70
import cPickle as pickle
65
import cPickle as pickle
73
66
import multiprocessing
85
74
import dbus.service
87
from gi.repository import GLib
88
77
from dbus.mainloop.glib import DBusGMainLoop
91
80
import xml.dom.minidom
94
if sys.version_info.major == 2:
98
# Add collections.abc.Callable if it does not exist
100
collections.abc.Callable
101
except AttributeError:
103
Callable = collections.Callable
104
collections.abc = abc
107
# Add shlex.quote if it does not exist
110
except AttributeError:
111
shlex.quote = re.escape
113
# Show warnings by default
114
if not sys.warnoptions:
116
warnings.simplefilter("default")
118
# Try to find the value of SO_BINDTODEVICE:
120
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
121
# newer, and it is also the most natural place for it:
122
84
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
123
85
except AttributeError:
125
# This is where SO_BINDTODEVICE was up to and including Python
127
87
from IN import SO_BINDTODEVICE
128
88
except ImportError:
129
# In Python 2.7 it seems to have been removed entirely.
130
# Try running the C preprocessor:
132
cc = subprocess.Popen(["cc", "--language=c", "-E",
134
stdin=subprocess.PIPE,
135
stdout=subprocess.PIPE)
136
stdout = cc.communicate(
137
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
138
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
139
except (OSError, ValueError, IndexError):
141
SO_BINDTODEVICE = None
143
if sys.version_info < (3, 2):
144
configparser.Configparser = configparser.SafeConfigParser
89
SO_BINDTODEVICE = None
147
92
stored_state_file = "clients.pickle"
149
94
logger = logging.getLogger()
150
logging.captureWarnings(True) # Show warnings via the logging system
154
if_nametoindex = ctypes.cdll.LoadLibrary(
155
ctypes.util.find_library("c")).if_nametoindex
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
156
101
except (OSError, AttributeError):
158
102
def if_nametoindex(interface):
159
103
"Get an interface index the hard way, i.e. using fcntl()"
160
104
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
161
105
with contextlib.closing(socket.socket()) as s:
162
106
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
163
struct.pack(b"16s16x", interface))
164
interface_index = struct.unpack("I", ifreq[16:20])[0]
107
struct.pack(str("16s16x"),
109
interface_index = struct.unpack(str("I"),
165
111
return interface_index
168
def copy_function(func):
169
"""Make a copy of a function"""
170
if sys.version_info.major == 2:
171
return types.FunctionType(func.func_code,
177
return types.FunctionType(func.__code__,
184
114
def initlogger(debug, level=logging.WARNING):
185
115
"""init logger and add loglevel"""
188
syslogger = (logging.handlers.SysLogHandler(
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
118
syslogger = (logging.handlers.SysLogHandler
120
logging.handlers.SysLogHandler.LOG_DAEMON,
121
address = str("/dev/log")))
191
122
syslogger.setFormatter(logging.Formatter
192
123
('Mandos [%(process)d]: %(levelname)s:'
194
125
logger.addHandler(syslogger)
197
128
console = logging.StreamHandler()
198
129
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
265
182
.replace(b"\n", b"\\n")
266
183
.replace(b"\0", b"\\x00"))
269
186
def encrypt(self, data, password):
270
187
passphrase = self.password_encode(password)
271
with tempfile.NamedTemporaryFile(
272
dir=self.tempdir) as passfile:
188
with tempfile.NamedTemporaryFile(dir=self.tempdir
273
190
passfile.write(passphrase)
275
proc = subprocess.Popen([self.gpg, '--symmetric',
192
proc = subprocess.Popen(['gpg', '--symmetric',
276
193
'--passphrase-file',
278
195
+ self.gnupgargs,
279
stdin=subprocess.PIPE,
280
stdout=subprocess.PIPE,
281
stderr=subprocess.PIPE)
282
ciphertext, err = proc.communicate(input=data)
196
stdin = subprocess.PIPE,
197
stdout = subprocess.PIPE,
198
stderr = subprocess.PIPE)
199
ciphertext, err = proc.communicate(input = data)
283
200
if proc.returncode != 0:
284
201
raise PGPError(err)
285
202
return ciphertext
287
204
def decrypt(self, data, password):
288
205
passphrase = self.password_encode(password)
289
with tempfile.NamedTemporaryFile(
290
dir=self.tempdir) as passfile:
206
with tempfile.NamedTemporaryFile(dir = self.tempdir
291
208
passfile.write(passphrase)
293
proc = subprocess.Popen([self.gpg, '--decrypt',
210
proc = subprocess.Popen(['gpg', '--decrypt',
294
211
'--passphrase-file',
296
213
+ self.gnupgargs,
297
stdin=subprocess.PIPE,
298
stdout=subprocess.PIPE,
299
stderr=subprocess.PIPE)
300
decrypted_plaintext, err = proc.communicate(input=data)
214
stdin = subprocess.PIPE,
215
stdout = subprocess.PIPE,
216
stderr = subprocess.PIPE)
217
decrypted_plaintext, err = proc.communicate(input
301
219
if proc.returncode != 0:
302
220
raise PGPError(err)
303
221
return decrypted_plaintext
306
# Pretend that we have an Avahi module
308
"""This isn't so much a class as it is a module-like namespace."""
309
IF_UNSPEC = -1 # avahi-common/address.h
310
PROTO_UNSPEC = -1 # avahi-common/address.h
311
PROTO_INET = 0 # avahi-common/address.h
312
PROTO_INET6 = 1 # avahi-common/address.h
313
DBUS_NAME = "org.freedesktop.Avahi"
314
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
315
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
DBUS_PATH_SERVER = "/"
319
def string_array_to_txt_array(t):
320
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
for s in t), signature="ay")
322
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
323
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
324
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
325
SERVER_INVALID = 0 # avahi-common/defs.h
326
SERVER_REGISTERING = 1 # avahi-common/defs.h
327
SERVER_RUNNING = 2 # avahi-common/defs.h
328
SERVER_COLLISION = 3 # avahi-common/defs.h
329
SERVER_FAILURE = 4 # avahi-common/defs.h
332
224
class AvahiError(Exception):
333
225
def __init__(self, value, *args, **kwargs):
334
226
self.value = value
335
return super(AvahiError, self).__init__(value, *args,
227
super(AvahiError, self).__init__(value, *args, **kwargs)
228
def __unicode__(self):
229
return unicode(repr(self.value))
339
231
class AvahiServiceError(AvahiError):
343
234
class AvahiGroupError(AvahiError):
238
class AvahiService(object):
348
239
"""An Avahi (Zeroconf) service.
351
242
interface: integer; avahi.IF_UNSPEC or an interface index.
352
243
Used to optionally bind to the specified interface.
517
386
follow_name_owner_changes=True),
518
387
avahi.DBUS_INTERFACE_SERVER)
519
388
self.server.connect_to_signal("StateChanged",
520
self.server_state_changed)
389
self.server_state_changed)
521
390
self.server_state_changed(self.server.GetState())
524
393
class AvahiServiceToSyslog(AvahiService):
525
def rename(self, *args, **kwargs):
526
395
"""Add the new name to the syslog messages"""
527
ret = super(AvahiServiceToSyslog, self).rename(*args,
529
syslogger.setFormatter(logging.Formatter(
530
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
396
ret = AvahiService.rename(self)
397
syslogger.setFormatter(logging.Formatter
398
('Mandos ({0}) [%(process)d]:'
399
' %(levelname)s: %(message)s'
535
# Pretend that we have a GnuTLS module
537
"""This isn't so much a class as it is a module-like namespace."""
539
library = ctypes.util.find_library("gnutls")
541
library = ctypes.util.find_library("gnutls-deb0")
542
_library = ctypes.cdll.LoadLibrary(library)
545
# Unless otherwise indicated, the constants and types below are
546
# all from the gnutls/gnutls.h C header file.
557
E_NO_CERTIFICATE_FOUND = -49
562
KEYID_USE_SHA256 = 1 # gnutls/x509.h
563
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
566
class _session_int(ctypes.Structure):
568
session_t = ctypes.POINTER(_session_int)
570
class certificate_credentials_st(ctypes.Structure):
572
certificate_credentials_t = ctypes.POINTER(
573
certificate_credentials_st)
574
certificate_type_t = ctypes.c_int
576
class datum_t(ctypes.Structure):
577
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
578
('size', ctypes.c_uint)]
580
class _openpgp_crt_int(ctypes.Structure):
582
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
583
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
584
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
585
credentials_type_t = ctypes.c_int
586
transport_ptr_t = ctypes.c_void_p
587
close_request_t = ctypes.c_int
590
class Error(Exception):
591
def __init__(self, message=None, code=None, args=()):
592
# Default usage is by a message string, but if a return
593
# code is passed, convert it to a string with
596
if message is None and code is not None:
597
message = gnutls.strerror(code).decode(
598
"utf-8", errors="replace")
599
return super(gnutls.Error, self).__init__(
602
class CertificateSecurityError(Error):
606
def __init__(self, cls):
609
def from_param(self, obj):
610
if not isinstance(obj, self.cls):
611
raise TypeError("Not of type {}: {!r}"
612
.format(self.cls.__name__, obj))
613
return ctypes.byref(obj.from_param(obj))
615
class CastToVoidPointer:
616
def __init__(self, cls):
619
def from_param(self, obj):
620
if not isinstance(obj, self.cls):
621
raise TypeError("Not of type {}: {!r}"
622
.format(self.cls.__name__, obj))
623
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
625
class With_from_param:
627
def from_param(cls, obj):
628
return obj._as_parameter_
631
class Credentials(With_from_param):
633
self._as_parameter_ = gnutls.certificate_credentials_t()
634
gnutls.certificate_allocate_credentials(self)
635
self.type = gnutls.CRD_CERTIFICATE
638
gnutls.certificate_free_credentials(self)
640
class ClientSession(With_from_param):
641
def __init__(self, socket, credentials=None):
642
self._as_parameter_ = gnutls.session_t()
643
gnutls_flags = gnutls.CLIENT
644
if gnutls.check_version(b"3.5.6"):
645
gnutls_flags |= gnutls.NO_TICKETS
647
gnutls_flags |= gnutls.ENABLE_RAWPK
648
gnutls.init(self, gnutls_flags)
650
gnutls.set_default_priority(self)
651
gnutls.transport_set_ptr(self, socket.fileno())
652
gnutls.handshake_set_private_extensions(self, True)
654
if credentials is None:
655
credentials = gnutls.Credentials()
656
gnutls.credentials_set(self, credentials.type,
658
self.credentials = credentials
664
return gnutls.handshake(self)
666
def send(self, data):
670
data_len -= gnutls.record_send(self, data[-data_len:],
674
return gnutls.bye(self, gnutls.SHUT_RDWR)
676
# Error handling functions
677
def _error_code(result):
678
"""A function to raise exceptions on errors, suitable
679
for the 'restype' attribute on ctypes functions"""
680
if result >= gnutls.E_SUCCESS:
682
if result == gnutls.E_NO_CERTIFICATE_FOUND:
683
raise gnutls.CertificateSecurityError(code=result)
684
raise gnutls.Error(code=result)
686
def _retry_on_error(result, func, arguments,
687
_error_code=_error_code):
688
"""A function to retry on some errors, suitable
689
for the 'errcheck' attribute on ctypes functions"""
690
while result < gnutls.E_SUCCESS:
691
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
692
return _error_code(result)
693
result = func(*arguments)
696
# Unless otherwise indicated, the function declarations below are
697
# all from the gnutls/gnutls.h C header file.
700
priority_set_direct = _library.gnutls_priority_set_direct
701
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
702
ctypes.POINTER(ctypes.c_char_p)]
703
priority_set_direct.restype = _error_code
705
init = _library.gnutls_init
706
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
707
init.restype = _error_code
709
set_default_priority = _library.gnutls_set_default_priority
710
set_default_priority.argtypes = [ClientSession]
711
set_default_priority.restype = _error_code
713
record_send = _library.gnutls_record_send
714
record_send.argtypes = [ClientSession, ctypes.c_void_p,
716
record_send.restype = ctypes.c_ssize_t
717
record_send.errcheck = _retry_on_error
719
certificate_allocate_credentials = (
720
_library.gnutls_certificate_allocate_credentials)
721
certificate_allocate_credentials.argtypes = [
722
PointerTo(Credentials)]
723
certificate_allocate_credentials.restype = _error_code
725
certificate_free_credentials = (
726
_library.gnutls_certificate_free_credentials)
727
certificate_free_credentials.argtypes = [Credentials]
728
certificate_free_credentials.restype = None
730
handshake_set_private_extensions = (
731
_library.gnutls_handshake_set_private_extensions)
732
handshake_set_private_extensions.argtypes = [ClientSession,
734
handshake_set_private_extensions.restype = None
736
credentials_set = _library.gnutls_credentials_set
737
credentials_set.argtypes = [ClientSession, credentials_type_t,
738
CastToVoidPointer(Credentials)]
739
credentials_set.restype = _error_code
741
strerror = _library.gnutls_strerror
742
strerror.argtypes = [ctypes.c_int]
743
strerror.restype = ctypes.c_char_p
745
certificate_type_get = _library.gnutls_certificate_type_get
746
certificate_type_get.argtypes = [ClientSession]
747
certificate_type_get.restype = _error_code
749
certificate_get_peers = _library.gnutls_certificate_get_peers
750
certificate_get_peers.argtypes = [ClientSession,
751
ctypes.POINTER(ctypes.c_uint)]
752
certificate_get_peers.restype = ctypes.POINTER(datum_t)
754
global_set_log_level = _library.gnutls_global_set_log_level
755
global_set_log_level.argtypes = [ctypes.c_int]
756
global_set_log_level.restype = None
758
global_set_log_function = _library.gnutls_global_set_log_function
759
global_set_log_function.argtypes = [log_func]
760
global_set_log_function.restype = None
762
deinit = _library.gnutls_deinit
763
deinit.argtypes = [ClientSession]
764
deinit.restype = None
766
handshake = _library.gnutls_handshake
767
handshake.argtypes = [ClientSession]
768
handshake.restype = ctypes.c_int
769
handshake.errcheck = _retry_on_error
771
transport_set_ptr = _library.gnutls_transport_set_ptr
772
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
773
transport_set_ptr.restype = None
775
bye = _library.gnutls_bye
776
bye.argtypes = [ClientSession, close_request_t]
777
bye.restype = ctypes.c_int
778
bye.errcheck = _retry_on_error
780
check_version = _library.gnutls_check_version
781
check_version.argtypes = [ctypes.c_char_p]
782
check_version.restype = ctypes.c_char_p
784
_need_version = b"3.3.0"
785
if check_version(_need_version) is None:
786
raise self.Error("Needs GnuTLS {} or later"
787
.format(_need_version))
789
_tls_rawpk_version = b"3.6.6"
790
has_rawpk = bool(check_version(_tls_rawpk_version))
794
class pubkey_st(ctypes.Structure):
796
pubkey_t = ctypes.POINTER(pubkey_st)
798
x509_crt_fmt_t = ctypes.c_int
800
# All the function declarations below are from
802
pubkey_init = _library.gnutls_pubkey_init
803
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
804
pubkey_init.restype = _error_code
806
pubkey_import = _library.gnutls_pubkey_import
807
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
809
pubkey_import.restype = _error_code
811
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
812
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
813
ctypes.POINTER(ctypes.c_ubyte),
814
ctypes.POINTER(ctypes.c_size_t)]
815
pubkey_get_key_id.restype = _error_code
817
pubkey_deinit = _library.gnutls_pubkey_deinit
818
pubkey_deinit.argtypes = [pubkey_t]
819
pubkey_deinit.restype = None
821
# All the function declarations below are from
824
openpgp_crt_init = _library.gnutls_openpgp_crt_init
825
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
826
openpgp_crt_init.restype = _error_code
828
openpgp_crt_import = _library.gnutls_openpgp_crt_import
829
openpgp_crt_import.argtypes = [openpgp_crt_t,
830
ctypes.POINTER(datum_t),
832
openpgp_crt_import.restype = _error_code
834
openpgp_crt_verify_self = \
835
_library.gnutls_openpgp_crt_verify_self
836
openpgp_crt_verify_self.argtypes = [
839
ctypes.POINTER(ctypes.c_uint),
841
openpgp_crt_verify_self.restype = _error_code
843
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
844
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
845
openpgp_crt_deinit.restype = None
847
openpgp_crt_get_fingerprint = (
848
_library.gnutls_openpgp_crt_get_fingerprint)
849
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
853
openpgp_crt_get_fingerprint.restype = _error_code
855
if check_version(b"3.6.4"):
856
certificate_type_get2 = _library.gnutls_certificate_type_get2
857
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
858
certificate_type_get2.restype = _error_code
860
# Remove non-public functions
861
del _error_code, _retry_on_error
864
def call_pipe(connection, # : multiprocessing.Connection
865
func, *args, **kwargs):
866
"""This function is meant to be called by multiprocessing.Process
868
This function runs func(*args, **kwargs), and writes the resulting
869
return value on the provided multiprocessing.Connection.
871
connection.send(func(*args, **kwargs))
404
def timedelta_to_milliseconds(td):
405
"Convert a datetime.timedelta() to milliseconds"
406
return ((td.days * 24 * 60 * 60 * 1000)
407
+ (td.seconds * 1000)
408
+ (td.microseconds // 1000))
411
class Client(object):
876
412
"""A representation of a client host served by this server.
879
415
approved: bool(); 'None' if not yet approved/disapproved
880
416
approval_delay: datetime.timedelta(); Time to wait for approval
881
417
approval_duration: datetime.timedelta(); Duration of one approval
882
checker: multiprocessing.Process(); a running checker process used
883
to see if the client lives. 'None' if no process is
885
checker_callback_tag: a GLib event source tag, or None
418
checker: subprocess.Popen(); a running checker process used
419
to see if the client lives.
420
'None' if no process is running.
421
checker_callback_tag: a gobject event source tag, or None
886
422
checker_command: string; External command which is run to check
887
423
if client lives. %() expansions are done at
888
424
runtime with vars(self) as dict, so that for
889
425
instance %(name)s can be used in the command.
890
checker_initiator_tag: a GLib event source tag, or None
426
checker_initiator_tag: a gobject event source tag, or None
891
427
created: datetime.datetime(); (UTC) object creation
892
428
client_structure: Object describing what attributes a client has
893
429
and is used for storing the client at exit
894
430
current_checker_command: string; current running checker_command
895
disable_initiator_tag: a GLib event source tag, or None
431
disable_initiator_tag: a gobject event source tag, or None
897
433
fingerprint: string (40 or 32 hexadecimal digits); used to
898
uniquely identify an OpenPGP client
899
key_id: string (64 hexadecimal digits); used to uniquely identify
900
a client using raw public keys
434
uniquely identify the client
901
435
host: string; available for use by the checker command
902
436
interval: datetime.timedelta(); How often to start a new checker
903
437
last_approval_request: datetime.datetime(); (UTC) or None
1060
604
logger.info("Disabling client %s", self.name)
1061
605
if getattr(self, "disable_initiator_tag", None) is not None:
1062
GLib.source_remove(self.disable_initiator_tag)
606
gobject.source_remove(self.disable_initiator_tag)
1063
607
self.disable_initiator_tag = None
1064
608
self.expires = None
1065
609
if getattr(self, "checker_initiator_tag", None) is not None:
1066
GLib.source_remove(self.checker_initiator_tag)
610
gobject.source_remove(self.checker_initiator_tag)
1067
611
self.checker_initiator_tag = None
1068
612
self.stop_checker()
1069
613
self.enabled = False
1071
615
self.send_changedstate()
1072
# Do not run this again if called by a GLib.timeout_add
616
# Do not run this again if called by a gobject.timeout_add
1075
619
def __del__(self):
1078
622
def init_checker(self):
1079
623
# Schedule a new checker to be started an 'interval' from now,
1080
624
# and every interval from then on.
1081
625
if self.checker_initiator_tag is not None:
1082
GLib.source_remove(self.checker_initiator_tag)
1083
self.checker_initiator_tag = GLib.timeout_add(
1084
random.randrange(int(self.interval.total_seconds() * 1000
626
gobject.source_remove(self.checker_initiator_tag)
627
self.checker_initiator_tag = (gobject.timeout_add
628
(self.interval_milliseconds(),
1087
630
# Schedule a disable() when 'timeout' has passed
1088
631
if self.disable_initiator_tag is not None:
1089
GLib.source_remove(self.disable_initiator_tag)
1090
self.disable_initiator_tag = GLib.timeout_add(
1091
int(self.timeout.total_seconds() * 1000), self.disable)
632
gobject.source_remove(self.disable_initiator_tag)
633
self.disable_initiator_tag = (gobject.timeout_add
634
(self.timeout_milliseconds(),
1092
636
# Also start a new checker *right now*.
1093
637
self.start_checker()
1095
def checker_callback(self, source, condition, connection,
639
def checker_callback(self, pid, condition, command):
1097
640
"""The checker has completed, so take appropriate actions."""
1098
# Read return code from connection (see call_pipe)
1099
returncode = connection.recv()
1101
if self.checker is not None:
1103
641
self.checker_callback_tag = None
1104
642
self.checker = None
1107
self.last_checker_status = returncode
1108
self.last_checker_signal = None
643
if os.WIFEXITED(condition):
644
self.last_checker_status = os.WEXITSTATUS(condition)
1109
645
if self.last_checker_status == 0:
1110
646
logger.info("Checker for %(name)s succeeded",
1112
648
self.checked_ok()
1114
logger.info("Checker for %(name)s failed", vars(self))
650
logger.info("Checker for %(name)s failed",
1116
653
self.last_checker_status = -1
1117
self.last_checker_signal = -returncode
1118
654
logger.warning("Checker for %(name)s crashed?",
1122
657
def checked_ok(self):
1123
658
"""Assert that the client has been seen, alive and well."""
1124
659
self.last_checked_ok = datetime.datetime.utcnow()
1125
660
self.last_checker_status = 0
1126
self.last_checker_signal = None
1127
661
self.bump_timeout()
1129
663
def bump_timeout(self, timeout=None):
1130
664
"""Bump up the timeout for this client."""
1131
665
if timeout is None:
1132
666
timeout = self.timeout
1133
667
if self.disable_initiator_tag is not None:
1134
GLib.source_remove(self.disable_initiator_tag)
668
gobject.source_remove(self.disable_initiator_tag)
1135
669
self.disable_initiator_tag = None
1136
670
if getattr(self, "enabled", False):
1137
self.disable_initiator_tag = GLib.timeout_add(
1138
int(timeout.total_seconds() * 1000), self.disable)
671
self.disable_initiator_tag = (gobject.timeout_add
672
(timedelta_to_milliseconds
673
(timeout), self.disable))
1139
674
self.expires = datetime.datetime.utcnow() + timeout
1141
676
def need_approval(self):
1142
677
self.last_approval_request = datetime.datetime.utcnow()
1144
679
def start_checker(self):
1145
680
"""Start a new checker subprocess if one is not running.
1147
682
If a checker already exists, leave it running and do
1149
684
# The reason for not killing a running checker is that if we
1154
689
# checkers alone, the checker would have to take more time
1155
690
# than 'timeout' for the client to be disabled, which is as it
1158
if self.checker is not None and not self.checker.is_alive():
1159
logger.warning("Checker was not alive; joining")
693
# If a checker exists, make sure it is not a zombie
695
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
696
except AttributeError:
698
except OSError as error:
699
if error.errno != errno.ECHILD:
703
logger.warning("Checker was a zombie")
704
gobject.source_remove(self.checker_callback_tag)
705
self.checker_callback(pid, status,
706
self.current_checker_command)
1162
707
# Start a new checker if needed
1163
708
if self.checker is None:
1164
709
# Escape attributes for the shell
1166
attr: shlex.quote(str(getattr(self, attr)))
1167
for attr in self.runtime_expansions}
710
escaped_attrs = dict(
711
(attr, re.escape(unicode(getattr(self, attr))))
713
self.runtime_expansions)
1169
715
command = self.checker_command % escaped_attrs
1170
716
except TypeError as error:
1171
717
logger.error('Could not format string "%s"',
1172
self.checker_command,
718
self.checker_command, exc_info=error)
719
return True # Try again later
720
self.current_checker_command = command
722
logger.info("Starting checker %r for %s",
724
# We don't need to redirect stdout and stderr, since
725
# in normal mode, that is already done by daemon(),
726
# and in debug mode we don't want to. (Stdin is
727
# always replaced by /dev/null.)
728
# The exception is when not debugging but nevertheless
729
# running in the foreground; use the previously
732
if (not self.server_settings["debug"]
733
and self.server_settings["foreground"]):
734
popen_args.update({"stdout": wnull,
736
self.checker = subprocess.Popen(command,
740
except OSError as error:
741
logger.error("Failed to start subprocess",
1174
return True # Try again later
1175
self.current_checker_command = command
1176
logger.info("Starting checker %r for %s", command,
1178
# We don't need to redirect stdout and stderr, since
1179
# in normal mode, that is already done by daemon(),
1180
# and in debug mode we don't want to. (Stdin is
1181
# always replaced by /dev/null.)
1182
# The exception is when not debugging but nevertheless
1183
# running in the foreground; use the previously
1185
popen_args = {"close_fds": True,
1188
if (not self.server_settings["debug"]
1189
and self.server_settings["foreground"]):
1190
popen_args.update({"stdout": wnull,
1192
pipe = multiprocessing.Pipe(duplex=False)
1193
self.checker = multiprocessing.Process(
1195
args=(pipe[1], subprocess.call, command),
1197
self.checker.start()
1198
self.checker_callback_tag = GLib.io_add_watch(
1199
GLib.IOChannel.unix_new(pipe[0].fileno()),
1200
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1201
self.checker_callback, pipe[0], command)
1202
# Re-run this periodically if run by GLib.timeout_add
744
self.checker_callback_tag = (gobject.child_watch_add
746
self.checker_callback,
748
# The checker may have completed before the gobject
749
# watch was added. Check for this.
751
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
752
except OSError as error:
753
if error.errno == errno.ECHILD:
754
# This should never happen
755
logger.error("Child process vanished",
760
gobject.source_remove(self.checker_callback_tag)
761
self.checker_callback(pid, status, command)
762
# Re-run this periodically if run by gobject.timeout_add
1205
765
def stop_checker(self):
1206
766
"""Force the checker process, if any, to stop."""
1207
767
if self.checker_callback_tag:
1208
GLib.source_remove(self.checker_callback_tag)
768
gobject.source_remove(self.checker_callback_tag)
1209
769
self.checker_callback_tag = None
1210
770
if getattr(self, "checker", None) is None:
1212
772
logger.debug("Stopping checker for %(name)s", vars(self))
1213
self.checker.terminate()
774
self.checker.terminate()
776
#if self.checker.poll() is None:
777
# self.checker.kill()
778
except OSError as error:
779
if error.errno != errno.ESRCH: # No such process
1214
781
self.checker = None
1217
def dbus_service_property(dbus_interface,
784
def dbus_service_property(dbus_interface, signature="v",
785
access="readwrite", byte_arrays=False):
1221
786
"""Decorators for marking methods of a DBusObjectWithProperties to
1222
787
become properties on the D-Bus.
1224
789
The decorated method will be called with no arguments by "Get"
1225
790
and with one argument by "Set".
1227
792
The parameters, where they are supported, are the same as
1228
793
dbus.service.method, except there is only "signature", since the
1229
794
type from Get() and the type sent to Set() is the same.
1312
class DBusObjectWithAnnotations(dbus.service.Object):
1313
"""A D-Bus object with annotations.
1315
Classes inheriting from this can use the dbus_annotations
1316
decorator to add annotations to methods or signals.
870
class DBusObjectWithProperties(dbus.service.Object):
871
"""A D-Bus object with properties.
873
Classes inheriting from this can use the dbus_service_property
874
decorator to expose methods as D-Bus properties. It exposes the
875
standard Get(), Set(), and GetAll() methods on the D-Bus.
1320
879
def _is_dbus_thing(thing):
1321
880
"""Returns a function testing if an attribute is a D-Bus thing
1323
882
If called like _is_dbus_thing("method") it returns a function
1324
883
suitable for use as predicate to inspect.getmembers().
1326
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
885
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1329
888
def _get_all_dbus_things(self, thing):
1330
889
"""Returns a generator of (name, attribute) pairs
1332
return ((getattr(athing.__get__(self), "_dbus_name", name),
891
return ((getattr(athing.__get__(self), "_dbus_name",
1333
893
athing.__get__(self))
1334
894
for cls in self.__class__.__mro__
1335
895
for name, athing in
1336
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1338
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1340
path_keyword='object_path',
1341
connection_keyword='connection')
1342
def Introspect(self, object_path, connection):
1343
"""Overloading of standard D-Bus method.
1345
Inserts annotation tags on methods and signals.
1347
xmlstring = dbus.service.Object.Introspect(self, object_path,
1350
document = xml.dom.minidom.parseString(xmlstring)
1352
for if_tag in document.getElementsByTagName("interface"):
1353
# Add annotation tags
1354
for typ in ("method", "signal"):
1355
for tag in if_tag.getElementsByTagName(typ):
1357
for name, prop in (self.
1358
_get_all_dbus_things(typ)):
1359
if (name == tag.getAttribute("name")
1360
and prop._dbus_interface
1361
== if_tag.getAttribute("name")):
1362
annots.update(getattr(
1363
prop, "_dbus_annotations", {}))
1364
for name, value in annots.items():
1365
ann_tag = document.createElement(
1367
ann_tag.setAttribute("name", name)
1368
ann_tag.setAttribute("value", value)
1369
tag.appendChild(ann_tag)
1370
# Add interface annotation tags
1371
for annotation, value in dict(
1372
itertools.chain.from_iterable(
1373
annotations().items()
1374
for name, annotations
1375
in self._get_all_dbus_things("interface")
1376
if name == if_tag.getAttribute("name")
1378
ann_tag = document.createElement("annotation")
1379
ann_tag.setAttribute("name", annotation)
1380
ann_tag.setAttribute("value", value)
1381
if_tag.appendChild(ann_tag)
1382
# Fix argument name for the Introspect method itself
1383
if (if_tag.getAttribute("name")
1384
== dbus.INTROSPECTABLE_IFACE):
1385
for cn in if_tag.getElementsByTagName("method"):
1386
if cn.getAttribute("name") == "Introspect":
1387
for arg in cn.getElementsByTagName("arg"):
1388
if (arg.getAttribute("direction")
1390
arg.setAttribute("name",
1392
xmlstring = document.toxml("utf-8")
1394
except (AttributeError, xml.dom.DOMException,
1395
xml.parsers.expat.ExpatError) as error:
1396
logger.error("Failed to override Introspection method",
1401
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1402
"""A D-Bus object with properties.
1404
Classes inheriting from this can use the dbus_service_property
1405
decorator to expose methods as D-Bus properties. It exposes the
1406
standard Get(), Set(), and GetAll() methods on the D-Bus.
896
inspect.getmembers(cls,
897
self._is_dbus_thing(thing)))
1409
899
def _get_dbus_property(self, interface_name, property_name):
1410
900
"""Returns a bound method if one exists which is a D-Bus
1411
901
property with the specified name and interface.
1413
for cls in self.__class__.__mro__:
1414
for name, value in inspect.getmembers(
1415
cls, self._is_dbus_thing("property")):
903
for cls in self.__class__.__mro__:
904
for name, value in (inspect.getmembers
906
self._is_dbus_thing("property"))):
1416
907
if (value._dbus_name == property_name
1417
908
and value._dbus_interface == interface_name):
1418
909
return value.__get__(self)
1420
911
# No such property
1421
raise DBusPropertyNotFound("{}:{}.{}".format(
1422
self.dbus_object_path, interface_name, property_name))
1425
def _get_all_interface_names(cls):
1426
"""Get a sequence of all interfaces supported by an object"""
1427
return (name for name in set(getattr(getattr(x, attr),
1428
"_dbus_interface", None)
1429
for x in (inspect.getmro(cls))
1431
if name is not None)
1433
@dbus.service.method(dbus.PROPERTIES_IFACE,
912
raise DBusPropertyNotFound(self.dbus_object_path + ":"
913
+ interface_name + "."
916
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1435
917
out_signature="v")
1436
918
def Get(self, interface_name, property_name):
1437
919
"""Standard D-Bus property Get() method, see D-Bus standard.
1565
1051
return xmlstring
1569
dbus.OBJECT_MANAGER_IFACE
1570
except AttributeError:
1571
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1574
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1575
"""A D-Bus object with an ObjectManager.
1577
Classes inheriting from this exposes the standard
1578
GetManagedObjects call and the InterfacesAdded and
1579
InterfacesRemoved signals on the standard
1580
"org.freedesktop.DBus.ObjectManager" interface.
1582
Note: No signals are sent automatically; they must be sent
1585
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1586
out_signature="a{oa{sa{sv}}}")
1587
def GetManagedObjects(self):
1588
"""This function must be overridden"""
1589
raise NotImplementedError()
1591
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1592
signature="oa{sa{sv}}")
1593
def InterfacesAdded(self, object_path, interfaces_and_properties):
1596
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1597
def InterfacesRemoved(self, object_path, interfaces):
1600
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1602
path_keyword='object_path',
1603
connection_keyword='connection')
1604
def Introspect(self, object_path, connection):
1605
"""Overloading of standard D-Bus method.
1607
Override return argument name of GetManagedObjects to be
1608
"objpath_interfaces_and_properties"
1610
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1614
document = xml.dom.minidom.parseString(xmlstring)
1616
for if_tag in document.getElementsByTagName("interface"):
1617
# Fix argument name for the GetManagedObjects method
1618
if (if_tag.getAttribute("name")
1619
== dbus.OBJECT_MANAGER_IFACE):
1620
for cn in if_tag.getElementsByTagName("method"):
1621
if (cn.getAttribute("name")
1622
== "GetManagedObjects"):
1623
for arg in cn.getElementsByTagName("arg"):
1624
if (arg.getAttribute("direction")
1628
"objpath_interfaces"
1630
xmlstring = document.toxml("utf-8")
1632
except (AttributeError, xml.dom.DOMException,
1633
xml.parsers.expat.ExpatError) as error:
1634
logger.error("Failed to override Introspection method",
1639
1054
def datetime_to_dbus(dt, variant_level=0):
1640
1055
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1642
return dbus.String("", variant_level=variant_level)
1643
return dbus.String(dt.isoformat(), variant_level=variant_level)
1057
return dbus.String("", variant_level = variant_level)
1058
return dbus.String(dt.isoformat(),
1059
variant_level=variant_level)
1646
1062
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
2007
1411
server to mandos-client
2011
1415
# Rejected - signal
2012
1416
@dbus.service.signal(_interface, signature="s")
2013
1417
def Rejected(self, reason):
2017
1421
# NeedApproval - signal
2018
1422
@dbus.service.signal(_interface, signature="tb")
2019
1423
def NeedApproval(self, timeout, default):
2021
1425
return self.need_approval()
2025
1429
# Approve - method
2026
1430
@dbus.service.method(_interface, in_signature="b")
2027
1431
def Approve(self, value):
2028
1432
self.approve(value)
2030
1434
# CheckedOK - method
2031
1435
@dbus.service.method(_interface)
2032
1436
def CheckedOK(self):
2033
1437
self.checked_ok()
2035
1439
# Enable - method
2036
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2037
1440
@dbus.service.method(_interface)
2038
1441
def Enable(self):
2042
1445
# StartChecker - method
2043
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2044
1446
@dbus.service.method(_interface)
2045
1447
def StartChecker(self):
2047
1449
self.start_checker()
2049
1451
# Disable - method
2050
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2051
1452
@dbus.service.method(_interface)
2052
1453
def Disable(self):
2056
1457
# StopChecker - method
2057
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2058
1458
@dbus.service.method(_interface)
2059
1459
def StopChecker(self):
2060
1460
self.stop_checker()
2064
1464
# ApprovalPending - property
2065
1465
@dbus_service_property(_interface, signature="b", access="read")
2066
1466
def ApprovalPending_dbus_property(self):
2067
1467
return dbus.Boolean(bool(self.approvals_pending))
2069
1469
# ApprovedByDefault - property
2070
@dbus_service_property(_interface,
1470
@dbus_service_property(_interface, signature="b",
2072
1471
access="readwrite")
2073
1472
def ApprovedByDefault_dbus_property(self, value=None):
2074
1473
if value is None: # get
2075
1474
return dbus.Boolean(self.approved_by_default)
2076
1475
self.approved_by_default = bool(value)
2078
1477
# ApprovalDelay - property
2079
@dbus_service_property(_interface,
1478
@dbus_service_property(_interface, signature="t",
2081
1479
access="readwrite")
2082
1480
def ApprovalDelay_dbus_property(self, value=None):
2083
1481
if value is None: # get
2084
return dbus.UInt64(self.approval_delay.total_seconds()
1482
return dbus.UInt64(self.approval_delay_milliseconds())
2086
1483
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2088
1485
# ApprovalDuration - property
2089
@dbus_service_property(_interface,
1486
@dbus_service_property(_interface, signature="t",
2091
1487
access="readwrite")
2092
1488
def ApprovalDuration_dbus_property(self, value=None):
2093
1489
if value is None: # get
2094
return dbus.UInt64(self.approval_duration.total_seconds()
1490
return dbus.UInt64(timedelta_to_milliseconds(
1491
self.approval_duration))
2096
1492
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2098
1494
# Name - property
2100
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2101
1495
@dbus_service_property(_interface, signature="s", access="read")
2102
1496
def Name_dbus_property(self):
2103
1497
return dbus.String(self.name)
2107
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2108
@dbus_service_property(_interface, signature="s", access="read")
2109
def KeyID_dbus_property(self):
2110
return dbus.String(self.key_id)
2112
1499
# Fingerprint - property
2114
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2115
1500
@dbus_service_property(_interface, signature="s", access="read")
2116
1501
def Fingerprint_dbus_property(self):
2117
1502
return dbus.String(self.fingerprint)
2119
1504
# Host - property
2120
@dbus_service_property(_interface,
1505
@dbus_service_property(_interface, signature="s",
2122
1506
access="readwrite")
2123
1507
def Host_dbus_property(self, value=None):
2124
1508
if value is None: # get
2125
1509
return dbus.String(self.host)
2126
self.host = str(value)
1510
self.host = unicode(value)
2128
1512
# Created - property
2130
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2131
1513
@dbus_service_property(_interface, signature="s", access="read")
2132
1514
def Created_dbus_property(self):
2133
1515
return datetime_to_dbus(self.created)
2135
1517
# LastEnabled - property
2136
1518
@dbus_service_property(_interface, signature="s", access="read")
2137
1519
def LastEnabled_dbus_property(self):
2138
1520
return datetime_to_dbus(self.last_enabled)
2140
1522
# Enabled - property
2141
@dbus_service_property(_interface,
1523
@dbus_service_property(_interface, signature="b",
2143
1524
access="readwrite")
2144
1525
def Enabled_dbus_property(self, value=None):
2145
1526
if value is None: # get
2428
1792
delay -= time2 - time
2431
session.send(client.secret)
2432
except gnutls.Error as error:
2433
logger.warning("gnutls send failed",
1795
while sent_size < len(client.secret):
1797
sent = session.send(client.secret[sent_size:])
1798
except gnutls.errors.GNUTLSError as error:
1799
logger.warning("gnutls send failed",
1802
logger.debug("Sent: %d, remaining: %d",
1803
sent, len(client.secret)
1804
- (sent_size + sent))
2437
1807
logger.info("Sending secret to %s", client.name)
2438
1808
# bump the timeout using extended_timeout
2439
1809
client.bump_timeout(client.extended_timeout)
2440
1810
if self.server.use_dbus:
2441
1811
# Emit D-Bus signal
2442
1812
client.GotSecret()
2445
1815
if approval_required:
2446
1816
client.approvals_pending -= 1
2449
except gnutls.Error as error:
1819
except gnutls.errors.GNUTLSError as error:
2450
1820
logger.warning("GnuTLS bye failed",
2451
1821
exc_info=error)
2454
1824
def peer_certificate(session):
2455
"Return the peer's certificate as a bytestring"
2457
cert_type = gnutls.certificate_type_get2(
2458
session, gnutls.CTYPE_PEERS)
2459
except AttributeError:
2460
cert_type = gnutls.certificate_type_get(session)
2461
if gnutls.has_rawpk:
2462
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2464
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2465
# If not a valid certificate type...
2466
if cert_type not in valid_cert_types:
2467
logger.info("Cert type %r not in %r", cert_type,
2469
# ...return invalid data
1825
"Return the peer's OpenPGP certificate as a bytestring"
1826
# If not an OpenPGP certificate...
1827
if (gnutls.library.functions
1828
.gnutls_certificate_type_get(session._c_object)
1829
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1830
# ...do the normal thing
1831
return session.peer_certificate
2471
1832
list_size = ctypes.c_uint(1)
2472
cert_list = (gnutls.certificate_get_peers
2473
(session, ctypes.byref(list_size)))
1833
cert_list = (gnutls.library.functions
1834
.gnutls_certificate_get_peers
1835
(session._c_object, ctypes.byref(list_size)))
2474
1836
if not bool(cert_list) and list_size.value != 0:
2475
raise gnutls.Error("error getting peer certificate")
1837
raise gnutls.errors.GNUTLSError("error getting peer"
2476
1839
if list_size.value == 0:
2478
1841
cert = cert_list[0]
2479
1842
return ctypes.string_at(cert.data, cert.size)
2482
def key_id(certificate):
2483
"Convert a certificate bytestring to a hexdigit key ID"
2484
# New GnuTLS "datum" with the public key
2485
datum = gnutls.datum_t(
2486
ctypes.cast(ctypes.c_char_p(certificate),
2487
ctypes.POINTER(ctypes.c_ubyte)),
2488
ctypes.c_uint(len(certificate)))
2489
# XXX all these need to be created in the gnutls "module"
2490
# New empty GnuTLS certificate
2491
pubkey = gnutls.pubkey_t()
2492
gnutls.pubkey_init(ctypes.byref(pubkey))
2493
# Import the raw public key into the certificate
2494
gnutls.pubkey_import(pubkey,
2495
ctypes.byref(datum),
2496
gnutls.X509_FMT_DER)
2497
# New buffer for the key ID
2498
buf = ctypes.create_string_buffer(32)
2499
buf_len = ctypes.c_size_t(len(buf))
2500
# Get the key ID from the raw public key into the buffer
2501
gnutls.pubkey_get_key_id(
2503
gnutls.KEYID_USE_SHA256,
2504
ctypes.cast(ctypes.byref(buf),
2505
ctypes.POINTER(ctypes.c_ubyte)),
2506
ctypes.byref(buf_len))
2507
# Deinit the certificate
2508
gnutls.pubkey_deinit(pubkey)
2510
# Convert the buffer to a Python bytestring
2511
key_id = ctypes.string_at(buf, buf_len.value)
2512
# Convert the bytestring to hexadecimal notation
2513
hex_key_id = binascii.hexlify(key_id).upper()
2517
1845
def fingerprint(openpgp):
2518
1846
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2519
1847
# New GnuTLS "datum" with the OpenPGP public key
2520
datum = gnutls.datum_t(
2521
ctypes.cast(ctypes.c_char_p(openpgp),
2522
ctypes.POINTER(ctypes.c_ubyte)),
2523
ctypes.c_uint(len(openpgp)))
1848
datum = (gnutls.library.types
1849
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1852
ctypes.c_uint(len(openpgp))))
2524
1853
# New empty GnuTLS certificate
2525
crt = gnutls.openpgp_crt_t()
2526
gnutls.openpgp_crt_init(ctypes.byref(crt))
1854
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1855
(gnutls.library.functions
1856
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2527
1857
# Import the OpenPGP public key into the certificate
2528
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2529
gnutls.OPENPGP_FMT_RAW)
1858
(gnutls.library.functions
1859
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1860
gnutls.library.constants
1861
.GNUTLS_OPENPGP_FMT_RAW))
2530
1862
# Verify the self signature in the key
2531
1863
crtverify = ctypes.c_uint()
2532
gnutls.openpgp_crt_verify_self(crt, 0,
2533
ctypes.byref(crtverify))
1864
(gnutls.library.functions
1865
.gnutls_openpgp_crt_verify_self(crt, 0,
1866
ctypes.byref(crtverify)))
2534
1867
if crtverify.value != 0:
2535
gnutls.openpgp_crt_deinit(crt)
2536
raise gnutls.CertificateSecurityError(code
1868
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1869
raise (gnutls.errors.CertificateSecurityError
2538
1871
# New buffer for the fingerprint
2539
1872
buf = ctypes.create_string_buffer(20)
2540
1873
buf_len = ctypes.c_size_t()
2541
1874
# Get the fingerprint from the certificate into the buffer
2542
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2543
ctypes.byref(buf_len))
1875
(gnutls.library.functions
1876
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1877
ctypes.byref(buf_len)))
2544
1878
# Deinit the certificate
2545
gnutls.openpgp_crt_deinit(crt)
1879
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2546
1880
# Convert the buffer to a Python bytestring
2547
1881
fpr = ctypes.string_at(buf, buf_len.value)
2548
1882
# Convert the bytestring to hexadecimal notation
2637
1965
# socket_wrapper(), if socketfd was set.
2638
1966
socketserver.TCPServer.__init__(self, server_address,
2639
1967
RequestHandlerClass)
2641
1969
def server_bind(self):
2642
1970
"""This overrides the normal server_bind() function
2643
1971
to bind to an interface if one was specified, and also NOT to
2644
1972
bind to an address or port if they were not specified."""
2645
global SO_BINDTODEVICE
2646
1973
if self.interface is not None:
2647
1974
if SO_BINDTODEVICE is None:
2648
# Fall back to a hard-coded value which seems to be
2650
logger.warning("SO_BINDTODEVICE not found, trying 25")
2651
SO_BINDTODEVICE = 25
2653
self.socket.setsockopt(
2654
socket.SOL_SOCKET, SO_BINDTODEVICE,
2655
(self.interface + "\0").encode("utf-8"))
2656
except socket.error as error:
2657
if error.errno == errno.EPERM:
2658
logger.error("No permission to bind to"
2659
" interface %s", self.interface)
2660
elif error.errno == errno.ENOPROTOOPT:
2661
logger.error("SO_BINDTODEVICE not available;"
2662
" cannot bind to interface %s",
2664
elif error.errno == errno.ENODEV:
2665
logger.error("Interface %s does not exist,"
2666
" cannot bind", self.interface)
1975
logger.error("SO_BINDTODEVICE does not exist;"
1976
" cannot bind to interface %s",
1980
self.socket.setsockopt(socket.SOL_SOCKET,
1982
str(self.interface + '\0'))
1983
except socket.error as error:
1984
if error.errno == errno.EPERM:
1985
logger.error("No permission to bind to"
1986
" interface %s", self.interface)
1987
elif error.errno == errno.ENOPROTOOPT:
1988
logger.error("SO_BINDTODEVICE not available;"
1989
" cannot bind to interface %s",
1991
elif error.errno == errno.ENODEV:
1992
logger.error("Interface %s does not exist,"
1993
" cannot bind", self.interface)
2669
1996
# Only bind(2) the socket if we really need to.
2670
1997
if self.server_address[0] or self.server_address[1]:
2671
if self.server_address[1]:
2672
self.allow_reuse_address = True
2673
1998
if not self.server_address[0]:
2674
1999
if self.address_family == socket.AF_INET6:
2675
any_address = "::" # in6addr_any
2000
any_address = "::" # in6addr_any
2677
any_address = "0.0.0.0" # INADDR_ANY
2002
any_address = "0.0.0.0" # INADDR_ANY
2678
2003
self.server_address = (any_address,
2679
2004
self.server_address[1])
2680
2005
elif not self.server_address[1]:
2681
self.server_address = (self.server_address[0], 0)
2006
self.server_address = (self.server_address[0],
2682
2008
# if self.interface:
2683
2009
# self.server_address = (self.server_address[0],
2714
2035
self.gnutls_priority = gnutls_priority
2715
2036
IPv6_TCPServer.__init__(self, server_address,
2716
2037
RequestHandlerClass,
2717
interface=interface,
2038
interface = interface,
2039
use_ipv6 = use_ipv6,
2040
socketfd = socketfd)
2721
2041
def server_activate(self):
2722
2042
if self.enabled:
2723
2043
return socketserver.TCPServer.server_activate(self)
2725
2045
def enable(self):
2726
2046
self.enabled = True
2728
2048
def add_pipe(self, parent_pipe, proc):
2729
2049
# Call "handle_ipc" for both data and EOF events
2731
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2732
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2733
functools.partial(self.handle_ipc,
2734
parent_pipe=parent_pipe,
2737
def handle_ipc(self, source, condition,
2740
client_object=None):
2050
gobject.io_add_watch(parent_pipe.fileno(),
2051
gobject.IO_IN | gobject.IO_HUP,
2052
functools.partial(self.handle_ipc,
2057
def handle_ipc(self, source, condition, parent_pipe=None,
2058
proc = None, client_object=None):
2741
2059
# error, or the other end of multiprocessing.Pipe has closed
2742
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2060
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2743
2061
# Wait for other process to exit
2747
2065
# Read a request from the child
2748
2066
request = parent_pipe.recv()
2749
2067
command = request[0]
2751
2069
if command == 'init':
2752
key_id = request[1].decode("ascii")
2753
fpr = request[2].decode("ascii")
2754
address = request[3]
2756
for c in self.clients.values():
2757
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2758
"27AE41E4649B934CA495991B7852B855"):
2760
if key_id and c.key_id == key_id:
2763
if fpr and c.fingerprint == fpr:
2071
address = request[2]
2073
for c in self.clients.itervalues():
2074
if c.fingerprint == fpr:
2767
logger.info("Client not found for key ID: %s, address"
2768
": %s", key_id or fpr, address)
2078
logger.info("Client not found for fingerprint: %s, ad"
2079
"dress: %s", fpr, address)
2769
2080
if self.use_dbus:
2770
2081
# Emit D-Bus signal
2771
mandos_dbus_service.ClientNotFound(key_id or fpr,
2082
mandos_dbus_service.ClientNotFound(fpr,
2773
2084
parent_pipe.send(False)
2777
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2778
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2779
functools.partial(self.handle_ipc,
2780
parent_pipe=parent_pipe,
2782
client_object=client))
2087
gobject.io_add_watch(parent_pipe.fileno(),
2088
gobject.IO_IN | gobject.IO_HUP,
2089
functools.partial(self.handle_ipc,
2783
2095
parent_pipe.send(True)
2784
2096
# remove the old hook in favor of the new above hook on
2788
2100
funcname = request[1]
2789
2101
args = request[2]
2790
2102
kwargs = request[3]
2792
2104
parent_pipe.send(('data', getattr(client_object,
2793
2105
funcname)(*args,
2796
2108
if command == 'getattr':
2797
2109
attrname = request[1]
2798
if isinstance(client_object.__getattribute__(attrname),
2799
collections.abc.Callable):
2800
parent_pipe.send(('function', ))
2110
if callable(client_object.__getattribute__(attrname)):
2111
parent_pipe.send(('function',))
2803
'data', client_object.__getattribute__(attrname)))
2113
parent_pipe.send(('data', client_object
2114
.__getattribute__(attrname)))
2805
2116
if command == 'setattr':
2806
2117
attrname = request[1]
2807
2118
value = request[2]
2808
2119
setattr(client_object, attrname, value)
2813
2124
def rfc3339_duration_to_delta(duration):
2814
2125
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2816
>>> timedelta = datetime.timedelta
2817
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2819
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2821
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2823
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2825
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2827
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2829
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2127
>>> rfc3339_duration_to_delta("P7D")
2128
datetime.timedelta(7)
2129
>>> rfc3339_duration_to_delta("PT60S")
2130
datetime.timedelta(0, 60)
2131
>>> rfc3339_duration_to_delta("PT60M")
2132
datetime.timedelta(0, 3600)
2133
>>> rfc3339_duration_to_delta("PT24H")
2134
datetime.timedelta(1)
2135
>>> rfc3339_duration_to_delta("P1W")
2136
datetime.timedelta(7)
2137
>>> rfc3339_duration_to_delta("PT5M30S")
2138
datetime.timedelta(0, 330)
2139
>>> rfc3339_duration_to_delta("P1DT3M20S")
2140
datetime.timedelta(1, 200)
2834
2143
# Parsing an RFC 3339 duration with regular expressions is not
2835
2144
# possible - there would have to be multiple places for the same
2836
2145
# values, like seconds. The current code, while more esoteric, is
2837
2146
# cleaner without depending on a parsing library. If Python had a
2838
2147
# built-in library for parsing we would use it, but we'd like to
2839
2148
# avoid excessive use of external libraries.
2841
2150
# New type for defining tokens, syntax, and semantics all-in-one
2842
Token = collections.namedtuple("Token", (
2843
"regexp", # To match token; if "value" is not None, must have
2844
# a "group" containing digits
2845
"value", # datetime.timedelta or None
2846
"followers")) # Tokens valid after this token
2151
Token = collections.namedtuple("Token",
2152
("regexp", # To match token; if
2153
# "value" is not None,
2154
# must have a "group"
2156
"value", # datetime.timedelta or
2158
"followers")) # Tokens valid after
2847
2160
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2848
2161
# the "duration" ABNF definition in RFC 3339, Appendix A.
2849
2162
token_end = Token(re.compile(r"$"), None, frozenset())
2850
2163
token_second = Token(re.compile(r"(\d+)S"),
2851
2164
datetime.timedelta(seconds=1),
2852
frozenset((token_end, )))
2165
frozenset((token_end,)))
2853
2166
token_minute = Token(re.compile(r"(\d+)M"),
2854
2167
datetime.timedelta(minutes=1),
2855
2168
frozenset((token_second, token_end)))
3187
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3189
2497
except OSError as error:
3190
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3191
.format(uid, gid, os.strerror(error.errno)))
3192
2498
if error.errno != errno.EPERM:
3196
2502
# Enable all possible GnuTLS debugging
3198
2504
# "Use a log level over 10 to enable all debugging options."
3199
2505
# - GnuTLS manual
3200
gnutls.global_set_log_level(11)
2506
gnutls.library.functions.gnutls_global_set_log_level(11)
2508
@gnutls.library.types.gnutls_log_func
3203
2509
def debug_gnutls(level, string):
3204
logger.debug("GnuTLS: %s",
3205
string[:-1].decode("utf-8",
3208
gnutls.global_set_log_function(debug_gnutls)
2510
logger.debug("GnuTLS: %s", string[:-1])
2512
(gnutls.library.functions
2513
.gnutls_global_set_log_function(debug_gnutls))
3210
2515
# Redirect stdin so all checkers get /dev/null
3211
2516
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3212
2517
os.dup2(null, sys.stdin.fileno())
3216
2521
# Need to fork before connecting to D-Bus
3217
2522
if not foreground:
3218
2523
# Close all input and output, do double fork, etc.
3221
if gi.version_info < (3, 10, 2):
3222
# multiprocessing will use threads, so before we use GLib we
3223
# need to inform GLib that threads will be used.
2526
# multiprocessing will use threads, so before we use gobject we
2527
# need to inform gobject that threads will be used.
2528
gobject.threads_init()
3226
2530
global main_loop
3227
2531
# From the Avahi example code
3228
2532
DBusGMainLoop(set_as_default=True)
3229
main_loop = GLib.MainLoop()
2533
main_loop = gobject.MainLoop()
3230
2534
bus = dbus.SystemBus()
3231
2535
# End of Avahi example code
3234
2538
bus_name = dbus.service.BusName("se.recompile.Mandos",
3237
old_bus_name = dbus.service.BusName(
3238
"se.bsnet.fukt.Mandos", bus,
3240
except dbus.exceptions.DBusException as e:
2539
bus, do_not_queue=True)
2540
old_bus_name = (dbus.service.BusName
2541
("se.bsnet.fukt.Mandos", bus,
2543
except dbus.exceptions.NameExistsException as e:
3241
2544
logger.error("Disabling D-Bus:", exc_info=e)
3242
2545
use_dbus = False
3243
2546
server_settings["use_dbus"] = False
3244
2547
tcp_server.use_dbus = False
3246
2549
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3247
service = AvahiServiceToSyslog(
3248
name=server_settings["servicename"],
3249
servicetype="_mandos._tcp",
2550
service = AvahiServiceToSyslog(name =
2551
server_settings["servicename"],
2552
servicetype = "_mandos._tcp",
2553
protocol = protocol, bus = bus)
3252
2554
if server_settings["interface"]:
3253
service.interface = if_nametoindex(
3254
server_settings["interface"].encode("utf-8"))
2555
service.interface = (if_nametoindex
2556
(str(server_settings["interface"])))
3256
2558
global multiprocessing_manager
3257
2559
multiprocessing_manager = multiprocessing.Manager()
3259
2561
client_class = Client
3261
client_class = functools.partial(ClientDBus, bus=bus)
2563
client_class = functools.partial(ClientDBus, bus = bus)
3263
2565
client_settings = Client.config_parser(client_config)
3264
2566
old_client_settings = {}
3265
2567
clients_data = {}
3267
2569
# This is used to redirect stdout and stderr for checker processes
3269
wnull = open(os.devnull, "w") # A writable /dev/null
2571
wnull = open(os.devnull, "w") # A writable /dev/null
3270
2572
# Only used if server is running in foreground but not in debug
3272
2574
if debug or not foreground:
3275
2577
# Get client data and settings from last running state.
3276
2578
if server_settings["restore"]:
3278
2580
with open(stored_state_path, "rb") as stored_state:
3279
if sys.version_info.major == 2:
3280
clients_data, old_client_settings = pickle.load(
3283
bytes_clients_data, bytes_old_client_settings = (
3284
pickle.load(stored_state, encoding="bytes"))
3285
# Fix bytes to strings
3288
clients_data = {(key.decode("utf-8")
3289
if isinstance(key, bytes)
3292
bytes_clients_data.items()}
3293
del bytes_clients_data
3294
for key in clients_data:
3295
value = {(k.decode("utf-8")
3296
if isinstance(k, bytes) else k): v
3298
clients_data[key].items()}
3299
clients_data[key] = value
3301
value["client_structure"] = [
3303
if isinstance(s, bytes)
3305
value["client_structure"]]
3306
# .name, .host, and .checker_command
3307
for k in ("name", "host", "checker_command"):
3308
if isinstance(value[k], bytes):
3309
value[k] = value[k].decode("utf-8")
3310
if "key_id" not in value:
3311
value["key_id"] = ""
3312
elif "fingerprint" not in value:
3313
value["fingerprint"] = ""
3314
# old_client_settings
3316
old_client_settings = {
3317
(key.decode("utf-8")
3318
if isinstance(key, bytes)
3321
bytes_old_client_settings.items()}
3322
del bytes_old_client_settings
3323
# .host and .checker_command
3324
for value in old_client_settings.values():
3325
for attribute in ("host", "checker_command"):
3326
if isinstance(value[attribute], bytes):
3327
value[attribute] = (value[attribute]
2581
clients_data, old_client_settings = (pickle.load
3329
2583
os.remove(stored_state_path)
3330
2584
except IOError as e:
3331
2585
if e.errno == errno.ENOENT:
3332
logger.warning("Could not load persistent state:"
3333
" {}".format(os.strerror(e.errno)))
2586
logger.warning("Could not load persistent state: {0}"
2587
.format(os.strerror(e.errno)))
3335
2589
logger.critical("Could not load persistent state:",
3338
2592
except EOFError as e:
3339
2593
logger.warning("Could not load persistent state: "
2594
"EOFError:", exc_info=e)
3343
2596
with PGPEngine() as pgp:
3344
for client_name, client in clients_data.items():
2597
for client_name, client in clients_data.iteritems():
3345
2598
# Skip removed clients
3346
2599
if client_name not in client_settings:
3349
2602
# Decide which value to use after restoring saved state.
3350
2603
# We have three different values: Old config file,
3351
2604
# new config file, and saved state.
3409
2662
for client_name in (set(client_settings)
3410
2663
- set(old_client_settings)):
3411
2664
clients_data[client_name] = client_settings[client_name]
3413
2666
# Create all client objects
3414
for client_name, client in clients_data.items():
2667
for client_name, client in clients_data.iteritems():
3415
2668
tcp_server.clients[client_name] = client_class(
3418
server_settings=server_settings)
2669
name = client_name, settings = client,
2670
server_settings = server_settings)
3420
2672
if not tcp_server.clients:
3421
2673
logger.warning("No clients defined")
3423
2675
if not foreground:
3424
2676
if pidfile is not None:
3428
print(pid, file=pidfile)
2680
pidfile.write(str(pid) + "\n".encode("utf-8"))
3429
2681
except IOError:
3430
2682
logger.error("Could not write to file %r with PID %d",
3431
2683
pidfilename, pid)
3433
2685
del pidfilename
3435
for termsig in (signal.SIGHUP, signal.SIGTERM):
3436
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3437
lambda: main_loop.quit() and False)
2687
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2688
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3441
@alternate_dbus_interfaces(
3442
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3443
class MandosDBusService(DBusObjectWithObjectManager):
2691
@alternate_dbus_interfaces({"se.recompile.Mandos":
2692
"se.bsnet.fukt.Mandos"})
2693
class MandosDBusService(DBusObjectWithProperties):
3444
2694
"""A D-Bus proxy object"""
3446
2695
def __init__(self):
3447
2696
dbus.service.Object.__init__(self, bus, "/")
3449
2697
_interface = "se.recompile.Mandos"
2699
@dbus_interface_annotations(_interface)
2701
return { "org.freedesktop.DBus.Property"
2702
".EmitsChangedSignal":
3451
2705
@dbus.service.signal(_interface, signature="o")
3452
2706
def ClientAdded(self, objpath):
3456
2710
@dbus.service.signal(_interface, signature="ss")
3457
def ClientNotFound(self, key_id, address):
2711
def ClientNotFound(self, fingerprint, address):
3461
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3463
2715
@dbus.service.signal(_interface, signature="os")
3464
2716
def ClientRemoved(self, objpath, name):
3468
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3470
2720
@dbus.service.method(_interface, out_signature="ao")
3471
2721
def GetAllClients(self):
3473
return dbus.Array(c.dbus_object_path for c in
3474
tcp_server.clients.values())
3476
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2723
return dbus.Array(c.dbus_object_path
2725
tcp_server.clients.itervalues())
3478
2727
@dbus.service.method(_interface,
3479
2728
out_signature="a{oa{sv}}")
3480
2729
def GetAllClientsWithProperties(self):
3482
2731
return dbus.Dictionary(
3483
{c.dbus_object_path: c.GetAll(
3484
"se.recompile.Mandos.Client")
3485
for c in tcp_server.clients.values()},
2732
((c.dbus_object_path, c.GetAll(""))
2733
for c in tcp_server.clients.itervalues()),
3486
2734
signature="oa{sv}")
3488
2736
@dbus.service.method(_interface, in_signature="o")
3489
2737
def RemoveClient(self, object_path):
3491
for c in tcp_server.clients.values():
2739
for c in tcp_server.clients.itervalues():
3492
2740
if c.dbus_object_path == object_path:
3493
2741
del tcp_server.clients[c.name]
3494
2742
c.remove_from_connection()
3495
# Don't signal the disabling
2743
# Don't signal anything except ClientRemoved
3496
2744
c.disable(quiet=True)
3497
# Emit D-Bus signal for removal
3498
self.client_removed_signal(c)
2746
self.ClientRemoved(object_path, c.name)
3500
2748
raise KeyError(object_path)
3504
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3505
out_signature="a{oa{sa{sv}}}")
3506
def GetManagedObjects(self):
3508
return dbus.Dictionary(
3509
{client.dbus_object_path:
3511
{interface: client.GetAll(interface)
3513
client._get_all_interface_names()})
3514
for client in tcp_server.clients.values()})
3516
def client_added_signal(self, client):
3517
"""Send the new standard signal and the old signal"""
3519
# New standard signal
3520
self.InterfacesAdded(
3521
client.dbus_object_path,
3523
{interface: client.GetAll(interface)
3525
client._get_all_interface_names()}))
3527
self.ClientAdded(client.dbus_object_path)
3529
def client_removed_signal(self, client):
3530
"""Send the new standard signal and the old signal"""
3532
# New standard signal
3533
self.InterfacesRemoved(
3534
client.dbus_object_path,
3535
client._get_all_interface_names())
3537
self.ClientRemoved(client.dbus_object_path,
3540
2752
mandos_dbus_service = MandosDBusService()
3542
# Save modules to variables to exempt the modules from being
3543
# unloaded before the function registered with atexit() is run.
3544
mp = multiprocessing
3548
2755
"Cleanup function; run on exit"
3550
2757
service.cleanup()
3552
mp.active_children()
2759
multiprocessing.active_children()
3554
2761
if not (tcp_server.clients or client_settings):
3557
2764
# Store client before exiting. Secrets are encrypted with key
3558
2765
# based on what config file has. If config file is
3559
2766
# removed/edited, old secret will thus be unrecovable.
3561
2768
with PGPEngine() as pgp:
3562
for client in tcp_server.clients.values():
2769
for client in tcp_server.clients.itervalues():
3563
2770
key = client_settings[client.name]["secret"]
3564
2771
client.encrypted_secret = pgp.encrypt(client.secret,
3566
2773
client_dict = {}
3568
2775
# A list of attributes that can not be pickled
3570
exclude = {"bus", "changedstate", "secret",
3571
"checker", "server_settings"}
3572
for name, typ in inspect.getmembers(dbus.service
2777
exclude = set(("bus", "changedstate", "secret",
2778
"checker", "server_settings"))
2779
for name, typ in (inspect.getmembers
2780
(dbus.service.Object)):
3574
2781
exclude.add(name)
3576
2783
client_dict["encrypted_secret"] = (client
3577
2784
.encrypted_secret)
3578
2785
for attr in client.client_structure:
3579
2786
if attr not in exclude:
3580
2787
client_dict[attr] = getattr(client, attr)
3582
2789
clients[client.name] = client_dict
3583
2790
del client_settings[client.name]["secret"]
3586
with tempfile.NamedTemporaryFile(
3590
dir=os.path.dirname(stored_state_path),
3591
delete=False) as stored_state:
3592
pickle.dump((clients, client_settings), stored_state,
3594
tempname = stored_state.name
2793
with (tempfile.NamedTemporaryFile
2794
(mode='wb', suffix=".pickle", prefix='clients-',
2795
dir=os.path.dirname(stored_state_path),
2796
delete=False)) as stored_state:
2797
pickle.dump((clients, client_settings), stored_state)
2798
tempname=stored_state.name
3595
2799
os.rename(tempname, stored_state_path)
3596
2800
except (IOError, OSError) as e: