
561
653
return _error_code(result)
562
654
result = func(*arguments)
565
657
# Unless otherwise indicated, the function declarations below are
566
658
# all from the gnutls/gnutls.h C header file.
569
661
priority_set_direct = _library.gnutls_priority_set_direct
570
662
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
571
663
ctypes.POINTER(ctypes.c_char_p)]
572
664
priority_set_direct.restype = _error_code
574
666
init = _library.gnutls_init
575
667
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
576
668
init.restype = _error_code
578
670
set_default_priority = _library.gnutls_set_default_priority
579
671
set_default_priority.argtypes = [session_t]
580
672
set_default_priority.restype = _error_code
582
674
record_send = _library.gnutls_record_send
583
675
record_send.argtypes = [session_t, ctypes.c_void_p,
585
677
record_send.restype = ctypes.c_ssize_t
586
678
record_send.errcheck = _retry_on_error
588
680
certificate_allocate_credentials = (
589
681
_library.gnutls_certificate_allocate_credentials)
590
682
certificate_allocate_credentials.argtypes = [
591
683
ctypes.POINTER(certificate_credentials_t)]
592
684
certificate_allocate_credentials.restype = _error_code
594
686
certificate_free_credentials = (
595
687
_library.gnutls_certificate_free_credentials)
596
certificate_free_credentials.argtypes = [certificate_credentials_t]
688
certificate_free_credentials.argtypes = [
689
certificate_credentials_t]
597
690
certificate_free_credentials.restype = None
599
692
handshake_set_private_extensions = (
600
693
_library.gnutls_handshake_set_private_extensions)
601
694
handshake_set_private_extensions.argtypes = [session_t,
603
696
handshake_set_private_extensions.restype = None
605
698
credentials_set = _library.gnutls_credentials_set
606
699
credentials_set.argtypes = [session_t, credentials_type_t,
608
701
credentials_set.restype = _error_code
610
703
strerror = _library.gnutls_strerror
611
704
strerror.argtypes = [ctypes.c_int]
612
705
strerror.restype = ctypes.c_char_p
614
707
certificate_type_get = _library.gnutls_certificate_type_get
615
708
certificate_type_get.argtypes = [session_t]
616
709
certificate_type_get.restype = _error_code
618
711
certificate_get_peers = _library.gnutls_certificate_get_peers
619
712
certificate_get_peers.argtypes = [session_t,
620
713
ctypes.POINTER(ctypes.c_uint)]
621
714
certificate_get_peers.restype = ctypes.POINTER(datum_t)
623
716
global_set_log_level = _library.gnutls_global_set_log_level
624
717
global_set_log_level.argtypes = [ctypes.c_int]
625
718
global_set_log_level.restype = None
627
720
global_set_log_function = _library.gnutls_global_set_log_function
628
721
global_set_log_function.argtypes = [log_func]
629
722
global_set_log_function.restype = None
631
724
deinit = _library.gnutls_deinit
632
725
deinit.argtypes = [session_t]
633
726
deinit.restype = None
635
728
handshake = _library.gnutls_handshake
636
729
handshake.argtypes = [session_t]
637
730
handshake.restype = _error_code
638
731
handshake.errcheck = _retry_on_error
640
733
transport_set_ptr = _library.gnutls_transport_set_ptr
641
734
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
642
735
transport_set_ptr.restype = None
644
737
bye = _library.gnutls_bye
645
738
bye.argtypes = [session_t, close_request_t]
646
739
bye.restype = _error_code
647
740
bye.errcheck = _retry_on_error
649
742
check_version = _library.gnutls_check_version
650
743
check_version.argtypes = [ctypes.c_char_p]
651
744
check_version.restype = ctypes.c_char_p
653
# All the function declarations below are from gnutls/openpgp.h
655
openpgp_crt_init = _library.gnutls_openpgp_crt_init
656
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
657
openpgp_crt_init.restype = _error_code
659
openpgp_crt_import = _library.gnutls_openpgp_crt_import
660
openpgp_crt_import.argtypes = [openpgp_crt_t,
661
ctypes.POINTER(datum_t),
663
openpgp_crt_import.restype = _error_code
665
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
666
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
667
ctypes.POINTER(ctypes.c_uint)]
668
openpgp_crt_verify_self.restype = _error_code
670
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
671
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
672
openpgp_crt_deinit.restype = None
674
openpgp_crt_get_fingerprint = (
675
_library.gnutls_openpgp_crt_get_fingerprint)
676
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
680
openpgp_crt_get_fingerprint.restype = _error_code
746
_need_version = b"3.3.0"
747
if check_version(_need_version) is None:
748
raise self.Error("Needs GnuTLS {} or later"
749
.format(_need_version))
751
_tls_rawpk_version = b"3.6.6"
752
has_rawpk = bool(check_version(_tls_rawpk_version))
756
class pubkey_st(ctypes.Structure):
758
pubkey_t = ctypes.POINTER(pubkey_st)
760
x509_crt_fmt_t = ctypes.c_int
762
# All the function declarations below are from gnutls/abstract.h
763
pubkey_init = _library.gnutls_pubkey_init
764
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
765
pubkey_init.restype = _error_code
767
pubkey_import = _library.gnutls_pubkey_import
768
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
770
pubkey_import.restype = _error_code
772
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
773
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
774
ctypes.POINTER(ctypes.c_ubyte),
775
ctypes.POINTER(ctypes.c_size_t)]
776
pubkey_get_key_id.restype = _error_code
778
pubkey_deinit = _library.gnutls_pubkey_deinit
779
pubkey_deinit.argtypes = [pubkey_t]
780
pubkey_deinit.restype = None
782
# All the function declarations below are from gnutls/openpgp.h
784
openpgp_crt_init = _library.gnutls_openpgp_crt_init
785
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
786
openpgp_crt_init.restype = _error_code
788
openpgp_crt_import = _library.gnutls_openpgp_crt_import
789
openpgp_crt_import.argtypes = [openpgp_crt_t,
790
ctypes.POINTER(datum_t),
792
openpgp_crt_import.restype = _error_code
794
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
795
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
796
ctypes.POINTER(ctypes.c_uint)]
797
openpgp_crt_verify_self.restype = _error_code
799
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
800
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
801
openpgp_crt_deinit.restype = None
803
openpgp_crt_get_fingerprint = (
804
_library.gnutls_openpgp_crt_get_fingerprint)
805
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
809
openpgp_crt_get_fingerprint.restype = _error_code
811
if check_version(b"3.6.4"):
812
certificate_type_get2 = _library.gnutls_certificate_type_get2
813
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
814
certificate_type_get2.restype = _error_code
682
816
# Remove non-public functions
683
817
del _error_code, _retry_on_error
684
# Create the global "gnutls" object, simulating a module
687
820
def call_pipe(connection, # : multiprocessing.Connection
688
821
func, *args, **kwargs):
689
822
"""This function is meant to be called by multiprocessing.Process
691
824
This function runs func(*args, **kwargs), and writes the resulting
692
825
return value on the provided multiprocessing.Connection.
694
827
connection.send(func(*args, **kwargs))
695
828
connection.close()
697
class Client(object):
698
832
"""A representation of a client host served by this server.
701
835
approved: bool(); 'None' if not yet approved/disapproved
702
836
approval_delay: datetime.timedelta(); Time to wait for approval
703
837
approval_duration: datetime.timedelta(); Duration of one approval
704
checker: subprocess.Popen(); a running checker process used
705
to see if the client lives.
706
'None' if no process is running.
707
checker_callback_tag: a gobject event source tag, or None
838
checker: multiprocessing.Process(); a running checker process used
839
to see if the client lives. 'None' if no process is
841
checker_callback_tag: a GLib event source tag, or None
708
842
checker_command: string; External command which is run to check
709
843
if client lives. %() expansions are done at
710
844
runtime with vars(self) as dict, so that for
711
845
instance %(name)s can be used in the command.
712
checker_initiator_tag: a gobject event source tag, or None
846
checker_initiator_tag: a GLib event source tag, or None
713
847
created: datetime.datetime(); (UTC) object creation
714
848
client_structure: Object describing what attributes a client has
715
849
and is used for storing the client at exit
716
850
current_checker_command: string; current running checker_command
717
disable_initiator_tag: a gobject event source tag, or None
851
disable_initiator_tag: a GLib event source tag, or None
719
853
fingerprint: string (40 or 32 hexadecimal digits); used to
720
uniquely identify the client
854
uniquely identify an OpenPGP client
855
key_id: string (64 hexadecimal digits); used to uniquely identify
856
a client using raw public keys
721
857
host: string; available for use by the checker command
722
858
interval: datetime.timedelta(); How often to start a new checker
723
859
last_approval_request: datetime.datetime(); (UTC) or None
875
1016
logger.info("Disabling client %s", self.name)
876
1017
if getattr(self, "disable_initiator_tag", None) is not None:
877
gobject.source_remove(self.disable_initiator_tag)
1018
GLib.source_remove(self.disable_initiator_tag)
878
1019
self.disable_initiator_tag = None
879
1020
self.expires = None
880
1021
if getattr(self, "checker_initiator_tag", None) is not None:
881
gobject.source_remove(self.checker_initiator_tag)
1022
GLib.source_remove(self.checker_initiator_tag)
882
1023
self.checker_initiator_tag = None
883
1024
self.stop_checker()
884
1025
self.enabled = False
886
1027
self.send_changedstate()
887
# Do not run this again if called by a gobject.timeout_add
1028
# Do not run this again if called by a GLib.timeout_add
890
1031
def __del__(self):
893
1034
def init_checker(self):
894
1035
# Schedule a new checker to be started an 'interval' from now,
895
1036
# and every interval from then on.
896
1037
if self.checker_initiator_tag is not None:
897
gobject.source_remove(self.checker_initiator_tag)
898
self.checker_initiator_tag = gobject.timeout_add(
1038
GLib.source_remove(self.checker_initiator_tag)
1039
self.checker_initiator_tag = GLib.timeout_add(
899
1040
int(self.interval.total_seconds() * 1000),
900
1041
self.start_checker)
901
1042
# Schedule a disable() when 'timeout' has passed
902
1043
if self.disable_initiator_tag is not None:
903
gobject.source_remove(self.disable_initiator_tag)
904
self.disable_initiator_tag = gobject.timeout_add(
1044
GLib.source_remove(self.disable_initiator_tag)
1045
self.disable_initiator_tag = GLib.timeout_add(
905
1046
int(self.timeout.total_seconds() * 1000), self.disable)
906
1047
# Also start a new checker *right now*.
907
1048
self.start_checker()
909
1050
def checker_callback(self, source, condition, connection,
911
1052
"""The checker has completed, so take appropriate actions."""
912
self.checker_callback_tag = None
914
1053
# Read return code from connection (see call_pipe)
915
1054
returncode = connection.recv()
916
1055
connection.close()
1056
if self.checker is not None:
1058
self.checker_callback_tag = None
918
1061
if returncode >= 0:
919
1062
self.last_checker_status = returncode
920
1063
self.last_checker_signal = None
1376
1520
exc_info=error)
1377
1521
return xmlstring
1380
1525
dbus.OBJECT_MANAGER_IFACE
1381
1526
except AttributeError:
1382
1527
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1384
1530
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1385
1531
"""A D-Bus object with an ObjectManager.
1387
1533
Classes inheriting from this exposes the standard
1388
1534
GetManagedObjects call and the InterfacesAdded and
1389
1535
InterfacesRemoved signals on the standard
1390
1536
"org.freedesktop.DBus.ObjectManager" interface.
1392
1538
Note: No signals are sent automatically; they must be sent
1395
1541
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1396
out_signature = "a{oa{sa{sv}}}")
1542
out_signature="a{oa{sa{sv}}}")
1397
1543
def GetManagedObjects(self):
1398
1544
"""This function must be overridden"""
1399
1545
raise NotImplementedError()
1401
1547
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1402
signature = "oa{sa{sv}}")
1548
signature="oa{sa{sv}}")
1403
1549
def InterfacesAdded(self, object_path, interfaces_and_properties):
1406
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1552
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1407
1553
def InterfacesRemoved(self, object_path, interfaces):
1410
1556
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1411
out_signature = "s",
1412
path_keyword = 'object_path',
1413
connection_keyword = 'connection')
1558
path_keyword='object_path',
1559
connection_keyword='connection')
1414
1560
def Introspect(self, object_path, connection):
1415
1561
"""Overloading of standard D-Bus method.
1417
1563
Override return argument name of GetManagedObjects to be
1418
1564
"objpath_interfaces_and_properties"
2312
class MultiprocessingMixIn(object):
2507
class MultiprocessingMixIn:
2313
2508
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2315
2510
def sub_process_main(self, request, address):
2317
2512
self.finish_request(request, address)
2318
2513
except Exception:
2319
2514
self.handle_error(request, address)
2320
2515
self.close_request(request)
2322
2517
def process_request(self, request, address):
2323
2518
"""Start a new process to process the request."""
2324
proc = multiprocessing.Process(target = self.sub_process_main,
2325
args = (request, address))
2519
proc = multiprocessing.Process(target=self.sub_process_main,
2520
args=(request, address))
2330
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2525
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2331
2526
""" adds a pipe to the MixIn """
2333
2528
def process_request(self, request, client_address):
2334
2529
"""Overrides and wraps the original process_request().
2336
2531
This function creates a new pipe in self.pipe
2338
2533
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2340
2535
proc = MultiprocessingMixIn.process_request(self, request,
2341
2536
client_address)
2342
2537
self.child_pipe.close()
2343
2538
self.add_pipe(parent_pipe, proc)
2345
2540
def add_pipe(self, parent_pipe, proc):
2346
2541
"""Dummy function; override as necessary"""
2347
2542
raise NotImplementedError()
2350
2545
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2351
socketserver.TCPServer, object):
2546
socketserver.TCPServer):
2352
2547
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2355
2550
enabled: Boolean; whether this server is activated yet
2356
2551
interface: None or a network interface name (string)
2357
2552
use_ipv6: Boolean; to use IPv6 or not
2360
2555
def __init__(self, server_address, RequestHandlerClass,
2361
2556
interface=None,
2395
2591
# socket_wrapper(), if socketfd was set.
2396
2592
socketserver.TCPServer.__init__(self, server_address,
2397
2593
RequestHandlerClass)
2399
2595
def server_bind(self):
2400
2596
"""This overrides the normal server_bind() function
2401
2597
to bind to an interface if one was specified, and also NOT to
2402
2598
bind to an address or port if they were not specified."""
2599
global SO_BINDTODEVICE
2403
2600
if self.interface is not None:
2404
2601
if SO_BINDTODEVICE is None:
2405
logger.error("SO_BINDTODEVICE does not exist;"
2406
" cannot bind to interface %s",
2410
self.socket.setsockopt(
2411
socket.SOL_SOCKET, SO_BINDTODEVICE,
2412
(self.interface + "\0").encode("utf-8"))
2413
except socket.error as error:
2414
if error.errno == errno.EPERM:
2415
logger.error("No permission to bind to"
2416
" interface %s", self.interface)
2417
elif error.errno == errno.ENOPROTOOPT:
2418
logger.error("SO_BINDTODEVICE not available;"
2419
" cannot bind to interface %s",
2421
elif error.errno == errno.ENODEV:
2422
logger.error("Interface %s does not exist,"
2423
" cannot bind", self.interface)
2602
# Fall back to a hard-coded value which seems to be
2604
logger.warning("SO_BINDTODEVICE not found, trying 25")
2605
SO_BINDTODEVICE = 25
2607
self.socket.setsockopt(
2608
socket.SOL_SOCKET, SO_BINDTODEVICE,
2609
(self.interface + "\0").encode("utf-8"))
2610
except socket.error as error:
2611
if error.errno == errno.EPERM:
2612
logger.error("No permission to bind to"
2613
" interface %s", self.interface)
2614
elif error.errno == errno.ENOPROTOOPT:
2615
logger.error("SO_BINDTODEVICE not available;"
2616
" cannot bind to interface %s",
2618
elif error.errno == errno.ENODEV:
2619
logger.error("Interface %s does not exist,"
2620
" cannot bind", self.interface)
2426
2623
# Only bind(2) the socket if we really need to.
2427
2624
if self.server_address[0] or self.server_address[1]:
2625
if self.server_address[1]:
2626
self.allow_reuse_address = True
2428
2627
if not self.server_address[0]:
2429
2628
if self.address_family == socket.AF_INET6:
2430
any_address = "::" # in6addr_any
2629
any_address = "::" # in6addr_any
2432
any_address = "0.0.0.0" # INADDR_ANY
2631
any_address = "0.0.0.0" # INADDR_ANY
2433
2632
self.server_address = (any_address,
2434
2633
self.server_address[1])
2435
2634
elif not self.server_address[1]:
2469
2668
self.gnutls_priority = gnutls_priority
2470
2669
IPv6_TCPServer.__init__(self, server_address,
2471
2670
RequestHandlerClass,
2472
interface = interface,
2473
use_ipv6 = use_ipv6,
2474
socketfd = socketfd)
2671
interface=interface,
2476
2675
def server_activate(self):
2477
2676
if self.enabled:
2478
2677
return socketserver.TCPServer.server_activate(self)
2480
2679
def enable(self):
2481
2680
self.enabled = True
2483
2682
def add_pipe(self, parent_pipe, proc):
2484
2683
# Call "handle_ipc" for both data and EOF events
2485
gobject.io_add_watch(
2486
parent_pipe.fileno(),
2487
gobject.IO_IN | gobject.IO_HUP,
2685
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2686
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2488
2687
functools.partial(self.handle_ipc,
2489
parent_pipe = parent_pipe,
2688
parent_pipe=parent_pipe,
2492
2691
def handle_ipc(self, source, condition,
2493
2692
parent_pipe=None,
2495
2694
client_object=None):
2496
2695
# error, or the other end of multiprocessing.Pipe has closed
2497
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2696
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2498
2697
# Wait for other process to exit
2502
2701
# Read a request from the child
2503
2702
request = parent_pipe.recv()
2504
2703
command = request[0]
2506
2705
if command == 'init':
2508
address = request[2]
2510
for c in self.clients.itervalues():
2511
if c.fingerprint == fpr:
2706
key_id = request[1].decode("ascii")
2707
fpr = request[2].decode("ascii")
2708
address = request[3]
2710
for c in self.clients.values():
2711
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2713
if key_id and c.key_id == key_id:
2716
if fpr and c.fingerprint == fpr:
2515
logger.info("Client not found for fingerprint: %s, ad"
2516
"dress: %s", fpr, address)
2720
logger.info("Client not found for key ID: %s, address"
2721
": %s", key_id or fpr, address)
2517
2722
if self.use_dbus:
2518
2723
# Emit D-Bus signal
2519
mandos_dbus_service.ClientNotFound(fpr,
2724
mandos_dbus_service.ClientNotFound(key_id or fpr,
2521
2726
parent_pipe.send(False)
2524
gobject.io_add_watch(
2525
parent_pipe.fileno(),
2526
gobject.IO_IN | gobject.IO_HUP,
2730
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2731
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2527
2732
functools.partial(self.handle_ipc,
2528
parent_pipe = parent_pipe,
2530
client_object = client))
2733
parent_pipe=parent_pipe,
2735
client_object=client))
2531
2736
parent_pipe.send(True)
2532
2737
# remove the old hook in favor of the new above hook on
2550
2755
parent_pipe.send((
2551
2756
'data', client_object.__getattribute__(attrname)))
2553
2758
if command == 'setattr':
2554
2759
attrname = request[1]
2555
2760
value = request[2]
2556
2761
setattr(client_object, attrname, value)
2561
2766
def rfc3339_duration_to_delta(duration):
2562
2767
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2564
>>> rfc3339_duration_to_delta("P7D")
2565
datetime.timedelta(7)
2566
>>> rfc3339_duration_to_delta("PT60S")
2567
datetime.timedelta(0, 60)
2568
>>> rfc3339_duration_to_delta("PT60M")
2569
datetime.timedelta(0, 3600)
2570
>>> rfc3339_duration_to_delta("PT24H")
2571
datetime.timedelta(1)
2572
>>> rfc3339_duration_to_delta("P1W")
2573
datetime.timedelta(7)
2574
>>> rfc3339_duration_to_delta("PT5M30S")
2575
datetime.timedelta(0, 330)
2576
>>> rfc3339_duration_to_delta("P1DT3M20S")
2577
datetime.timedelta(1, 200)
2769
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2771
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2773
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2775
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2777
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2779
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2781
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2580
2785
# Parsing an RFC 3339 duration with regular expressions is not
2581
2786
# possible - there would have to be multiple places for the same
2582
2787
# values, like seconds. The current code, while more esoteric, is
2583
2788
# cleaner without depending on a parsing library. If Python had a
2584
2789
# built-in library for parsing we would use it, but we'd like to
2585
2790
# avoid excessive use of external libraries.
2587
2792
# New type for defining tokens, syntax, and semantics all-in-one
2588
2793
Token = collections.namedtuple("Token", (
2589
2794
"regexp", # To match token; if "value" is not None, must have
2773
2981
parser.add_argument("--no-zeroconf", action="store_false",
2774
2982
dest="zeroconf", help="Do not use Zeroconf",
2777
2985
options = parser.parse_args()
2781
fail_count, test_count = doctest.testmod()
2782
sys.exit(os.EX_OK if fail_count == 0 else 1)
2784
2987
# Default values for config file for server-global settings
2785
server_defaults = { "interface": "",
2790
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2791
":+SIGN-DSA-SHA256",
2792
"servicename": "Mandos",
2798
"statedir": "/var/lib/mandos",
2799
"foreground": "False",
2988
if gnutls.has_rawpk:
2989
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2990
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2992
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2993
":+SIGN-DSA-SHA256")
2994
server_defaults = {"interface": "",
2998
"priority": priority,
2999
"servicename": "Mandos",
3005
"statedir": "/var/lib/mandos",
3006
"foreground": "False",
2803
3011
# Parse config file for server-global settings
2804
server_config = configparser.SafeConfigParser(server_defaults)
3012
server_config = configparser.ConfigParser(server_defaults)
2805
3013
del server_defaults
2806
3014
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2807
# Convert the SafeConfigParser object to a dict
3015
# Convert the ConfigParser object to a dict
2808
3016
server_settings = server_config.defaults()
2809
3017
# Use the appropriate methods on the non-string config options
2810
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3018
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3019
"foreground", "zeroconf"):
2811
3020
server_settings[option] = server_config.getboolean("DEFAULT",
2813
3022
if server_settings["port"]:
2979
3195
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2980
3196
service = AvahiServiceToSyslog(
2981
name = server_settings["servicename"],
2982
servicetype = "_mandos._tcp",
2983
protocol = protocol,
3197
name=server_settings["servicename"],
3198
servicetype="_mandos._tcp",
2985
3201
if server_settings["interface"]:
2986
3202
service.interface = if_nametoindex(
2987
3203
server_settings["interface"].encode("utf-8"))
2989
3205
global multiprocessing_manager
2990
3206
multiprocessing_manager = multiprocessing.Manager()
2992
3208
client_class = Client
2994
client_class = functools.partial(ClientDBus, bus = bus)
3210
client_class = functools.partial(ClientDBus, bus=bus)
2996
3212
client_settings = Client.config_parser(client_config)
2997
3213
old_client_settings = {}
2998
3214
clients_data = {}
3000
3216
# This is used to redirect stdout and stderr for checker processes
3002
wnull = open(os.devnull, "w") # A writable /dev/null
3218
wnull = open(os.devnull, "w") # A writable /dev/null
3003
3219
# Only used if server is running in foreground but not in debug
3005
3221
if debug or not foreground:
3008
3224
# Get client data and settings from last running state.
3009
3225
if server_settings["restore"]:
3011
3227
with open(stored_state_path, "rb") as stored_state:
3012
clients_data, old_client_settings = pickle.load(
3228
if sys.version_info.major == 2:
3229
clients_data, old_client_settings = pickle.load(
3232
bytes_clients_data, bytes_old_client_settings = (
3233
pickle.load(stored_state, encoding="bytes"))
3234
# Fix bytes to strings
3237
clients_data = {(key.decode("utf-8")
3238
if isinstance(key, bytes)
3241
bytes_clients_data.items()}
3242
del bytes_clients_data
3243
for key in clients_data:
3244
value = {(k.decode("utf-8")
3245
if isinstance(k, bytes) else k): v
3247
clients_data[key].items()}
3248
clients_data[key] = value
3250
value["client_structure"] = [
3252
if isinstance(s, bytes)
3254
value["client_structure"]]
3255
# .name, .host, and .checker_command
3256
for k in ("name", "host", "checker_command"):
3257
if isinstance(value[k], bytes):
3258
value[k] = value[k].decode("utf-8")
3259
if "key_id" not in value:
3260
value["key_id"] = ""
3261
elif "fingerprint" not in value:
3262
value["fingerprint"] = ""
3263
# old_client_settings
3265
old_client_settings = {
3266
(key.decode("utf-8")
3267
if isinstance(key, bytes)
3270
bytes_old_client_settings.items()}
3271
del bytes_old_client_settings
3272
# .host and .checker_command
3273
for value in old_client_settings.values():
3274
for attribute in ("host", "checker_command"):
3275
if isinstance(value[attribute], bytes):
3276
value[attribute] = (value[attribute]
3014
3278
os.remove(stored_state_path)
3015
3279
except IOError as e:
3016
3280
if e.errno == errno.ENOENT:
3116
3380
pidfilename, pid)
3118
3382
del pidfilename
3120
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3121
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3384
for termsig in (signal.SIGHUP, signal.SIGTERM):
3385
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3386
lambda: main_loop.quit() and False)
3125
3390
@alternate_dbus_interfaces(
3126
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3391
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3127
3392
class MandosDBusService(DBusObjectWithObjectManager):
3128
3393
"""A D-Bus proxy object"""
3130
3395
def __init__(self):
3131
3396
dbus.service.Object.__init__(self, bus, "/")
3133
3398
_interface = "se.recompile.Mandos"
3135
3400
@dbus.service.signal(_interface, signature="o")
3136
3401
def ClientAdded(self, objpath):
3140
3405
@dbus.service.signal(_interface, signature="ss")
3141
def ClientNotFound(self, fingerprint, address):
3406
def ClientNotFound(self, key_id, address):
3145
3410
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3147
3412
@dbus.service.signal(_interface, signature="os")
3148
3413
def ClientRemoved(self, objpath, name):
3152
3417
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3154
3419
@dbus.service.method(_interface, out_signature="ao")
3155
3420
def GetAllClients(self):
3157
3422
return dbus.Array(c.dbus_object_path for c in
3158
tcp_server.clients.itervalues())
3423
tcp_server.clients.values())
3160
3425
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3162
3427
@dbus.service.method(_interface,