65
import cPickle as pickle
70
import cPickle as pickle
66
73
import multiprocessing
74
82
import dbus.service
83
from gi.repository import GLib
77
84
from dbus.mainloop.glib import DBusGMainLoop
80
87
import xml.dom.minidom
90
# Try to find the value of SO_BINDTODEVICE:
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
93
# newer, and it is also the most natural place for it:
84
94
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
95
except AttributeError:
97
# This is where SO_BINDTODEVICE was up to and including Python
87
99
from IN import SO_BINDTODEVICE
88
100
except ImportError:
89
SO_BINDTODEVICE = None
101
# In Python 2.7 it seems to have been removed entirely.
102
# Try running the C preprocessor:
104
cc = subprocess.Popen(["cc", "--language=c", "-E",
106
stdin=subprocess.PIPE,
107
stdout=subprocess.PIPE)
108
stdout = cc.communicate(
109
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
110
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
111
except (OSError, ValueError, IndexError):
113
SO_BINDTODEVICE = None
115
if sys.version_info.major == 2:
92
119
stored_state_file = "clients.pickle"
94
121
logger = logging.getLogger()
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
125
if_nametoindex = ctypes.cdll.LoadLibrary(
126
ctypes.util.find_library("c")).if_nametoindex
101
127
except (OSError, AttributeError):
102
129
def if_nametoindex(interface):
103
130
"Get an interface index the hard way, i.e. using fcntl()"
104
131
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
105
132
with contextlib.closing(socket.socket()) as s:
106
133
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
107
struct.pack(str("16s16x"),
109
interface_index = struct.unpack(str("I"),
134
struct.pack(b"16s16x", interface))
135
interface_index = struct.unpack("I", ifreq[16:20])[0]
111
136
return interface_index
139
def copy_function(func):
140
"""Make a copy of a function"""
141
if sys.version_info.major == 2:
142
return types.FunctionType(func.func_code,
148
return types.FunctionType(func.__code__,
114
155
def initlogger(debug, level=logging.WARNING):
115
156
"""init logger and add loglevel"""
118
syslogger = (logging.handlers.SysLogHandler
120
logging.handlers.SysLogHandler.LOG_DAEMON,
121
address = str("/dev/log")))
159
syslogger = (logging.handlers.SysLogHandler(
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
122
162
syslogger.setFormatter(logging.Formatter
123
163
('Mandos [%(process)d]: %(levelname)s:'
125
165
logger.addHandler(syslogger)
128
168
console = logging.StreamHandler()
129
169
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
182
236
.replace(b"\n", b"\\n")
183
237
.replace(b"\0", b"\\x00"))
186
240
def encrypt(self, data, password):
187
241
passphrase = self.password_encode(password)
188
with tempfile.NamedTemporaryFile(dir=self.tempdir
242
with tempfile.NamedTemporaryFile(
243
dir=self.tempdir) as passfile:
190
244
passfile.write(passphrase)
192
proc = subprocess.Popen(['gpg', '--symmetric',
246
proc = subprocess.Popen([self.gpg, '--symmetric',
193
247
'--passphrase-file',
195
249
+ self.gnupgargs,
196
stdin = subprocess.PIPE,
197
stdout = subprocess.PIPE,
198
stderr = subprocess.PIPE)
199
ciphertext, err = proc.communicate(input = data)
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
200
254
if proc.returncode != 0:
201
255
raise PGPError(err)
202
256
return ciphertext
204
258
def decrypt(self, data, password):
205
259
passphrase = self.password_encode(password)
206
with tempfile.NamedTemporaryFile(dir = self.tempdir
260
with tempfile.NamedTemporaryFile(
261
dir=self.tempdir) as passfile:
208
262
passfile.write(passphrase)
210
proc = subprocess.Popen(['gpg', '--decrypt',
264
proc = subprocess.Popen([self.gpg, '--decrypt',
211
265
'--passphrase-file',
213
267
+ self.gnupgargs,
214
stdin = subprocess.PIPE,
215
stdout = subprocess.PIPE,
216
stderr = subprocess.PIPE)
217
decrypted_plaintext, err = proc.communicate(input
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
219
272
if proc.returncode != 0:
220
273
raise PGPError(err)
221
274
return decrypted_plaintext
277
# Pretend that we have an Avahi module
279
"""This isn't so much a class as it is a module-like namespace."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
290
def string_array_to_txt_array(t):
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
224
303
class AvahiError(Exception):
225
304
def __init__(self, value, *args, **kwargs):
226
305
self.value = value
227
super(AvahiError, self).__init__(value, *args, **kwargs)
228
def __unicode__(self):
229
return unicode(repr(self.value))
306
return super(AvahiError, self).__init__(value, *args,
231
310
class AvahiServiceError(AvahiError):
234
314
class AvahiGroupError(AvahiError):
238
318
class AvahiService(object):
239
319
"""An Avahi (Zeroconf) service.
242
322
interface: integer; avahi.IF_UNSPEC or an interface index.
243
323
Used to optionally bind to the specified interface.
386
488
follow_name_owner_changes=True),
387
489
avahi.DBUS_INTERFACE_SERVER)
388
490
self.server.connect_to_signal("StateChanged",
389
self.server_state_changed)
491
self.server_state_changed)
390
492
self.server_state_changed(self.server.GetState())
393
495
class AvahiServiceToSyslog(AvahiService):
496
def rename(self, *args, **kwargs):
395
497
"""Add the new name to the syslog messages"""
396
ret = AvahiService.rename(self)
397
syslogger.setFormatter(logging.Formatter
398
('Mandos ({}) [%(process)d]:'
399
' %(levelname)s: %(message)s'
498
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
499
syslogger.setFormatter(logging.Formatter(
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
505
# Pretend that we have a GnuTLS module
506
class gnutls(object):
507
"""This isn't so much a class as it is a module-like namespace."""
509
library = ctypes.util.find_library("gnutls")
511
library = ctypes.util.find_library("gnutls-deb0")
512
_library = ctypes.cdll.LoadLibrary(library)
515
# Unless otherwise indicated, the constants and types below are
516
# all from the gnutls/gnutls.h C header file.
527
E_NO_CERTIFICATE_FOUND = -49
532
KEYID_USE_SHA256 = 1 # gnutls/x509.h
533
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
536
class session_int(ctypes.Structure):
538
session_t = ctypes.POINTER(session_int)
540
class certificate_credentials_st(ctypes.Structure):
542
certificate_credentials_t = ctypes.POINTER(
543
certificate_credentials_st)
544
certificate_type_t = ctypes.c_int
546
class datum_t(ctypes.Structure):
547
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
548
('size', ctypes.c_uint)]
550
class openpgp_crt_int(ctypes.Structure):
552
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
553
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
554
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
555
credentials_type_t = ctypes.c_int
556
transport_ptr_t = ctypes.c_void_p
557
close_request_t = ctypes.c_int
560
class Error(Exception):
561
def __init__(self, message=None, code=None, args=()):
562
# Default usage is by a message string, but if a return
563
# code is passed, convert it to a string with
566
if message is None and code is not None:
567
message = gnutls.strerror(code)
568
return super(gnutls.Error, self).__init__(
571
class CertificateSecurityError(Error):
575
class Credentials(object):
577
self._c_object = gnutls.certificate_credentials_t()
578
gnutls.certificate_allocate_credentials(
579
ctypes.byref(self._c_object))
580
self.type = gnutls.CRD_CERTIFICATE
583
gnutls.certificate_free_credentials(self._c_object)
585
class ClientSession(object):
586
def __init__(self, socket, credentials=None):
587
self._c_object = gnutls.session_t()
588
gnutls_flags = gnutls.CLIENT
589
if gnutls.check_version(b"3.5.6"):
590
gnutls_flags |= gnutls.NO_TICKETS
592
gnutls_flags |= gnutls.ENABLE_RAWPK
593
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
595
gnutls.set_default_priority(self._c_object)
596
gnutls.transport_set_ptr(self._c_object, socket.fileno())
597
gnutls.handshake_set_private_extensions(self._c_object,
600
if credentials is None:
601
credentials = gnutls.Credentials()
602
gnutls.credentials_set(self._c_object, credentials.type,
603
ctypes.cast(credentials._c_object,
605
self.credentials = credentials
608
gnutls.deinit(self._c_object)
611
return gnutls.handshake(self._c_object)
613
def send(self, data):
617
data_len -= gnutls.record_send(self._c_object,
622
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
624
# Error handling functions
625
def _error_code(result):
626
"""A function to raise exceptions on errors, suitable
627
for the 'restype' attribute on ctypes functions"""
630
if result == gnutls.E_NO_CERTIFICATE_FOUND:
631
raise gnutls.CertificateSecurityError(code=result)
632
raise gnutls.Error(code=result)
634
def _retry_on_error(result, func, arguments):
635
"""A function to retry on some errors, suitable
636
for the 'errcheck' attribute on ctypes functions"""
638
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
639
return _error_code(result)
640
result = func(*arguments)
643
# Unless otherwise indicated, the function declarations below are
644
# all from the gnutls/gnutls.h C header file.
647
priority_set_direct = _library.gnutls_priority_set_direct
648
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
649
ctypes.POINTER(ctypes.c_char_p)]
650
priority_set_direct.restype = _error_code
652
init = _library.gnutls_init
653
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
654
init.restype = _error_code
656
set_default_priority = _library.gnutls_set_default_priority
657
set_default_priority.argtypes = [session_t]
658
set_default_priority.restype = _error_code
660
record_send = _library.gnutls_record_send
661
record_send.argtypes = [session_t, ctypes.c_void_p,
663
record_send.restype = ctypes.c_ssize_t
664
record_send.errcheck = _retry_on_error
666
certificate_allocate_credentials = (
667
_library.gnutls_certificate_allocate_credentials)
668
certificate_allocate_credentials.argtypes = [
669
ctypes.POINTER(certificate_credentials_t)]
670
certificate_allocate_credentials.restype = _error_code
672
certificate_free_credentials = (
673
_library.gnutls_certificate_free_credentials)
674
certificate_free_credentials.argtypes = [
675
certificate_credentials_t]
676
certificate_free_credentials.restype = None
678
handshake_set_private_extensions = (
679
_library.gnutls_handshake_set_private_extensions)
680
handshake_set_private_extensions.argtypes = [session_t,
682
handshake_set_private_extensions.restype = None
684
credentials_set = _library.gnutls_credentials_set
685
credentials_set.argtypes = [session_t, credentials_type_t,
687
credentials_set.restype = _error_code
689
strerror = _library.gnutls_strerror
690
strerror.argtypes = [ctypes.c_int]
691
strerror.restype = ctypes.c_char_p
693
certificate_type_get = _library.gnutls_certificate_type_get
694
certificate_type_get.argtypes = [session_t]
695
certificate_type_get.restype = _error_code
697
certificate_get_peers = _library.gnutls_certificate_get_peers
698
certificate_get_peers.argtypes = [session_t,
699
ctypes.POINTER(ctypes.c_uint)]
700
certificate_get_peers.restype = ctypes.POINTER(datum_t)
702
global_set_log_level = _library.gnutls_global_set_log_level
703
global_set_log_level.argtypes = [ctypes.c_int]
704
global_set_log_level.restype = None
706
global_set_log_function = _library.gnutls_global_set_log_function
707
global_set_log_function.argtypes = [log_func]
708
global_set_log_function.restype = None
710
deinit = _library.gnutls_deinit
711
deinit.argtypes = [session_t]
712
deinit.restype = None
714
handshake = _library.gnutls_handshake
715
handshake.argtypes = [session_t]
716
handshake.restype = _error_code
717
handshake.errcheck = _retry_on_error
719
transport_set_ptr = _library.gnutls_transport_set_ptr
720
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
721
transport_set_ptr.restype = None
723
bye = _library.gnutls_bye
724
bye.argtypes = [session_t, close_request_t]
725
bye.restype = _error_code
726
bye.errcheck = _retry_on_error
728
check_version = _library.gnutls_check_version
729
check_version.argtypes = [ctypes.c_char_p]
730
check_version.restype = ctypes.c_char_p
732
_need_version = b"3.3.0"
733
if check_version(_need_version) is None:
734
raise self.Error("Needs GnuTLS {} or later"
735
.format(_need_version))
737
_tls_rawpk_version = b"3.6.6"
738
has_rawpk = bool(check_version(_tls_rawpk_version))
742
class pubkey_st(ctypes.Structure):
744
pubkey_t = ctypes.POINTER(pubkey_st)
746
x509_crt_fmt_t = ctypes.c_int
748
# All the function declarations below are from gnutls/abstract.h
749
pubkey_init = _library.gnutls_pubkey_init
750
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
751
pubkey_init.restype = _error_code
753
pubkey_import = _library.gnutls_pubkey_import
754
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
756
pubkey_import.restype = _error_code
758
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
759
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
760
ctypes.POINTER(ctypes.c_ubyte),
761
ctypes.POINTER(ctypes.c_size_t)]
762
pubkey_get_key_id.restype = _error_code
764
pubkey_deinit = _library.gnutls_pubkey_deinit
765
pubkey_deinit.argtypes = [pubkey_t]
766
pubkey_deinit.restype = None
768
# All the function declarations below are from gnutls/openpgp.h
770
openpgp_crt_init = _library.gnutls_openpgp_crt_init
771
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
772
openpgp_crt_init.restype = _error_code
774
openpgp_crt_import = _library.gnutls_openpgp_crt_import
775
openpgp_crt_import.argtypes = [openpgp_crt_t,
776
ctypes.POINTER(datum_t),
778
openpgp_crt_import.restype = _error_code
780
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
781
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
782
ctypes.POINTER(ctypes.c_uint)]
783
openpgp_crt_verify_self.restype = _error_code
785
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
786
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
787
openpgp_crt_deinit.restype = None
789
openpgp_crt_get_fingerprint = (
790
_library.gnutls_openpgp_crt_get_fingerprint)
791
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
795
openpgp_crt_get_fingerprint.restype = _error_code
797
if check_version(b"3.6.4"):
798
certificate_type_get2 = _library.gnutls_certificate_type_get2
799
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
800
certificate_type_get2.restype = _error_code
802
# Remove non-public functions
803
del _error_code, _retry_on_error
806
def call_pipe(connection, # : multiprocessing.Connection
807
func, *args, **kwargs):
808
"""This function is meant to be called by multiprocessing.Process
810
This function runs func(*args, **kwargs), and writes the resulting
811
return value on the provided multiprocessing.Connection.
813
connection.send(func(*args, **kwargs))
404
817
class Client(object):
405
818
"""A representation of a client host served by this server.
408
821
approved: bool(); 'None' if not yet approved/disapproved
409
822
approval_delay: datetime.timedelta(); Time to wait for approval
410
823
approval_duration: datetime.timedelta(); Duration of one approval
411
checker: subprocess.Popen(); a running checker process used
412
to see if the client lives.
413
'None' if no process is running.
414
checker_callback_tag: a gobject event source tag, or None
824
checker: multiprocessing.Process(); a running checker process used
825
to see if the client lives. 'None' if no process is
827
checker_callback_tag: a GLib event source tag, or None
415
828
checker_command: string; External command which is run to check
416
829
if client lives. %() expansions are done at
417
830
runtime with vars(self) as dict, so that for
418
831
instance %(name)s can be used in the command.
419
checker_initiator_tag: a gobject event source tag, or None
832
checker_initiator_tag: a GLib event source tag, or None
420
833
created: datetime.datetime(); (UTC) object creation
421
834
client_structure: Object describing what attributes a client has
422
835
and is used for storing the client at exit
423
836
current_checker_command: string; current running checker_command
424
disable_initiator_tag: a gobject event source tag, or None
837
disable_initiator_tag: a GLib event source tag, or None
426
839
fingerprint: string (40 or 32 hexadecimal digits); used to
427
uniquely identify the client
840
uniquely identify an OpenPGP client
841
key_id: string (64 hexadecimal digits); used to uniquely identify
842
a client using raw public keys
428
843
host: string; available for use by the checker command
429
844
interval: datetime.timedelta(); How often to start a new checker
430
845
last_approval_request: datetime.datetime(); (UTC) or None
582
1002
logger.info("Disabling client %s", self.name)
583
1003
if getattr(self, "disable_initiator_tag", None) is not None:
584
gobject.source_remove(self.disable_initiator_tag)
1004
GLib.source_remove(self.disable_initiator_tag)
585
1005
self.disable_initiator_tag = None
586
1006
self.expires = None
587
1007
if getattr(self, "checker_initiator_tag", None) is not None:
588
gobject.source_remove(self.checker_initiator_tag)
1008
GLib.source_remove(self.checker_initiator_tag)
589
1009
self.checker_initiator_tag = None
590
1010
self.stop_checker()
591
1011
self.enabled = False
593
1013
self.send_changedstate()
594
# Do not run this again if called by a gobject.timeout_add
1014
# Do not run this again if called by a GLib.timeout_add
597
1017
def __del__(self):
600
1020
def init_checker(self):
601
1021
# Schedule a new checker to be started an 'interval' from now,
602
1022
# and every interval from then on.
603
1023
if self.checker_initiator_tag is not None:
604
gobject.source_remove(self.checker_initiator_tag)
605
self.checker_initiator_tag = (gobject.timeout_add
607
.total_seconds() * 1000),
1024
GLib.source_remove(self.checker_initiator_tag)
1025
self.checker_initiator_tag = GLib.timeout_add(
1026
int(self.interval.total_seconds() * 1000),
609
1028
# Schedule a disable() when 'timeout' has passed
610
1029
if self.disable_initiator_tag is not None:
611
gobject.source_remove(self.disable_initiator_tag)
612
self.disable_initiator_tag = (gobject.timeout_add
614
.total_seconds() * 1000),
1030
GLib.source_remove(self.disable_initiator_tag)
1031
self.disable_initiator_tag = GLib.timeout_add(
1032
int(self.timeout.total_seconds() * 1000), self.disable)
616
1033
# Also start a new checker *right now*.
617
1034
self.start_checker()
619
def checker_callback(self, pid, condition, command):
1036
def checker_callback(self, source, condition, connection,
620
1038
"""The checker has completed, so take appropriate actions."""
1039
# Read return code from connection (see call_pipe)
1040
returncode = connection.recv()
621
1043
self.checker_callback_tag = None
622
1044
self.checker = None
623
if os.WIFEXITED(condition):
624
self.last_checker_status = os.WEXITSTATUS(condition)
1047
self.last_checker_status = returncode
1048
self.last_checker_signal = None
625
1049
if self.last_checker_status == 0:
626
1050
logger.info("Checker for %(name)s succeeded",
628
1052
self.checked_ok()
630
logger.info("Checker for %(name)s failed",
1054
logger.info("Checker for %(name)s failed", vars(self))
633
1056
self.last_checker_status = -1
1057
self.last_checker_signal = -returncode
634
1058
logger.warning("Checker for %(name)s crashed?",
637
1062
def checked_ok(self):
638
1063
"""Assert that the client has been seen, alive and well."""
639
1064
self.last_checked_ok = datetime.datetime.utcnow()
640
1065
self.last_checker_status = 0
1066
self.last_checker_signal = None
641
1067
self.bump_timeout()
643
1069
def bump_timeout(self, timeout=None):
644
1070
"""Bump up the timeout for this client."""
645
1071
if timeout is None:
646
1072
timeout = self.timeout
647
1073
if self.disable_initiator_tag is not None:
648
gobject.source_remove(self.disable_initiator_tag)
1074
GLib.source_remove(self.disable_initiator_tag)
649
1075
self.disable_initiator_tag = None
650
1076
if getattr(self, "enabled", False):
651
self.disable_initiator_tag = (gobject.timeout_add
652
(int(timeout.total_seconds()
653
* 1000), self.disable))
1077
self.disable_initiator_tag = GLib.timeout_add(
1078
int(timeout.total_seconds() * 1000), self.disable)
654
1079
self.expires = datetime.datetime.utcnow() + timeout
656
1081
def need_approval(self):
657
1082
self.last_approval_request = datetime.datetime.utcnow()
659
1084
def start_checker(self):
660
1085
"""Start a new checker subprocess if one is not running.
662
1087
If a checker already exists, leave it running and do
664
1089
# The reason for not killing a running checker is that if we
669
1094
# checkers alone, the checker would have to take more time
670
1095
# than 'timeout' for the client to be disabled, which is as it
673
# If a checker exists, make sure it is not a zombie
675
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
676
except AttributeError:
678
except OSError as error:
679
if error.errno != errno.ECHILD:
683
logger.warning("Checker was a zombie")
684
gobject.source_remove(self.checker_callback_tag)
685
self.checker_callback(pid, status,
686
self.current_checker_command)
1098
if self.checker is not None and not self.checker.is_alive():
1099
logger.warning("Checker was not alive; joining")
687
1102
# Start a new checker if needed
688
1103
if self.checker is None:
689
1104
# Escape attributes for the shell
690
escaped_attrs = { attr:
691
re.escape(unicode(getattr(self,
693
for attr in self.runtime_expansions }
1106
attr: re.escape(str(getattr(self, attr)))
1107
for attr in self.runtime_expansions}
695
1109
command = self.checker_command % escaped_attrs
696
1110
except TypeError as error:
697
1111
logger.error('Could not format string "%s"',
698
self.checker_command, exc_info=error)
699
return True # Try again later
1112
self.checker_command,
1114
return True # Try again later
700
1115
self.current_checker_command = command
702
logger.info("Starting checker %r for %s",
704
# We don't need to redirect stdout and stderr, since
705
# in normal mode, that is already done by daemon(),
706
# and in debug mode we don't want to. (Stdin is
707
# always replaced by /dev/null.)
708
# The exception is when not debugging but nevertheless
709
# running in the foreground; use the previously
712
if (not self.server_settings["debug"]
713
and self.server_settings["foreground"]):
714
popen_args.update({"stdout": wnull,
716
self.checker = subprocess.Popen(command,
720
except OSError as error:
721
logger.error("Failed to start subprocess",
724
self.checker_callback_tag = (gobject.child_watch_add
726
self.checker_callback,
728
# The checker may have completed before the gobject
729
# watch was added. Check for this.
731
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
732
except OSError as error:
733
if error.errno == errno.ECHILD:
734
# This should never happen
735
logger.error("Child process vanished",
740
gobject.source_remove(self.checker_callback_tag)
741
self.checker_callback(pid, status, command)
742
# Re-run this periodically if run by gobject.timeout_add
1116
logger.info("Starting checker %r for %s", command,
1118
# We don't need to redirect stdout and stderr, since
1119
# in normal mode, that is already done by daemon(),
1120
# and in debug mode we don't want to. (Stdin is
1121
# always replaced by /dev/null.)
1122
# The exception is when not debugging but nevertheless
1123
# running in the foreground; use the previously
1125
popen_args = {"close_fds": True,
1128
if (not self.server_settings["debug"]
1129
and self.server_settings["foreground"]):
1130
popen_args.update({"stdout": wnull,
1132
pipe = multiprocessing.Pipe(duplex=False)
1133
self.checker = multiprocessing.Process(
1135
args=(pipe[1], subprocess.call, command),
1137
self.checker.start()
1138
self.checker_callback_tag = GLib.io_add_watch(
1139
pipe[0].fileno(), GLib.IO_IN,
1140
self.checker_callback, pipe[0], command)
1141
# Re-run this periodically if run by GLib.timeout_add
745
1144
def stop_checker(self):
746
1145
"""Force the checker process, if any, to stop."""
747
1146
if self.checker_callback_tag:
748
gobject.source_remove(self.checker_callback_tag)
1147
GLib.source_remove(self.checker_callback_tag)
749
1148
self.checker_callback_tag = None
750
1149
if getattr(self, "checker", None) is None:
752
1151
logger.debug("Stopping checker for %(name)s", vars(self))
754
self.checker.terminate()
756
#if self.checker.poll() is None:
757
# self.checker.kill()
758
except OSError as error:
759
if error.errno != errno.ESRCH: # No such process
1152
self.checker.terminate()
761
1153
self.checker = None
764
def dbus_service_property(dbus_interface, signature="v",
765
access="readwrite", byte_arrays=False):
1156
def dbus_service_property(dbus_interface,
766
1160
"""Decorators for marking methods of a DBusObjectWithProperties to
767
1161
become properties on the D-Bus.
769
1163
The decorated method will be called with no arguments by "Get"
770
1164
and with one argument by "Set".
772
1166
The parameters, where they are supported, are the same as
773
1167
dbus.service.method, except there is only "signature", since the
774
1168
type from Get() and the type sent to Set() is the same.
850
class DBusObjectWithProperties(dbus.service.Object):
851
"""A D-Bus object with properties.
853
Classes inheriting from this can use the dbus_service_property
854
decorator to expose methods as D-Bus properties. It exposes the
855
standard Get(), Set(), and GetAll() methods on the D-Bus.
1251
class DBusObjectWithAnnotations(dbus.service.Object):
1252
"""A D-Bus object with annotations.
1254
Classes inheriting from this can use the dbus_annotations
1255
decorator to add annotations to methods or signals.
859
1259
def _is_dbus_thing(thing):
860
1260
"""Returns a function testing if an attribute is a D-Bus thing
862
1262
If called like _is_dbus_thing("method") it returns a function
863
1263
suitable for use as predicate to inspect.getmembers().
865
1265
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
868
1268
def _get_all_dbus_things(self, thing):
869
1269
"""Returns a generator of (name, attribute) pairs
871
return ((getattr(athing.__get__(self), "_dbus_name",
1271
return ((getattr(athing.__get__(self), "_dbus_name", name),
873
1272
athing.__get__(self))
874
1273
for cls in self.__class__.__mro__
875
1274
for name, athing in
876
inspect.getmembers(cls,
877
self._is_dbus_thing(thing)))
1275
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1277
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1279
path_keyword='object_path',
1280
connection_keyword='connection')
1281
def Introspect(self, object_path, connection):
1282
"""Overloading of standard D-Bus method.
1284
Inserts annotation tags on methods and signals.
1286
xmlstring = dbus.service.Object.Introspect(self, object_path,
1289
document = xml.dom.minidom.parseString(xmlstring)
1291
for if_tag in document.getElementsByTagName("interface"):
1292
# Add annotation tags
1293
for typ in ("method", "signal"):
1294
for tag in if_tag.getElementsByTagName(typ):
1296
for name, prop in (self.
1297
_get_all_dbus_things(typ)):
1298
if (name == tag.getAttribute("name")
1299
and prop._dbus_interface
1300
== if_tag.getAttribute("name")):
1301
annots.update(getattr(
1302
prop, "_dbus_annotations", {}))
1303
for name, value in annots.items():
1304
ann_tag = document.createElement(
1306
ann_tag.setAttribute("name", name)
1307
ann_tag.setAttribute("value", value)
1308
tag.appendChild(ann_tag)
1309
# Add interface annotation tags
1310
for annotation, value in dict(
1311
itertools.chain.from_iterable(
1312
annotations().items()
1313
for name, annotations
1314
in self._get_all_dbus_things("interface")
1315
if name == if_tag.getAttribute("name")
1317
ann_tag = document.createElement("annotation")
1318
ann_tag.setAttribute("name", annotation)
1319
ann_tag.setAttribute("value", value)
1320
if_tag.appendChild(ann_tag)
1321
# Fix argument name for the Introspect method itself
1322
if (if_tag.getAttribute("name")
1323
== dbus.INTROSPECTABLE_IFACE):
1324
for cn in if_tag.getElementsByTagName("method"):
1325
if cn.getAttribute("name") == "Introspect":
1326
for arg in cn.getElementsByTagName("arg"):
1327
if (arg.getAttribute("direction")
1329
arg.setAttribute("name",
1331
xmlstring = document.toxml("utf-8")
1333
except (AttributeError, xml.dom.DOMException,
1334
xml.parsers.expat.ExpatError) as error:
1335
logger.error("Failed to override Introspection method",
1340
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1341
"""A D-Bus object with properties.
1343
Classes inheriting from this can use the dbus_service_property
1344
decorator to expose methods as D-Bus properties. It exposes the
1345
standard Get(), Set(), and GetAll() methods on the D-Bus.
879
1348
def _get_dbus_property(self, interface_name, property_name):
880
1349
"""Returns a bound method if one exists which is a D-Bus
881
1350
property with the specified name and interface.
883
for cls in self.__class__.__mro__:
884
for name, value in (inspect.getmembers
886
self._is_dbus_thing("property"))):
1352
for cls in self.__class__.__mro__:
1353
for name, value in inspect.getmembers(
1354
cls, self._is_dbus_thing("property")):
887
1355
if (value._dbus_name == property_name
888
1356
and value._dbus_interface == interface_name):
889
1357
return value.__get__(self)
891
1359
# No such property
892
raise DBusPropertyNotFound(self.dbus_object_path + ":"
893
+ interface_name + "."
896
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1360
raise DBusPropertyNotFound("{}:{}.{}".format(
1361
self.dbus_object_path, interface_name, property_name))
1364
def _get_all_interface_names(cls):
1365
"""Get a sequence of all interfaces supported by an object"""
1366
return (name for name in set(getattr(getattr(x, attr),
1367
"_dbus_interface", None)
1368
for x in (inspect.getmro(cls))
1370
if name is not None)
1372
@dbus.service.method(dbus.PROPERTIES_IFACE,
897
1374
out_signature="v")
898
1375
def Get(self, interface_name, property_name):
899
1376
"""Standard D-Bus property Get() method, see D-Bus standard.
1031
1505
return xmlstring
1509
dbus.OBJECT_MANAGER_IFACE
1510
except AttributeError:
1511
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1514
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1515
"""A D-Bus object with an ObjectManager.
1517
Classes inheriting from this exposes the standard
1518
GetManagedObjects call and the InterfacesAdded and
1519
InterfacesRemoved signals on the standard
1520
"org.freedesktop.DBus.ObjectManager" interface.
1522
Note: No signals are sent automatically; they must be sent
1525
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1526
out_signature="a{oa{sa{sv}}}")
1527
def GetManagedObjects(self):
1528
"""This function must be overridden"""
1529
raise NotImplementedError()
1531
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1532
signature="oa{sa{sv}}")
1533
def InterfacesAdded(self, object_path, interfaces_and_properties):
1536
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1537
def InterfacesRemoved(self, object_path, interfaces):
1540
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1542
path_keyword='object_path',
1543
connection_keyword='connection')
1544
def Introspect(self, object_path, connection):
1545
"""Overloading of standard D-Bus method.
1547
Override return argument name of GetManagedObjects to be
1548
"objpath_interfaces_and_properties"
1550
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1554
document = xml.dom.minidom.parseString(xmlstring)
1556
for if_tag in document.getElementsByTagName("interface"):
1557
# Fix argument name for the GetManagedObjects method
1558
if (if_tag.getAttribute("name")
1559
== dbus.OBJECT_MANAGER_IFACE):
1560
for cn in if_tag.getElementsByTagName("method"):
1561
if (cn.getAttribute("name")
1562
== "GetManagedObjects"):
1563
for arg in cn.getElementsByTagName("arg"):
1564
if (arg.getAttribute("direction")
1568
"objpath_interfaces"
1570
xmlstring = document.toxml("utf-8")
1572
except (AttributeError, xml.dom.DOMException,
1573
xml.parsers.expat.ExpatError) as error:
1574
logger.error("Failed to override Introspection method",
1034
1579
def datetime_to_dbus(dt, variant_level=0):
1035
1580
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1037
return dbus.String("", variant_level = variant_level)
1038
return dbus.String(dt.isoformat(),
1039
variant_level=variant_level)
1582
return dbus.String("", variant_level=variant_level)
1583
return dbus.String(dt.isoformat(), variant_level=variant_level)
1042
1586
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1392
1947
server to mandos-client
1396
1951
# Rejected - signal
1397
1952
@dbus.service.signal(_interface, signature="s")
1398
1953
def Rejected(self, reason):
1402
1957
# NeedApproval - signal
1403
1958
@dbus.service.signal(_interface, signature="tb")
1404
1959
def NeedApproval(self, timeout, default):
1406
1961
return self.need_approval()
1410
1965
# Approve - method
1411
1966
@dbus.service.method(_interface, in_signature="b")
1412
1967
def Approve(self, value):
1413
1968
self.approve(value)
1415
1970
# CheckedOK - method
1416
1971
@dbus.service.method(_interface)
1417
1972
def CheckedOK(self):
1418
1973
self.checked_ok()
1420
1975
# Enable - method
1976
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1421
1977
@dbus.service.method(_interface)
1422
1978
def Enable(self):
1426
1982
# StartChecker - method
1983
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1427
1984
@dbus.service.method(_interface)
1428
1985
def StartChecker(self):
1430
1987
self.start_checker()
1432
1989
# Disable - method
1990
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1433
1991
@dbus.service.method(_interface)
1434
1992
def Disable(self):
1438
1996
# StopChecker - method
1997
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1439
1998
@dbus.service.method(_interface)
1440
1999
def StopChecker(self):
1441
2000
self.stop_checker()
1445
2004
# ApprovalPending - property
1446
2005
@dbus_service_property(_interface, signature="b", access="read")
1447
2006
def ApprovalPending_dbus_property(self):
1448
2007
return dbus.Boolean(bool(self.approvals_pending))
1450
2009
# ApprovedByDefault - property
1451
@dbus_service_property(_interface, signature="b",
2010
@dbus_service_property(_interface,
1452
2012
access="readwrite")
1453
2013
def ApprovedByDefault_dbus_property(self, value=None):
1454
2014
if value is None: # get
1455
2015
return dbus.Boolean(self.approved_by_default)
1456
2016
self.approved_by_default = bool(value)
1458
2018
# ApprovalDelay - property
1459
@dbus_service_property(_interface, signature="t",
2019
@dbus_service_property(_interface,
1460
2021
access="readwrite")
1461
2022
def ApprovalDelay_dbus_property(self, value=None):
1462
2023
if value is None: # get
1463
2024
return dbus.UInt64(self.approval_delay.total_seconds()
1465
2026
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1467
2028
# ApprovalDuration - property
1468
@dbus_service_property(_interface, signature="t",
2029
@dbus_service_property(_interface,
1469
2031
access="readwrite")
1470
2032
def ApprovalDuration_dbus_property(self, value=None):
1471
2033
if value is None: # get
1472
2034
return dbus.UInt64(self.approval_duration.total_seconds()
1474
2036
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1476
2038
# Name - property
2040
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1477
2041
@dbus_service_property(_interface, signature="s", access="read")
1478
2042
def Name_dbus_property(self):
1479
2043
return dbus.String(self.name)
2047
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2048
@dbus_service_property(_interface, signature="s", access="read")
2049
def KeyID_dbus_property(self):
2050
return dbus.String(self.key_id)
1481
2052
# Fingerprint - property
2054
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1482
2055
@dbus_service_property(_interface, signature="s", access="read")
1483
2056
def Fingerprint_dbus_property(self):
1484
2057
return dbus.String(self.fingerprint)
1486
2059
# Host - property
1487
@dbus_service_property(_interface, signature="s",
2060
@dbus_service_property(_interface,
1488
2062
access="readwrite")
1489
2063
def Host_dbus_property(self, value=None):
1490
2064
if value is None: # get
1491
2065
return dbus.String(self.host)
1492
self.host = unicode(value)
2066
self.host = str(value)
1494
2068
# Created - property
2070
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1495
2071
@dbus_service_property(_interface, signature="s", access="read")
1496
2072
def Created_dbus_property(self):
1497
2073
return datetime_to_dbus(self.created)
1499
2075
# LastEnabled - property
1500
2076
@dbus_service_property(_interface, signature="s", access="read")
1501
2077
def LastEnabled_dbus_property(self):
1502
2078
return datetime_to_dbus(self.last_enabled)
1504
2080
# Enabled - property
1505
@dbus_service_property(_interface, signature="b",
2081
@dbus_service_property(_interface,
1506
2083
access="readwrite")
1507
2084
def Enabled_dbus_property(self, value=None):
1508
2085
if value is None: # get
1773
2367
delay -= time2 - time
1776
while sent_size < len(client.secret):
1778
sent = session.send(client.secret[sent_size:])
1779
except gnutls.errors.GNUTLSError as error:
1780
logger.warning("gnutls send failed",
1783
logger.debug("Sent: %d, remaining: %d",
1784
sent, len(client.secret)
1785
- (sent_size + sent))
2370
session.send(client.secret)
2371
except gnutls.Error as error:
2372
logger.warning("gnutls send failed",
1788
2376
logger.info("Sending secret to %s", client.name)
1789
2377
# bump the timeout using extended_timeout
1790
2378
client.bump_timeout(client.extended_timeout)
1791
2379
if self.server.use_dbus:
1792
2380
# Emit D-Bus signal
1793
2381
client.GotSecret()
1796
2384
if approval_required:
1797
2385
client.approvals_pending -= 1
1800
except gnutls.errors.GNUTLSError as error:
2388
except gnutls.Error as error:
1801
2389
logger.warning("GnuTLS bye failed",
1802
2390
exc_info=error)
1805
2393
def peer_certificate(session):
1806
"Return the peer's OpenPGP certificate as a bytestring"
1807
# If not an OpenPGP certificate...
1808
if (gnutls.library.functions
1809
.gnutls_certificate_type_get(session._c_object)
1810
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1811
# ...do the normal thing
1812
return session.peer_certificate
2394
"Return the peer's certificate as a bytestring"
2396
cert_type = gnutls.certificate_type_get2(session._c_object,
2398
except AttributeError:
2399
cert_type = gnutls.certificate_type_get(session._c_object)
2400
if gnutls.has_rawpk:
2401
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2403
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2404
# If not a valid certificate type...
2405
if cert_type not in valid_cert_types:
2406
logger.info("Cert type %r not in %r", cert_type,
2408
# ...return invalid data
1813
2410
list_size = ctypes.c_uint(1)
1814
cert_list = (gnutls.library.functions
1815
.gnutls_certificate_get_peers
2411
cert_list = (gnutls.certificate_get_peers
1816
2412
(session._c_object, ctypes.byref(list_size)))
1817
2413
if not bool(cert_list) and list_size.value != 0:
1818
raise gnutls.errors.GNUTLSError("error getting peer"
2414
raise gnutls.Error("error getting peer certificate")
1820
2415
if list_size.value == 0:
1822
2417
cert = cert_list[0]
1823
2418
return ctypes.string_at(cert.data, cert.size)
2421
def key_id(certificate):
2422
"Convert a certificate bytestring to a hexdigit key ID"
2423
# New GnuTLS "datum" with the public key
2424
datum = gnutls.datum_t(
2425
ctypes.cast(ctypes.c_char_p(certificate),
2426
ctypes.POINTER(ctypes.c_ubyte)),
2427
ctypes.c_uint(len(certificate)))
2428
# XXX all these need to be created in the gnutls "module"
2429
# New empty GnuTLS certificate
2430
pubkey = gnutls.pubkey_t()
2431
gnutls.pubkey_init(ctypes.byref(pubkey))
2432
# Import the raw public key into the certificate
2433
gnutls.pubkey_import(pubkey,
2434
ctypes.byref(datum),
2435
gnutls.X509_FMT_DER)
2436
# New buffer for the key ID
2437
buf = ctypes.create_string_buffer(32)
2438
buf_len = ctypes.c_size_t(len(buf))
2439
# Get the key ID from the raw public key into the buffer
2440
gnutls.pubkey_get_key_id(pubkey,
2441
gnutls.KEYID_USE_SHA256,
2442
ctypes.cast(ctypes.byref(buf),
2443
ctypes.POINTER(ctypes.c_ubyte)),
2444
ctypes.byref(buf_len))
2445
# Deinit the certificate
2446
gnutls.pubkey_deinit(pubkey)
2448
# Convert the buffer to a Python bytestring
2449
key_id = ctypes.string_at(buf, buf_len.value)
2450
# Convert the bytestring to hexadecimal notation
2451
hex_key_id = binascii.hexlify(key_id).upper()
1826
2455
def fingerprint(openpgp):
1827
2456
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1828
2457
# New GnuTLS "datum" with the OpenPGP public key
1829
datum = (gnutls.library.types
1830
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1833
ctypes.c_uint(len(openpgp))))
2458
datum = gnutls.datum_t(
2459
ctypes.cast(ctypes.c_char_p(openpgp),
2460
ctypes.POINTER(ctypes.c_ubyte)),
2461
ctypes.c_uint(len(openpgp)))
1834
2462
# New empty GnuTLS certificate
1835
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1836
(gnutls.library.functions
1837
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2463
crt = gnutls.openpgp_crt_t()
2464
gnutls.openpgp_crt_init(ctypes.byref(crt))
1838
2465
# Import the OpenPGP public key into the certificate
1839
(gnutls.library.functions
1840
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1841
gnutls.library.constants
1842
.GNUTLS_OPENPGP_FMT_RAW))
2466
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2467
gnutls.OPENPGP_FMT_RAW)
1843
2468
# Verify the self signature in the key
1844
2469
crtverify = ctypes.c_uint()
1845
(gnutls.library.functions
1846
.gnutls_openpgp_crt_verify_self(crt, 0,
1847
ctypes.byref(crtverify)))
2470
gnutls.openpgp_crt_verify_self(crt, 0,
2471
ctypes.byref(crtverify))
1848
2472
if crtverify.value != 0:
1849
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1850
raise (gnutls.errors.CertificateSecurityError
2473
gnutls.openpgp_crt_deinit(crt)
2474
raise gnutls.CertificateSecurityError(code
1852
2476
# New buffer for the fingerprint
1853
2477
buf = ctypes.create_string_buffer(20)
1854
2478
buf_len = ctypes.c_size_t()
1855
2479
# Get the fingerprint from the certificate into the buffer
1856
(gnutls.library.functions
1857
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1858
ctypes.byref(buf_len)))
2480
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2481
ctypes.byref(buf_len))
1859
2482
# Deinit the certificate
1860
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2483
gnutls.openpgp_crt_deinit(crt)
1861
2484
# Convert the buffer to a Python bytestring
1862
2485
fpr = ctypes.string_at(buf, buf_len.value)
1863
2486
# Convert the bytestring to hexadecimal notation
1946
2575
# socket_wrapper(), if socketfd was set.
1947
2576
socketserver.TCPServer.__init__(self, server_address,
1948
2577
RequestHandlerClass)
1950
2579
def server_bind(self):
1951
2580
"""This overrides the normal server_bind() function
1952
2581
to bind to an interface if one was specified, and also NOT to
1953
2582
bind to an address or port if they were not specified."""
2583
global SO_BINDTODEVICE
1954
2584
if self.interface is not None:
1955
2585
if SO_BINDTODEVICE is None:
1956
logger.error("SO_BINDTODEVICE does not exist;"
1957
" cannot bind to interface %s",
1961
self.socket.setsockopt(socket.SOL_SOCKET,
1963
str(self.interface + '\0'))
1964
except socket.error as error:
1965
if error.errno == errno.EPERM:
1966
logger.error("No permission to bind to"
1967
" interface %s", self.interface)
1968
elif error.errno == errno.ENOPROTOOPT:
1969
logger.error("SO_BINDTODEVICE not available;"
1970
" cannot bind to interface %s",
1972
elif error.errno == errno.ENODEV:
1973
logger.error("Interface %s does not exist,"
1974
" cannot bind", self.interface)
2586
# Fall back to a hard-coded value which seems to be
2588
logger.warning("SO_BINDTODEVICE not found, trying 25")
2589
SO_BINDTODEVICE = 25
2591
self.socket.setsockopt(
2592
socket.SOL_SOCKET, SO_BINDTODEVICE,
2593
(self.interface + "\0").encode("utf-8"))
2594
except socket.error as error:
2595
if error.errno == errno.EPERM:
2596
logger.error("No permission to bind to"
2597
" interface %s", self.interface)
2598
elif error.errno == errno.ENOPROTOOPT:
2599
logger.error("SO_BINDTODEVICE not available;"
2600
" cannot bind to interface %s",
2602
elif error.errno == errno.ENODEV:
2603
logger.error("Interface %s does not exist,"
2604
" cannot bind", self.interface)
1977
2607
# Only bind(2) the socket if we really need to.
1978
2608
if self.server_address[0] or self.server_address[1]:
2609
if self.server_address[1]:
2610
self.allow_reuse_address = True
1979
2611
if not self.server_address[0]:
1980
2612
if self.address_family == socket.AF_INET6:
1981
any_address = "::" # in6addr_any
2613
any_address = "::" # in6addr_any
1983
any_address = "0.0.0.0" # INADDR_ANY
2615
any_address = "0.0.0.0" # INADDR_ANY
1984
2616
self.server_address = (any_address,
1985
2617
self.server_address[1])
1986
2618
elif not self.server_address[1]:
1987
self.server_address = (self.server_address[0],
2619
self.server_address = (self.server_address[0], 0)
1989
2620
# if self.interface:
1990
2621
# self.server_address = (self.server_address[0],
2016
2652
self.gnutls_priority = gnutls_priority
2017
2653
IPv6_TCPServer.__init__(self, server_address,
2018
2654
RequestHandlerClass,
2019
interface = interface,
2020
use_ipv6 = use_ipv6,
2021
socketfd = socketfd)
2655
interface=interface,
2022
2659
def server_activate(self):
2023
2660
if self.enabled:
2024
2661
return socketserver.TCPServer.server_activate(self)
2026
2663
def enable(self):
2027
2664
self.enabled = True
2029
2666
def add_pipe(self, parent_pipe, proc):
2030
2667
# Call "handle_ipc" for both data and EOF events
2031
gobject.io_add_watch(parent_pipe.fileno(),
2032
gobject.IO_IN | gobject.IO_HUP,
2033
functools.partial(self.handle_ipc,
2038
def handle_ipc(self, source, condition, parent_pipe=None,
2039
proc = None, client_object=None):
2669
parent_pipe.fileno(),
2670
GLib.IO_IN | GLib.IO_HUP,
2671
functools.partial(self.handle_ipc,
2672
parent_pipe=parent_pipe,
2675
def handle_ipc(self, source, condition,
2678
client_object=None):
2040
2679
# error, or the other end of multiprocessing.Pipe has closed
2041
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2680
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2042
2681
# Wait for other process to exit
2046
2685
# Read a request from the child
2047
2686
request = parent_pipe.recv()
2048
2687
command = request[0]
2050
2689
if command == 'init':
2052
address = request[2]
2054
for c in self.clients.itervalues():
2055
if c.fingerprint == fpr:
2690
key_id = request[1].decode("ascii")
2691
fpr = request[2].decode("ascii")
2692
address = request[3]
2694
for c in self.clients.values():
2695
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2697
if key_id and c.key_id == key_id:
2700
if fpr and c.fingerprint == fpr:
2059
logger.info("Client not found for fingerprint: %s, ad"
2060
"dress: %s", fpr, address)
2704
logger.info("Client not found for key ID: %s, address"
2705
": %s", key_id or fpr, address)
2061
2706
if self.use_dbus:
2062
2707
# Emit D-Bus signal
2063
mandos_dbus_service.ClientNotFound(fpr,
2708
mandos_dbus_service.ClientNotFound(key_id or fpr,
2065
2710
parent_pipe.send(False)
2068
gobject.io_add_watch(parent_pipe.fileno(),
2069
gobject.IO_IN | gobject.IO_HUP,
2070
functools.partial(self.handle_ipc,
2714
parent_pipe.fileno(),
2715
GLib.IO_IN | GLib.IO_HUP,
2716
functools.partial(self.handle_ipc,
2717
parent_pipe=parent_pipe,
2719
client_object=client))
2076
2720
parent_pipe.send(True)
2077
2721
# remove the old hook in favor of the new above hook on
3128
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2477
3130
except OSError as error:
3131
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3132
.format(uid, gid, os.strerror(error.errno)))
2478
3133
if error.errno != errno.EPERM:
2482
3137
# Enable all possible GnuTLS debugging
2484
3139
# "Use a log level over 10 to enable all debugging options."
2485
3140
# - GnuTLS manual
2486
gnutls.library.functions.gnutls_global_set_log_level(11)
2488
@gnutls.library.types.gnutls_log_func
3141
gnutls.global_set_log_level(11)
2489
3144
def debug_gnutls(level, string):
2490
3145
logger.debug("GnuTLS: %s", string[:-1])
2492
(gnutls.library.functions
2493
.gnutls_global_set_log_function(debug_gnutls))
3147
gnutls.global_set_log_function(debug_gnutls)
2495
3149
# Redirect stdin so all checkers get /dev/null
2496
3150
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2497
3151
os.dup2(null, sys.stdin.fileno())
2501
3155
# Need to fork before connecting to D-Bus
2502
3156
if not foreground:
2503
3157
# Close all input and output, do double fork, etc.
2506
# multiprocessing will use threads, so before we use gobject we
2507
# need to inform gobject that threads will be used.
2508
gobject.threads_init()
3160
# multiprocessing will use threads, so before we use GLib we need
3161
# to inform GLib that threads will be used.
2510
3164
global main_loop
2511
3165
# From the Avahi example code
2512
3166
DBusGMainLoop(set_as_default=True)
2513
main_loop = gobject.MainLoop()
3167
main_loop = GLib.MainLoop()
2514
3168
bus = dbus.SystemBus()
2515
3169
# End of Avahi example code
2518
3172
bus_name = dbus.service.BusName("se.recompile.Mandos",
2519
bus, do_not_queue=True)
2520
old_bus_name = (dbus.service.BusName
2521
("se.bsnet.fukt.Mandos", bus,
2523
except dbus.exceptions.NameExistsException as e:
3175
old_bus_name = dbus.service.BusName(
3176
"se.bsnet.fukt.Mandos", bus,
3178
except dbus.exceptions.DBusException as e:
2524
3179
logger.error("Disabling D-Bus:", exc_info=e)
2525
3180
use_dbus = False
2526
3181
server_settings["use_dbus"] = False
2527
3182
tcp_server.use_dbus = False
2529
3184
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2530
service = AvahiServiceToSyslog(name =
2531
server_settings["servicename"],
2532
servicetype = "_mandos._tcp",
2533
protocol = protocol, bus = bus)
3185
service = AvahiServiceToSyslog(
3186
name=server_settings["servicename"],
3187
servicetype="_mandos._tcp",
2534
3190
if server_settings["interface"]:
2535
service.interface = (if_nametoindex
2536
(str(server_settings["interface"])))
3191
service.interface = if_nametoindex(
3192
server_settings["interface"].encode("utf-8"))
2538
3194
global multiprocessing_manager
2539
3195
multiprocessing_manager = multiprocessing.Manager()
2541
3197
client_class = Client
2543
client_class = functools.partial(ClientDBus, bus = bus)
3199
client_class = functools.partial(ClientDBus, bus=bus)
2545
3201
client_settings = Client.config_parser(client_config)
2546
3202
old_client_settings = {}
2547
3203
clients_data = {}
2549
3205
# This is used to redirect stdout and stderr for checker processes
2551
wnull = open(os.devnull, "w") # A writable /dev/null
3207
wnull = open(os.devnull, "w") # A writable /dev/null
2552
3208
# Only used if server is running in foreground but not in debug
2554
3210
if debug or not foreground:
2557
3213
# Get client data and settings from last running state.
2558
3214
if server_settings["restore"]:
2560
3216
with open(stored_state_path, "rb") as stored_state:
2561
clients_data, old_client_settings = (pickle.load
3217
if sys.version_info.major == 2:
3218
clients_data, old_client_settings = pickle.load(
3221
bytes_clients_data, bytes_old_client_settings = (
3222
pickle.load(stored_state, encoding="bytes"))
3223
# Fix bytes to strings
3226
clients_data = {(key.decode("utf-8")
3227
if isinstance(key, bytes)
3230
bytes_clients_data.items()}
3231
del bytes_clients_data
3232
for key in clients_data:
3233
value = {(k.decode("utf-8")
3234
if isinstance(k, bytes) else k): v
3236
clients_data[key].items()}
3237
clients_data[key] = value
3239
value["client_structure"] = [
3241
if isinstance(s, bytes)
3243
value["client_structure"]]
3245
for k in ("name", "host"):
3246
if isinstance(value[k], bytes):
3247
value[k] = value[k].decode("utf-8")
3248
if "key_id" not in value:
3249
value["key_id"] = ""
3250
elif "fingerprint" not in value:
3251
value["fingerprint"] = ""
3252
# old_client_settings
3254
old_client_settings = {
3255
(key.decode("utf-8")
3256
if isinstance(key, bytes)
3259
bytes_old_client_settings.items()}
3260
del bytes_old_client_settings
3262
for value in old_client_settings.values():
3263
if isinstance(value["host"], bytes):
3264
value["host"] = (value["host"]
2563
3266
os.remove(stored_state_path)
2564
3267
except IOError as e:
2565
3268
if e.errno == errno.ENOENT:
2566
logger.warning("Could not load persistent state: {}"
2567
.format(os.strerror(e.errno)))
3269
logger.warning("Could not load persistent state:"
3270
" {}".format(os.strerror(e.errno)))
2569
3272
logger.critical("Could not load persistent state:",
2572
3275
except EOFError as e:
2573
3276
logger.warning("Could not load persistent state: "
2574
"EOFError:", exc_info=e)
2576
3280
with PGPEngine() as pgp:
2577
3281
for client_name, client in clients_data.items():
2578
3282
# Skip removed clients
2579
3283
if client_name not in client_settings:
2582
3286
# Decide which value to use after restoring saved state.
2583
3287
# We have three different values: Old config file,
2584
3288
# new config file, and saved state.
2642
3346
for client_name in (set(client_settings)
2643
3347
- set(old_client_settings)):
2644
3348
clients_data[client_name] = client_settings[client_name]
2646
3350
# Create all client objects
2647
3351
for client_name, client in clients_data.items():
2648
3352
tcp_server.clients[client_name] = client_class(
2649
name = client_name, settings = client,
2650
server_settings = server_settings)
3355
server_settings=server_settings)
2652
3357
if not tcp_server.clients:
2653
3358
logger.warning("No clients defined")
2655
3360
if not foreground:
2656
3361
if pidfile is not None:
2660
pidfile.write(str(pid) + "\n".encode("utf-8"))
3365
print(pid, file=pidfile)
2661
3366
except IOError:
2662
3367
logger.error("Could not write to file %r with PID %d",
2663
3368
pidfilename, pid)
2665
3370
del pidfilename
2667
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2668
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3372
for termsig in (signal.SIGHUP, signal.SIGTERM):
3373
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3374
lambda: main_loop.quit() and False)
2671
@alternate_dbus_interfaces({"se.recompile.Mandos":
2672
"se.bsnet.fukt.Mandos"})
2673
class MandosDBusService(DBusObjectWithProperties):
3378
@alternate_dbus_interfaces(
3379
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3380
class MandosDBusService(DBusObjectWithObjectManager):
2674
3381
"""A D-Bus proxy object"""
2675
3383
def __init__(self):
2676
3384
dbus.service.Object.__init__(self, bus, "/")
2677
3386
_interface = "se.recompile.Mandos"
2679
@dbus_interface_annotations(_interface)
2681
return { "org.freedesktop.DBus.Property"
2682
".EmitsChangedSignal":
2685
3388
@dbus.service.signal(_interface, signature="o")
2686
3389
def ClientAdded(self, objpath):
2690
3393
@dbus.service.signal(_interface, signature="ss")
2691
def ClientNotFound(self, fingerprint, address):
3394
def ClientNotFound(self, key_id, address):
3398
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2695
3400
@dbus.service.signal(_interface, signature="os")
2696
3401
def ClientRemoved(self, objpath, name):
3405
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2700
3407
@dbus.service.method(_interface, out_signature="ao")
2701
3408
def GetAllClients(self):
2703
return dbus.Array(c.dbus_object_path
2705
tcp_server.clients.itervalues())
3410
return dbus.Array(c.dbus_object_path for c in
3411
tcp_server.clients.values())
3413
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2707
3415
@dbus.service.method(_interface,
2708
3416
out_signature="a{oa{sv}}")
2709
3417
def GetAllClientsWithProperties(self):
2711
3419
return dbus.Dictionary(
2712
((c.dbus_object_path, c.GetAll(""))
2713
for c in tcp_server.clients.itervalues()),
3420
{c.dbus_object_path: c.GetAll(
3421
"se.recompile.Mandos.Client")
3422
for c in tcp_server.clients.values()},
2714
3423
signature="oa{sv}")
2716
3425
@dbus.service.method(_interface, in_signature="o")
2717
3426
def RemoveClient(self, object_path):
2719
for c in tcp_server.clients.itervalues():
3428
for c in tcp_server.clients.values():
2720
3429
if c.dbus_object_path == object_path:
2721
3430
del tcp_server.clients[c.name]
2722
3431
c.remove_from_connection()
2723
# Don't signal anything except ClientRemoved
3432
# Don't signal the disabling
2724
3433
c.disable(quiet=True)
2726
self.ClientRemoved(object_path, c.name)
3434
# Emit D-Bus signal for removal
3435
self.client_removed_signal(c)
2728
3437
raise KeyError(object_path)
3441
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3442
out_signature="a{oa{sa{sv}}}")
3443
def GetManagedObjects(self):
3445
return dbus.Dictionary(
3446
{client.dbus_object_path:
3448
{interface: client.GetAll(interface)
3450
client._get_all_interface_names()})
3451
for client in tcp_server.clients.values()})
3453
def client_added_signal(self, client):
3454
"""Send the new standard signal and the old signal"""
3456
# New standard signal
3457
self.InterfacesAdded(
3458
client.dbus_object_path,
3460
{interface: client.GetAll(interface)
3462
client._get_all_interface_names()}))
3464
self.ClientAdded(client.dbus_object_path)
3466
def client_removed_signal(self, client):
3467
"""Send the new standard signal and the old signal"""
3469
# New standard signal
3470
self.InterfacesRemoved(
3471
client.dbus_object_path,
3472
client._get_all_interface_names())
3474
self.ClientRemoved(client.dbus_object_path,
2732
3477
mandos_dbus_service = MandosDBusService()
3479
# Save modules to variables to exempt the modules from being
3480
# unloaded before the function registered with atexit() is run.
3481
mp = multiprocessing
2735
3485
"Cleanup function; run on exit"
2737
3487
service.cleanup()
2739
multiprocessing.active_children()
3489
mp.active_children()
2741
3491
if not (tcp_server.clients or client_settings):
2744
3494
# Store client before exiting. Secrets are encrypted with key
2745
3495
# based on what config file has. If config file is
2746
3496
# removed/edited, old secret will thus be unrecovable.
2748
3498
with PGPEngine() as pgp:
2749
for client in tcp_server.clients.itervalues():
3499
for client in tcp_server.clients.values():
2750
3500
key = client_settings[client.name]["secret"]
2751
3501
client.encrypted_secret = pgp.encrypt(client.secret,
2753
3503
client_dict = {}
2755
3505
# A list of attributes that can not be pickled
2757
exclude = { "bus", "changedstate", "secret",
2758
"checker", "server_settings" }
2759
for name, typ in (inspect.getmembers
2760
(dbus.service.Object)):
3507
exclude = {"bus", "changedstate", "secret",
3508
"checker", "server_settings"}
3509
for name, typ in inspect.getmembers(dbus.service
2761
3511
exclude.add(name)
2763
3513
client_dict["encrypted_secret"] = (client
2764
3514
.encrypted_secret)
2765
3515
for attr in client.client_structure:
2766
3516
if attr not in exclude:
2767
3517
client_dict[attr] = getattr(client, attr)
2769
3519
clients[client.name] = client_dict
2770
3520
del client_settings[client.name]["secret"]
2773
with (tempfile.NamedTemporaryFile
2774
(mode='wb', suffix=".pickle", prefix='clients-',
2775
dir=os.path.dirname(stored_state_path),
2776
delete=False)) as stored_state:
2777
pickle.dump((clients, client_settings), stored_state)
2778
tempname=stored_state.name
3523
with tempfile.NamedTemporaryFile(
3527
dir=os.path.dirname(stored_state_path),
3528
delete=False) as stored_state:
3529
pickle.dump((clients, client_settings), stored_state,
3531
tempname = stored_state.name
2779
3532
os.rename(tempname, stored_state_path)
2780
3533
except (IOError, OSError) as e: