195
248
.replace(b"\n", b"\\n")
196
249
.replace(b"\0", b"\\x00"))
199
252
def encrypt(self, data, password):
200
253
passphrase = self.password_encode(password)
201
254
with tempfile.NamedTemporaryFile(
202
255
dir=self.tempdir) as passfile:
203
256
passfile.write(passphrase)
205
proc = subprocess.Popen(['gpg', '--symmetric',
258
proc = subprocess.Popen([self.gpg, '--symmetric',
206
259
'--passphrase-file',
208
261
+ self.gnupgargs,
209
stdin = subprocess.PIPE,
210
stdout = subprocess.PIPE,
211
stderr = subprocess.PIPE)
212
ciphertext, err = proc.communicate(input = data)
262
stdin=subprocess.PIPE,
263
stdout=subprocess.PIPE,
264
stderr=subprocess.PIPE)
265
ciphertext, err = proc.communicate(input=data)
213
266
if proc.returncode != 0:
214
267
raise PGPError(err)
215
268
return ciphertext
217
270
def decrypt(self, data, password):
218
271
passphrase = self.password_encode(password)
219
272
with tempfile.NamedTemporaryFile(
220
dir = self.tempdir) as passfile:
273
dir=self.tempdir) as passfile:
221
274
passfile.write(passphrase)
223
proc = subprocess.Popen(['gpg', '--decrypt',
276
proc = subprocess.Popen([self.gpg, '--decrypt',
224
277
'--passphrase-file',
226
279
+ self.gnupgargs,
227
stdin = subprocess.PIPE,
228
stdout = subprocess.PIPE,
229
stderr = subprocess.PIPE)
230
decrypted_plaintext, err = proc.communicate(input = data)
280
stdin=subprocess.PIPE,
281
stdout=subprocess.PIPE,
282
stderr=subprocess.PIPE)
283
decrypted_plaintext, err = proc.communicate(input=data)
231
284
if proc.returncode != 0:
232
285
raise PGPError(err)
233
286
return decrypted_plaintext
289
# Pretend that we have an Avahi module
291
"""This isn't so much a class as it is a module-like namespace."""
292
IF_UNSPEC = -1 # avahi-common/address.h
293
PROTO_UNSPEC = -1 # avahi-common/address.h
294
PROTO_INET = 0 # avahi-common/address.h
295
PROTO_INET6 = 1 # avahi-common/address.h
296
DBUS_NAME = "org.freedesktop.Avahi"
297
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
298
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
299
DBUS_PATH_SERVER = "/"
302
def string_array_to_txt_array(t):
303
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
304
for s in t), signature="ay")
305
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
306
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
307
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
308
SERVER_INVALID = 0 # avahi-common/defs.h
309
SERVER_REGISTERING = 1 # avahi-common/defs.h
310
SERVER_RUNNING = 2 # avahi-common/defs.h
311
SERVER_COLLISION = 3 # avahi-common/defs.h
312
SERVER_FAILURE = 4 # avahi-common/defs.h
236
315
class AvahiError(Exception):
237
316
def __init__(self, value, *args, **kwargs):
238
317
self.value = value
417
507
class AvahiServiceToSyslog(AvahiService):
418
508
def rename(self, *args, **kwargs):
419
509
"""Add the new name to the syslog messages"""
420
ret = AvahiService.rename(self, *args, **kwargs)
510
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
421
511
syslogger.setFormatter(logging.Formatter(
422
512
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
423
513
.format(self.name)))
426
def subprocess_call_pipe(connection, # : multiprocessing.Connection
517
# Pretend that we have a GnuTLS module
519
"""This isn't so much a class as it is a module-like namespace."""
521
library = ctypes.util.find_library("gnutls")
523
library = ctypes.util.find_library("gnutls-deb0")
524
_library = ctypes.cdll.LoadLibrary(library)
527
# Unless otherwise indicated, the constants and types below are
528
# all from the gnutls/gnutls.h C header file.
539
E_NO_CERTIFICATE_FOUND = -49
544
KEYID_USE_SHA256 = 1 # gnutls/x509.h
545
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
548
class session_int(ctypes.Structure):
550
session_t = ctypes.POINTER(session_int)
552
class certificate_credentials_st(ctypes.Structure):
554
certificate_credentials_t = ctypes.POINTER(
555
certificate_credentials_st)
556
certificate_type_t = ctypes.c_int
558
class datum_t(ctypes.Structure):
559
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
560
('size', ctypes.c_uint)]
562
class openpgp_crt_int(ctypes.Structure):
564
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
565
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
566
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
567
credentials_type_t = ctypes.c_int
568
transport_ptr_t = ctypes.c_void_p
569
close_request_t = ctypes.c_int
572
class Error(Exception):
573
def __init__(self, message=None, code=None, args=()):
574
# Default usage is by a message string, but if a return
575
# code is passed, convert it to a string with
578
if message is None and code is not None:
579
message = gnutls.strerror(code)
580
return super(gnutls.Error, self).__init__(
583
class CertificateSecurityError(Error):
589
self._c_object = gnutls.certificate_credentials_t()
590
gnutls.certificate_allocate_credentials(
591
ctypes.byref(self._c_object))
592
self.type = gnutls.CRD_CERTIFICATE
595
gnutls.certificate_free_credentials(self._c_object)
598
def __init__(self, socket, credentials=None):
599
self._c_object = gnutls.session_t()
600
gnutls_flags = gnutls.CLIENT
601
if gnutls.check_version(b"3.5.6"):
602
gnutls_flags |= gnutls.NO_TICKETS
604
gnutls_flags |= gnutls.ENABLE_RAWPK
605
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
607
gnutls.set_default_priority(self._c_object)
608
gnutls.transport_set_ptr(self._c_object, socket.fileno())
609
gnutls.handshake_set_private_extensions(self._c_object,
612
if credentials is None:
613
credentials = gnutls.Credentials()
614
gnutls.credentials_set(self._c_object, credentials.type,
615
ctypes.cast(credentials._c_object,
617
self.credentials = credentials
620
gnutls.deinit(self._c_object)
623
return gnutls.handshake(self._c_object)
625
def send(self, data):
629
data_len -= gnutls.record_send(self._c_object,
634
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
636
# Error handling functions
637
def _error_code(result):
638
"""A function to raise exceptions on errors, suitable
639
for the 'restype' attribute on ctypes functions"""
642
if result == gnutls.E_NO_CERTIFICATE_FOUND:
643
raise gnutls.CertificateSecurityError(code=result)
644
raise gnutls.Error(code=result)
646
def _retry_on_error(result, func, arguments):
647
"""A function to retry on some errors, suitable
648
for the 'errcheck' attribute on ctypes functions"""
650
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
651
return _error_code(result)
652
result = func(*arguments)
655
# Unless otherwise indicated, the function declarations below are
656
# all from the gnutls/gnutls.h C header file.
659
priority_set_direct = _library.gnutls_priority_set_direct
660
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
661
ctypes.POINTER(ctypes.c_char_p)]
662
priority_set_direct.restype = _error_code
664
init = _library.gnutls_init
665
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
666
init.restype = _error_code
668
set_default_priority = _library.gnutls_set_default_priority
669
set_default_priority.argtypes = [session_t]
670
set_default_priority.restype = _error_code
672
record_send = _library.gnutls_record_send
673
record_send.argtypes = [session_t, ctypes.c_void_p,
675
record_send.restype = ctypes.c_ssize_t
676
record_send.errcheck = _retry_on_error
678
certificate_allocate_credentials = (
679
_library.gnutls_certificate_allocate_credentials)
680
certificate_allocate_credentials.argtypes = [
681
ctypes.POINTER(certificate_credentials_t)]
682
certificate_allocate_credentials.restype = _error_code
684
certificate_free_credentials = (
685
_library.gnutls_certificate_free_credentials)
686
certificate_free_credentials.argtypes = [
687
certificate_credentials_t]
688
certificate_free_credentials.restype = None
690
handshake_set_private_extensions = (
691
_library.gnutls_handshake_set_private_extensions)
692
handshake_set_private_extensions.argtypes = [session_t,
694
handshake_set_private_extensions.restype = None
696
credentials_set = _library.gnutls_credentials_set
697
credentials_set.argtypes = [session_t, credentials_type_t,
699
credentials_set.restype = _error_code
701
strerror = _library.gnutls_strerror
702
strerror.argtypes = [ctypes.c_int]
703
strerror.restype = ctypes.c_char_p
705
certificate_type_get = _library.gnutls_certificate_type_get
706
certificate_type_get.argtypes = [session_t]
707
certificate_type_get.restype = _error_code
709
certificate_get_peers = _library.gnutls_certificate_get_peers
710
certificate_get_peers.argtypes = [session_t,
711
ctypes.POINTER(ctypes.c_uint)]
712
certificate_get_peers.restype = ctypes.POINTER(datum_t)
714
global_set_log_level = _library.gnutls_global_set_log_level
715
global_set_log_level.argtypes = [ctypes.c_int]
716
global_set_log_level.restype = None
718
global_set_log_function = _library.gnutls_global_set_log_function
719
global_set_log_function.argtypes = [log_func]
720
global_set_log_function.restype = None
722
deinit = _library.gnutls_deinit
723
deinit.argtypes = [session_t]
724
deinit.restype = None
726
handshake = _library.gnutls_handshake
727
handshake.argtypes = [session_t]
728
handshake.restype = _error_code
729
handshake.errcheck = _retry_on_error
731
transport_set_ptr = _library.gnutls_transport_set_ptr
732
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
733
transport_set_ptr.restype = None
735
bye = _library.gnutls_bye
736
bye.argtypes = [session_t, close_request_t]
737
bye.restype = _error_code
738
bye.errcheck = _retry_on_error
740
check_version = _library.gnutls_check_version
741
check_version.argtypes = [ctypes.c_char_p]
742
check_version.restype = ctypes.c_char_p
744
_need_version = b"3.3.0"
745
if check_version(_need_version) is None:
746
raise self.Error("Needs GnuTLS {} or later"
747
.format(_need_version))
749
_tls_rawpk_version = b"3.6.6"
750
has_rawpk = bool(check_version(_tls_rawpk_version))
754
class pubkey_st(ctypes.Structure):
756
pubkey_t = ctypes.POINTER(pubkey_st)
758
x509_crt_fmt_t = ctypes.c_int
760
# All the function declarations below are from gnutls/abstract.h
761
pubkey_init = _library.gnutls_pubkey_init
762
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
763
pubkey_init.restype = _error_code
765
pubkey_import = _library.gnutls_pubkey_import
766
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
768
pubkey_import.restype = _error_code
770
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
771
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
772
ctypes.POINTER(ctypes.c_ubyte),
773
ctypes.POINTER(ctypes.c_size_t)]
774
pubkey_get_key_id.restype = _error_code
776
pubkey_deinit = _library.gnutls_pubkey_deinit
777
pubkey_deinit.argtypes = [pubkey_t]
778
pubkey_deinit.restype = None
780
# All the function declarations below are from gnutls/openpgp.h
782
openpgp_crt_init = _library.gnutls_openpgp_crt_init
783
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
784
openpgp_crt_init.restype = _error_code
786
openpgp_crt_import = _library.gnutls_openpgp_crt_import
787
openpgp_crt_import.argtypes = [openpgp_crt_t,
788
ctypes.POINTER(datum_t),
790
openpgp_crt_import.restype = _error_code
792
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
793
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
794
ctypes.POINTER(ctypes.c_uint)]
795
openpgp_crt_verify_self.restype = _error_code
797
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
798
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
799
openpgp_crt_deinit.restype = None
801
openpgp_crt_get_fingerprint = (
802
_library.gnutls_openpgp_crt_get_fingerprint)
803
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
807
openpgp_crt_get_fingerprint.restype = _error_code
809
if check_version(b"3.6.4"):
810
certificate_type_get2 = _library.gnutls_certificate_type_get2
811
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
812
certificate_type_get2.restype = _error_code
814
# Remove non-public functions
815
del _error_code, _retry_on_error
818
def call_pipe(connection, # : multiprocessing.Connection
819
func, *args, **kwargs):
428
820
"""This function is meant to be called by multiprocessing.Process
430
This function runs a synchronous subprocess.call(), and writes the
431
resulting return code on the provided multiprocessing.Connection.
822
This function runs func(*args, **kwargs), and writes the resulting
823
return value on the provided multiprocessing.Connection.
433
connection.send(subprocess.call(*args, **kwargs))
825
connection.send(func(*args, **kwargs))
434
826
connection.close()
436
class Client(object):
437
830
"""A representation of a client host served by this server.
440
833
approved: bool(); 'None' if not yet approved/disapproved
441
834
approval_delay: datetime.timedelta(); Time to wait for approval
442
835
approval_duration: datetime.timedelta(); Duration of one approval
443
checker: subprocess.Popen(); a running checker process used
444
to see if the client lives.
445
'None' if no process is running.
446
checker_callback_tag: a gobject event source tag, or None
836
checker: multiprocessing.Process(); a running checker process used
837
to see if the client lives. 'None' if no process is
839
checker_callback_tag: a GLib event source tag, or None
447
840
checker_command: string; External command which is run to check
448
841
if client lives. %() expansions are done at
449
842
runtime with vars(self) as dict, so that for
450
843
instance %(name)s can be used in the command.
451
checker_initiator_tag: a gobject event source tag, or None
844
checker_initiator_tag: a GLib event source tag, or None
452
845
created: datetime.datetime(); (UTC) object creation
453
846
client_structure: Object describing what attributes a client has
454
847
and is used for storing the client at exit
455
848
current_checker_command: string; current running checker_command
456
disable_initiator_tag: a gobject event source tag, or None
849
disable_initiator_tag: a GLib event source tag, or None
458
851
fingerprint: string (40 or 32 hexadecimal digits); used to
459
uniquely identify the client
852
uniquely identify an OpenPGP client
853
key_id: string (64 hexadecimal digits); used to uniquely identify
854
a client using raw public keys
460
855
host: string; available for use by the checker command
461
856
interval: datetime.timedelta(); How often to start a new checker
462
857
last_approval_request: datetime.datetime(); (UTC) or None
882
1287
for cls in self.__class__.__mro__
883
1288
for name, athing in
884
1289
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1291
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1293
path_keyword='object_path',
1294
connection_keyword='connection')
1295
def Introspect(self, object_path, connection):
1296
"""Overloading of standard D-Bus method.
1298
Inserts annotation tags on methods and signals.
1300
xmlstring = dbus.service.Object.Introspect(self, object_path,
1303
document = xml.dom.minidom.parseString(xmlstring)
1305
for if_tag in document.getElementsByTagName("interface"):
1306
# Add annotation tags
1307
for typ in ("method", "signal"):
1308
for tag in if_tag.getElementsByTagName(typ):
1310
for name, prop in (self.
1311
_get_all_dbus_things(typ)):
1312
if (name == tag.getAttribute("name")
1313
and prop._dbus_interface
1314
== if_tag.getAttribute("name")):
1315
annots.update(getattr(
1316
prop, "_dbus_annotations", {}))
1317
for name, value in annots.items():
1318
ann_tag = document.createElement(
1320
ann_tag.setAttribute("name", name)
1321
ann_tag.setAttribute("value", value)
1322
tag.appendChild(ann_tag)
1323
# Add interface annotation tags
1324
for annotation, value in dict(
1325
itertools.chain.from_iterable(
1326
annotations().items()
1327
for name, annotations
1328
in self._get_all_dbus_things("interface")
1329
if name == if_tag.getAttribute("name")
1331
ann_tag = document.createElement("annotation")
1332
ann_tag.setAttribute("name", annotation)
1333
ann_tag.setAttribute("value", value)
1334
if_tag.appendChild(ann_tag)
1335
# Fix argument name for the Introspect method itself
1336
if (if_tag.getAttribute("name")
1337
== dbus.INTROSPECTABLE_IFACE):
1338
for cn in if_tag.getElementsByTagName("method"):
1339
if cn.getAttribute("name") == "Introspect":
1340
for arg in cn.getElementsByTagName("arg"):
1341
if (arg.getAttribute("direction")
1343
arg.setAttribute("name",
1345
xmlstring = document.toxml("utf-8")
1347
except (AttributeError, xml.dom.DOMException,
1348
xml.parsers.expat.ExpatError) as error:
1349
logger.error("Failed to override Introspection method",
1354
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1355
"""A D-Bus object with properties.
1357
Classes inheriting from this can use the dbus_service_property
1358
decorator to expose methods as D-Bus properties. It exposes the
1359
standard Get(), Set(), and GetAll() methods on the D-Bus.
886
1362
def _get_dbus_property(self, interface_name, property_name):
887
1363
"""Returns a bound method if one exists which is a D-Bus
888
1364
property with the specified name and interface.
1046
1518
return xmlstring
1522
dbus.OBJECT_MANAGER_IFACE
1523
except AttributeError:
1524
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1527
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1528
"""A D-Bus object with an ObjectManager.
1530
Classes inheriting from this exposes the standard
1531
GetManagedObjects call and the InterfacesAdded and
1532
InterfacesRemoved signals on the standard
1533
"org.freedesktop.DBus.ObjectManager" interface.
1535
Note: No signals are sent automatically; they must be sent
1538
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1539
out_signature="a{oa{sa{sv}}}")
1540
def GetManagedObjects(self):
1541
"""This function must be overridden"""
1542
raise NotImplementedError()
1544
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1545
signature="oa{sa{sv}}")
1546
def InterfacesAdded(self, object_path, interfaces_and_properties):
1549
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1550
def InterfacesRemoved(self, object_path, interfaces):
1553
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1555
path_keyword='object_path',
1556
connection_keyword='connection')
1557
def Introspect(self, object_path, connection):
1558
"""Overloading of standard D-Bus method.
1560
Override return argument name of GetManagedObjects to be
1561
"objpath_interfaces_and_properties"
1563
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1567
document = xml.dom.minidom.parseString(xmlstring)
1569
for if_tag in document.getElementsByTagName("interface"):
1570
# Fix argument name for the GetManagedObjects method
1571
if (if_tag.getAttribute("name")
1572
== dbus.OBJECT_MANAGER_IFACE):
1573
for cn in if_tag.getElementsByTagName("method"):
1574
if (cn.getAttribute("name")
1575
== "GetManagedObjects"):
1576
for arg in cn.getElementsByTagName("arg"):
1577
if (arg.getAttribute("direction")
1581
"objpath_interfaces"
1583
xmlstring = document.toxml("utf-8")
1585
except (AttributeError, xml.dom.DOMException,
1586
xml.parsers.expat.ExpatError) as error:
1587
logger.error("Failed to override Introspection method",
1049
1592
def datetime_to_dbus(dt, variant_level=0):
1050
1593
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1052
return dbus.String("", variant_level = variant_level)
1595
return dbus.String("", variant_level=variant_level)
1053
1596
return dbus.String(dt.isoformat(), variant_level=variant_level)
1805
2380
delay -= time2 - time
1808
while sent_size < len(client.secret):
1810
sent = session.send(client.secret[sent_size:])
1811
except gnutls.errors.GNUTLSError as error:
1812
logger.warning("gnutls send failed",
1815
logger.debug("Sent: %d, remaining: %d", sent,
1816
len(client.secret) - (sent_size
2383
session.send(client.secret)
2384
except gnutls.Error as error:
2385
logger.warning("gnutls send failed",
1820
2389
logger.info("Sending secret to %s", client.name)
1821
2390
# bump the timeout using extended_timeout
1822
2391
client.bump_timeout(client.extended_timeout)
1823
2392
if self.server.use_dbus:
1824
2393
# Emit D-Bus signal
1825
2394
client.GotSecret()
1828
2397
if approval_required:
1829
2398
client.approvals_pending -= 1
1832
except gnutls.errors.GNUTLSError as error:
2401
except gnutls.Error as error:
1833
2402
logger.warning("GnuTLS bye failed",
1834
2403
exc_info=error)
1837
2406
def peer_certificate(session):
1838
"Return the peer's OpenPGP certificate as a bytestring"
1839
# If not an OpenPGP certificate...
1840
if (gnutls.library.functions.gnutls_certificate_type_get(
1842
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1843
# ...do the normal thing
1844
return session.peer_certificate
2407
"Return the peer's certificate as a bytestring"
2409
cert_type = gnutls.certificate_type_get2(session._c_object,
2411
except AttributeError:
2412
cert_type = gnutls.certificate_type_get(session._c_object)
2413
if gnutls.has_rawpk:
2414
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2416
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2417
# If not a valid certificate type...
2418
if cert_type not in valid_cert_types:
2419
logger.info("Cert type %r not in %r", cert_type,
2421
# ...return invalid data
1845
2423
list_size = ctypes.c_uint(1)
1846
cert_list = (gnutls.library.functions
1847
.gnutls_certificate_get_peers
2424
cert_list = (gnutls.certificate_get_peers
1848
2425
(session._c_object, ctypes.byref(list_size)))
1849
2426
if not bool(cert_list) and list_size.value != 0:
1850
raise gnutls.errors.GNUTLSError("error getting peer"
2427
raise gnutls.Error("error getting peer certificate")
1852
2428
if list_size.value == 0:
1854
2430
cert = cert_list[0]
1855
2431
return ctypes.string_at(cert.data, cert.size)
2434
def key_id(certificate):
2435
"Convert a certificate bytestring to a hexdigit key ID"
2436
# New GnuTLS "datum" with the public key
2437
datum = gnutls.datum_t(
2438
ctypes.cast(ctypes.c_char_p(certificate),
2439
ctypes.POINTER(ctypes.c_ubyte)),
2440
ctypes.c_uint(len(certificate)))
2441
# XXX all these need to be created in the gnutls "module"
2442
# New empty GnuTLS certificate
2443
pubkey = gnutls.pubkey_t()
2444
gnutls.pubkey_init(ctypes.byref(pubkey))
2445
# Import the raw public key into the certificate
2446
gnutls.pubkey_import(pubkey,
2447
ctypes.byref(datum),
2448
gnutls.X509_FMT_DER)
2449
# New buffer for the key ID
2450
buf = ctypes.create_string_buffer(32)
2451
buf_len = ctypes.c_size_t(len(buf))
2452
# Get the key ID from the raw public key into the buffer
2453
gnutls.pubkey_get_key_id(pubkey,
2454
gnutls.KEYID_USE_SHA256,
2455
ctypes.cast(ctypes.byref(buf),
2456
ctypes.POINTER(ctypes.c_ubyte)),
2457
ctypes.byref(buf_len))
2458
# Deinit the certificate
2459
gnutls.pubkey_deinit(pubkey)
2461
# Convert the buffer to a Python bytestring
2462
key_id = ctypes.string_at(buf, buf_len.value)
2463
# Convert the bytestring to hexadecimal notation
2464
hex_key_id = binascii.hexlify(key_id).upper()
1858
2468
def fingerprint(openpgp):
1859
2469
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1860
2470
# New GnuTLS "datum" with the OpenPGP public key
1861
datum = gnutls.library.types.gnutls_datum_t(
2471
datum = gnutls.datum_t(
1862
2472
ctypes.cast(ctypes.c_char_p(openpgp),
1863
2473
ctypes.POINTER(ctypes.c_ubyte)),
1864
2474
ctypes.c_uint(len(openpgp)))
1865
2475
# New empty GnuTLS certificate
1866
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1867
gnutls.library.functions.gnutls_openpgp_crt_init(
2476
crt = gnutls.openpgp_crt_t()
2477
gnutls.openpgp_crt_init(ctypes.byref(crt))
1869
2478
# Import the OpenPGP public key into the certificate
1870
gnutls.library.functions.gnutls_openpgp_crt_import(
1871
crt, ctypes.byref(datum),
1872
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2479
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2480
gnutls.OPENPGP_FMT_RAW)
1873
2481
# Verify the self signature in the key
1874
2482
crtverify = ctypes.c_uint()
1875
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1876
crt, 0, ctypes.byref(crtverify))
2483
gnutls.openpgp_crt_verify_self(crt, 0,
2484
ctypes.byref(crtverify))
1877
2485
if crtverify.value != 0:
1878
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1879
raise gnutls.errors.CertificateSecurityError(
2486
gnutls.openpgp_crt_deinit(crt)
2487
raise gnutls.CertificateSecurityError(code
1881
2489
# New buffer for the fingerprint
1882
2490
buf = ctypes.create_string_buffer(20)
1883
2491
buf_len = ctypes.c_size_t()
1884
2492
# Get the fingerprint from the certificate into the buffer
1885
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1886
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2493
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2494
ctypes.byref(buf_len))
1887
2495
# Deinit the certificate
1888
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2496
gnutls.openpgp_crt_deinit(crt)
1889
2497
# Convert the buffer to a Python bytestring
1890
2498
fpr = ctypes.string_at(buf, buf_len.value)
1891
2499
# Convert the bytestring to hexadecimal notation
1979
2588
# socket_wrapper(), if socketfd was set.
1980
2589
socketserver.TCPServer.__init__(self, server_address,
1981
2590
RequestHandlerClass)
1983
2592
def server_bind(self):
1984
2593
"""This overrides the normal server_bind() function
1985
2594
to bind to an interface if one was specified, and also NOT to
1986
2595
bind to an address or port if they were not specified."""
2596
global SO_BINDTODEVICE
1987
2597
if self.interface is not None:
1988
2598
if SO_BINDTODEVICE is None:
1989
logger.error("SO_BINDTODEVICE does not exist;"
1990
" cannot bind to interface %s",
1994
self.socket.setsockopt(
1995
socket.SOL_SOCKET, SO_BINDTODEVICE,
1996
(self.interface + "\0").encode("utf-8"))
1997
except socket.error as error:
1998
if error.errno == errno.EPERM:
1999
logger.error("No permission to bind to"
2000
" interface %s", self.interface)
2001
elif error.errno == errno.ENOPROTOOPT:
2002
logger.error("SO_BINDTODEVICE not available;"
2003
" cannot bind to interface %s",
2005
elif error.errno == errno.ENODEV:
2006
logger.error("Interface %s does not exist,"
2007
" cannot bind", self.interface)
2599
# Fall back to a hard-coded value which seems to be
2601
logger.warning("SO_BINDTODEVICE not found, trying 25")
2602
SO_BINDTODEVICE = 25
2604
self.socket.setsockopt(
2605
socket.SOL_SOCKET, SO_BINDTODEVICE,
2606
(self.interface + "\0").encode("utf-8"))
2607
except socket.error as error:
2608
if error.errno == errno.EPERM:
2609
logger.error("No permission to bind to"
2610
" interface %s", self.interface)
2611
elif error.errno == errno.ENOPROTOOPT:
2612
logger.error("SO_BINDTODEVICE not available;"
2613
" cannot bind to interface %s",
2615
elif error.errno == errno.ENODEV:
2616
logger.error("Interface %s does not exist,"
2617
" cannot bind", self.interface)
2010
2620
# Only bind(2) the socket if we really need to.
2011
2621
if self.server_address[0] or self.server_address[1]:
2622
if self.server_address[1]:
2623
self.allow_reuse_address = True
2012
2624
if not self.server_address[0]:
2013
2625
if self.address_family == socket.AF_INET6:
2014
any_address = "::" # in6addr_any
2626
any_address = "::" # in6addr_any
2016
any_address = "0.0.0.0" # INADDR_ANY
2628
any_address = "0.0.0.0" # INADDR_ANY
2017
2629
self.server_address = (any_address,
2018
2630
self.server_address[1])
2019
2631
elif not self.server_address[1]:
2053
2665
self.gnutls_priority = gnutls_priority
2054
2666
IPv6_TCPServer.__init__(self, server_address,
2055
2667
RequestHandlerClass,
2056
interface = interface,
2057
use_ipv6 = use_ipv6,
2058
socketfd = socketfd)
2668
interface=interface,
2060
2672
def server_activate(self):
2061
2673
if self.enabled:
2062
2674
return socketserver.TCPServer.server_activate(self)
2064
2676
def enable(self):
2065
2677
self.enabled = True
2067
2679
def add_pipe(self, parent_pipe, proc):
2068
2680
# Call "handle_ipc" for both data and EOF events
2069
gobject.io_add_watch(
2070
parent_pipe.fileno(),
2071
gobject.IO_IN | gobject.IO_HUP,
2682
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2683
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2072
2684
functools.partial(self.handle_ipc,
2073
parent_pipe = parent_pipe,
2685
parent_pipe=parent_pipe,
2076
2688
def handle_ipc(self, source, condition,
2077
2689
parent_pipe=None,
2079
2691
client_object=None):
2080
2692
# error, or the other end of multiprocessing.Pipe has closed
2081
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2693
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2082
2694
# Wait for other process to exit
2086
2698
# Read a request from the child
2087
2699
request = parent_pipe.recv()
2088
2700
command = request[0]
2090
2702
if command == 'init':
2092
address = request[2]
2094
for c in self.clients.itervalues():
2095
if c.fingerprint == fpr:
2703
key_id = request[1].decode("ascii")
2704
fpr = request[2].decode("ascii")
2705
address = request[3]
2707
for c in self.clients.values():
2708
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2710
if key_id and c.key_id == key_id:
2713
if fpr and c.fingerprint == fpr:
2099
logger.info("Client not found for fingerprint: %s, ad"
2100
"dress: %s", fpr, address)
2717
logger.info("Client not found for key ID: %s, address"
2718
": %s", key_id or fpr, address)
2101
2719
if self.use_dbus:
2102
2720
# Emit D-Bus signal
2103
mandos_dbus_service.ClientNotFound(fpr,
2721
mandos_dbus_service.ClientNotFound(key_id or fpr,
2105
2723
parent_pipe.send(False)
2108
gobject.io_add_watch(
2109
parent_pipe.fileno(),
2110
gobject.IO_IN | gobject.IO_HUP,
2727
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2728
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2111
2729
functools.partial(self.handle_ipc,
2112
parent_pipe = parent_pipe,
2114
client_object = client))
2730
parent_pipe=parent_pipe,
2732
client_object=client))
2115
2733
parent_pipe.send(True)
2116
2734
# remove the old hook in favor of the new above hook on
2120
2738
funcname = request[1]
2121
2739
args = request[2]
2122
2740
kwargs = request[3]
2124
2742
parent_pipe.send(('data', getattr(client_object,
2125
2743
funcname)(*args,
2128
2746
if command == 'getattr':
2129
2747
attrname = request[1]
2130
if callable(client_object.__getattribute__(attrname)):
2748
if isinstance(client_object.__getattribute__(attrname),
2749
collections.Callable):
2131
2750
parent_pipe.send(('function', ))
2133
2752
parent_pipe.send((
2134
2753
'data', client_object.__getattribute__(attrname)))
2136
2755
if command == 'setattr':
2137
2756
attrname = request[1]
2138
2757
value = request[2]
2139
2758
setattr(client_object, attrname, value)
2144
2763
def rfc3339_duration_to_delta(duration):
2145
2764
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2147
>>> rfc3339_duration_to_delta("P7D")
2148
datetime.timedelta(7)
2149
>>> rfc3339_duration_to_delta("PT60S")
2150
datetime.timedelta(0, 60)
2151
>>> rfc3339_duration_to_delta("PT60M")
2152
datetime.timedelta(0, 3600)
2153
>>> rfc3339_duration_to_delta("PT24H")
2154
datetime.timedelta(1)
2155
>>> rfc3339_duration_to_delta("P1W")
2156
datetime.timedelta(7)
2157
>>> rfc3339_duration_to_delta("PT5M30S")
2158
datetime.timedelta(0, 330)
2159
>>> rfc3339_duration_to_delta("P1DT3M20S")
2160
datetime.timedelta(1, 200)
2766
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2768
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2770
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2772
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2774
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2776
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2778
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2163
2782
# Parsing an RFC 3339 duration with regular expressions is not
2164
2783
# possible - there would have to be multiple places for the same
2165
2784
# values, like seconds. The current code, while more esoteric, is
2166
2785
# cleaner without depending on a parsing library. If Python had a
2167
2786
# built-in library for parsing we would use it, but we'd like to
2168
2787
# avoid excessive use of external libraries.
2170
2789
# New type for defining tokens, syntax, and semantics all-in-one
2171
Token = collections.namedtuple("Token",
2172
("regexp", # To match token; if
2173
# "value" is not None,
2174
# must have a "group"
2176
"value", # datetime.timedelta or
2178
"followers")) # Tokens valid after
2180
2790
Token = collections.namedtuple("Token", (
2181
2791
"regexp", # To match token; if "value" is not None, must have
2182
2792
# a "group" containing digits
2571
3192
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2572
3193
service = AvahiServiceToSyslog(
2573
name = server_settings["servicename"],
2574
servicetype = "_mandos._tcp",
2575
protocol = protocol,
3194
name=server_settings["servicename"],
3195
servicetype="_mandos._tcp",
2577
3198
if server_settings["interface"]:
2578
3199
service.interface = if_nametoindex(
2579
3200
server_settings["interface"].encode("utf-8"))
2581
3202
global multiprocessing_manager
2582
3203
multiprocessing_manager = multiprocessing.Manager()
2584
3205
client_class = Client
2586
client_class = functools.partial(ClientDBus, bus = bus)
3207
client_class = functools.partial(ClientDBus, bus=bus)
2588
3209
client_settings = Client.config_parser(client_config)
2589
3210
old_client_settings = {}
2590
3211
clients_data = {}
2592
3213
# This is used to redirect stdout and stderr for checker processes
2594
wnull = open(os.devnull, "w") # A writable /dev/null
3215
wnull = open(os.devnull, "w") # A writable /dev/null
2595
3216
# Only used if server is running in foreground but not in debug
2597
3218
if debug or not foreground:
2600
3221
# Get client data and settings from last running state.
2601
3222
if server_settings["restore"]:
2603
3224
with open(stored_state_path, "rb") as stored_state:
2604
clients_data, old_client_settings = pickle.load(
3225
if sys.version_info.major == 2:
3226
clients_data, old_client_settings = pickle.load(
3229
bytes_clients_data, bytes_old_client_settings = (
3230
pickle.load(stored_state, encoding="bytes"))
3231
# Fix bytes to strings
3234
clients_data = {(key.decode("utf-8")
3235
if isinstance(key, bytes)
3238
bytes_clients_data.items()}
3239
del bytes_clients_data
3240
for key in clients_data:
3241
value = {(k.decode("utf-8")
3242
if isinstance(k, bytes) else k): v
3244
clients_data[key].items()}
3245
clients_data[key] = value
3247
value["client_structure"] = [
3249
if isinstance(s, bytes)
3251
value["client_structure"]]
3252
# .name, .host, and .checker_command
3253
for k in ("name", "host", "checker_command"):
3254
if isinstance(value[k], bytes):
3255
value[k] = value[k].decode("utf-8")
3256
if "key_id" not in value:
3257
value["key_id"] = ""
3258
elif "fingerprint" not in value:
3259
value["fingerprint"] = ""
3260
# old_client_settings
3262
old_client_settings = {
3263
(key.decode("utf-8")
3264
if isinstance(key, bytes)
3267
bytes_old_client_settings.items()}
3268
del bytes_old_client_settings
3269
# .host and .checker_command
3270
for value in old_client_settings.values():
3271
for attribute in ("host", "checker_command"):
3272
if isinstance(value[attribute], bytes):
3273
value[attribute] = (value[attribute]
2606
3275
os.remove(stored_state_path)
2607
3276
except IOError as e:
2608
3277
if e.errno == errno.ENOENT:
2686
3355
for client_name in (set(client_settings)
2687
3356
- set(old_client_settings)):
2688
3357
clients_data[client_name] = client_settings[client_name]
2690
3359
# Create all client objects
2691
3360
for client_name, client in clients_data.items():
2692
3361
tcp_server.clients[client_name] = client_class(
2695
server_settings = server_settings)
3364
server_settings=server_settings)
2697
3366
if not tcp_server.clients:
2698
3367
logger.warning("No clients defined")
2700
3369
if not foreground:
2701
3370
if pidfile is not None:
2705
pidfile.write("{}\n".format(pid).encode("utf-8"))
3374
print(pid, file=pidfile)
2706
3375
except IOError:
2707
3376
logger.error("Could not write to file %r with PID %d",
2708
3377
pidfilename, pid)
2710
3379
del pidfilename
2712
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2713
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3381
for termsig in (signal.SIGHUP, signal.SIGTERM):
3382
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3383
lambda: main_loop.quit() and False)
2717
3387
@alternate_dbus_interfaces(
2718
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2719
class MandosDBusService(DBusObjectWithProperties):
3388
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3389
class MandosDBusService(DBusObjectWithObjectManager):
2720
3390
"""A D-Bus proxy object"""
2722
3392
def __init__(self):
2723
3393
dbus.service.Object.__init__(self, bus, "/")
2725
3395
_interface = "se.recompile.Mandos"
2727
@dbus_interface_annotations(_interface)
2730
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2733
3397
@dbus.service.signal(_interface, signature="o")
2734
3398
def ClientAdded(self, objpath):
2738
3402
@dbus.service.signal(_interface, signature="ss")
2739
def ClientNotFound(self, fingerprint, address):
3403
def ClientNotFound(self, key_id, address):
3407
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2743
3409
@dbus.service.signal(_interface, signature="os")
2744
3410
def ClientRemoved(self, objpath, name):
3414
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2748
3416
@dbus.service.method(_interface, out_signature="ao")
2749
3417
def GetAllClients(self):
2751
3419
return dbus.Array(c.dbus_object_path for c in
2752
tcp_server.clients.itervalues())
3420
tcp_server.clients.values())
3422
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2754
3424
@dbus.service.method(_interface,
2755
3425
out_signature="a{oa{sv}}")
2756
3426
def GetAllClientsWithProperties(self):
2758
3428
return dbus.Dictionary(
2759
{ c.dbus_object_path: c.GetAll("")
2760
for c in tcp_server.clients.itervalues() },
3429
{c.dbus_object_path: c.GetAll(
3430
"se.recompile.Mandos.Client")
3431
for c in tcp_server.clients.values()},
2761
3432
signature="oa{sv}")
2763
3434
@dbus.service.method(_interface, in_signature="o")
2764
3435
def RemoveClient(self, object_path):
2766
for c in tcp_server.clients.itervalues():
3437
for c in tcp_server.clients.values():
2767
3438
if c.dbus_object_path == object_path:
2768
3439
del tcp_server.clients[c.name]
2769
3440
c.remove_from_connection()
2770
# Don't signal anything except ClientRemoved
3441
# Don't signal the disabling
2771
3442
c.disable(quiet=True)
2773
self.ClientRemoved(object_path, c.name)
3443
# Emit D-Bus signal for removal
3444
self.client_removed_signal(c)
2775
3446
raise KeyError(object_path)
3450
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3451
out_signature="a{oa{sa{sv}}}")
3452
def GetManagedObjects(self):
3454
return dbus.Dictionary(
3455
{client.dbus_object_path:
3457
{interface: client.GetAll(interface)
3459
client._get_all_interface_names()})
3460
for client in tcp_server.clients.values()})
3462
def client_added_signal(self, client):
3463
"""Send the new standard signal and the old signal"""
3465
# New standard signal
3466
self.InterfacesAdded(
3467
client.dbus_object_path,
3469
{interface: client.GetAll(interface)
3471
client._get_all_interface_names()}))
3473
self.ClientAdded(client.dbus_object_path)
3475
def client_removed_signal(self, client):
3476
"""Send the new standard signal and the old signal"""
3478
# New standard signal
3479
self.InterfacesRemoved(
3480
client.dbus_object_path,
3481
client._get_all_interface_names())
3483
self.ClientRemoved(client.dbus_object_path,
2779
3486
mandos_dbus_service = MandosDBusService()
3488
# Save modules to variables to exempt the modules from being
3489
# unloaded before the function registered with atexit() is run.
3490
mp = multiprocessing
2782
3494
"Cleanup function; run on exit"
2784
3496
service.cleanup()
2786
multiprocessing.active_children()
3498
mp.active_children()
2788
3500
if not (tcp_server.clients or client_settings):
2791
3503
# Store client before exiting. Secrets are encrypted with key
2792
3504
# based on what config file has. If config file is
2793
3505
# removed/edited, old secret will thus be unrecovable.
2795
3507
with PGPEngine() as pgp:
2796
for client in tcp_server.clients.itervalues():
3508
for client in tcp_server.clients.values():
2797
3509
key = client_settings[client.name]["secret"]
2798
3510
client.encrypted_secret = pgp.encrypt(client.secret,
2800
3512
client_dict = {}
2802
3514
# A list of attributes that can not be pickled
2804
exclude = { "bus", "changedstate", "secret",
2805
"checker", "server_settings" }
3516
exclude = {"bus", "changedstate", "secret",
3517
"checker", "server_settings"}
2806
3518
for name, typ in inspect.getmembers(dbus.service
2808
3520
exclude.add(name)
2810
3522
client_dict["encrypted_secret"] = (client
2811
3523
.encrypted_secret)
2812
3524
for attr in client.client_structure:
2813
3525
if attr not in exclude:
2814
3526
client_dict[attr] = getattr(client, attr)
2816
3528
clients[client.name] = client_dict
2817
3529
del client_settings[client.name]["secret"]
2820
3532
with tempfile.NamedTemporaryFile(