2
2
# -*- mode: python; coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
17
# This file is part of Mandos.
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
32
# Contact the authors at <mandos@recompile.se>.
34
35
from __future__ import (division, absolute_import, print_function,
37
from future_builtins import *
39
from future_builtins import *
40
44
import SocketServer as socketserver
195
236
.replace(b"\n", b"\\n")
196
237
.replace(b"\0", b"\\x00"))
199
240
def encrypt(self, data, password):
200
241
passphrase = self.password_encode(password)
201
242
with tempfile.NamedTemporaryFile(
202
243
dir=self.tempdir) as passfile:
203
244
passfile.write(passphrase)
205
proc = subprocess.Popen(['gpg', '--symmetric',
246
proc = subprocess.Popen([self.gpg, '--symmetric',
206
247
'--passphrase-file',
208
249
+ self.gnupgargs,
209
stdin = subprocess.PIPE,
210
stdout = subprocess.PIPE,
211
stderr = subprocess.PIPE)
212
ciphertext, err = proc.communicate(input = data)
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
213
254
if proc.returncode != 0:
214
255
raise PGPError(err)
215
256
return ciphertext
217
258
def decrypt(self, data, password):
218
259
passphrase = self.password_encode(password)
219
260
with tempfile.NamedTemporaryFile(
220
dir = self.tempdir) as passfile:
261
dir=self.tempdir) as passfile:
221
262
passfile.write(passphrase)
223
proc = subprocess.Popen(['gpg', '--decrypt',
264
proc = subprocess.Popen([self.gpg, '--decrypt',
224
265
'--passphrase-file',
226
267
+ self.gnupgargs,
227
stdin = subprocess.PIPE,
228
stdout = subprocess.PIPE,
229
stderr = subprocess.PIPE)
230
decrypted_plaintext, err = proc.communicate(input = data)
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
231
272
if proc.returncode != 0:
232
273
raise PGPError(err)
233
274
return decrypted_plaintext
277
# Pretend that we have an Avahi module
279
"""This isn't so much a class as it is a module-like namespace."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
290
def string_array_to_txt_array(t):
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
236
303
class AvahiError(Exception):
237
304
def __init__(self, value, *args, **kwargs):
238
305
self.value = value
417
495
class AvahiServiceToSyslog(AvahiService):
418
496
def rename(self, *args, **kwargs):
419
497
"""Add the new name to the syslog messages"""
420
ret = AvahiService.rename(self, *args, **kwargs)
498
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
421
499
syslogger.setFormatter(logging.Formatter(
422
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
423
501
.format(self.name)))
505
# Pretend that we have a GnuTLS module
506
class gnutls(object):
507
"""This isn't so much a class as it is a module-like namespace."""
509
library = ctypes.util.find_library("gnutls")
511
library = ctypes.util.find_library("gnutls-deb0")
512
_library = ctypes.cdll.LoadLibrary(library)
515
# Unless otherwise indicated, the constants and types below are
516
# all from the gnutls/gnutls.h C header file.
527
E_NO_CERTIFICATE_FOUND = -49
532
KEYID_USE_SHA256 = 1 # gnutls/x509.h
533
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
536
class session_int(ctypes.Structure):
538
session_t = ctypes.POINTER(session_int)
540
class certificate_credentials_st(ctypes.Structure):
542
certificate_credentials_t = ctypes.POINTER(
543
certificate_credentials_st)
544
certificate_type_t = ctypes.c_int
546
class datum_t(ctypes.Structure):
547
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
548
('size', ctypes.c_uint)]
550
class openpgp_crt_int(ctypes.Structure):
552
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
553
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
554
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
555
credentials_type_t = ctypes.c_int
556
transport_ptr_t = ctypes.c_void_p
557
close_request_t = ctypes.c_int
560
class Error(Exception):
561
def __init__(self, message=None, code=None, args=()):
562
# Default usage is by a message string, but if a return
563
# code is passed, convert it to a string with
566
if message is None and code is not None:
567
message = gnutls.strerror(code)
568
return super(gnutls.Error, self).__init__(
571
class CertificateSecurityError(Error):
575
class Credentials(object):
577
self._c_object = gnutls.certificate_credentials_t()
578
gnutls.certificate_allocate_credentials(
579
ctypes.byref(self._c_object))
580
self.type = gnutls.CRD_CERTIFICATE
583
gnutls.certificate_free_credentials(self._c_object)
585
class ClientSession(object):
586
def __init__(self, socket, credentials=None):
587
self._c_object = gnutls.session_t()
588
gnutls_flags = gnutls.CLIENT
589
if gnutls.check_version("3.5.6"):
590
gnutls_flags |= gnutls.NO_TICKETS
592
gnutls_flags |= gnutls.ENABLE_RAWPK
593
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
595
gnutls.set_default_priority(self._c_object)
596
gnutls.transport_set_ptr(self._c_object, socket.fileno())
597
gnutls.handshake_set_private_extensions(self._c_object,
600
if credentials is None:
601
credentials = gnutls.Credentials()
602
gnutls.credentials_set(self._c_object, credentials.type,
603
ctypes.cast(credentials._c_object,
605
self.credentials = credentials
608
gnutls.deinit(self._c_object)
611
return gnutls.handshake(self._c_object)
613
def send(self, data):
617
data_len -= gnutls.record_send(self._c_object,
622
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
624
# Error handling functions
625
def _error_code(result):
626
"""A function to raise exceptions on errors, suitable
627
for the 'restype' attribute on ctypes functions"""
630
if result == gnutls.E_NO_CERTIFICATE_FOUND:
631
raise gnutls.CertificateSecurityError(code=result)
632
raise gnutls.Error(code=result)
634
def _retry_on_error(result, func, arguments):
635
"""A function to retry on some errors, suitable
636
for the 'errcheck' attribute on ctypes functions"""
638
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
639
return _error_code(result)
640
result = func(*arguments)
643
# Unless otherwise indicated, the function declarations below are
644
# all from the gnutls/gnutls.h C header file.
647
priority_set_direct = _library.gnutls_priority_set_direct
648
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
649
ctypes.POINTER(ctypes.c_char_p)]
650
priority_set_direct.restype = _error_code
652
init = _library.gnutls_init
653
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
654
init.restype = _error_code
656
set_default_priority = _library.gnutls_set_default_priority
657
set_default_priority.argtypes = [session_t]
658
set_default_priority.restype = _error_code
660
record_send = _library.gnutls_record_send
661
record_send.argtypes = [session_t, ctypes.c_void_p,
663
record_send.restype = ctypes.c_ssize_t
664
record_send.errcheck = _retry_on_error
666
certificate_allocate_credentials = (
667
_library.gnutls_certificate_allocate_credentials)
668
certificate_allocate_credentials.argtypes = [
669
ctypes.POINTER(certificate_credentials_t)]
670
certificate_allocate_credentials.restype = _error_code
672
certificate_free_credentials = (
673
_library.gnutls_certificate_free_credentials)
674
certificate_free_credentials.argtypes = [
675
certificate_credentials_t]
676
certificate_free_credentials.restype = None
678
handshake_set_private_extensions = (
679
_library.gnutls_handshake_set_private_extensions)
680
handshake_set_private_extensions.argtypes = [session_t,
682
handshake_set_private_extensions.restype = None
684
credentials_set = _library.gnutls_credentials_set
685
credentials_set.argtypes = [session_t, credentials_type_t,
687
credentials_set.restype = _error_code
689
strerror = _library.gnutls_strerror
690
strerror.argtypes = [ctypes.c_int]
691
strerror.restype = ctypes.c_char_p
693
certificate_type_get = _library.gnutls_certificate_type_get
694
certificate_type_get.argtypes = [session_t]
695
certificate_type_get.restype = _error_code
697
certificate_get_peers = _library.gnutls_certificate_get_peers
698
certificate_get_peers.argtypes = [session_t,
699
ctypes.POINTER(ctypes.c_uint)]
700
certificate_get_peers.restype = ctypes.POINTER(datum_t)
702
global_set_log_level = _library.gnutls_global_set_log_level
703
global_set_log_level.argtypes = [ctypes.c_int]
704
global_set_log_level.restype = None
706
global_set_log_function = _library.gnutls_global_set_log_function
707
global_set_log_function.argtypes = [log_func]
708
global_set_log_function.restype = None
710
deinit = _library.gnutls_deinit
711
deinit.argtypes = [session_t]
712
deinit.restype = None
714
handshake = _library.gnutls_handshake
715
handshake.argtypes = [session_t]
716
handshake.restype = _error_code
717
handshake.errcheck = _retry_on_error
719
transport_set_ptr = _library.gnutls_transport_set_ptr
720
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
721
transport_set_ptr.restype = None
723
bye = _library.gnutls_bye
724
bye.argtypes = [session_t, close_request_t]
725
bye.restype = _error_code
726
bye.errcheck = _retry_on_error
728
check_version = _library.gnutls_check_version
729
check_version.argtypes = [ctypes.c_char_p]
730
check_version.restype = ctypes.c_char_p
732
_need_version = b"3.3.0"
733
if check_version(_need_version) is None:
734
raise self.Error("Needs GnuTLS {} or later"
735
.format(_need_version))
737
_tls_rawpk_version = b"3.6.6"
738
has_rawpk = bool(check_version(_tls_rawpk_version))
742
class pubkey_st(ctypes.Structure):
744
pubkey_t = ctypes.POINTER(pubkey_st)
746
x509_crt_fmt_t = ctypes.c_int
748
# All the function declarations below are from gnutls/abstract.h
749
pubkey_init = _library.gnutls_pubkey_init
750
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
751
pubkey_init.restype = _error_code
753
pubkey_import = _library.gnutls_pubkey_import
754
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
756
pubkey_import.restype = _error_code
758
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
759
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
760
ctypes.POINTER(ctypes.c_ubyte),
761
ctypes.POINTER(ctypes.c_size_t)]
762
pubkey_get_key_id.restype = _error_code
764
pubkey_deinit = _library.gnutls_pubkey_deinit
765
pubkey_deinit.argtypes = [pubkey_t]
766
pubkey_deinit.restype = None
768
# All the function declarations below are from gnutls/openpgp.h
770
openpgp_crt_init = _library.gnutls_openpgp_crt_init
771
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
772
openpgp_crt_init.restype = _error_code
774
openpgp_crt_import = _library.gnutls_openpgp_crt_import
775
openpgp_crt_import.argtypes = [openpgp_crt_t,
776
ctypes.POINTER(datum_t),
778
openpgp_crt_import.restype = _error_code
780
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
781
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
782
ctypes.POINTER(ctypes.c_uint)]
783
openpgp_crt_verify_self.restype = _error_code
785
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
786
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
787
openpgp_crt_deinit.restype = None
789
openpgp_crt_get_fingerprint = (
790
_library.gnutls_openpgp_crt_get_fingerprint)
791
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
795
openpgp_crt_get_fingerprint.restype = _error_code
797
if check_version("3.6.4"):
798
certificate_type_get2 = _library.gnutls_certificate_type_get2
799
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
800
certificate_type_get2.restype = _error_code
802
# Remove non-public functions
803
del _error_code, _retry_on_error
426
806
def call_pipe(connection, # : multiprocessing.Connection
427
807
func, *args, **kwargs):
428
808
"""This function is meant to be called by multiprocessing.Process
430
810
This function runs func(*args, **kwargs), and writes the resulting
431
811
return value on the provided multiprocessing.Connection.
433
813
connection.send(func(*args, **kwargs))
434
814
connection.close()
436
817
class Client(object):
437
818
"""A representation of a client host served by this server.
440
821
approved: bool(); 'None' if not yet approved/disapproved
441
822
approval_delay: datetime.timedelta(); Time to wait for approval
614
1002
logger.info("Disabling client %s", self.name)
615
1003
if getattr(self, "disable_initiator_tag", None) is not None:
616
gobject.source_remove(self.disable_initiator_tag)
1004
GLib.source_remove(self.disable_initiator_tag)
617
1005
self.disable_initiator_tag = None
618
1006
self.expires = None
619
1007
if getattr(self, "checker_initiator_tag", None) is not None:
620
gobject.source_remove(self.checker_initiator_tag)
1008
GLib.source_remove(self.checker_initiator_tag)
621
1009
self.checker_initiator_tag = None
622
1010
self.stop_checker()
623
1011
self.enabled = False
625
1013
self.send_changedstate()
626
# Do not run this again if called by a gobject.timeout_add
1014
# Do not run this again if called by a GLib.timeout_add
629
1017
def __del__(self):
632
1020
def init_checker(self):
633
1021
# Schedule a new checker to be started an 'interval' from now,
634
1022
# and every interval from then on.
635
1023
if self.checker_initiator_tag is not None:
636
gobject.source_remove(self.checker_initiator_tag)
637
self.checker_initiator_tag = gobject.timeout_add(
1024
GLib.source_remove(self.checker_initiator_tag)
1025
self.checker_initiator_tag = GLib.timeout_add(
638
1026
int(self.interval.total_seconds() * 1000),
639
1027
self.start_checker)
640
1028
# Schedule a disable() when 'timeout' has passed
641
1029
if self.disable_initiator_tag is not None:
642
gobject.source_remove(self.disable_initiator_tag)
643
self.disable_initiator_tag = gobject.timeout_add(
1030
GLib.source_remove(self.disable_initiator_tag)
1031
self.disable_initiator_tag = GLib.timeout_add(
644
1032
int(self.timeout.total_seconds() * 1000), self.disable)
645
1033
# Also start a new checker *right now*.
646
1034
self.start_checker()
648
def checker_callback(self, source, condition,
649
(connection, command)):
1036
def checker_callback(self, source, condition, connection,
650
1038
"""The checker has completed, so take appropriate actions."""
651
1039
self.checker_callback_tag = None
652
1040
self.checker = None
653
1041
# Read return code from connection (see call_pipe)
654
1042
returncode = connection.recv()
655
1043
connection.close()
657
1045
if returncode >= 0:
658
1046
self.last_checker_status = returncode
659
1047
self.last_checker_signal = None
883
1272
for cls in self.__class__.__mro__
884
1273
for name, athing in
885
1274
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1276
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1278
path_keyword='object_path',
1279
connection_keyword='connection')
1280
def Introspect(self, object_path, connection):
1281
"""Overloading of standard D-Bus method.
1283
Inserts annotation tags on methods and signals.
1285
xmlstring = dbus.service.Object.Introspect(self, object_path,
1288
document = xml.dom.minidom.parseString(xmlstring)
1290
for if_tag in document.getElementsByTagName("interface"):
1291
# Add annotation tags
1292
for typ in ("method", "signal"):
1293
for tag in if_tag.getElementsByTagName(typ):
1295
for name, prop in (self.
1296
_get_all_dbus_things(typ)):
1297
if (name == tag.getAttribute("name")
1298
and prop._dbus_interface
1299
== if_tag.getAttribute("name")):
1300
annots.update(getattr(
1301
prop, "_dbus_annotations", {}))
1302
for name, value in annots.items():
1303
ann_tag = document.createElement(
1305
ann_tag.setAttribute("name", name)
1306
ann_tag.setAttribute("value", value)
1307
tag.appendChild(ann_tag)
1308
# Add interface annotation tags
1309
for annotation, value in dict(
1310
itertools.chain.from_iterable(
1311
annotations().items()
1312
for name, annotations
1313
in self._get_all_dbus_things("interface")
1314
if name == if_tag.getAttribute("name")
1316
ann_tag = document.createElement("annotation")
1317
ann_tag.setAttribute("name", annotation)
1318
ann_tag.setAttribute("value", value)
1319
if_tag.appendChild(ann_tag)
1320
# Fix argument name for the Introspect method itself
1321
if (if_tag.getAttribute("name")
1322
== dbus.INTROSPECTABLE_IFACE):
1323
for cn in if_tag.getElementsByTagName("method"):
1324
if cn.getAttribute("name") == "Introspect":
1325
for arg in cn.getElementsByTagName("arg"):
1326
if (arg.getAttribute("direction")
1328
arg.setAttribute("name",
1330
xmlstring = document.toxml("utf-8")
1332
except (AttributeError, xml.dom.DOMException,
1333
xml.parsers.expat.ExpatError) as error:
1334
logger.error("Failed to override Introspection method",
1339
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1340
"""A D-Bus object with properties.
1342
Classes inheriting from this can use the dbus_service_property
1343
decorator to expose methods as D-Bus properties. It exposes the
1344
standard Get(), Set(), and GetAll() methods on the D-Bus.
887
1347
def _get_dbus_property(self, interface_name, property_name):
888
1348
"""Returns a bound method if one exists which is a D-Bus
889
1349
property with the specified name and interface.
1047
1504
return xmlstring
1508
dbus.OBJECT_MANAGER_IFACE
1509
except AttributeError:
1510
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1513
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1514
"""A D-Bus object with an ObjectManager.
1516
Classes inheriting from this exposes the standard
1517
GetManagedObjects call and the InterfacesAdded and
1518
InterfacesRemoved signals on the standard
1519
"org.freedesktop.DBus.ObjectManager" interface.
1521
Note: No signals are sent automatically; they must be sent
1524
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1525
out_signature="a{oa{sa{sv}}}")
1526
def GetManagedObjects(self):
1527
"""This function must be overridden"""
1528
raise NotImplementedError()
1530
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1531
signature="oa{sa{sv}}")
1532
def InterfacesAdded(self, object_path, interfaces_and_properties):
1535
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1536
def InterfacesRemoved(self, object_path, interfaces):
1539
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1541
path_keyword='object_path',
1542
connection_keyword='connection')
1543
def Introspect(self, object_path, connection):
1544
"""Overloading of standard D-Bus method.
1546
Override return argument name of GetManagedObjects to be
1547
"objpath_interfaces_and_properties"
1549
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1553
document = xml.dom.minidom.parseString(xmlstring)
1555
for if_tag in document.getElementsByTagName("interface"):
1556
# Fix argument name for the GetManagedObjects method
1557
if (if_tag.getAttribute("name")
1558
== dbus.OBJECT_MANAGER_IFACE):
1559
for cn in if_tag.getElementsByTagName("method"):
1560
if (cn.getAttribute("name")
1561
== "GetManagedObjects"):
1562
for arg in cn.getElementsByTagName("arg"):
1563
if (arg.getAttribute("direction")
1567
"objpath_interfaces"
1569
xmlstring = document.toxml("utf-8")
1571
except (AttributeError, xml.dom.DOMException,
1572
xml.parsers.expat.ExpatError) as error:
1573
logger.error("Failed to override Introspection method",
1050
1578
def datetime_to_dbus(dt, variant_level=0):
1051
1579
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1053
return dbus.String("", variant_level = variant_level)
1581
return dbus.String("", variant_level=variant_level)
1054
1582
return dbus.String(dt.isoformat(), variant_level=variant_level)
1806
2366
delay -= time2 - time
1809
while sent_size < len(client.secret):
1811
sent = session.send(client.secret[sent_size:])
1812
except gnutls.errors.GNUTLSError as error:
1813
logger.warning("gnutls send failed",
1816
logger.debug("Sent: %d, remaining: %d", sent,
1817
len(client.secret) - (sent_size
2369
session.send(client.secret)
2370
except gnutls.Error as error:
2371
logger.warning("gnutls send failed",
1821
2375
logger.info("Sending secret to %s", client.name)
1822
2376
# bump the timeout using extended_timeout
1823
2377
client.bump_timeout(client.extended_timeout)
1824
2378
if self.server.use_dbus:
1825
2379
# Emit D-Bus signal
1826
2380
client.GotSecret()
1829
2383
if approval_required:
1830
2384
client.approvals_pending -= 1
1833
except gnutls.errors.GNUTLSError as error:
2387
except gnutls.Error as error:
1834
2388
logger.warning("GnuTLS bye failed",
1835
2389
exc_info=error)
1838
2392
def peer_certificate(session):
1839
"Return the peer's OpenPGP certificate as a bytestring"
1840
# If not an OpenPGP certificate...
1841
if (gnutls.library.functions.gnutls_certificate_type_get(
1843
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1844
# ...do the normal thing
1845
return session.peer_certificate
2393
"Return the peer's certificate as a bytestring"
2395
cert_type = gnutls.certificate_type_get2(session._c_object,
2397
except AttributeError:
2398
cert_type = gnutls.certificate_type_get(session._c_object)
2399
if gnutls.has_rawpk:
2400
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2402
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2403
# If not a valid certificate type...
2404
if cert_type not in valid_cert_types:
2405
logger.info("Cert type %r not in %r", cert_type,
2407
# ...return invalid data
1846
2409
list_size = ctypes.c_uint(1)
1847
cert_list = (gnutls.library.functions
1848
.gnutls_certificate_get_peers
2410
cert_list = (gnutls.certificate_get_peers
1849
2411
(session._c_object, ctypes.byref(list_size)))
1850
2412
if not bool(cert_list) and list_size.value != 0:
1851
raise gnutls.errors.GNUTLSError("error getting peer"
2413
raise gnutls.Error("error getting peer certificate")
1853
2414
if list_size.value == 0:
1855
2416
cert = cert_list[0]
1856
2417
return ctypes.string_at(cert.data, cert.size)
2420
def key_id(certificate):
2421
"Convert a certificate bytestring to a hexdigit key ID"
2422
# New GnuTLS "datum" with the public key
2423
datum = gnutls.datum_t(
2424
ctypes.cast(ctypes.c_char_p(certificate),
2425
ctypes.POINTER(ctypes.c_ubyte)),
2426
ctypes.c_uint(len(certificate)))
2427
# XXX all these need to be created in the gnutls "module"
2428
# New empty GnuTLS certificate
2429
pubkey = gnutls.pubkey_t()
2430
gnutls.pubkey_init(ctypes.byref(pubkey))
2431
# Import the raw public key into the certificate
2432
gnutls.pubkey_import(pubkey,
2433
ctypes.byref(datum),
2434
gnutls.X509_FMT_DER)
2435
# New buffer for the key ID
2436
buf = ctypes.create_string_buffer(32)
2437
buf_len = ctypes.c_size_t(len(buf))
2438
# Get the key ID from the raw public key into the buffer
2439
gnutls.pubkey_get_key_id(pubkey,
2440
gnutls.KEYID_USE_SHA256,
2441
ctypes.cast(ctypes.byref(buf),
2442
ctypes.POINTER(ctypes.c_ubyte)),
2443
ctypes.byref(buf_len))
2444
# Deinit the certificate
2445
gnutls.pubkey_deinit(pubkey)
2447
# Convert the buffer to a Python bytestring
2448
key_id = ctypes.string_at(buf, buf_len.value)
2449
# Convert the bytestring to hexadecimal notation
2450
hex_key_id = binascii.hexlify(key_id).upper()
1859
2454
def fingerprint(openpgp):
1860
2455
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1861
2456
# New GnuTLS "datum" with the OpenPGP public key
1862
datum = gnutls.library.types.gnutls_datum_t(
2457
datum = gnutls.datum_t(
1863
2458
ctypes.cast(ctypes.c_char_p(openpgp),
1864
2459
ctypes.POINTER(ctypes.c_ubyte)),
1865
2460
ctypes.c_uint(len(openpgp)))
1866
2461
# New empty GnuTLS certificate
1867
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1868
gnutls.library.functions.gnutls_openpgp_crt_init(
2462
crt = gnutls.openpgp_crt_t()
2463
gnutls.openpgp_crt_init(ctypes.byref(crt))
1870
2464
# Import the OpenPGP public key into the certificate
1871
gnutls.library.functions.gnutls_openpgp_crt_import(
1872
crt, ctypes.byref(datum),
1873
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2465
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2466
gnutls.OPENPGP_FMT_RAW)
1874
2467
# Verify the self signature in the key
1875
2468
crtverify = ctypes.c_uint()
1876
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1877
crt, 0, ctypes.byref(crtverify))
2469
gnutls.openpgp_crt_verify_self(crt, 0,
2470
ctypes.byref(crtverify))
1878
2471
if crtverify.value != 0:
1879
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1880
raise gnutls.errors.CertificateSecurityError(
2472
gnutls.openpgp_crt_deinit(crt)
2473
raise gnutls.CertificateSecurityError(code
1882
2475
# New buffer for the fingerprint
1883
2476
buf = ctypes.create_string_buffer(20)
1884
2477
buf_len = ctypes.c_size_t()
1885
2478
# Get the fingerprint from the certificate into the buffer
1886
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1887
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2479
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2480
ctypes.byref(buf_len))
1888
2481
# Deinit the certificate
1889
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2482
gnutls.openpgp_crt_deinit(crt)
1890
2483
# Convert the buffer to a Python bytestring
1891
2484
fpr = ctypes.string_at(buf, buf_len.value)
1892
2485
# Convert the bytestring to hexadecimal notation
1980
2574
# socket_wrapper(), if socketfd was set.
1981
2575
socketserver.TCPServer.__init__(self, server_address,
1982
2576
RequestHandlerClass)
1984
2578
def server_bind(self):
1985
2579
"""This overrides the normal server_bind() function
1986
2580
to bind to an interface if one was specified, and also NOT to
1987
2581
bind to an address or port if they were not specified."""
2582
global SO_BINDTODEVICE
1988
2583
if self.interface is not None:
1989
2584
if SO_BINDTODEVICE is None:
1990
logger.error("SO_BINDTODEVICE does not exist;"
1991
" cannot bind to interface %s",
1995
self.socket.setsockopt(
1996
socket.SOL_SOCKET, SO_BINDTODEVICE,
1997
(self.interface + "\0").encode("utf-8"))
1998
except socket.error as error:
1999
if error.errno == errno.EPERM:
2000
logger.error("No permission to bind to"
2001
" interface %s", self.interface)
2002
elif error.errno == errno.ENOPROTOOPT:
2003
logger.error("SO_BINDTODEVICE not available;"
2004
" cannot bind to interface %s",
2006
elif error.errno == errno.ENODEV:
2007
logger.error("Interface %s does not exist,"
2008
" cannot bind", self.interface)
2585
# Fall back to a hard-coded value which seems to be
2587
logger.warning("SO_BINDTODEVICE not found, trying 25")
2588
SO_BINDTODEVICE = 25
2590
self.socket.setsockopt(
2591
socket.SOL_SOCKET, SO_BINDTODEVICE,
2592
(self.interface + "\0").encode("utf-8"))
2593
except socket.error as error:
2594
if error.errno == errno.EPERM:
2595
logger.error("No permission to bind to"
2596
" interface %s", self.interface)
2597
elif error.errno == errno.ENOPROTOOPT:
2598
logger.error("SO_BINDTODEVICE not available;"
2599
" cannot bind to interface %s",
2601
elif error.errno == errno.ENODEV:
2602
logger.error("Interface %s does not exist,"
2603
" cannot bind", self.interface)
2011
2606
# Only bind(2) the socket if we really need to.
2012
2607
if self.server_address[0] or self.server_address[1]:
2013
2608
if not self.server_address[0]:
2014
2609
if self.address_family == socket.AF_INET6:
2015
any_address = "::" # in6addr_any
2610
any_address = "::" # in6addr_any
2017
any_address = "0.0.0.0" # INADDR_ANY
2612
any_address = "0.0.0.0" # INADDR_ANY
2018
2613
self.server_address = (any_address,
2019
2614
self.server_address[1])
2020
2615
elif not self.server_address[1]:
2054
2649
self.gnutls_priority = gnutls_priority
2055
2650
IPv6_TCPServer.__init__(self, server_address,
2056
2651
RequestHandlerClass,
2057
interface = interface,
2058
use_ipv6 = use_ipv6,
2059
socketfd = socketfd)
2652
interface=interface,
2061
2656
def server_activate(self):
2062
2657
if self.enabled:
2063
2658
return socketserver.TCPServer.server_activate(self)
2065
2660
def enable(self):
2066
2661
self.enabled = True
2068
2663
def add_pipe(self, parent_pipe, proc):
2069
2664
# Call "handle_ipc" for both data and EOF events
2070
gobject.io_add_watch(
2071
2666
parent_pipe.fileno(),
2072
gobject.IO_IN | gobject.IO_HUP,
2667
GLib.IO_IN | GLib.IO_HUP,
2073
2668
functools.partial(self.handle_ipc,
2074
parent_pipe = parent_pipe,
2669
parent_pipe=parent_pipe,
2077
2672
def handle_ipc(self, source, condition,
2078
2673
parent_pipe=None,
2080
2675
client_object=None):
2081
2676
# error, or the other end of multiprocessing.Pipe has closed
2082
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2677
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2083
2678
# Wait for other process to exit
2087
2682
# Read a request from the child
2088
2683
request = parent_pipe.recv()
2089
2684
command = request[0]
2091
2686
if command == 'init':
2093
address = request[2]
2095
for c in self.clients.itervalues():
2096
if c.fingerprint == fpr:
2687
key_id = request[1].decode("ascii")
2688
fpr = request[2].decode("ascii")
2689
address = request[3]
2691
for c in self.clients.values():
2692
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2694
if key_id and c.key_id == key_id:
2697
if fpr and c.fingerprint == fpr:
2100
logger.info("Client not found for fingerprint: %s, ad"
2101
"dress: %s", fpr, address)
2701
logger.info("Client not found for key ID: %s, address"
2702
": %s", key_id or fpr, address)
2102
2703
if self.use_dbus:
2103
2704
# Emit D-Bus signal
2104
mandos_dbus_service.ClientNotFound(fpr,
2705
mandos_dbus_service.ClientNotFound(key_id or fpr,
2106
2707
parent_pipe.send(False)
2109
gobject.io_add_watch(
2110
2711
parent_pipe.fileno(),
2111
gobject.IO_IN | gobject.IO_HUP,
2712
GLib.IO_IN | GLib.IO_HUP,
2112
2713
functools.partial(self.handle_ipc,
2113
parent_pipe = parent_pipe,
2115
client_object = client))
2714
parent_pipe=parent_pipe,
2716
client_object=client))
2116
2717
parent_pipe.send(True)
2117
2718
# remove the old hook in favor of the new above hook on
2572
3181
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2573
3182
service = AvahiServiceToSyslog(
2574
name = server_settings["servicename"],
2575
servicetype = "_mandos._tcp",
2576
protocol = protocol,
3183
name=server_settings["servicename"],
3184
servicetype="_mandos._tcp",
2578
3187
if server_settings["interface"]:
2579
3188
service.interface = if_nametoindex(
2580
3189
server_settings["interface"].encode("utf-8"))
2582
3191
global multiprocessing_manager
2583
3192
multiprocessing_manager = multiprocessing.Manager()
2585
3194
client_class = Client
2587
client_class = functools.partial(ClientDBus, bus = bus)
3196
client_class = functools.partial(ClientDBus, bus=bus)
2589
3198
client_settings = Client.config_parser(client_config)
2590
3199
old_client_settings = {}
2591
3200
clients_data = {}
2593
3202
# This is used to redirect stdout and stderr for checker processes
2595
wnull = open(os.devnull, "w") # A writable /dev/null
3204
wnull = open(os.devnull, "w") # A writable /dev/null
2596
3205
# Only used if server is running in foreground but not in debug
2598
3207
if debug or not foreground:
2601
3210
# Get client data and settings from last running state.
2602
3211
if server_settings["restore"]:
2604
3213
with open(stored_state_path, "rb") as stored_state:
2605
clients_data, old_client_settings = pickle.load(
3214
if sys.version_info.major == 2:
3215
clients_data, old_client_settings = pickle.load(
3218
bytes_clients_data, bytes_old_client_settings = (
3219
pickle.load(stored_state, encoding="bytes"))
3220
# Fix bytes to strings
3223
clients_data = {(key.decode("utf-8")
3224
if isinstance(key, bytes)
3227
bytes_clients_data.items()}
3228
del bytes_clients_data
3229
for key in clients_data:
3230
value = {(k.decode("utf-8")
3231
if isinstance(k, bytes) else k): v
3233
clients_data[key].items()}
3234
clients_data[key] = value
3236
value["client_structure"] = [
3238
if isinstance(s, bytes)
3240
value["client_structure"]]
3242
for k in ("name", "host"):
3243
if isinstance(value[k], bytes):
3244
value[k] = value[k].decode("utf-8")
3245
if not value.has_key("key_id"):
3246
value["key_id"] = ""
3247
elif not value.has_key("fingerprint"):
3248
value["fingerprint"] = ""
3249
# old_client_settings
3251
old_client_settings = {
3252
(key.decode("utf-8")
3253
if isinstance(key, bytes)
3256
bytes_old_client_settings.items()}
3257
del bytes_old_client_settings
3259
for value in old_client_settings.values():
3260
if isinstance(value["host"], bytes):
3261
value["host"] = (value["host"]
2607
3263
os.remove(stored_state_path)
2608
3264
except IOError as e:
2609
3265
if e.errno == errno.ENOENT:
2687
3343
for client_name in (set(client_settings)
2688
3344
- set(old_client_settings)):
2689
3345
clients_data[client_name] = client_settings[client_name]
2691
3347
# Create all client objects
2692
3348
for client_name, client in clients_data.items():
2693
3349
tcp_server.clients[client_name] = client_class(
2696
server_settings = server_settings)
3352
server_settings=server_settings)
2698
3354
if not tcp_server.clients:
2699
3355
logger.warning("No clients defined")
2701
3357
if not foreground:
2702
3358
if pidfile is not None:
2706
pidfile.write("{}\n".format(pid).encode("utf-8"))
3362
print(pid, file=pidfile)
2707
3363
except IOError:
2708
3364
logger.error("Could not write to file %r with PID %d",
2709
3365
pidfilename, pid)
2711
3367
del pidfilename
2713
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2714
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3369
for termsig in (signal.SIGHUP, signal.SIGTERM):
3370
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3371
lambda: main_loop.quit() and False)
2718
3375
@alternate_dbus_interfaces(
2719
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2720
class MandosDBusService(DBusObjectWithProperties):
3376
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3377
class MandosDBusService(DBusObjectWithObjectManager):
2721
3378
"""A D-Bus proxy object"""
2723
3380
def __init__(self):
2724
3381
dbus.service.Object.__init__(self, bus, "/")
2726
3383
_interface = "se.recompile.Mandos"
2728
@dbus_interface_annotations(_interface)
2731
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2734
3385
@dbus.service.signal(_interface, signature="o")
2735
3386
def ClientAdded(self, objpath):
2739
3390
@dbus.service.signal(_interface, signature="ss")
2740
def ClientNotFound(self, fingerprint, address):
3391
def ClientNotFound(self, key_id, address):
3395
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2744
3397
@dbus.service.signal(_interface, signature="os")
2745
3398
def ClientRemoved(self, objpath, name):
3402
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2749
3404
@dbus.service.method(_interface, out_signature="ao")
2750
3405
def GetAllClients(self):
2752
3407
return dbus.Array(c.dbus_object_path for c in
2753
tcp_server.clients.itervalues())
3408
tcp_server.clients.values())
3410
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2755
3412
@dbus.service.method(_interface,
2756
3413
out_signature="a{oa{sv}}")
2757
3414
def GetAllClientsWithProperties(self):
2759
3416
return dbus.Dictionary(
2760
{ c.dbus_object_path: c.GetAll("")
2761
for c in tcp_server.clients.itervalues() },
3417
{c.dbus_object_path: c.GetAll(
3418
"se.recompile.Mandos.Client")
3419
for c in tcp_server.clients.values()},
2762
3420
signature="oa{sv}")
2764
3422
@dbus.service.method(_interface, in_signature="o")
2765
3423
def RemoveClient(self, object_path):
2767
for c in tcp_server.clients.itervalues():
3425
for c in tcp_server.clients.values():
2768
3426
if c.dbus_object_path == object_path:
2769
3427
del tcp_server.clients[c.name]
2770
3428
c.remove_from_connection()
2771
# Don't signal anything except ClientRemoved
3429
# Don't signal the disabling
2772
3430
c.disable(quiet=True)
2774
self.ClientRemoved(object_path, c.name)
3431
# Emit D-Bus signal for removal
3432
self.client_removed_signal(c)
2776
3434
raise KeyError(object_path)
3438
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3439
out_signature="a{oa{sa{sv}}}")
3440
def GetManagedObjects(self):
3442
return dbus.Dictionary(
3443
{client.dbus_object_path:
3445
{interface: client.GetAll(interface)
3447
client._get_all_interface_names()})
3448
for client in tcp_server.clients.values()})
3450
def client_added_signal(self, client):
3451
"""Send the new standard signal and the old signal"""
3453
# New standard signal
3454
self.InterfacesAdded(
3455
client.dbus_object_path,
3457
{interface: client.GetAll(interface)
3459
client._get_all_interface_names()}))
3461
self.ClientAdded(client.dbus_object_path)
3463
def client_removed_signal(self, client):
3464
"""Send the new standard signal and the old signal"""
3466
# New standard signal
3467
self.InterfacesRemoved(
3468
client.dbus_object_path,
3469
client._get_all_interface_names())
3471
self.ClientRemoved(client.dbus_object_path,
2780
3474
mandos_dbus_service = MandosDBusService()
3476
# Save modules to variables to exempt the modules from being
3477
# unloaded before the function registered with atexit() is run.
3478
mp = multiprocessing
2783
3482
"Cleanup function; run on exit"
2785
3484
service.cleanup()
2787
multiprocessing.active_children()
3486
mp.active_children()
2789
3488
if not (tcp_server.clients or client_settings):
2792
3491
# Store client before exiting. Secrets are encrypted with key
2793
3492
# based on what config file has. If config file is
2794
3493
# removed/edited, old secret will thus be unrecovable.
2796
3495
with PGPEngine() as pgp:
2797
for client in tcp_server.clients.itervalues():
3496
for client in tcp_server.clients.values():
2798
3497
key = client_settings[client.name]["secret"]
2799
3498
client.encrypted_secret = pgp.encrypt(client.secret,
2801
3500
client_dict = {}
2803
3502
# A list of attributes that can not be pickled
2805
exclude = { "bus", "changedstate", "secret",
2806
"checker", "server_settings" }
3504
exclude = {"bus", "changedstate", "secret",
3505
"checker", "server_settings"}
2807
3506
for name, typ in inspect.getmembers(dbus.service
2809
3508
exclude.add(name)
2811
3510
client_dict["encrypted_secret"] = (client
2812
3511
.encrypted_secret)
2813
3512
for attr in client.client_structure:
2814
3513
if attr not in exclude:
2815
3514
client_dict[attr] = getattr(client, attr)
2817
3516
clients[client.name] = client_dict
2818
3517
del client_settings[client.name]["secret"]
2821
3520
with tempfile.NamedTemporaryFile(