423
523
class AvahiServiceToSyslog(AvahiService):
424
524
def rename(self, *args, **kwargs):
425
525
"""Add the new name to the syslog messages"""
426
ret = AvahiService.rename(self, *args, **kwargs)
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
427
528
syslogger.setFormatter(logging.Formatter(
428
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
429
530
.format(self.name)))
432
534
# Pretend that we have a GnuTLS module
433
class GnuTLS(object):
434
"""This isn't so much a class as it is a module-like namespace.
435
It is instantiated once, and simulates having a GnuTLS module."""
437
_library = ctypes.cdll.LoadLibrary(
438
ctypes.util.find_library("gnutls"))
439
_need_version = "3.3.0"
441
# Need to use class name "GnuTLS" here, since this method is
442
# called before the assignment to the "gnutls" global variable
444
if GnuTLS.check_version(self._need_version) is None:
445
raise GnuTLS.Error("Needs GnuTLS {} or later"
446
.format(self._need_version))
536
"""This isn't so much a class as it is a module-like namespace."""
538
library = ctypes.util.find_library("gnutls")
540
library = ctypes.util.find_library("gnutls-deb0")
541
_library = ctypes.cdll.LoadLibrary(library)
448
544
# Unless otherwise indicated, the constants and types below are
449
545
# all from the gnutls/gnutls.h C header file.
453
549
E_INTERRUPTED = -52
458
555
CRD_CERTIFICATE = 1
459
556
E_NO_CERTIFICATE_FOUND = -49
561
KEYID_USE_SHA256 = 1 # gnutls/x509.h
460
562
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
463
class session_int(ctypes.Structure):
565
class _session_int(ctypes.Structure):
465
session_t = ctypes.POINTER(session_int)
567
session_t = ctypes.POINTER(_session_int)
466
569
class certificate_credentials_st(ctypes.Structure):
468
571
certificate_credentials_t = ctypes.POINTER(
469
572
certificate_credentials_st)
470
573
certificate_type_t = ctypes.c_int
471
575
class datum_t(ctypes.Structure):
472
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
473
('size', ctypes.c_uint)]
474
class openpgp_crt_int(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
579
class _openpgp_crt_int(ctypes.Structure):
476
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
477
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
582
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
478
583
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
479
credentials_type_t = ctypes.c_int #
584
credentials_type_t = ctypes.c_int
480
585
transport_ptr_t = ctypes.c_void_p
481
586
close_request_t = ctypes.c_int
484
589
class Error(Exception):
485
# We need to use the class name "GnuTLS" here, since this
486
# exception might be raised from within GnuTLS.__init__,
487
# which is called before the assignment to the "gnutls"
488
# global variable has happened.
489
def __init__(self, message = None, code = None, args=()):
590
def __init__(self, message=None, code=None, args=()):
490
591
# Default usage is by a message string, but if a return
491
592
# code is passed, convert it to a string with
492
593
# gnutls.strerror()
494
595
if message is None and code is not None:
495
message = GnuTLS.strerror(code)
496
return super(GnuTLS.Error, self).__init__(
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
598
return super(gnutls.Error, self).__init__(
499
601
class CertificateSecurityError(Error):
605
def __init__(self, cls):
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
614
class CastToVoidPointer:
615
def __init__(self, cls):
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
624
class With_from_param:
626
def from_param(cls, obj):
627
return obj._as_parameter_
503
class Credentials(object):
630
class Credentials(With_from_param):
504
631
def __init__(self):
505
self._c_object = gnutls.certificate_credentials_t()
506
gnutls.certificate_allocate_credentials(
507
ctypes.byref(self._c_object))
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
508
634
self.type = gnutls.CRD_CERTIFICATE
510
636
def __del__(self):
511
gnutls.certificate_free_credentials(self._c_object)
513
class ClientSession(object):
514
def __init__(self, socket, credentials = None):
515
self._c_object = gnutls.session_t()
516
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
517
gnutls.set_default_priority(self._c_object)
518
gnutls.transport_set_ptr(self._c_object, socket.fileno())
519
gnutls.handshake_set_private_extensions(self._c_object,
637
gnutls.certificate_free_credentials(self)
639
class ClientSession(With_from_param):
640
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
642
gnutls_flags = gnutls.CLIENT
643
if gnutls.check_version(b"3.5.6"):
644
gnutls_flags |= gnutls.NO_TICKETS
646
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
521
652
self.socket = socket
522
653
if credentials is None:
523
654
credentials = gnutls.Credentials()
524
gnutls.credentials_set(self._c_object, credentials.type,
525
ctypes.cast(credentials._c_object,
655
gnutls.credentials_set(self, credentials.type,
527
657
self.credentials = credentials
529
659
def __del__(self):
530
gnutls.deinit(self._c_object)
532
662
def handshake(self):
533
return gnutls.handshake(self._c_object)
663
return gnutls.handshake(self)
535
665
def send(self, data):
536
666
data = bytes(data)
537
667
data_len = len(data)
538
668
while data_len > 0:
539
data_len -= gnutls.record_send(self._c_object,
669
data_len -= gnutls.record_send(self, data[-data_len:],
544
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
546
675
# Error handling functions
547
676
def _error_code(result):
548
677
"""A function to raise exceptions on errors, suitable
549
for the 'restype' attribute on ctypes functions"""
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
552
681
if result == gnutls.E_NO_CERTIFICATE_FOUND:
553
raise gnutls.CertificateSecurityError(code = result)
554
raise gnutls.Error(code = result)
556
def _retry_on_error(result, func, arguments):
682
raise gnutls.CertificateSecurityError(code=result)
683
raise gnutls.Error(code=result)
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
557
687
"""A function to retry on some errors, suitable
558
for the 'errcheck' attribute on ctypes functions"""
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
560
690
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
561
691
return _error_code(result)
562
692
result = func(*arguments)
565
695
# Unless otherwise indicated, the function declarations below are
566
696
# all from the gnutls/gnutls.h C header file.
569
699
priority_set_direct = _library.gnutls_priority_set_direct
570
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
571
701
ctypes.POINTER(ctypes.c_char_p)]
572
702
priority_set_direct.restype = _error_code
574
704
init = _library.gnutls_init
575
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
576
706
init.restype = _error_code
578
708
set_default_priority = _library.gnutls_set_default_priority
579
set_default_priority.argtypes = [session_t]
709
set_default_priority.argtypes = [ClientSession]
580
710
set_default_priority.restype = _error_code
582
712
record_send = _library.gnutls_record_send
583
record_send.argtypes = [session_t, ctypes.c_void_p,
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
585
715
record_send.restype = ctypes.c_ssize_t
586
716
record_send.errcheck = _retry_on_error
588
718
certificate_allocate_credentials = (
589
719
_library.gnutls_certificate_allocate_credentials)
590
720
certificate_allocate_credentials.argtypes = [
591
ctypes.POINTER(certificate_credentials_t)]
721
PointerTo(Credentials)]
592
722
certificate_allocate_credentials.restype = _error_code
594
724
certificate_free_credentials = (
595
725
_library.gnutls_certificate_free_credentials)
596
certificate_free_credentials.argtypes = [certificate_credentials_t]
726
certificate_free_credentials.argtypes = [Credentials]
597
727
certificate_free_credentials.restype = None
599
729
handshake_set_private_extensions = (
600
730
_library.gnutls_handshake_set_private_extensions)
601
handshake_set_private_extensions.argtypes = [session_t,
731
handshake_set_private_extensions.argtypes = [ClientSession,
603
733
handshake_set_private_extensions.restype = None
605
735
credentials_set = _library.gnutls_credentials_set
606
credentials_set.argtypes = [session_t, credentials_type_t,
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
608
738
credentials_set.restype = _error_code
610
740
strerror = _library.gnutls_strerror
611
741
strerror.argtypes = [ctypes.c_int]
612
742
strerror.restype = ctypes.c_char_p
614
744
certificate_type_get = _library.gnutls_certificate_type_get
615
certificate_type_get.argtypes = [session_t]
745
certificate_type_get.argtypes = [ClientSession]
616
746
certificate_type_get.restype = _error_code
618
748
certificate_get_peers = _library.gnutls_certificate_get_peers
619
certificate_get_peers.argtypes = [session_t,
749
certificate_get_peers.argtypes = [ClientSession,
620
750
ctypes.POINTER(ctypes.c_uint)]
621
751
certificate_get_peers.restype = ctypes.POINTER(datum_t)
623
753
global_set_log_level = _library.gnutls_global_set_log_level
624
754
global_set_log_level.argtypes = [ctypes.c_int]
625
755
global_set_log_level.restype = None
627
757
global_set_log_function = _library.gnutls_global_set_log_function
628
758
global_set_log_function.argtypes = [log_func]
629
759
global_set_log_function.restype = None
631
761
deinit = _library.gnutls_deinit
632
deinit.argtypes = [session_t]
762
deinit.argtypes = [ClientSession]
633
763
deinit.restype = None
635
765
handshake = _library.gnutls_handshake
636
handshake.argtypes = [session_t]
637
handshake.restype = _error_code
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
638
768
handshake.errcheck = _retry_on_error
640
770
transport_set_ptr = _library.gnutls_transport_set_ptr
641
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
642
772
transport_set_ptr.restype = None
644
774
bye = _library.gnutls_bye
645
bye.argtypes = [session_t, close_request_t]
646
bye.restype = _error_code
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
647
777
bye.errcheck = _retry_on_error
649
779
check_version = _library.gnutls_check_version
650
780
check_version.argtypes = [ctypes.c_char_p]
651
781
check_version.restype = ctypes.c_char_p
653
# All the function declarations below are from gnutls/openpgp.h
655
openpgp_crt_init = _library.gnutls_openpgp_crt_init
656
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
657
openpgp_crt_init.restype = _error_code
659
openpgp_crt_import = _library.gnutls_openpgp_crt_import
660
openpgp_crt_import.argtypes = [openpgp_crt_t,
661
ctypes.POINTER(datum_t),
663
openpgp_crt_import.restype = _error_code
665
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
666
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
667
ctypes.POINTER(ctypes.c_uint)]
668
openpgp_crt_verify_self.restype = _error_code
670
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
671
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
672
openpgp_crt_deinit.restype = None
674
openpgp_crt_get_fingerprint = (
675
_library.gnutls_openpgp_crt_get_fingerprint)
676
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
680
openpgp_crt_get_fingerprint.restype = _error_code
783
_need_version = b"3.3.0"
784
if check_version(_need_version) is None:
785
raise self.Error("Needs GnuTLS {} or later"
786
.format(_need_version))
788
_tls_rawpk_version = b"3.6.6"
789
has_rawpk = bool(check_version(_tls_rawpk_version))
793
class pubkey_st(ctypes.Structure):
795
pubkey_t = ctypes.POINTER(pubkey_st)
797
x509_crt_fmt_t = ctypes.c_int
799
# All the function declarations below are from
801
pubkey_init = _library.gnutls_pubkey_init
802
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
pubkey_init.restype = _error_code
805
pubkey_import = _library.gnutls_pubkey_import
806
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
808
pubkey_import.restype = _error_code
810
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
811
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
812
ctypes.POINTER(ctypes.c_ubyte),
813
ctypes.POINTER(ctypes.c_size_t)]
814
pubkey_get_key_id.restype = _error_code
816
pubkey_deinit = _library.gnutls_pubkey_deinit
817
pubkey_deinit.argtypes = [pubkey_t]
818
pubkey_deinit.restype = None
820
# All the function declarations below are from
823
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
825
openpgp_crt_init.restype = _error_code
827
openpgp_crt_import = _library.gnutls_openpgp_crt_import
828
openpgp_crt_import.argtypes = [openpgp_crt_t,
829
ctypes.POINTER(datum_t),
831
openpgp_crt_import.restype = _error_code
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
838
ctypes.POINTER(ctypes.c_uint),
840
openpgp_crt_verify_self.restype = _error_code
842
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
843
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
844
openpgp_crt_deinit.restype = None
846
openpgp_crt_get_fingerprint = (
847
_library.gnutls_openpgp_crt_get_fingerprint)
848
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
852
openpgp_crt_get_fingerprint.restype = _error_code
854
if check_version(b"3.6.4"):
855
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
857
certificate_type_get2.restype = _error_code
682
859
# Remove non-public functions
683
860
del _error_code, _retry_on_error
684
# Create the global "gnutls" object, simulating a module
687
863
def call_pipe(connection, # : multiprocessing.Connection
688
864
func, *args, **kwargs):
689
865
"""This function is meant to be called by multiprocessing.Process
691
867
This function runs func(*args, **kwargs), and writes the resulting
692
868
return value on the provided multiprocessing.Connection.
694
870
connection.send(func(*args, **kwargs))
695
871
connection.close()
697
class Client(object):
698
875
"""A representation of a client host served by this server.
701
approved: bool(); 'None' if not yet approved/disapproved
878
approved: bool(); None if not yet approved/disapproved
702
879
approval_delay: datetime.timedelta(); Time to wait for approval
703
880
approval_duration: datetime.timedelta(); Duration of one approval
704
checker: subprocess.Popen(); a running checker process used
705
to see if the client lives.
706
'None' if no process is running.
707
checker_callback_tag: a gobject event source tag, or None
881
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
884
checker_callback_tag: a GLib event source tag, or None
708
885
checker_command: string; External command which is run to check
709
886
if client lives. %() expansions are done at
710
887
runtime with vars(self) as dict, so that for
711
888
instance %(name)s can be used in the command.
712
checker_initiator_tag: a gobject event source tag, or None
889
checker_initiator_tag: a GLib event source tag, or None
713
890
created: datetime.datetime(); (UTC) object creation
714
891
client_structure: Object describing what attributes a client has
715
892
and is used for storing the client at exit
716
893
current_checker_command: string; current running checker_command
717
disable_initiator_tag: a gobject event source tag, or None
894
disable_initiator_tag: a GLib event source tag, or None
719
896
fingerprint: string (40 or 32 hexadecimal digits); used to
720
uniquely identify the client
897
uniquely identify an OpenPGP client
898
key_id: string (64 hexadecimal digits); used to uniquely identify
899
a client using raw public keys
721
900
host: string; available for use by the checker command
722
901
interval: datetime.timedelta(); How often to start a new checker
723
902
last_approval_request: datetime.datetime(); (UTC) or None
842
1026
self.changedstate = multiprocessing_manager.Condition(
843
1027
multiprocessing_manager.Lock())
844
1028
self.client_structure = [attr
845
for attr in self.__dict__.iterkeys()
1029
for attr in self.__dict__.keys()
846
1030
if not attr.startswith("_")]
847
1031
self.client_structure.append("client_structure")
849
1033
for name, t in inspect.getmembers(
850
1034
type(self), lambda obj: isinstance(obj, property)):
851
1035
if not name.startswith("_"):
852
1036
self.client_structure.append(name)
854
1038
# Send notice to process children that client state has changed
855
1039
def send_changedstate(self):
856
1040
with self.changedstate:
857
1041
self.changedstate.notify_all()
859
1043
def enable(self):
860
1044
"""Start this client's checker and timeout hooks"""
861
1045
if getattr(self, "enabled", False):
862
1046
# Already enabled
864
self.expires = datetime.datetime.utcnow() + self.timeout
865
1048
self.enabled = True
866
1049
self.last_enabled = datetime.datetime.utcnow()
867
1050
self.init_checker()
868
1051
self.send_changedstate()
870
1053
def disable(self, quiet=True):
871
1054
"""Disable this client."""
872
1055
if not getattr(self, "enabled", False):
875
logger.info("Disabling client %s", self.name)
1058
log.info("Disabling client %s", self.name)
876
1059
if getattr(self, "disable_initiator_tag", None) is not None:
877
gobject.source_remove(self.disable_initiator_tag)
1060
GLib.source_remove(self.disable_initiator_tag)
878
1061
self.disable_initiator_tag = None
879
1062
self.expires = None
880
1063
if getattr(self, "checker_initiator_tag", None) is not None:
881
gobject.source_remove(self.checker_initiator_tag)
1064
GLib.source_remove(self.checker_initiator_tag)
882
1065
self.checker_initiator_tag = None
883
1066
self.stop_checker()
884
1067
self.enabled = False
886
1069
self.send_changedstate()
887
# Do not run this again if called by a gobject.timeout_add
1070
# Do not run this again if called by a GLib.timeout_add
890
1073
def __del__(self):
893
def init_checker(self):
894
# Schedule a new checker to be started an 'interval' from now,
895
# and every interval from then on.
1076
def init_checker(self, randomize_start=False):
1077
# Schedule a new checker to be started a randomly selected
1078
# time (a fraction of 'interval') from now. This spreads out
1079
# the startup of checkers over time when the server is
896
1081
if self.checker_initiator_tag is not None:
897
gobject.source_remove(self.checker_initiator_tag)
898
self.checker_initiator_tag = gobject.timeout_add(
899
int(self.interval.total_seconds() * 1000),
901
# Schedule a disable() when 'timeout' has passed
1082
GLib.source_remove(self.checker_initiator_tag)
1083
interval_milliseconds = int(self.interval.total_seconds()
1086
delay_milliseconds = random.randrange(
1087
interval_milliseconds + 1)
1089
delay_milliseconds = interval_milliseconds
1090
self.checker_initiator_tag = GLib.timeout_add(
1091
delay_milliseconds, self.start_checker, randomize_start)
1092
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1093
# A checker might take up to an 'interval' of time, so we can
1094
# expire at the soonest one interval after a checker was
1095
# started. Since the initial checker is delayed, the expire
1096
# time might have to be extended.
1097
now = datetime.datetime.utcnow()
1098
self.expires = now + delay + self.interval
1099
# Schedule a disable() at expire time
902
1100
if self.disable_initiator_tag is not None:
903
gobject.source_remove(self.disable_initiator_tag)
904
self.disable_initiator_tag = gobject.timeout_add(
905
int(self.timeout.total_seconds() * 1000), self.disable)
906
# Also start a new checker *right now*.
1101
GLib.source_remove(self.disable_initiator_tag)
1102
self.disable_initiator_tag = GLib.timeout_add(
1103
int((self.expires - now).total_seconds() * 1000),
909
1106
def checker_callback(self, source, condition, connection,
911
1108
"""The checker has completed, so take appropriate actions."""
912
self.checker_callback_tag = None
914
1109
# Read return code from connection (see call_pipe)
915
1110
returncode = connection.recv()
916
1111
connection.close()
1112
if self.checker is not None:
1114
self.checker_callback_tag = None
918
1117
if returncode >= 0:
919
1118
self.last_checker_status = returncode
920
1119
self.last_checker_signal = None
921
1120
if self.last_checker_status == 0:
922
logger.info("Checker for %(name)s succeeded",
1121
log.info("Checker for %(name)s succeeded", vars(self))
924
1122
self.checked_ok()
926
logger.info("Checker for %(name)s failed", vars(self))
1124
log.info("Checker for %(name)s failed", vars(self))
928
1126
self.last_checker_status = -1
929
1127
self.last_checker_signal = -returncode
930
logger.warning("Checker for %(name)s crashed?",
1128
log.warning("Checker for %(name)s crashed?", vars(self))
934
1131
def checked_ok(self):
935
1132
"""Assert that the client has been seen, alive and well."""
936
1133
self.last_checked_ok = datetime.datetime.utcnow()
937
1134
self.last_checker_status = 0
938
1135
self.last_checker_signal = None
939
1136
self.bump_timeout()
941
1138
def bump_timeout(self, timeout=None):
942
1139
"""Bump up the timeout for this client."""
943
1140
if timeout is None:
944
1141
timeout = self.timeout
945
1142
if self.disable_initiator_tag is not None:
946
gobject.source_remove(self.disable_initiator_tag)
1143
GLib.source_remove(self.disable_initiator_tag)
947
1144
self.disable_initiator_tag = None
948
1145
if getattr(self, "enabled", False):
949
self.disable_initiator_tag = gobject.timeout_add(
1146
self.disable_initiator_tag = GLib.timeout_add(
950
1147
int(timeout.total_seconds() * 1000), self.disable)
951
1148
self.expires = datetime.datetime.utcnow() + timeout
953
1150
def need_approval(self):
954
1151
self.last_approval_request = datetime.datetime.utcnow()
956
def start_checker(self):
1153
def start_checker(self, start_was_randomized=False):
957
1154
"""Start a new checker subprocess if one is not running.
959
1156
If a checker already exists, leave it running and do
961
1158
# The reason for not killing a running checker is that if we
2084
2283
byte_arrays=True)
2085
2284
def Secret_dbus_property(self, value):
2086
2285
self.secret = bytes(value)
2091
class ProxyClient(object):
2092
def __init__(self, child_pipe, fpr, address):
2291
def __init__(self, child_pipe, key_id, fpr, address):
2093
2292
self._pipe = child_pipe
2094
self._pipe.send(('init', fpr, address))
2293
self._pipe.send(("init", key_id, fpr, address))
2095
2294
if not self._pipe.recv():
2295
raise KeyError(key_id or fpr)
2098
2297
def __getattribute__(self, name):
2100
2299
return super(ProxyClient, self).__getattribute__(name)
2101
self._pipe.send(('getattr', name))
2300
self._pipe.send(("getattr", name))
2102
2301
data = self._pipe.recv()
2103
if data[0] == 'data':
2302
if data[0] == "data":
2105
if data[0] == 'function':
2304
if data[0] == "function":
2107
2306
def func(*args, **kwargs):
2108
self._pipe.send(('funcall', name, args, kwargs))
2307
self._pipe.send(("funcall", name, args, kwargs))
2109
2308
return self._pipe.recv()[1]
2113
2312
def __setattr__(self, name, value):
2115
2314
return super(ProxyClient, self).__setattr__(name, value)
2116
self._pipe.send(('setattr', name, value))
2315
self._pipe.send(("setattr", name, value))
2119
2318
class ClientHandler(socketserver.BaseRequestHandler, object):
2120
2319
"""A class to handle client connections.
2122
2321
Instantiated once for each connection to handle it.
2123
2322
Note: This will run in its own forked process."""
2125
2324
def handle(self):
2126
2325
with contextlib.closing(self.server.child_pipe) as child_pipe:
2127
logger.info("TCP connection from: %s",
2128
str(self.client_address))
2129
logger.debug("Pipe FD: %d",
2130
self.server.child_pipe.fileno())
2326
log.info("TCP connection from: %s",
2327
str(self.client_address))
2328
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2132
2330
session = gnutls.ClientSession(self.request)
2134
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2135
# "+AES-256-CBC", "+SHA1",
2136
# "+COMP-NULL", "+CTYPE-OPENPGP",
2332
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2333
# "+AES-256-CBC", "+SHA1",
2334
# "+COMP-NULL", "+CTYPE-OPENPGP",
2138
2336
# Use a fallback default, since this MUST be set.
2139
2337
priority = self.server.gnutls_priority
2140
2338
if priority is None:
2141
2339
priority = "NORMAL"
2142
gnutls.priority_set_direct(session._c_object, priority,
2340
gnutls.priority_set_direct(session,
2341
priority.encode("utf-8"), None)
2145
2343
# Start communication using the Mandos protocol
2146
2344
# Get protocol number
2147
2345
line = self.request.makefile().readline()
2148
logger.debug("Protocol version: %r", line)
2346
log.debug("Protocol version: %r", line)
2150
2348
if int(line.strip().split()[0]) > 1:
2151
2349
raise RuntimeError(line)
2152
2350
except (ValueError, IndexError, RuntimeError) as error:
2153
logger.error("Unknown protocol version: %s", error)
2351
log.error("Unknown protocol version: %s", error)
2156
2354
# Start GnuTLS connection
2158
2356
session.handshake()
2159
2357
except gnutls.Error as error:
2160
logger.warning("Handshake failed: %s", error)
2358
log.warning("Handshake failed: %s", error)
2161
2359
# Do not run session.bye() here: the session is not
2162
2360
# established. Just abandon the request.
2164
logger.debug("Handshake succeeded")
2362
log.debug("Handshake succeeded")
2166
2364
approval_required = False
2169
fpr = self.fingerprint(
2170
self.peer_certificate(session))
2171
except (TypeError, gnutls.Error) as error:
2172
logger.warning("Bad certificate: %s", error)
2174
logger.debug("Fingerprint: %s", fpr)
2177
client = ProxyClient(child_pipe, fpr,
2366
if gnutls.has_rawpk:
2369
key_id = self.key_id(
2370
self.peer_certificate(session))
2371
except (TypeError, gnutls.Error) as error:
2372
log.warning("Bad certificate: %s", error)
2374
log.debug("Key ID: %s",
2375
key_id.decode("utf-8",
2381
fpr = self.fingerprint(
2382
self.peer_certificate(session))
2383
except (TypeError, gnutls.Error) as error:
2384
log.warning("Bad certificate: %s", error)
2386
log.debug("Fingerprint: %s", fpr)
2389
client = ProxyClient(child_pipe, key_id, fpr,
2178
2390
self.client_address)
2179
2391
except KeyError:
2182
2394
if client.approval_delay:
2183
2395
delay = client.approval_delay
2184
2396
client.approvals_pending += 1
2185
2397
approval_required = True
2188
2400
if not client.enabled:
2189
logger.info("Client %s is disabled",
2401
log.info("Client %s is disabled", client.name)
2191
2402
if self.server.use_dbus:
2192
2403
# Emit D-Bus signal
2193
2404
client.Rejected("Disabled")
2196
2407
if client.approved or not client.approval_delay:
2197
#We are approved or approval is disabled
2408
# We are approved or approval is disabled
2199
2410
elif client.approved is None:
2200
logger.info("Client %s needs approval",
2411
log.info("Client %s needs approval",
2202
2413
if self.server.use_dbus:
2203
2414
# Emit D-Bus signal
2204
2415
client.NeedApproval(
2205
2416
client.approval_delay.total_seconds()
2206
2417
* 1000, client.approved_by_default)
2208
logger.warning("Client %s was not approved",
2419
log.warning("Client %s was not approved",
2210
2421
if self.server.use_dbus:
2211
2422
# Emit D-Bus signal
2212
2423
client.Rejected("Denied")
2215
#wait until timeout or approved
2426
# wait until timeout or approved
2216
2427
time = datetime.datetime.now()
2217
2428
client.changedstate.acquire()
2218
2429
client.changedstate.wait(delay.total_seconds())
2469
2727
self.gnutls_priority = gnutls_priority
2470
2728
IPv6_TCPServer.__init__(self, server_address,
2471
2729
RequestHandlerClass,
2472
interface = interface,
2473
use_ipv6 = use_ipv6,
2474
socketfd = socketfd)
2730
interface=interface,
2476
2734
def server_activate(self):
2477
2735
if self.enabled:
2478
2736
return socketserver.TCPServer.server_activate(self)
2480
2738
def enable(self):
2481
2739
self.enabled = True
2483
2741
def add_pipe(self, parent_pipe, proc):
2484
2742
# Call "handle_ipc" for both data and EOF events
2485
gobject.io_add_watch(
2486
parent_pipe.fileno(),
2487
gobject.IO_IN | gobject.IO_HUP,
2744
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2745
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2488
2746
functools.partial(self.handle_ipc,
2489
parent_pipe = parent_pipe,
2747
parent_pipe=parent_pipe,
2492
2750
def handle_ipc(self, source, condition,
2493
2751
parent_pipe=None,
2495
2753
client_object=None):
2496
2754
# error, or the other end of multiprocessing.Pipe has closed
2497
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2755
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2498
2756
# Wait for other process to exit
2502
2760
# Read a request from the child
2503
2761
request = parent_pipe.recv()
2504
2762
command = request[0]
2506
if command == 'init':
2508
address = request[2]
2510
for c in self.clients.itervalues():
2511
if c.fingerprint == fpr:
2764
if command == "init":
2765
key_id = request[1].decode("ascii")
2766
fpr = request[2].decode("ascii")
2767
address = request[3]
2769
for c in self.clients.values():
2770
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2771
"27AE41E4649B934CA495991B7852B855"):
2773
if key_id and c.key_id == key_id:
2776
if fpr and c.fingerprint == fpr:
2515
logger.info("Client not found for fingerprint: %s, ad"
2516
"dress: %s", fpr, address)
2780
log.info("Client not found for key ID: %s, address:"
2781
" %s", key_id or fpr, address)
2517
2782
if self.use_dbus:
2518
2783
# Emit D-Bus signal
2519
mandos_dbus_service.ClientNotFound(fpr,
2784
mandos_dbus_service.ClientNotFound(key_id or fpr,
2521
2786
parent_pipe.send(False)
2524
gobject.io_add_watch(
2525
parent_pipe.fileno(),
2526
gobject.IO_IN | gobject.IO_HUP,
2790
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2791
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2527
2792
functools.partial(self.handle_ipc,
2528
parent_pipe = parent_pipe,
2530
client_object = client))
2793
parent_pipe=parent_pipe,
2795
client_object=client))
2531
2796
parent_pipe.send(True)
2532
2797
# remove the old hook in favor of the new above hook on
2535
if command == 'funcall':
2800
if command == "funcall":
2536
2801
funcname = request[1]
2537
2802
args = request[2]
2538
2803
kwargs = request[3]
2540
parent_pipe.send(('data', getattr(client_object,
2805
parent_pipe.send(("data", getattr(client_object,
2541
2806
funcname)(*args,
2544
if command == 'getattr':
2809
if command == "getattr":
2545
2810
attrname = request[1]
2546
2811
if isinstance(client_object.__getattribute__(attrname),
2547
collections.Callable):
2548
parent_pipe.send(('function', ))
2812
collections.abc.Callable):
2813
parent_pipe.send(("function", ))
2550
2815
parent_pipe.send((
2551
'data', client_object.__getattribute__(attrname)))
2553
if command == 'setattr':
2816
"data", client_object.__getattribute__(attrname)))
2818
if command == "setattr":
2554
2819
attrname = request[1]
2555
2820
value = request[2]
2556
2821
setattr(client_object, attrname, value)
2561
2826
def rfc3339_duration_to_delta(duration):
2562
2827
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2564
>>> rfc3339_duration_to_delta("P7D")
2565
datetime.timedelta(7)
2566
>>> rfc3339_duration_to_delta("PT60S")
2567
datetime.timedelta(0, 60)
2568
>>> rfc3339_duration_to_delta("PT60M")
2569
datetime.timedelta(0, 3600)
2570
>>> rfc3339_duration_to_delta("PT24H")
2571
datetime.timedelta(1)
2572
>>> rfc3339_duration_to_delta("P1W")
2573
datetime.timedelta(7)
2574
>>> rfc3339_duration_to_delta("PT5M30S")
2575
datetime.timedelta(0, 330)
2576
>>> rfc3339_duration_to_delta("P1DT3M20S")
2577
datetime.timedelta(1, 200)
2829
>>> timedelta = datetime.timedelta
2830
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2832
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2834
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2836
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2838
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2840
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2842
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2580
2847
# Parsing an RFC 3339 duration with regular expressions is not
2581
2848
# possible - there would have to be multiple places for the same
2582
2849
# values, like seconds. The current code, while more esoteric, is
2583
2850
# cleaner without depending on a parsing library. If Python had a
2584
2851
# built-in library for parsing we would use it, but we'd like to
2585
2852
# avoid excessive use of external libraries.
2587
2854
# New type for defining tokens, syntax, and semantics all-in-one
2588
2855
Token = collections.namedtuple("Token", (
2589
2856
"regexp", # To match token; if "value" is not None, must have
2971
3248
"se.bsnet.fukt.Mandos", bus,
2972
3249
do_not_queue=True)
2973
3250
except dbus.exceptions.DBusException as e:
2974
logger.error("Disabling D-Bus:", exc_info=e)
3251
log.error("Disabling D-Bus:", exc_info=e)
2975
3252
use_dbus = False
2976
3253
server_settings["use_dbus"] = False
2977
3254
tcp_server.use_dbus = False
2979
3256
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2980
3257
service = AvahiServiceToSyslog(
2981
name = server_settings["servicename"],
2982
servicetype = "_mandos._tcp",
2983
protocol = protocol,
3258
name=server_settings["servicename"],
3259
servicetype="_mandos._tcp",
2985
3262
if server_settings["interface"]:
2986
3263
service.interface = if_nametoindex(
2987
3264
server_settings["interface"].encode("utf-8"))
2989
3266
global multiprocessing_manager
2990
3267
multiprocessing_manager = multiprocessing.Manager()
2992
3269
client_class = Client
2994
client_class = functools.partial(ClientDBus, bus = bus)
3271
client_class = functools.partial(ClientDBus, bus=bus)
2996
3273
client_settings = Client.config_parser(client_config)
2997
3274
old_client_settings = {}
2998
3275
clients_data = {}
3000
3277
# This is used to redirect stdout and stderr for checker processes
3002
wnull = open(os.devnull, "w") # A writable /dev/null
3279
wnull = open(os.devnull, "w") # A writable /dev/null
3003
3280
# Only used if server is running in foreground but not in debug
3005
3282
if debug or not foreground:
3008
3285
# Get client data and settings from last running state.
3009
3286
if server_settings["restore"]:
3011
3288
with open(stored_state_path, "rb") as stored_state:
3012
clients_data, old_client_settings = pickle.load(
3289
if sys.version_info.major == 2:
3290
clients_data, old_client_settings = pickle.load(
3293
bytes_clients_data, bytes_old_client_settings = (
3294
pickle.load(stored_state, encoding="bytes"))
3295
# Fix bytes to strings
3298
clients_data = {(key.decode("utf-8")
3299
if isinstance(key, bytes)
3302
bytes_clients_data.items()}
3303
del bytes_clients_data
3304
for key in clients_data:
3305
value = {(k.decode("utf-8")
3306
if isinstance(k, bytes) else k): v
3308
clients_data[key].items()}
3309
clients_data[key] = value
3311
value["client_structure"] = [
3313
if isinstance(s, bytes)
3315
value["client_structure"]]
3316
# .name, .host, and .checker_command
3317
for k in ("name", "host", "checker_command"):
3318
if isinstance(value[k], bytes):
3319
value[k] = value[k].decode("utf-8")
3320
if "key_id" not in value:
3321
value["key_id"] = ""
3322
elif "fingerprint" not in value:
3323
value["fingerprint"] = ""
3324
# old_client_settings
3326
old_client_settings = {
3327
(key.decode("utf-8")
3328
if isinstance(key, bytes)
3331
bytes_old_client_settings.items()}
3332
del bytes_old_client_settings
3333
# .host and .checker_command
3334
for value in old_client_settings.values():
3335
for attribute in ("host", "checker_command"):
3336
if isinstance(value[attribute], bytes):
3337
value[attribute] = (value[attribute]
3014
3339
os.remove(stored_state_path)
3015
3340
except IOError as e:
3016
3341
if e.errno == errno.ENOENT:
3017
logger.warning("Could not load persistent state:"
3018
" {}".format(os.strerror(e.errno)))
3342
log.warning("Could not load persistent state:"
3343
" %s", os.strerror(e.errno))
3020
logger.critical("Could not load persistent state:",
3345
log.critical("Could not load persistent state:",
3023
3348
except EOFError as e:
3024
logger.warning("Could not load persistent state: "
3349
log.warning("Could not load persistent state: EOFError:",
3028
3352
with PGPEngine() as pgp:
3029
3353
for client_name, client in clients_data.items():
3030
3354
# Skip removed clients
3031
3355
if client_name not in client_settings:
3034
3358
# Decide which value to use after restoring saved state.
3035
3359
# We have three different values: Old config file,
3036
3360
# new config file, and saved state.
3297
3624
mandos_dbus_service.client_removed_signal(client)
3298
3625
client_settings.clear()
3300
3627
atexit.register(cleanup)
3302
for client in tcp_server.clients.itervalues():
3629
for client in tcp_server.clients.values():
3304
3631
# Emit D-Bus signal for adding
3305
3632
mandos_dbus_service.client_added_signal(client)
3306
3633
# Need to initiate checking of clients
3307
3634
if client.enabled:
3308
client.init_checker()
3635
client.init_checker(randomize_start=True)
3310
3637
tcp_server.enable()
3311
3638
tcp_server.server_activate()
3313
3640
# Find out what port we got
3315
3642
service.port = tcp_server.socket.getsockname()[1]
3317
logger.info("Now listening on address %r, port %d,"
3318
" flowinfo %d, scope_id %d",
3319
*tcp_server.socket.getsockname())
3644
log.info("Now listening on address %r, port %d, flowinfo %d,"
3645
" scope_id %d", *tcp_server.socket.getsockname())
3321
logger.info("Now listening on address %r, port %d",
3322
*tcp_server.socket.getsockname())
3324
#service.interface = tcp_server.socket.getsockname()[3]
3647
log.info("Now listening on address %r, port %d",
3648
*tcp_server.socket.getsockname())
3650
# service.interface = tcp_server.socket.getsockname()[3]
3328
3654
# From the Avahi example code
3330
3656
service.activate()
3331
3657
except dbus.exceptions.DBusException as error:
3332
logger.critical("D-Bus Exception", exc_info=error)
3658
log.critical("D-Bus Exception", exc_info=error)
3335
3661
# End of Avahi example code
3337
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3338
lambda *args, **kwargs:
3339
(tcp_server.handle_request
3340
(*args[2:], **kwargs) or True))
3342
logger.debug("Starting main loop")
3664
GLib.IOChannel.unix_new(tcp_server.fileno()),
3665
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3666
lambda *args, **kwargs: (tcp_server.handle_request
3667
(*args[2:], **kwargs) or True))
3669
log.debug("Starting main loop")
3343
3670
main_loop.run()
3344
3671
except AvahiError as error:
3345
logger.critical("Avahi Error", exc_info=error)
3672
log.critical("Avahi Error", exc_info=error)
3348
3675
except KeyboardInterrupt:
3350
3677
print("", file=sys.stderr)
3351
logger.debug("Server received KeyboardInterrupt")
3352
logger.debug("Server exiting")
3678
log.debug("Server received KeyboardInterrupt")
3679
log.debug("Server exiting")
3353
3680
# Must run before the D-Bus bus name gets deregistered
3357
if __name__ == '__main__':
3684
def parse_test_args():
3685
# type: () -> argparse.Namespace
3686
parser = argparse.ArgumentParser(add_help=False)
3687
parser.add_argument("--check", action="store_true")
3688
parser.add_argument("--prefix", )
3689
args, unknown_args = parser.parse_known_args()
3691
# Remove test options from sys.argv
3692
sys.argv[1:] = unknown_args
3695
# Add all tests from doctest strings
3696
def load_tests(loader, tests, none):
3698
tests.addTests(doctest.DocTestSuite())
3701
if __name__ == "__main__":
3702
options = parse_test_args()
3705
extra_test_prefix = options.prefix
3706
if extra_test_prefix is not None:
3707
if not (unittest.main(argv=[""], exit=False)
3708
.result.wasSuccessful()):
3710
class ExtraTestLoader(unittest.TestLoader):
3711
testMethodPrefix = extra_test_prefix
3712
# Call using ./scriptname --test [--verbose]
3713
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3715
unittest.main(argv=[""])
3723
# (lambda (&optional extra)
3724
# (if (not (funcall run-tests-in-test-buffer default-directory
3726
# (funcall show-test-buffer-in-test-window)
3727
# (funcall remove-test-window)
3728
# (if extra (message "Extra tests run successfully!"))))
3729
# run-tests-in-test-buffer:
3730
# (lambda (dir &optional extra)
3731
# (with-current-buffer (get-buffer-create "*Test*")
3732
# (setq buffer-read-only nil
3733
# default-directory dir)
3735
# (compilation-mode))
3736
# (let ((process-result
3737
# (let ((inhibit-read-only t))
3738
# (process-file-shell-command
3739
# (funcall get-command-line extra) nil "*Test*"))))
3740
# (and (numberp process-result)
3741
# (= process-result 0))))
3743
# (lambda (&optional extra)
3744
# (let ((quoted-script
3745
# (shell-quote-argument (funcall get-script-name))))
3747
# (concat "%s --check" (if extra " --prefix=atest" ""))
3751
# (if (fboundp 'file-local-name)
3752
# (file-local-name (buffer-file-name))
3753
# (or (file-remote-p (buffer-file-name) 'localname)
3754
# (buffer-file-name))))
3755
# remove-test-window:
3757
# (let ((test-window (get-buffer-window "*Test*")))
3758
# (if test-window (delete-window test-window))))
3759
# show-test-buffer-in-test-window:
3761
# (when (not (get-buffer-window-list "*Test*"))
3762
# (setq next-error-last-buffer (get-buffer "*Test*"))
3763
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3764
# (display-buffer-overriding-action
3765
# `((display-buffer-in-side-window) (side . ,side)
3766
# (window-height . fit-window-to-buffer)
3767
# (window-width . fit-window-to-buffer))))
3768
# (display-buffer "*Test*"))))
3771
# (let* ((run-extra-tests (lambda () (interactive)
3772
# (funcall run-tests t)))
3773
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3774
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3775
# (setq minor-mode-overriding-map-alist
3776
# (cons `(run-tests . ,outer-keymap)
3777
# minor-mode-overriding-map-alist)))
3778
# (add-hook 'after-save-hook run-tests 90 t))