2
# -*- mode: python; coding: utf-8 -*-
2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
17
# This file is part of Mandos.
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
32
# Contact the authors at <mandos@recompile.se>.
34
35
from __future__ import (division, absolute_import, print_function,
86
89
import xml.dom.minidom
92
if sys.version_info.major == 2:
96
# Show warnings by default
97
if not sys.warnoptions:
99
warnings.simplefilter("default")
101
# Try to find the value of SO_BINDTODEVICE:
103
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
104
# newer, and it is also the most natural place for it:
90
105
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
91
106
except AttributeError:
108
# This is where SO_BINDTODEVICE was up to and including Python
93
110
from IN import SO_BINDTODEVICE
94
111
except ImportError:
95
SO_BINDTODEVICE = None
97
if sys.version_info.major == 2:
112
# In Python 2.7 it seems to have been removed entirely.
113
# Try running the C preprocessor:
115
cc = subprocess.Popen(["cc", "--language=c", "-E",
117
stdin=subprocess.PIPE,
118
stdout=subprocess.PIPE)
119
stdout = cc.communicate(
120
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
121
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
122
except (OSError, ValueError, IndexError):
124
SO_BINDTODEVICE = None
126
if sys.version_info < (3, 2):
127
configparser.Configparser = configparser.SafeConfigParser
101
130
stored_state_file = "clients.pickle"
103
132
logger = logging.getLogger()
133
logging.captureWarnings(True) # Show warnings via the logging system
107
137
if_nametoindex = ctypes.cdll.LoadLibrary(
108
138
ctypes.util.find_library("c")).if_nametoindex
109
139
except (OSError, AttributeError):
111
141
def if_nametoindex(interface):
112
142
"Get an interface index the hard way, i.e. using fcntl()"
113
143
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
227
259
'--passphrase-file',
229
261
+ self.gnupgargs,
230
stdin = subprocess.PIPE,
231
stdout = subprocess.PIPE,
232
stderr = subprocess.PIPE)
233
ciphertext, err = proc.communicate(input = data)
262
stdin=subprocess.PIPE,
263
stdout=subprocess.PIPE,
264
stderr=subprocess.PIPE)
265
ciphertext, err = proc.communicate(input=data)
234
266
if proc.returncode != 0:
235
267
raise PGPError(err)
236
268
return ciphertext
238
270
def decrypt(self, data, password):
239
271
passphrase = self.password_encode(password)
240
272
with tempfile.NamedTemporaryFile(
241
dir = self.tempdir) as passfile:
273
dir=self.tempdir) as passfile:
242
274
passfile.write(passphrase)
244
276
proc = subprocess.Popen([self.gpg, '--decrypt',
245
277
'--passphrase-file',
247
279
+ self.gnupgargs,
248
stdin = subprocess.PIPE,
249
stdout = subprocess.PIPE,
250
stderr = subprocess.PIPE)
251
decrypted_plaintext, err = proc.communicate(input = data)
280
stdin=subprocess.PIPE,
281
stdout=subprocess.PIPE,
282
stderr=subprocess.PIPE)
283
decrypted_plaintext, err = proc.communicate(input=data)
252
284
if proc.returncode != 0:
253
285
raise PGPError(err)
254
286
return decrypted_plaintext
256
289
# Pretend that we have an Avahi module
258
"""This isn't so much a class as it is a module-like namespace.
259
It is instantiated once, and simulates having an Avahi module."""
260
IF_UNSPEC = -1 # avahi-common/address.h
261
PROTO_UNSPEC = -1 # avahi-common/address.h
262
PROTO_INET = 0 # avahi-common/address.h
263
PROTO_INET6 = 1 # avahi-common/address.h
291
"""This isn't so much a class as it is a module-like namespace."""
292
IF_UNSPEC = -1 # avahi-common/address.h
293
PROTO_UNSPEC = -1 # avahi-common/address.h
294
PROTO_INET = 0 # avahi-common/address.h
295
PROTO_INET6 = 1 # avahi-common/address.h
264
296
DBUS_NAME = "org.freedesktop.Avahi"
265
297
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
266
298
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
267
299
DBUS_PATH_SERVER = "/"
268
def string_array_to_txt_array(self, t):
302
def string_array_to_txt_array(t):
269
303
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
270
304
for s in t), signature="ay")
271
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
272
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
273
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
274
SERVER_INVALID = 0 # avahi-common/defs.h
275
SERVER_REGISTERING = 1 # avahi-common/defs.h
276
SERVER_RUNNING = 2 # avahi-common/defs.h
277
SERVER_COLLISION = 3 # avahi-common/defs.h
278
SERVER_FAILURE = 4 # avahi-common/defs.h
305
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
306
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
307
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
308
SERVER_INVALID = 0 # avahi-common/defs.h
309
SERVER_REGISTERING = 1 # avahi-common/defs.h
310
SERVER_RUNNING = 2 # avahi-common/defs.h
311
SERVER_COLLISION = 3 # avahi-common/defs.h
312
SERVER_FAILURE = 4 # avahi-common/defs.h
281
315
class AvahiError(Exception):
282
316
def __init__(self, value, *args, **kwargs):
473
507
class AvahiServiceToSyslog(AvahiService):
474
508
def rename(self, *args, **kwargs):
475
509
"""Add the new name to the syslog messages"""
476
ret = AvahiService.rename(self, *args, **kwargs)
510
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
477
511
syslogger.setFormatter(logging.Formatter(
478
512
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
479
513
.format(self.name)))
482
517
# Pretend that we have a GnuTLS module
483
class GnuTLS(object):
484
"""This isn't so much a class as it is a module-like namespace.
485
It is instantiated once, and simulates having a GnuTLS module."""
487
_library = ctypes.cdll.LoadLibrary(
488
ctypes.util.find_library("gnutls"))
489
_need_version = b"3.3.0"
491
# Need to use class name "GnuTLS" here, since this method is
492
# called before the assignment to the "gnutls" global variable
494
if GnuTLS.check_version(self._need_version) is None:
495
raise GnuTLS.Error("Needs GnuTLS {} or later"
496
.format(self._need_version))
519
"""This isn't so much a class as it is a module-like namespace."""
521
library = ctypes.util.find_library("gnutls")
523
library = ctypes.util.find_library("gnutls-deb0")
524
_library = ctypes.cdll.LoadLibrary(library)
498
527
# Unless otherwise indicated, the constants and types below are
499
528
# all from the gnutls/gnutls.h C header file.
503
532
E_INTERRUPTED = -52
508
538
CRD_CERTIFICATE = 1
509
539
E_NO_CERTIFICATE_FOUND = -49
544
KEYID_USE_SHA256 = 1 # gnutls/x509.h
510
545
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
513
548
class session_int(ctypes.Structure):
515
550
session_t = ctypes.POINTER(session_int)
516
552
class certificate_credentials_st(ctypes.Structure):
518
554
certificate_credentials_t = ctypes.POINTER(
519
555
certificate_credentials_st)
520
556
certificate_type_t = ctypes.c_int
521
558
class datum_t(ctypes.Structure):
522
559
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
523
560
('size', ctypes.c_uint)]
524
562
class openpgp_crt_int(ctypes.Structure):
526
564
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
527
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
565
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
528
566
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
529
567
credentials_type_t = ctypes.c_int
530
568
transport_ptr_t = ctypes.c_void_p
531
569
close_request_t = ctypes.c_int
534
572
class Error(Exception):
535
# We need to use the class name "GnuTLS" here, since this
536
# exception might be raised from within GnuTLS.__init__,
537
# which is called before the assignment to the "gnutls"
538
# global variable has happened.
539
def __init__(self, message = None, code = None, args=()):
573
def __init__(self, message=None, code=None, args=()):
540
574
# Default usage is by a message string, but if a return
541
575
# code is passed, convert it to a string with
542
576
# gnutls.strerror()
544
578
if message is None and code is not None:
545
message = GnuTLS.strerror(code)
546
return super(GnuTLS.Error, self).__init__(
579
message = gnutls.strerror(code)
580
return super(gnutls.Error, self).__init__(
549
583
class CertificateSecurityError(Error):
553
class Credentials(object):
554
588
def __init__(self):
555
589
self._c_object = gnutls.certificate_credentials_t()
556
590
gnutls.certificate_allocate_credentials(
557
591
ctypes.byref(self._c_object))
558
592
self.type = gnutls.CRD_CERTIFICATE
560
594
def __del__(self):
561
595
gnutls.certificate_free_credentials(self._c_object)
563
class ClientSession(object):
564
def __init__(self, socket, credentials = None):
598
def __init__(self, socket, credentials=None):
565
599
self._c_object = gnutls.session_t()
566
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
600
gnutls_flags = gnutls.CLIENT
601
if gnutls.check_version(b"3.5.6"):
602
gnutls_flags |= gnutls.NO_TICKETS
604
gnutls_flags |= gnutls.ENABLE_RAWPK
605
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
567
607
gnutls.set_default_priority(self._c_object)
568
608
gnutls.transport_set_ptr(self._c_object, socket.fileno())
569
609
gnutls.handshake_set_private_extensions(self._c_object,
611
651
return _error_code(result)
612
652
result = func(*arguments)
615
655
# Unless otherwise indicated, the function declarations below are
616
656
# all from the gnutls/gnutls.h C header file.
619
659
priority_set_direct = _library.gnutls_priority_set_direct
620
660
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
621
661
ctypes.POINTER(ctypes.c_char_p)]
622
662
priority_set_direct.restype = _error_code
624
664
init = _library.gnutls_init
625
665
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
626
666
init.restype = _error_code
628
668
set_default_priority = _library.gnutls_set_default_priority
629
669
set_default_priority.argtypes = [session_t]
630
670
set_default_priority.restype = _error_code
632
672
record_send = _library.gnutls_record_send
633
673
record_send.argtypes = [session_t, ctypes.c_void_p,
635
675
record_send.restype = ctypes.c_ssize_t
636
676
record_send.errcheck = _retry_on_error
638
678
certificate_allocate_credentials = (
639
679
_library.gnutls_certificate_allocate_credentials)
640
680
certificate_allocate_credentials.argtypes = [
641
681
ctypes.POINTER(certificate_credentials_t)]
642
682
certificate_allocate_credentials.restype = _error_code
644
684
certificate_free_credentials = (
645
685
_library.gnutls_certificate_free_credentials)
646
certificate_free_credentials.argtypes = [certificate_credentials_t]
686
certificate_free_credentials.argtypes = [
687
certificate_credentials_t]
647
688
certificate_free_credentials.restype = None
649
690
handshake_set_private_extensions = (
650
691
_library.gnutls_handshake_set_private_extensions)
651
692
handshake_set_private_extensions.argtypes = [session_t,
653
694
handshake_set_private_extensions.restype = None
655
696
credentials_set = _library.gnutls_credentials_set
656
697
credentials_set.argtypes = [session_t, credentials_type_t,
658
699
credentials_set.restype = _error_code
660
701
strerror = _library.gnutls_strerror
661
702
strerror.argtypes = [ctypes.c_int]
662
703
strerror.restype = ctypes.c_char_p
664
705
certificate_type_get = _library.gnutls_certificate_type_get
665
706
certificate_type_get.argtypes = [session_t]
666
707
certificate_type_get.restype = _error_code
668
709
certificate_get_peers = _library.gnutls_certificate_get_peers
669
710
certificate_get_peers.argtypes = [session_t,
670
711
ctypes.POINTER(ctypes.c_uint)]
671
712
certificate_get_peers.restype = ctypes.POINTER(datum_t)
673
714
global_set_log_level = _library.gnutls_global_set_log_level
674
715
global_set_log_level.argtypes = [ctypes.c_int]
675
716
global_set_log_level.restype = None
677
718
global_set_log_function = _library.gnutls_global_set_log_function
678
719
global_set_log_function.argtypes = [log_func]
679
720
global_set_log_function.restype = None
681
722
deinit = _library.gnutls_deinit
682
723
deinit.argtypes = [session_t]
683
724
deinit.restype = None
685
726
handshake = _library.gnutls_handshake
686
727
handshake.argtypes = [session_t]
687
728
handshake.restype = _error_code
688
729
handshake.errcheck = _retry_on_error
690
731
transport_set_ptr = _library.gnutls_transport_set_ptr
691
732
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
692
733
transport_set_ptr.restype = None
694
735
bye = _library.gnutls_bye
695
736
bye.argtypes = [session_t, close_request_t]
696
737
bye.restype = _error_code
697
738
bye.errcheck = _retry_on_error
699
740
check_version = _library.gnutls_check_version
700
741
check_version.argtypes = [ctypes.c_char_p]
701
742
check_version.restype = ctypes.c_char_p
703
# All the function declarations below are from gnutls/openpgp.h
705
openpgp_crt_init = _library.gnutls_openpgp_crt_init
706
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
707
openpgp_crt_init.restype = _error_code
709
openpgp_crt_import = _library.gnutls_openpgp_crt_import
710
openpgp_crt_import.argtypes = [openpgp_crt_t,
711
ctypes.POINTER(datum_t),
713
openpgp_crt_import.restype = _error_code
715
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
716
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
717
ctypes.POINTER(ctypes.c_uint)]
718
openpgp_crt_verify_self.restype = _error_code
720
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
721
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
722
openpgp_crt_deinit.restype = None
724
openpgp_crt_get_fingerprint = (
725
_library.gnutls_openpgp_crt_get_fingerprint)
726
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
730
openpgp_crt_get_fingerprint.restype = _error_code
744
_need_version = b"3.3.0"
745
if check_version(_need_version) is None:
746
raise self.Error("Needs GnuTLS {} or later"
747
.format(_need_version))
749
_tls_rawpk_version = b"3.6.6"
750
has_rawpk = bool(check_version(_tls_rawpk_version))
754
class pubkey_st(ctypes.Structure):
756
pubkey_t = ctypes.POINTER(pubkey_st)
758
x509_crt_fmt_t = ctypes.c_int
760
# All the function declarations below are from gnutls/abstract.h
761
pubkey_init = _library.gnutls_pubkey_init
762
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
763
pubkey_init.restype = _error_code
765
pubkey_import = _library.gnutls_pubkey_import
766
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
768
pubkey_import.restype = _error_code
770
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
771
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
772
ctypes.POINTER(ctypes.c_ubyte),
773
ctypes.POINTER(ctypes.c_size_t)]
774
pubkey_get_key_id.restype = _error_code
776
pubkey_deinit = _library.gnutls_pubkey_deinit
777
pubkey_deinit.argtypes = [pubkey_t]
778
pubkey_deinit.restype = None
780
# All the function declarations below are from gnutls/openpgp.h
782
openpgp_crt_init = _library.gnutls_openpgp_crt_init
783
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
784
openpgp_crt_init.restype = _error_code
786
openpgp_crt_import = _library.gnutls_openpgp_crt_import
787
openpgp_crt_import.argtypes = [openpgp_crt_t,
788
ctypes.POINTER(datum_t),
790
openpgp_crt_import.restype = _error_code
792
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
793
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
794
ctypes.POINTER(ctypes.c_uint)]
795
openpgp_crt_verify_self.restype = _error_code
797
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
798
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
799
openpgp_crt_deinit.restype = None
801
openpgp_crt_get_fingerprint = (
802
_library.gnutls_openpgp_crt_get_fingerprint)
803
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
807
openpgp_crt_get_fingerprint.restype = _error_code
809
if check_version(b"3.6.4"):
810
certificate_type_get2 = _library.gnutls_certificate_type_get2
811
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
812
certificate_type_get2.restype = _error_code
732
814
# Remove non-public functions
733
815
del _error_code, _retry_on_error
734
# Create the global "gnutls" object, simulating a module
737
818
def call_pipe(connection, # : multiprocessing.Connection
738
819
func, *args, **kwargs):
739
820
"""This function is meant to be called by multiprocessing.Process
741
822
This function runs func(*args, **kwargs), and writes the resulting
742
823
return value on the provided multiprocessing.Connection.
744
825
connection.send(func(*args, **kwargs))
745
826
connection.close()
747
class Client(object):
748
830
"""A representation of a client host served by this server.
751
833
approved: bool(); 'None' if not yet approved/disapproved
752
834
approval_delay: datetime.timedelta(); Time to wait for approval
753
835
approval_duration: datetime.timedelta(); Duration of one approval
754
checker: subprocess.Popen(); a running checker process used
755
to see if the client lives.
756
'None' if no process is running.
836
checker: multiprocessing.Process(); a running checker process used
837
to see if the client lives. 'None' if no process is
757
839
checker_callback_tag: a GLib event source tag, or None
758
840
checker_command: string; External command which is run to check
759
841
if client lives. %() expansions are done at
1428
1517
exc_info=error)
1429
1518
return xmlstring
1432
1522
dbus.OBJECT_MANAGER_IFACE
1433
1523
except AttributeError:
1434
1524
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1436
1527
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1437
1528
"""A D-Bus object with an ObjectManager.
1439
1530
Classes inheriting from this exposes the standard
1440
1531
GetManagedObjects call and the InterfacesAdded and
1441
1532
InterfacesRemoved signals on the standard
1442
1533
"org.freedesktop.DBus.ObjectManager" interface.
1444
1535
Note: No signals are sent automatically; they must be sent
1447
1538
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1448
out_signature = "a{oa{sa{sv}}}")
1539
out_signature="a{oa{sa{sv}}}")
1449
1540
def GetManagedObjects(self):
1450
1541
"""This function must be overridden"""
1451
1542
raise NotImplementedError()
1453
1544
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1454
signature = "oa{sa{sv}}")
1545
signature="oa{sa{sv}}")
1455
1546
def InterfacesAdded(self, object_path, interfaces_and_properties):
1458
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1549
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1459
1550
def InterfacesRemoved(self, object_path, interfaces):
1462
1553
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1463
out_signature = "s",
1464
path_keyword = 'object_path',
1465
connection_keyword = 'connection')
1555
path_keyword='object_path',
1556
connection_keyword='connection')
1466
1557
def Introspect(self, object_path, connection):
1467
1558
"""Overloading of standard D-Bus method.
1469
1560
Override return argument name of GetManagedObjects to be
1470
1561
"objpath_interfaces_and_properties"
2152
2253
class ClientHandler(socketserver.BaseRequestHandler, object):
2153
2254
"""A class to handle client connections.
2155
2256
Instantiated once for each connection to handle it.
2156
2257
Note: This will run in its own forked process."""
2158
2259
def handle(self):
2159
2260
with contextlib.closing(self.server.child_pipe) as child_pipe:
2160
2261
logger.info("TCP connection from: %s",
2161
2262
str(self.client_address))
2162
2263
logger.debug("Pipe FD: %d",
2163
2264
self.server.child_pipe.fileno())
2165
2266
session = gnutls.ClientSession(self.request)
2167
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2168
# "+AES-256-CBC", "+SHA1",
2169
# "+COMP-NULL", "+CTYPE-OPENPGP",
2268
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2269
# "+AES-256-CBC", "+SHA1",
2270
# "+COMP-NULL", "+CTYPE-OPENPGP",
2171
2272
# Use a fallback default, since this MUST be set.
2172
2273
priority = self.server.gnutls_priority
2173
2274
if priority is None:
2174
2275
priority = "NORMAL"
2175
gnutls.priority_set_direct(session._c_object, priority,
2276
gnutls.priority_set_direct(session._c_object,
2277
priority.encode("utf-8"),
2178
2280
# Start communication using the Mandos protocol
2179
2281
# Get protocol number
2180
2282
line = self.request.makefile().readline()
2345
class MultiprocessingMixIn(object):
2504
class MultiprocessingMixIn:
2346
2505
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2348
2507
def sub_process_main(self, request, address):
2350
2509
self.finish_request(request, address)
2351
2510
except Exception:
2352
2511
self.handle_error(request, address)
2353
2512
self.close_request(request)
2355
2514
def process_request(self, request, address):
2356
2515
"""Start a new process to process the request."""
2357
proc = multiprocessing.Process(target = self.sub_process_main,
2358
args = (request, address))
2516
proc = multiprocessing.Process(target=self.sub_process_main,
2517
args=(request, address))
2363
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2522
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2364
2523
""" adds a pipe to the MixIn """
2366
2525
def process_request(self, request, client_address):
2367
2526
"""Overrides and wraps the original process_request().
2369
2528
This function creates a new pipe in self.pipe
2371
2530
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2373
2532
proc = MultiprocessingMixIn.process_request(self, request,
2374
2533
client_address)
2375
2534
self.child_pipe.close()
2376
2535
self.add_pipe(parent_pipe, proc)
2378
2537
def add_pipe(self, parent_pipe, proc):
2379
2538
"""Dummy function; override as necessary"""
2380
2539
raise NotImplementedError()
2383
2542
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2384
socketserver.TCPServer, object):
2543
socketserver.TCPServer):
2385
2544
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2388
2547
enabled: Boolean; whether this server is activated yet
2389
2548
interface: None or a network interface name (string)
2390
2549
use_ipv6: Boolean; to use IPv6 or not
2393
2552
def __init__(self, server_address, RequestHandlerClass,
2394
2553
interface=None,
2428
2588
# socket_wrapper(), if socketfd was set.
2429
2589
socketserver.TCPServer.__init__(self, server_address,
2430
2590
RequestHandlerClass)
2432
2592
def server_bind(self):
2433
2593
"""This overrides the normal server_bind() function
2434
2594
to bind to an interface if one was specified, and also NOT to
2435
2595
bind to an address or port if they were not specified."""
2596
global SO_BINDTODEVICE
2436
2597
if self.interface is not None:
2437
2598
if SO_BINDTODEVICE is None:
2438
logger.error("SO_BINDTODEVICE does not exist;"
2439
" cannot bind to interface %s",
2443
self.socket.setsockopt(
2444
socket.SOL_SOCKET, SO_BINDTODEVICE,
2445
(self.interface + "\0").encode("utf-8"))
2446
except socket.error as error:
2447
if error.errno == errno.EPERM:
2448
logger.error("No permission to bind to"
2449
" interface %s", self.interface)
2450
elif error.errno == errno.ENOPROTOOPT:
2451
logger.error("SO_BINDTODEVICE not available;"
2452
" cannot bind to interface %s",
2454
elif error.errno == errno.ENODEV:
2455
logger.error("Interface %s does not exist,"
2456
" cannot bind", self.interface)
2599
# Fall back to a hard-coded value which seems to be
2601
logger.warning("SO_BINDTODEVICE not found, trying 25")
2602
SO_BINDTODEVICE = 25
2604
self.socket.setsockopt(
2605
socket.SOL_SOCKET, SO_BINDTODEVICE,
2606
(self.interface + "\0").encode("utf-8"))
2607
except socket.error as error:
2608
if error.errno == errno.EPERM:
2609
logger.error("No permission to bind to"
2610
" interface %s", self.interface)
2611
elif error.errno == errno.ENOPROTOOPT:
2612
logger.error("SO_BINDTODEVICE not available;"
2613
" cannot bind to interface %s",
2615
elif error.errno == errno.ENODEV:
2616
logger.error("Interface %s does not exist,"
2617
" cannot bind", self.interface)
2459
2620
# Only bind(2) the socket if we really need to.
2460
2621
if self.server_address[0] or self.server_address[1]:
2622
if self.server_address[1]:
2623
self.allow_reuse_address = True
2461
2624
if not self.server_address[0]:
2462
2625
if self.address_family == socket.AF_INET6:
2463
any_address = "::" # in6addr_any
2626
any_address = "::" # in6addr_any
2465
any_address = "0.0.0.0" # INADDR_ANY
2628
any_address = "0.0.0.0" # INADDR_ANY
2466
2629
self.server_address = (any_address,
2467
2630
self.server_address[1])
2468
2631
elif not self.server_address[1]:
2502
2665
self.gnutls_priority = gnutls_priority
2503
2666
IPv6_TCPServer.__init__(self, server_address,
2504
2667
RequestHandlerClass,
2505
interface = interface,
2506
use_ipv6 = use_ipv6,
2507
socketfd = socketfd)
2668
interface=interface,
2509
2672
def server_activate(self):
2510
2673
if self.enabled:
2511
2674
return socketserver.TCPServer.server_activate(self)
2513
2676
def enable(self):
2514
2677
self.enabled = True
2516
2679
def add_pipe(self, parent_pipe, proc):
2517
2680
# Call "handle_ipc" for both data and EOF events
2518
2681
GLib.io_add_watch(
2519
parent_pipe.fileno(),
2520
GLib.IO_IN | GLib.IO_HUP,
2682
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2683
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2521
2684
functools.partial(self.handle_ipc,
2522
parent_pipe = parent_pipe,
2685
parent_pipe=parent_pipe,
2525
2688
def handle_ipc(self, source, condition,
2526
2689
parent_pipe=None,
2528
2691
client_object=None):
2529
2692
# error, or the other end of multiprocessing.Pipe has closed
2530
2693
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2531
2694
# Wait for other process to exit
2535
2698
# Read a request from the child
2536
2699
request = parent_pipe.recv()
2537
2700
command = request[0]
2539
2702
if command == 'init':
2541
address = request[2]
2703
key_id = request[1].decode("ascii")
2704
fpr = request[2].decode("ascii")
2705
address = request[3]
2543
2707
for c in self.clients.values():
2544
if c.fingerprint == fpr:
2708
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2710
if key_id and c.key_id == key_id:
2713
if fpr and c.fingerprint == fpr:
2548
logger.info("Client not found for fingerprint: %s, ad"
2549
"dress: %s", fpr, address)
2717
logger.info("Client not found for key ID: %s, address"
2718
": %s", key_id or fpr, address)
2550
2719
if self.use_dbus:
2551
2720
# Emit D-Bus signal
2552
mandos_dbus_service.ClientNotFound(fpr,
2721
mandos_dbus_service.ClientNotFound(key_id or fpr,
2554
2723
parent_pipe.send(False)
2557
2726
GLib.io_add_watch(
2558
parent_pipe.fileno(),
2559
GLib.IO_IN | GLib.IO_HUP,
2727
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2728
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2560
2729
functools.partial(self.handle_ipc,
2561
parent_pipe = parent_pipe,
2563
client_object = client))
2730
parent_pipe=parent_pipe,
2732
client_object=client))
2564
2733
parent_pipe.send(True)
2565
2734
# remove the old hook in favor of the new above hook on
2583
2752
parent_pipe.send((
2584
2753
'data', client_object.__getattribute__(attrname)))
2586
2755
if command == 'setattr':
2587
2756
attrname = request[1]
2588
2757
value = request[2]
2589
2758
setattr(client_object, attrname, value)
2594
2763
def rfc3339_duration_to_delta(duration):
2595
2764
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2597
>>> rfc3339_duration_to_delta("P7D")
2598
datetime.timedelta(7)
2599
>>> rfc3339_duration_to_delta("PT60S")
2600
datetime.timedelta(0, 60)
2601
>>> rfc3339_duration_to_delta("PT60M")
2602
datetime.timedelta(0, 3600)
2603
>>> rfc3339_duration_to_delta("PT24H")
2604
datetime.timedelta(1)
2605
>>> rfc3339_duration_to_delta("P1W")
2606
datetime.timedelta(7)
2607
>>> rfc3339_duration_to_delta("PT5M30S")
2608
datetime.timedelta(0, 330)
2609
>>> rfc3339_duration_to_delta("P1DT3M20S")
2610
datetime.timedelta(1, 200)
2766
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2768
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2770
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2772
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2774
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2776
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2778
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2613
2782
# Parsing an RFC 3339 duration with regular expressions is not
2614
2783
# possible - there would have to be multiple places for the same
2615
2784
# values, like seconds. The current code, while more esoteric, is
2616
2785
# cleaner without depending on a parsing library. If Python had a
2617
2786
# built-in library for parsing we would use it, but we'd like to
2618
2787
# avoid excessive use of external libraries.
2620
2789
# New type for defining tokens, syntax, and semantics all-in-one
2621
2790
Token = collections.namedtuple("Token", (
2622
2791
"regexp", # To match token; if "value" is not None, must have
2806
2978
parser.add_argument("--no-zeroconf", action="store_false",
2807
2979
dest="zeroconf", help="Do not use Zeroconf",
2810
2982
options = parser.parse_args()
2814
fail_count, test_count = doctest.testmod()
2815
sys.exit(os.EX_OK if fail_count == 0 else 1)
2817
2984
# Default values for config file for server-global settings
2818
server_defaults = { "interface": "",
2823
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2824
":+SIGN-DSA-SHA256",
2825
"servicename": "Mandos",
2831
"statedir": "/var/lib/mandos",
2832
"foreground": "False",
2985
if gnutls.has_rawpk:
2986
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2987
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2989
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2990
":+SIGN-DSA-SHA256")
2991
server_defaults = {"interface": "",
2995
"priority": priority,
2996
"servicename": "Mandos",
3002
"statedir": "/var/lib/mandos",
3003
"foreground": "False",
2836
3008
# Parse config file for server-global settings
2837
server_config = configparser.SafeConfigParser(server_defaults)
3009
server_config = configparser.ConfigParser(server_defaults)
2838
3010
del server_defaults
2839
3011
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2840
# Convert the SafeConfigParser object to a dict
3012
# Convert the ConfigParser object to a dict
2841
3013
server_settings = server_config.defaults()
2842
3014
# Use the appropriate methods on the non-string config options
2843
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3015
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3016
"foreground", "zeroconf"):
2844
3017
server_settings[option] = server_config.getboolean("DEFAULT",
2846
3019
if server_settings["port"]:
3019
3192
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3020
3193
service = AvahiServiceToSyslog(
3021
name = server_settings["servicename"],
3022
servicetype = "_mandos._tcp",
3023
protocol = protocol,
3194
name=server_settings["servicename"],
3195
servicetype="_mandos._tcp",
3025
3198
if server_settings["interface"]:
3026
3199
service.interface = if_nametoindex(
3027
3200
server_settings["interface"].encode("utf-8"))
3029
3202
global multiprocessing_manager
3030
3203
multiprocessing_manager = multiprocessing.Manager()
3032
3205
client_class = Client
3034
client_class = functools.partial(ClientDBus, bus = bus)
3207
client_class = functools.partial(ClientDBus, bus=bus)
3036
3209
client_settings = Client.config_parser(client_config)
3037
3210
old_client_settings = {}
3038
3211
clients_data = {}
3040
3213
# This is used to redirect stdout and stderr for checker processes
3042
wnull = open(os.devnull, "w") # A writable /dev/null
3215
wnull = open(os.devnull, "w") # A writable /dev/null
3043
3216
# Only used if server is running in foreground but not in debug
3045
3218
if debug or not foreground:
3048
3221
# Get client data and settings from last running state.
3049
3222
if server_settings["restore"]:
3051
3224
with open(stored_state_path, "rb") as stored_state:
3052
if sys.version_info.major == 2:
3225
if sys.version_info.major == 2:
3053
3226
clients_data, old_client_settings = pickle.load(
3056
3229
bytes_clients_data, bytes_old_client_settings = (
3057
pickle.load(stored_state, encoding = "bytes"))
3058
### Fix bytes to strings
3230
pickle.load(stored_state, encoding="bytes"))
3231
# Fix bytes to strings
3061
clients_data = { (key.decode("utf-8")
3062
if isinstance(key, bytes)
3065
bytes_clients_data.items() }
3234
clients_data = {(key.decode("utf-8")
3235
if isinstance(key, bytes)
3238
bytes_clients_data.items()}
3066
3239
del bytes_clients_data
3067
3240
for key in clients_data:
3068
value = { (k.decode("utf-8")
3069
if isinstance(k, bytes) else k): v
3071
clients_data[key].items() }
3241
value = {(k.decode("utf-8")
3242
if isinstance(k, bytes) else k): v
3244
clients_data[key].items()}
3072
3245
clients_data[key] = value
3073
3246
# .client_structure
3074
3247
value["client_structure"] = [
3075
3248
(s.decode("utf-8")
3076
3249
if isinstance(s, bytes)
3077
3250
else s) for s in
3078
value["client_structure"] ]
3080
for k in ("name", "host"):
3251
value["client_structure"]]
3252
# .name, .host, and .checker_command
3253
for k in ("name", "host", "checker_command"):
3081
3254
if isinstance(value[k], bytes):
3082
3255
value[k] = value[k].decode("utf-8")
3083
## old_client_settings
3256
if "key_id" not in value:
3257
value["key_id"] = ""
3258
elif "fingerprint" not in value:
3259
value["fingerprint"] = ""
3260
# old_client_settings
3085
3262
old_client_settings = {
3086
3263
(key.decode("utf-8")
3087
3264
if isinstance(key, bytes)
3088
3265
else key): value
3089
3266
for key, value in
3090
bytes_old_client_settings.items() }
3267
bytes_old_client_settings.items()}
3091
3268
del bytes_old_client_settings
3269
# .host and .checker_command
3093
3270
for value in old_client_settings.values():
3094
if isinstance(value["host"], bytes):
3095
value["host"] = (value["host"]
3271
for attribute in ("host", "checker_command"):
3272
if isinstance(value[attribute], bytes):
3273
value[attribute] = (value[attribute]
3097
3275
os.remove(stored_state_path)
3098
3276
except IOError as e:
3099
3277
if e.errno == errno.ENOENT: