2
2
# -*- mode: python; coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
17
# This file is part of Mandos.
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2014 Teddy Hogeborn
15
# Copyright © 2008-2014 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
32
31
# Contact the authors at <mandos@recompile.se>.
35
34
from __future__ import (division, absolute_import, print_function,
39
from future_builtins import *
37
from future_builtins import *
44
import SocketServer as socketserver
39
import SocketServer as socketserver
52
import ConfigParser as configparser
45
import gnutls.connection
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
50
import ConfigParser as configparser
70
import cPickle as pickle
65
import cPickle as pickle
73
66
import multiprocessing
82
74
import dbus.service
83
from gi.repository import GLib
84
77
from dbus.mainloop.glib import DBusGMainLoop
87
80
import xml.dom.minidom
90
# Try to find the value of SO_BINDTODEVICE:
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
93
# newer, and it is also the most natural place for it:
94
84
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
95
85
except AttributeError:
97
# This is where SO_BINDTODEVICE was up to and including Python
99
87
from IN import SO_BINDTODEVICE
100
88
except ImportError:
101
# In Python 2.7 it seems to have been removed entirely.
102
# Try running the C preprocessor:
104
cc = subprocess.Popen(["cc", "--language=c", "-E",
106
stdin=subprocess.PIPE,
107
stdout=subprocess.PIPE)
108
stdout = cc.communicate(
109
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
110
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
111
except (OSError, ValueError, IndexError):
113
SO_BINDTODEVICE = None
115
if sys.version_info.major == 2:
89
SO_BINDTODEVICE = None
119
92
stored_state_file = "clients.pickle"
121
94
logger = logging.getLogger()
125
if_nametoindex = ctypes.cdll.LoadLibrary(
126
ctypes.util.find_library("c")).if_nametoindex
98
if_nametoindex = (ctypes.cdll.LoadLibrary
99
(ctypes.util.find_library("c"))
127
101
except (OSError, AttributeError):
129
102
def if_nametoindex(interface):
130
103
"Get an interface index the hard way, i.e. using fcntl()"
131
104
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
132
105
with contextlib.closing(socket.socket()) as s:
133
106
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
134
struct.pack(b"16s16x", interface))
135
interface_index = struct.unpack("I", ifreq[16:20])[0]
107
struct.pack(str("16s16x"),
109
interface_index = struct.unpack(str("I"),
136
111
return interface_index
139
def copy_function(func):
140
"""Make a copy of a function"""
141
if sys.version_info.major == 2:
142
return types.FunctionType(func.func_code,
148
return types.FunctionType(func.__code__,
155
114
def initlogger(debug, level=logging.WARNING):
156
115
"""init logger and add loglevel"""
159
syslogger = (logging.handlers.SysLogHandler(
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
118
syslogger = (logging.handlers.SysLogHandler
120
logging.handlers.SysLogHandler.LOG_DAEMON,
121
address = str("/dev/log")))
162
122
syslogger.setFormatter(logging.Formatter
163
123
('Mandos [%(process)d]: %(levelname)s:'
165
125
logger.addHandler(syslogger)
168
128
console = logging.StreamHandler()
169
129
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
236
182
.replace(b"\n", b"\\n")
237
183
.replace(b"\0", b"\\x00"))
240
186
def encrypt(self, data, password):
241
187
passphrase = self.password_encode(password)
242
with tempfile.NamedTemporaryFile(
243
dir=self.tempdir) as passfile:
188
with tempfile.NamedTemporaryFile(dir=self.tempdir
244
190
passfile.write(passphrase)
246
proc = subprocess.Popen([self.gpg, '--symmetric',
192
proc = subprocess.Popen(['gpg', '--symmetric',
247
193
'--passphrase-file',
249
195
+ self.gnupgargs,
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
196
stdin = subprocess.PIPE,
197
stdout = subprocess.PIPE,
198
stderr = subprocess.PIPE)
199
ciphertext, err = proc.communicate(input = data)
254
200
if proc.returncode != 0:
255
201
raise PGPError(err)
256
202
return ciphertext
258
204
def decrypt(self, data, password):
259
205
passphrase = self.password_encode(password)
260
with tempfile.NamedTemporaryFile(
261
dir=self.tempdir) as passfile:
206
with tempfile.NamedTemporaryFile(dir = self.tempdir
262
208
passfile.write(passphrase)
264
proc = subprocess.Popen([self.gpg, '--decrypt',
210
proc = subprocess.Popen(['gpg', '--decrypt',
265
211
'--passphrase-file',
267
213
+ self.gnupgargs,
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
214
stdin = subprocess.PIPE,
215
stdout = subprocess.PIPE,
216
stderr = subprocess.PIPE)
217
decrypted_plaintext, err = proc.communicate(input
272
219
if proc.returncode != 0:
273
220
raise PGPError(err)
274
221
return decrypted_plaintext
277
# Pretend that we have an Avahi module
279
"""This isn't so much a class as it is a module-like namespace."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
290
def string_array_to_txt_array(t):
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
303
224
class AvahiError(Exception):
304
225
def __init__(self, value, *args, **kwargs):
305
226
self.value = value
306
return super(AvahiError, self).__init__(value, *args,
227
super(AvahiError, self).__init__(value, *args, **kwargs)
228
def __unicode__(self):
229
return unicode(repr(self.value))
310
231
class AvahiServiceError(AvahiError):
314
234
class AvahiGroupError(AvahiError):
318
238
class AvahiService(object):
319
239
"""An Avahi (Zeroconf) service.
322
242
interface: integer; avahi.IF_UNSPEC or an interface index.
323
243
Used to optionally bind to the specified interface.
488
386
follow_name_owner_changes=True),
489
387
avahi.DBUS_INTERFACE_SERVER)
490
388
self.server.connect_to_signal("StateChanged",
491
self.server_state_changed)
389
self.server_state_changed)
492
390
self.server_state_changed(self.server.GetState())
495
393
class AvahiServiceToSyslog(AvahiService):
496
def rename(self, *args, **kwargs):
497
395
"""Add the new name to the syslog messages"""
498
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
499
syslogger.setFormatter(logging.Formatter(
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
396
ret = AvahiService.rename(self)
397
syslogger.setFormatter(logging.Formatter
398
('Mandos ({}) [%(process)d]:'
399
' %(levelname)s: %(message)s'
505
# Pretend that we have a GnuTLS module
506
class gnutls(object):
507
"""This isn't so much a class as it is a module-like namespace."""
509
library = ctypes.util.find_library("gnutls")
511
library = ctypes.util.find_library("gnutls-deb0")
512
_library = ctypes.cdll.LoadLibrary(library)
515
# Unless otherwise indicated, the constants and types below are
516
# all from the gnutls/gnutls.h C header file.
527
E_NO_CERTIFICATE_FOUND = -49
532
KEYID_USE_SHA256 = 1 # gnutls/x509.h
533
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
536
class session_int(ctypes.Structure):
538
session_t = ctypes.POINTER(session_int)
540
class certificate_credentials_st(ctypes.Structure):
542
certificate_credentials_t = ctypes.POINTER(
543
certificate_credentials_st)
544
certificate_type_t = ctypes.c_int
546
class datum_t(ctypes.Structure):
547
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
548
('size', ctypes.c_uint)]
550
class openpgp_crt_int(ctypes.Structure):
552
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
553
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
554
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
555
credentials_type_t = ctypes.c_int
556
transport_ptr_t = ctypes.c_void_p
557
close_request_t = ctypes.c_int
560
class Error(Exception):
561
def __init__(self, message=None, code=None, args=()):
562
# Default usage is by a message string, but if a return
563
# code is passed, convert it to a string with
566
if message is None and code is not None:
567
message = gnutls.strerror(code)
568
return super(gnutls.Error, self).__init__(
571
class CertificateSecurityError(Error):
575
class Credentials(object):
577
self._c_object = gnutls.certificate_credentials_t()
578
gnutls.certificate_allocate_credentials(
579
ctypes.byref(self._c_object))
580
self.type = gnutls.CRD_CERTIFICATE
583
gnutls.certificate_free_credentials(self._c_object)
585
class ClientSession(object):
586
def __init__(self, socket, credentials=None):
587
self._c_object = gnutls.session_t()
588
gnutls_flags = gnutls.CLIENT
589
if gnutls.check_version("3.5.6"):
590
gnutls_flags |= gnutls.NO_TICKETS
592
gnutls_flags |= gnutls.ENABLE_RAWPK
593
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
595
gnutls.set_default_priority(self._c_object)
596
gnutls.transport_set_ptr(self._c_object, socket.fileno())
597
gnutls.handshake_set_private_extensions(self._c_object,
600
if credentials is None:
601
credentials = gnutls.Credentials()
602
gnutls.credentials_set(self._c_object, credentials.type,
603
ctypes.cast(credentials._c_object,
605
self.credentials = credentials
608
gnutls.deinit(self._c_object)
611
return gnutls.handshake(self._c_object)
613
def send(self, data):
617
data_len -= gnutls.record_send(self._c_object,
622
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
624
# Error handling functions
625
def _error_code(result):
626
"""A function to raise exceptions on errors, suitable
627
for the 'restype' attribute on ctypes functions"""
630
if result == gnutls.E_NO_CERTIFICATE_FOUND:
631
raise gnutls.CertificateSecurityError(code=result)
632
raise gnutls.Error(code=result)
634
def _retry_on_error(result, func, arguments):
635
"""A function to retry on some errors, suitable
636
for the 'errcheck' attribute on ctypes functions"""
638
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
639
return _error_code(result)
640
result = func(*arguments)
643
# Unless otherwise indicated, the function declarations below are
644
# all from the gnutls/gnutls.h C header file.
647
priority_set_direct = _library.gnutls_priority_set_direct
648
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
649
ctypes.POINTER(ctypes.c_char_p)]
650
priority_set_direct.restype = _error_code
652
init = _library.gnutls_init
653
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
654
init.restype = _error_code
656
set_default_priority = _library.gnutls_set_default_priority
657
set_default_priority.argtypes = [session_t]
658
set_default_priority.restype = _error_code
660
record_send = _library.gnutls_record_send
661
record_send.argtypes = [session_t, ctypes.c_void_p,
663
record_send.restype = ctypes.c_ssize_t
664
record_send.errcheck = _retry_on_error
666
certificate_allocate_credentials = (
667
_library.gnutls_certificate_allocate_credentials)
668
certificate_allocate_credentials.argtypes = [
669
ctypes.POINTER(certificate_credentials_t)]
670
certificate_allocate_credentials.restype = _error_code
672
certificate_free_credentials = (
673
_library.gnutls_certificate_free_credentials)
674
certificate_free_credentials.argtypes = [
675
certificate_credentials_t]
676
certificate_free_credentials.restype = None
678
handshake_set_private_extensions = (
679
_library.gnutls_handshake_set_private_extensions)
680
handshake_set_private_extensions.argtypes = [session_t,
682
handshake_set_private_extensions.restype = None
684
credentials_set = _library.gnutls_credentials_set
685
credentials_set.argtypes = [session_t, credentials_type_t,
687
credentials_set.restype = _error_code
689
strerror = _library.gnutls_strerror
690
strerror.argtypes = [ctypes.c_int]
691
strerror.restype = ctypes.c_char_p
693
certificate_type_get = _library.gnutls_certificate_type_get
694
certificate_type_get.argtypes = [session_t]
695
certificate_type_get.restype = _error_code
697
certificate_get_peers = _library.gnutls_certificate_get_peers
698
certificate_get_peers.argtypes = [session_t,
699
ctypes.POINTER(ctypes.c_uint)]
700
certificate_get_peers.restype = ctypes.POINTER(datum_t)
702
global_set_log_level = _library.gnutls_global_set_log_level
703
global_set_log_level.argtypes = [ctypes.c_int]
704
global_set_log_level.restype = None
706
global_set_log_function = _library.gnutls_global_set_log_function
707
global_set_log_function.argtypes = [log_func]
708
global_set_log_function.restype = None
710
deinit = _library.gnutls_deinit
711
deinit.argtypes = [session_t]
712
deinit.restype = None
714
handshake = _library.gnutls_handshake
715
handshake.argtypes = [session_t]
716
handshake.restype = _error_code
717
handshake.errcheck = _retry_on_error
719
transport_set_ptr = _library.gnutls_transport_set_ptr
720
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
721
transport_set_ptr.restype = None
723
bye = _library.gnutls_bye
724
bye.argtypes = [session_t, close_request_t]
725
bye.restype = _error_code
726
bye.errcheck = _retry_on_error
728
check_version = _library.gnutls_check_version
729
check_version.argtypes = [ctypes.c_char_p]
730
check_version.restype = ctypes.c_char_p
732
_need_version = b"3.3.0"
733
if check_version(_need_version) is None:
734
raise self.Error("Needs GnuTLS {} or later"
735
.format(_need_version))
737
_tls_rawpk_version = b"3.6.6"
738
has_rawpk = bool(check_version(_tls_rawpk_version))
742
class pubkey_st(ctypes.Structure):
744
pubkey_t = ctypes.POINTER(pubkey_st)
746
x509_crt_fmt_t = ctypes.c_int
748
# All the function declarations below are from gnutls/abstract.h
749
pubkey_init = _library.gnutls_pubkey_init
750
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
751
pubkey_init.restype = _error_code
753
pubkey_import = _library.gnutls_pubkey_import
754
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
756
pubkey_import.restype = _error_code
758
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
759
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
760
ctypes.POINTER(ctypes.c_ubyte),
761
ctypes.POINTER(ctypes.c_size_t)]
762
pubkey_get_key_id.restype = _error_code
764
pubkey_deinit = _library.gnutls_pubkey_deinit
765
pubkey_deinit.argtypes = [pubkey_t]
766
pubkey_deinit.restype = None
768
# All the function declarations below are from gnutls/openpgp.h
770
openpgp_crt_init = _library.gnutls_openpgp_crt_init
771
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
772
openpgp_crt_init.restype = _error_code
774
openpgp_crt_import = _library.gnutls_openpgp_crt_import
775
openpgp_crt_import.argtypes = [openpgp_crt_t,
776
ctypes.POINTER(datum_t),
778
openpgp_crt_import.restype = _error_code
780
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
781
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
782
ctypes.POINTER(ctypes.c_uint)]
783
openpgp_crt_verify_self.restype = _error_code
785
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
786
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
787
openpgp_crt_deinit.restype = None
789
openpgp_crt_get_fingerprint = (
790
_library.gnutls_openpgp_crt_get_fingerprint)
791
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
795
openpgp_crt_get_fingerprint.restype = _error_code
797
if check_version("3.6.4"):
798
certificate_type_get2 = _library.gnutls_certificate_type_get2
799
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
800
certificate_type_get2.restype = _error_code
802
# Remove non-public functions
803
del _error_code, _retry_on_error
806
def call_pipe(connection, # : multiprocessing.Connection
807
func, *args, **kwargs):
808
"""This function is meant to be called by multiprocessing.Process
810
This function runs func(*args, **kwargs), and writes the resulting
811
return value on the provided multiprocessing.Connection.
813
connection.send(func(*args, **kwargs))
817
404
class Client(object):
818
405
"""A representation of a client host served by this server.
821
408
approved: bool(); 'None' if not yet approved/disapproved
822
409
approval_delay: datetime.timedelta(); Time to wait for approval
1002
582
logger.info("Disabling client %s", self.name)
1003
583
if getattr(self, "disable_initiator_tag", None) is not None:
1004
GLib.source_remove(self.disable_initiator_tag)
584
gobject.source_remove(self.disable_initiator_tag)
1005
585
self.disable_initiator_tag = None
1006
586
self.expires = None
1007
587
if getattr(self, "checker_initiator_tag", None) is not None:
1008
GLib.source_remove(self.checker_initiator_tag)
588
gobject.source_remove(self.checker_initiator_tag)
1009
589
self.checker_initiator_tag = None
1010
590
self.stop_checker()
1011
591
self.enabled = False
1013
593
self.send_changedstate()
1014
# Do not run this again if called by a GLib.timeout_add
594
# Do not run this again if called by a gobject.timeout_add
1017
597
def __del__(self):
1020
600
def init_checker(self):
1021
601
# Schedule a new checker to be started an 'interval' from now,
1022
602
# and every interval from then on.
1023
603
if self.checker_initiator_tag is not None:
1024
GLib.source_remove(self.checker_initiator_tag)
1025
self.checker_initiator_tag = GLib.timeout_add(
1026
int(self.interval.total_seconds() * 1000),
604
gobject.source_remove(self.checker_initiator_tag)
605
self.checker_initiator_tag = (gobject.timeout_add
607
.total_seconds() * 1000),
1028
609
# Schedule a disable() when 'timeout' has passed
1029
610
if self.disable_initiator_tag is not None:
1030
GLib.source_remove(self.disable_initiator_tag)
1031
self.disable_initiator_tag = GLib.timeout_add(
1032
int(self.timeout.total_seconds() * 1000), self.disable)
611
gobject.source_remove(self.disable_initiator_tag)
612
self.disable_initiator_tag = (gobject.timeout_add
614
.total_seconds() * 1000),
1033
616
# Also start a new checker *right now*.
1034
617
self.start_checker()
1036
def checker_callback(self, source, condition, connection,
619
def checker_callback(self, pid, condition, command):
1038
620
"""The checker has completed, so take appropriate actions."""
1039
621
self.checker_callback_tag = None
1040
622
self.checker = None
1041
# Read return code from connection (see call_pipe)
1042
returncode = connection.recv()
1046
self.last_checker_status = returncode
1047
self.last_checker_signal = None
623
if os.WIFEXITED(condition):
624
self.last_checker_status = os.WEXITSTATUS(condition)
1048
625
if self.last_checker_status == 0:
1049
626
logger.info("Checker for %(name)s succeeded",
1051
628
self.checked_ok()
1053
logger.info("Checker for %(name)s failed", vars(self))
630
logger.info("Checker for %(name)s failed",
1055
633
self.last_checker_status = -1
1056
self.last_checker_signal = -returncode
1057
634
logger.warning("Checker for %(name)s crashed?",
1061
637
def checked_ok(self):
1062
638
"""Assert that the client has been seen, alive and well."""
1063
639
self.last_checked_ok = datetime.datetime.utcnow()
1064
640
self.last_checker_status = 0
1065
self.last_checker_signal = None
1066
641
self.bump_timeout()
1068
643
def bump_timeout(self, timeout=None):
1069
644
"""Bump up the timeout for this client."""
1070
645
if timeout is None:
1071
646
timeout = self.timeout
1072
647
if self.disable_initiator_tag is not None:
1073
GLib.source_remove(self.disable_initiator_tag)
648
gobject.source_remove(self.disable_initiator_tag)
1074
649
self.disable_initiator_tag = None
1075
650
if getattr(self, "enabled", False):
1076
self.disable_initiator_tag = GLib.timeout_add(
1077
int(timeout.total_seconds() * 1000), self.disable)
651
self.disable_initiator_tag = (gobject.timeout_add
652
(int(timeout.total_seconds()
653
* 1000), self.disable))
1078
654
self.expires = datetime.datetime.utcnow() + timeout
1080
656
def need_approval(self):
1081
657
self.last_approval_request = datetime.datetime.utcnow()
1083
659
def start_checker(self):
1084
660
"""Start a new checker subprocess if one is not running.
1086
662
If a checker already exists, leave it running and do
1088
664
# The reason for not killing a running checker is that if we
1093
669
# checkers alone, the checker would have to take more time
1094
670
# than 'timeout' for the client to be disabled, which is as it
1097
if self.checker is not None and not self.checker.is_alive():
1098
logger.warning("Checker was not alive; joining")
673
# If a checker exists, make sure it is not a zombie
675
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
676
except AttributeError:
678
except OSError as error:
679
if error.errno != errno.ECHILD:
683
logger.warning("Checker was a zombie")
684
gobject.source_remove(self.checker_callback_tag)
685
self.checker_callback(pid, status,
686
self.current_checker_command)
1101
687
# Start a new checker if needed
1102
688
if self.checker is None:
1103
689
# Escape attributes for the shell
1105
attr: re.escape(str(getattr(self, attr)))
1106
for attr in self.runtime_expansions}
690
escaped_attrs = { attr:
691
re.escape(unicode(getattr(self,
693
for attr in self.runtime_expansions }
1108
695
command = self.checker_command % escaped_attrs
1109
696
except TypeError as error:
1110
697
logger.error('Could not format string "%s"',
1111
self.checker_command,
698
self.checker_command, exc_info=error)
699
return True # Try again later
700
self.current_checker_command = command
702
logger.info("Starting checker %r for %s",
704
# We don't need to redirect stdout and stderr, since
705
# in normal mode, that is already done by daemon(),
706
# and in debug mode we don't want to. (Stdin is
707
# always replaced by /dev/null.)
708
# The exception is when not debugging but nevertheless
709
# running in the foreground; use the previously
712
if (not self.server_settings["debug"]
713
and self.server_settings["foreground"]):
714
popen_args.update({"stdout": wnull,
716
self.checker = subprocess.Popen(command,
720
except OSError as error:
721
logger.error("Failed to start subprocess",
1113
return True # Try again later
1114
self.current_checker_command = command
1115
logger.info("Starting checker %r for %s", command,
1117
# We don't need to redirect stdout and stderr, since
1118
# in normal mode, that is already done by daemon(),
1119
# and in debug mode we don't want to. (Stdin is
1120
# always replaced by /dev/null.)
1121
# The exception is when not debugging but nevertheless
1122
# running in the foreground; use the previously
1124
popen_args = {"close_fds": True,
1127
if (not self.server_settings["debug"]
1128
and self.server_settings["foreground"]):
1129
popen_args.update({"stdout": wnull,
1131
pipe = multiprocessing.Pipe(duplex=False)
1132
self.checker = multiprocessing.Process(
1134
args=(pipe[1], subprocess.call, command),
1136
self.checker.start()
1137
self.checker_callback_tag = GLib.io_add_watch(
1138
pipe[0].fileno(), GLib.IO_IN,
1139
self.checker_callback, pipe[0], command)
1140
# Re-run this periodically if run by GLib.timeout_add
724
self.checker_callback_tag = (gobject.child_watch_add
726
self.checker_callback,
728
# The checker may have completed before the gobject
729
# watch was added. Check for this.
731
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
732
except OSError as error:
733
if error.errno == errno.ECHILD:
734
# This should never happen
735
logger.error("Child process vanished",
740
gobject.source_remove(self.checker_callback_tag)
741
self.checker_callback(pid, status, command)
742
# Re-run this periodically if run by gobject.timeout_add
1143
745
def stop_checker(self):
1144
746
"""Force the checker process, if any, to stop."""
1145
747
if self.checker_callback_tag:
1146
GLib.source_remove(self.checker_callback_tag)
748
gobject.source_remove(self.checker_callback_tag)
1147
749
self.checker_callback_tag = None
1148
750
if getattr(self, "checker", None) is None:
1150
752
logger.debug("Stopping checker for %(name)s", vars(self))
1151
self.checker.terminate()
754
self.checker.terminate()
756
#if self.checker.poll() is None:
757
# self.checker.kill()
758
except OSError as error:
759
if error.errno != errno.ESRCH: # No such process
1152
761
self.checker = None
1155
def dbus_service_property(dbus_interface,
764
def dbus_service_property(dbus_interface, signature="v",
765
access="readwrite", byte_arrays=False):
1159
766
"""Decorators for marking methods of a DBusObjectWithProperties to
1160
767
become properties on the D-Bus.
1162
769
The decorated method will be called with no arguments by "Get"
1163
770
and with one argument by "Set".
1165
772
The parameters, where they are supported, are the same as
1166
773
dbus.service.method, except there is only "signature", since the
1167
774
type from Get() and the type sent to Set() is the same.
1250
class DBusObjectWithAnnotations(dbus.service.Object):
1251
"""A D-Bus object with annotations.
1253
Classes inheriting from this can use the dbus_annotations
1254
decorator to add annotations to methods or signals.
850
class DBusObjectWithProperties(dbus.service.Object):
851
"""A D-Bus object with properties.
853
Classes inheriting from this can use the dbus_service_property
854
decorator to expose methods as D-Bus properties. It exposes the
855
standard Get(), Set(), and GetAll() methods on the D-Bus.
1258
859
def _is_dbus_thing(thing):
1259
860
"""Returns a function testing if an attribute is a D-Bus thing
1261
862
If called like _is_dbus_thing("method") it returns a function
1262
863
suitable for use as predicate to inspect.getmembers().
1264
865
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1267
868
def _get_all_dbus_things(self, thing):
1268
869
"""Returns a generator of (name, attribute) pairs
1270
return ((getattr(athing.__get__(self), "_dbus_name", name),
871
return ((getattr(athing.__get__(self), "_dbus_name",
1271
873
athing.__get__(self))
1272
874
for cls in self.__class__.__mro__
1273
875
for name, athing in
1274
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1276
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1278
path_keyword='object_path',
1279
connection_keyword='connection')
1280
def Introspect(self, object_path, connection):
1281
"""Overloading of standard D-Bus method.
1283
Inserts annotation tags on methods and signals.
1285
xmlstring = dbus.service.Object.Introspect(self, object_path,
1288
document = xml.dom.minidom.parseString(xmlstring)
1290
for if_tag in document.getElementsByTagName("interface"):
1291
# Add annotation tags
1292
for typ in ("method", "signal"):
1293
for tag in if_tag.getElementsByTagName(typ):
1295
for name, prop in (self.
1296
_get_all_dbus_things(typ)):
1297
if (name == tag.getAttribute("name")
1298
and prop._dbus_interface
1299
== if_tag.getAttribute("name")):
1300
annots.update(getattr(
1301
prop, "_dbus_annotations", {}))
1302
for name, value in annots.items():
1303
ann_tag = document.createElement(
1305
ann_tag.setAttribute("name", name)
1306
ann_tag.setAttribute("value", value)
1307
tag.appendChild(ann_tag)
1308
# Add interface annotation tags
1309
for annotation, value in dict(
1310
itertools.chain.from_iterable(
1311
annotations().items()
1312
for name, annotations
1313
in self._get_all_dbus_things("interface")
1314
if name == if_tag.getAttribute("name")
1316
ann_tag = document.createElement("annotation")
1317
ann_tag.setAttribute("name", annotation)
1318
ann_tag.setAttribute("value", value)
1319
if_tag.appendChild(ann_tag)
1320
# Fix argument name for the Introspect method itself
1321
if (if_tag.getAttribute("name")
1322
== dbus.INTROSPECTABLE_IFACE):
1323
for cn in if_tag.getElementsByTagName("method"):
1324
if cn.getAttribute("name") == "Introspect":
1325
for arg in cn.getElementsByTagName("arg"):
1326
if (arg.getAttribute("direction")
1328
arg.setAttribute("name",
1330
xmlstring = document.toxml("utf-8")
1332
except (AttributeError, xml.dom.DOMException,
1333
xml.parsers.expat.ExpatError) as error:
1334
logger.error("Failed to override Introspection method",
1339
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1340
"""A D-Bus object with properties.
1342
Classes inheriting from this can use the dbus_service_property
1343
decorator to expose methods as D-Bus properties. It exposes the
1344
standard Get(), Set(), and GetAll() methods on the D-Bus.
876
inspect.getmembers(cls,
877
self._is_dbus_thing(thing)))
1347
879
def _get_dbus_property(self, interface_name, property_name):
1348
880
"""Returns a bound method if one exists which is a D-Bus
1349
881
property with the specified name and interface.
1351
for cls in self.__class__.__mro__:
1352
for name, value in inspect.getmembers(
1353
cls, self._is_dbus_thing("property")):
883
for cls in self.__class__.__mro__:
884
for name, value in (inspect.getmembers
886
self._is_dbus_thing("property"))):
1354
887
if (value._dbus_name == property_name
1355
888
and value._dbus_interface == interface_name):
1356
889
return value.__get__(self)
1358
891
# No such property
1359
raise DBusPropertyNotFound("{}:{}.{}".format(
1360
self.dbus_object_path, interface_name, property_name))
1363
def _get_all_interface_names(cls):
1364
"""Get a sequence of all interfaces supported by an object"""
1365
return (name for name in set(getattr(getattr(x, attr),
1366
"_dbus_interface", None)
1367
for x in (inspect.getmro(cls))
1369
if name is not None)
1371
@dbus.service.method(dbus.PROPERTIES_IFACE,
892
raise DBusPropertyNotFound(self.dbus_object_path + ":"
893
+ interface_name + "."
896
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1373
897
out_signature="v")
1374
898
def Get(self, interface_name, property_name):
1375
899
"""Standard D-Bus property Get() method, see D-Bus standard.
1504
1031
return xmlstring
1508
dbus.OBJECT_MANAGER_IFACE
1509
except AttributeError:
1510
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1513
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1514
"""A D-Bus object with an ObjectManager.
1516
Classes inheriting from this exposes the standard
1517
GetManagedObjects call and the InterfacesAdded and
1518
InterfacesRemoved signals on the standard
1519
"org.freedesktop.DBus.ObjectManager" interface.
1521
Note: No signals are sent automatically; they must be sent
1524
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1525
out_signature="a{oa{sa{sv}}}")
1526
def GetManagedObjects(self):
1527
"""This function must be overridden"""
1528
raise NotImplementedError()
1530
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1531
signature="oa{sa{sv}}")
1532
def InterfacesAdded(self, object_path, interfaces_and_properties):
1535
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1536
def InterfacesRemoved(self, object_path, interfaces):
1539
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1541
path_keyword='object_path',
1542
connection_keyword='connection')
1543
def Introspect(self, object_path, connection):
1544
"""Overloading of standard D-Bus method.
1546
Override return argument name of GetManagedObjects to be
1547
"objpath_interfaces_and_properties"
1549
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1553
document = xml.dom.minidom.parseString(xmlstring)
1555
for if_tag in document.getElementsByTagName("interface"):
1556
# Fix argument name for the GetManagedObjects method
1557
if (if_tag.getAttribute("name")
1558
== dbus.OBJECT_MANAGER_IFACE):
1559
for cn in if_tag.getElementsByTagName("method"):
1560
if (cn.getAttribute("name")
1561
== "GetManagedObjects"):
1562
for arg in cn.getElementsByTagName("arg"):
1563
if (arg.getAttribute("direction")
1567
"objpath_interfaces"
1569
xmlstring = document.toxml("utf-8")
1571
except (AttributeError, xml.dom.DOMException,
1572
xml.parsers.expat.ExpatError) as error:
1573
logger.error("Failed to override Introspection method",
1578
1034
def datetime_to_dbus(dt, variant_level=0):
1579
1035
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1581
return dbus.String("", variant_level=variant_level)
1582
return dbus.String(dt.isoformat(), variant_level=variant_level)
1037
return dbus.String("", variant_level = variant_level)
1038
return dbus.String(dt.isoformat(),
1039
variant_level=variant_level)
1585
1042
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1616
1072
# Ignore non-D-Bus attributes, and D-Bus attributes
1617
1073
# with the wrong interface name
1618
1074
if (not hasattr(attribute, "_dbus_interface")
1619
or not attribute._dbus_interface.startswith(
1620
orig_interface_name)):
1075
or not attribute._dbus_interface
1076
.startswith(orig_interface_name)):
1622
1078
# Create an alternate D-Bus interface name based on
1623
1079
# the current name
1624
alt_interface = attribute._dbus_interface.replace(
1625
orig_interface_name, alt_interface_name)
1080
alt_interface = (attribute._dbus_interface
1081
.replace(orig_interface_name,
1082
alt_interface_name))
1626
1083
interface_names.add(alt_interface)
1627
1084
# Is this a D-Bus signal?
1628
1085
if getattr(attribute, "_dbus_is_signal", False):
1629
1086
# Extract the original non-method undecorated
1630
1087
# function by black magic
1631
if sys.version_info.major == 2:
1632
nonmethod_func = (dict(
1088
nonmethod_func = (dict(
1633
1089
zip(attribute.func_code.co_freevars,
1634
attribute.__closure__))
1635
["func"].cell_contents)
1637
nonmethod_func = (dict(
1638
zip(attribute.__code__.co_freevars,
1639
attribute.__closure__))
1640
["func"].cell_contents)
1090
attribute.__closure__))["func"]
1641
1092
# Create a new, but exactly alike, function
1642
1093
# object, and decorate it to be a new D-Bus signal
1643
1094
# with the alternate D-Bus interface name
1644
new_function = copy_function(nonmethod_func)
1645
new_function = (dbus.service.signal(
1647
attribute._dbus_signature)(new_function))
1095
new_function = (dbus.service.signal
1097
attribute._dbus_signature)
1098
(types.FunctionType(
1099
nonmethod_func.func_code,
1100
nonmethod_func.func_globals,
1101
nonmethod_func.func_name,
1102
nonmethod_func.func_defaults,
1103
nonmethod_func.func_closure)))
1648
1104
# Copy annotations, if any
1650
new_function._dbus_annotations = dict(
1651
attribute._dbus_annotations)
1106
new_function._dbus_annotations = (
1107
dict(attribute._dbus_annotations))
1652
1108
except AttributeError:
1655
1110
# Define a creator of a function to call both the
1656
1111
# original and alternate functions, so both the
1657
1112
# original and alternate signals gets sent when
1740
1202
if interface_names:
1741
1203
# Replace the class with a new subclass of it with
1742
1204
# methods, signals, etc. as created above.
1743
if sys.version_info.major == 2:
1744
cls = type(b"{}Alternate".format(cls.__name__),
1747
cls = type("{}Alternate".format(cls.__name__),
1205
cls = type(b"{}Alternate".format(cls.__name__),
1754
1211
@alternate_dbus_interfaces({"se.recompile.Mandos":
1755
"se.bsnet.fukt.Mandos"})
1212
"se.bsnet.fukt.Mandos"})
1756
1213
class ClientDBus(Client, DBusObjectWithProperties):
1757
1214
"""A Client class using D-Bus
1760
1217
dbus_object_path: dbus.ObjectPath
1761
1218
bus: dbus.SystemBus()
1764
1221
runtime_expansions = (Client.runtime_expansions
1765
+ ("dbus_object_path", ))
1767
_interface = "se.recompile.Mandos.Client"
1222
+ ("dbus_object_path",))
1769
1224
# dbus.service.Object doesn't use super(), so we can't either.
1771
def __init__(self, bus=None, *args, **kwargs):
1226
def __init__(self, bus = None, *args, **kwargs):
1773
1228
Client.__init__(self, *args, **kwargs)
1774
1229
# Only now, when this client is initialized, can it show up on
1776
client_object_name = str(self.name).translate(
1231
client_object_name = unicode(self.name).translate(
1777
1232
{ord("."): ord("_"),
1778
1233
ord("-"): ord("_")})
1779
self.dbus_object_path = dbus.ObjectPath(
1780
"/clients/" + client_object_name)
1234
self.dbus_object_path = (dbus.ObjectPath
1235
("/clients/" + client_object_name))
1781
1236
DBusObjectWithProperties.__init__(self, self.bus,
1782
1237
self.dbus_object_path)
1784
def notifychangeproperty(transform_func, dbus_name,
1785
type_func=lambda x: x,
1787
invalidate_only=False,
1788
_interface=_interface):
1239
def notifychangeproperty(transform_func,
1240
dbus_name, type_func=lambda x: x,
1789
1242
""" Modify a variable so that it's a property which announces
1790
1243
its changes to DBus.
1792
1245
transform_fun: Function that takes a value and a variant_level
1793
1246
and transforms it to a D-Bus type.
1794
1247
dbus_name: D-Bus name of the variable
1946
1392
server to mandos-client
1950
1396
# Rejected - signal
1951
1397
@dbus.service.signal(_interface, signature="s")
1952
1398
def Rejected(self, reason):
1956
1402
# NeedApproval - signal
1957
1403
@dbus.service.signal(_interface, signature="tb")
1958
1404
def NeedApproval(self, timeout, default):
1960
1406
return self.need_approval()
1964
1410
# Approve - method
1965
1411
@dbus.service.method(_interface, in_signature="b")
1966
1412
def Approve(self, value):
1967
1413
self.approve(value)
1969
1415
# CheckedOK - method
1970
1416
@dbus.service.method(_interface)
1971
1417
def CheckedOK(self):
1972
1418
self.checked_ok()
1974
1420
# Enable - method
1975
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1976
1421
@dbus.service.method(_interface)
1977
1422
def Enable(self):
1981
1426
# StartChecker - method
1982
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1983
1427
@dbus.service.method(_interface)
1984
1428
def StartChecker(self):
1986
1430
self.start_checker()
1988
1432
# Disable - method
1989
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1990
1433
@dbus.service.method(_interface)
1991
1434
def Disable(self):
1995
1438
# StopChecker - method
1996
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1997
1439
@dbus.service.method(_interface)
1998
1440
def StopChecker(self):
1999
1441
self.stop_checker()
2003
1445
# ApprovalPending - property
2004
1446
@dbus_service_property(_interface, signature="b", access="read")
2005
1447
def ApprovalPending_dbus_property(self):
2006
1448
return dbus.Boolean(bool(self.approvals_pending))
2008
1450
# ApprovedByDefault - property
2009
@dbus_service_property(_interface,
1451
@dbus_service_property(_interface, signature="b",
2011
1452
access="readwrite")
2012
1453
def ApprovedByDefault_dbus_property(self, value=None):
2013
1454
if value is None: # get
2014
1455
return dbus.Boolean(self.approved_by_default)
2015
1456
self.approved_by_default = bool(value)
2017
1458
# ApprovalDelay - property
2018
@dbus_service_property(_interface,
1459
@dbus_service_property(_interface, signature="t",
2020
1460
access="readwrite")
2021
1461
def ApprovalDelay_dbus_property(self, value=None):
2022
1462
if value is None: # get
2023
1463
return dbus.UInt64(self.approval_delay.total_seconds()
2025
1465
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2027
1467
# ApprovalDuration - property
2028
@dbus_service_property(_interface,
1468
@dbus_service_property(_interface, signature="t",
2030
1469
access="readwrite")
2031
1470
def ApprovalDuration_dbus_property(self, value=None):
2032
1471
if value is None: # get
2033
1472
return dbus.UInt64(self.approval_duration.total_seconds()
2035
1474
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2037
1476
# Name - property
2039
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2040
1477
@dbus_service_property(_interface, signature="s", access="read")
2041
1478
def Name_dbus_property(self):
2042
1479
return dbus.String(self.name)
2046
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2047
@dbus_service_property(_interface, signature="s", access="read")
2048
def KeyID_dbus_property(self):
2049
return dbus.String(self.key_id)
2051
1481
# Fingerprint - property
2053
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2054
1482
@dbus_service_property(_interface, signature="s", access="read")
2055
1483
def Fingerprint_dbus_property(self):
2056
1484
return dbus.String(self.fingerprint)
2058
1486
# Host - property
2059
@dbus_service_property(_interface,
1487
@dbus_service_property(_interface, signature="s",
2061
1488
access="readwrite")
2062
1489
def Host_dbus_property(self, value=None):
2063
1490
if value is None: # get
2064
1491
return dbus.String(self.host)
2065
self.host = str(value)
1492
self.host = unicode(value)
2067
1494
# Created - property
2069
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2070
1495
@dbus_service_property(_interface, signature="s", access="read")
2071
1496
def Created_dbus_property(self):
2072
1497
return datetime_to_dbus(self.created)
2074
1499
# LastEnabled - property
2075
1500
@dbus_service_property(_interface, signature="s", access="read")
2076
1501
def LastEnabled_dbus_property(self):
2077
1502
return datetime_to_dbus(self.last_enabled)
2079
1504
# Enabled - property
2080
@dbus_service_property(_interface,
1505
@dbus_service_property(_interface, signature="b",
2082
1506
access="readwrite")
2083
1507
def Enabled_dbus_property(self, value=None):
2084
1508
if value is None: # get
2366
1773
delay -= time2 - time
2369
session.send(client.secret)
2370
except gnutls.Error as error:
2371
logger.warning("gnutls send failed",
1776
while sent_size < len(client.secret):
1778
sent = session.send(client.secret[sent_size:])
1779
except gnutls.errors.GNUTLSError as error:
1780
logger.warning("gnutls send failed",
1783
logger.debug("Sent: %d, remaining: %d",
1784
sent, len(client.secret)
1785
- (sent_size + sent))
2375
1788
logger.info("Sending secret to %s", client.name)
2376
1789
# bump the timeout using extended_timeout
2377
1790
client.bump_timeout(client.extended_timeout)
2378
1791
if self.server.use_dbus:
2379
1792
# Emit D-Bus signal
2380
1793
client.GotSecret()
2383
1796
if approval_required:
2384
1797
client.approvals_pending -= 1
2387
except gnutls.Error as error:
1800
except gnutls.errors.GNUTLSError as error:
2388
1801
logger.warning("GnuTLS bye failed",
2389
1802
exc_info=error)
2392
1805
def peer_certificate(session):
2393
"Return the peer's certificate as a bytestring"
2395
cert_type = gnutls.certificate_type_get2(session._c_object,
2397
except AttributeError:
2398
cert_type = gnutls.certificate_type_get(session._c_object)
2399
if gnutls.has_rawpk:
2400
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2402
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2403
# If not a valid certificate type...
2404
if cert_type not in valid_cert_types:
2405
logger.info("Cert type %r not in %r", cert_type,
2407
# ...return invalid data
1806
"Return the peer's OpenPGP certificate as a bytestring"
1807
# If not an OpenPGP certificate...
1808
if (gnutls.library.functions
1809
.gnutls_certificate_type_get(session._c_object)
1810
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1811
# ...do the normal thing
1812
return session.peer_certificate
2409
1813
list_size = ctypes.c_uint(1)
2410
cert_list = (gnutls.certificate_get_peers
1814
cert_list = (gnutls.library.functions
1815
.gnutls_certificate_get_peers
2411
1816
(session._c_object, ctypes.byref(list_size)))
2412
1817
if not bool(cert_list) and list_size.value != 0:
2413
raise gnutls.Error("error getting peer certificate")
1818
raise gnutls.errors.GNUTLSError("error getting peer"
2414
1820
if list_size.value == 0:
2416
1822
cert = cert_list[0]
2417
1823
return ctypes.string_at(cert.data, cert.size)
2420
def key_id(certificate):
2421
"Convert a certificate bytestring to a hexdigit key ID"
2422
# New GnuTLS "datum" with the public key
2423
datum = gnutls.datum_t(
2424
ctypes.cast(ctypes.c_char_p(certificate),
2425
ctypes.POINTER(ctypes.c_ubyte)),
2426
ctypes.c_uint(len(certificate)))
2427
# XXX all these need to be created in the gnutls "module"
2428
# New empty GnuTLS certificate
2429
pubkey = gnutls.pubkey_t()
2430
gnutls.pubkey_init(ctypes.byref(pubkey))
2431
# Import the raw public key into the certificate
2432
gnutls.pubkey_import(pubkey,
2433
ctypes.byref(datum),
2434
gnutls.X509_FMT_DER)
2435
# New buffer for the key ID
2436
buf = ctypes.create_string_buffer(32)
2437
buf_len = ctypes.c_size_t(len(buf))
2438
# Get the key ID from the raw public key into the buffer
2439
gnutls.pubkey_get_key_id(pubkey,
2440
gnutls.KEYID_USE_SHA256,
2441
ctypes.cast(ctypes.byref(buf),
2442
ctypes.POINTER(ctypes.c_ubyte)),
2443
ctypes.byref(buf_len))
2444
# Deinit the certificate
2445
gnutls.pubkey_deinit(pubkey)
2447
# Convert the buffer to a Python bytestring
2448
key_id = ctypes.string_at(buf, buf_len.value)
2449
# Convert the bytestring to hexadecimal notation
2450
hex_key_id = binascii.hexlify(key_id).upper()
2454
1826
def fingerprint(openpgp):
2455
1827
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2456
1828
# New GnuTLS "datum" with the OpenPGP public key
2457
datum = gnutls.datum_t(
2458
ctypes.cast(ctypes.c_char_p(openpgp),
2459
ctypes.POINTER(ctypes.c_ubyte)),
2460
ctypes.c_uint(len(openpgp)))
1829
datum = (gnutls.library.types
1830
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1833
ctypes.c_uint(len(openpgp))))
2461
1834
# New empty GnuTLS certificate
2462
crt = gnutls.openpgp_crt_t()
2463
gnutls.openpgp_crt_init(ctypes.byref(crt))
1835
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1836
(gnutls.library.functions
1837
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2464
1838
# Import the OpenPGP public key into the certificate
2465
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2466
gnutls.OPENPGP_FMT_RAW)
1839
(gnutls.library.functions
1840
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1841
gnutls.library.constants
1842
.GNUTLS_OPENPGP_FMT_RAW))
2467
1843
# Verify the self signature in the key
2468
1844
crtverify = ctypes.c_uint()
2469
gnutls.openpgp_crt_verify_self(crt, 0,
2470
ctypes.byref(crtverify))
1845
(gnutls.library.functions
1846
.gnutls_openpgp_crt_verify_self(crt, 0,
1847
ctypes.byref(crtverify)))
2471
1848
if crtverify.value != 0:
2472
gnutls.openpgp_crt_deinit(crt)
2473
raise gnutls.CertificateSecurityError(code
1849
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1850
raise (gnutls.errors.CertificateSecurityError
2475
1852
# New buffer for the fingerprint
2476
1853
buf = ctypes.create_string_buffer(20)
2477
1854
buf_len = ctypes.c_size_t()
2478
1855
# Get the fingerprint from the certificate into the buffer
2479
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2480
ctypes.byref(buf_len))
1856
(gnutls.library.functions
1857
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1858
ctypes.byref(buf_len)))
2481
1859
# Deinit the certificate
2482
gnutls.openpgp_crt_deinit(crt)
1860
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2483
1861
# Convert the buffer to a Python bytestring
2484
1862
fpr = ctypes.string_at(buf, buf_len.value)
2485
1863
# Convert the bytestring to hexadecimal notation
2574
1946
# socket_wrapper(), if socketfd was set.
2575
1947
socketserver.TCPServer.__init__(self, server_address,
2576
1948
RequestHandlerClass)
2578
1950
def server_bind(self):
2579
1951
"""This overrides the normal server_bind() function
2580
1952
to bind to an interface if one was specified, and also NOT to
2581
1953
bind to an address or port if they were not specified."""
2582
global SO_BINDTODEVICE
2583
1954
if self.interface is not None:
2584
1955
if SO_BINDTODEVICE is None:
2585
# Fall back to a hard-coded value which seems to be
2587
logger.warning("SO_BINDTODEVICE not found, trying 25")
2588
SO_BINDTODEVICE = 25
2590
self.socket.setsockopt(
2591
socket.SOL_SOCKET, SO_BINDTODEVICE,
2592
(self.interface + "\0").encode("utf-8"))
2593
except socket.error as error:
2594
if error.errno == errno.EPERM:
2595
logger.error("No permission to bind to"
2596
" interface %s", self.interface)
2597
elif error.errno == errno.ENOPROTOOPT:
2598
logger.error("SO_BINDTODEVICE not available;"
2599
" cannot bind to interface %s",
2601
elif error.errno == errno.ENODEV:
2602
logger.error("Interface %s does not exist,"
2603
" cannot bind", self.interface)
1956
logger.error("SO_BINDTODEVICE does not exist;"
1957
" cannot bind to interface %s",
1961
self.socket.setsockopt(socket.SOL_SOCKET,
1963
str(self.interface + '\0'))
1964
except socket.error as error:
1965
if error.errno == errno.EPERM:
1966
logger.error("No permission to bind to"
1967
" interface %s", self.interface)
1968
elif error.errno == errno.ENOPROTOOPT:
1969
logger.error("SO_BINDTODEVICE not available;"
1970
" cannot bind to interface %s",
1972
elif error.errno == errno.ENODEV:
1973
logger.error("Interface %s does not exist,"
1974
" cannot bind", self.interface)
2606
1977
# Only bind(2) the socket if we really need to.
2607
1978
if self.server_address[0] or self.server_address[1]:
2608
1979
if not self.server_address[0]:
2609
1980
if self.address_family == socket.AF_INET6:
2610
any_address = "::" # in6addr_any
1981
any_address = "::" # in6addr_any
2612
any_address = "0.0.0.0" # INADDR_ANY
1983
any_address = "0.0.0.0" # INADDR_ANY
2613
1984
self.server_address = (any_address,
2614
1985
self.server_address[1])
2615
1986
elif not self.server_address[1]:
2616
self.server_address = (self.server_address[0], 0)
1987
self.server_address = (self.server_address[0],
2617
1989
# if self.interface:
2618
1990
# self.server_address = (self.server_address[0],
2649
2016
self.gnutls_priority = gnutls_priority
2650
2017
IPv6_TCPServer.__init__(self, server_address,
2651
2018
RequestHandlerClass,
2652
interface=interface,
2019
interface = interface,
2020
use_ipv6 = use_ipv6,
2021
socketfd = socketfd)
2656
2022
def server_activate(self):
2657
2023
if self.enabled:
2658
2024
return socketserver.TCPServer.server_activate(self)
2660
2026
def enable(self):
2661
2027
self.enabled = True
2663
2029
def add_pipe(self, parent_pipe, proc):
2664
2030
# Call "handle_ipc" for both data and EOF events
2666
parent_pipe.fileno(),
2667
GLib.IO_IN | GLib.IO_HUP,
2668
functools.partial(self.handle_ipc,
2669
parent_pipe=parent_pipe,
2672
def handle_ipc(self, source, condition,
2675
client_object=None):
2031
gobject.io_add_watch(parent_pipe.fileno(),
2032
gobject.IO_IN | gobject.IO_HUP,
2033
functools.partial(self.handle_ipc,
2038
def handle_ipc(self, source, condition, parent_pipe=None,
2039
proc = None, client_object=None):
2676
2040
# error, or the other end of multiprocessing.Pipe has closed
2677
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2041
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2678
2042
# Wait for other process to exit
2682
2046
# Read a request from the child
2683
2047
request = parent_pipe.recv()
2684
2048
command = request[0]
2686
2050
if command == 'init':
2687
key_id = request[1].decode("ascii")
2688
fpr = request[2].decode("ascii")
2689
address = request[3]
2691
for c in self.clients.values():
2692
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2694
if key_id and c.key_id == key_id:
2697
if fpr and c.fingerprint == fpr:
2052
address = request[2]
2054
for c in self.clients.itervalues():
2055
if c.fingerprint == fpr:
2701
logger.info("Client not found for key ID: %s, address"
2702
": %s", key_id or fpr, address)
2059
logger.info("Client not found for fingerprint: %s, ad"
2060
"dress: %s", fpr, address)
2703
2061
if self.use_dbus:
2704
2062
# Emit D-Bus signal
2705
mandos_dbus_service.ClientNotFound(key_id or fpr,
2063
mandos_dbus_service.ClientNotFound(fpr,
2707
2065
parent_pipe.send(False)
2711
parent_pipe.fileno(),
2712
GLib.IO_IN | GLib.IO_HUP,
2713
functools.partial(self.handle_ipc,
2714
parent_pipe=parent_pipe,
2716
client_object=client))
2068
gobject.io_add_watch(parent_pipe.fileno(),
2069
gobject.IO_IN | gobject.IO_HUP,
2070
functools.partial(self.handle_ipc,
2717
2076
parent_pipe.send(True)
2718
2077
# remove the old hook in favor of the new above hook on
3125
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3127
2477
except OSError as error:
3128
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3129
.format(uid, gid, os.strerror(error.errno)))
3130
2478
if error.errno != errno.EPERM:
3134
2482
# Enable all possible GnuTLS debugging
3136
2484
# "Use a log level over 10 to enable all debugging options."
3137
2485
# - GnuTLS manual
3138
gnutls.global_set_log_level(11)
2486
gnutls.library.functions.gnutls_global_set_log_level(11)
2488
@gnutls.library.types.gnutls_log_func
3141
2489
def debug_gnutls(level, string):
3142
2490
logger.debug("GnuTLS: %s", string[:-1])
3144
gnutls.global_set_log_function(debug_gnutls)
2492
(gnutls.library.functions
2493
.gnutls_global_set_log_function(debug_gnutls))
3146
2495
# Redirect stdin so all checkers get /dev/null
3147
2496
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3148
2497
os.dup2(null, sys.stdin.fileno())
3152
2501
# Need to fork before connecting to D-Bus
3153
2502
if not foreground:
3154
2503
# Close all input and output, do double fork, etc.
3157
# multiprocessing will use threads, so before we use GLib we need
3158
# to inform GLib that threads will be used.
2506
# multiprocessing will use threads, so before we use gobject we
2507
# need to inform gobject that threads will be used.
2508
gobject.threads_init()
3161
2510
global main_loop
3162
2511
# From the Avahi example code
3163
2512
DBusGMainLoop(set_as_default=True)
3164
main_loop = GLib.MainLoop()
2513
main_loop = gobject.MainLoop()
3165
2514
bus = dbus.SystemBus()
3166
2515
# End of Avahi example code
3169
2518
bus_name = dbus.service.BusName("se.recompile.Mandos",
3172
old_bus_name = dbus.service.BusName(
3173
"se.bsnet.fukt.Mandos", bus,
3175
except dbus.exceptions.DBusException as e:
2519
bus, do_not_queue=True)
2520
old_bus_name = (dbus.service.BusName
2521
("se.bsnet.fukt.Mandos", bus,
2523
except dbus.exceptions.NameExistsException as e:
3176
2524
logger.error("Disabling D-Bus:", exc_info=e)
3177
2525
use_dbus = False
3178
2526
server_settings["use_dbus"] = False
3179
2527
tcp_server.use_dbus = False
3181
2529
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3182
service = AvahiServiceToSyslog(
3183
name=server_settings["servicename"],
3184
servicetype="_mandos._tcp",
2530
service = AvahiServiceToSyslog(name =
2531
server_settings["servicename"],
2532
servicetype = "_mandos._tcp",
2533
protocol = protocol, bus = bus)
3187
2534
if server_settings["interface"]:
3188
service.interface = if_nametoindex(
3189
server_settings["interface"].encode("utf-8"))
2535
service.interface = (if_nametoindex
2536
(str(server_settings["interface"])))
3191
2538
global multiprocessing_manager
3192
2539
multiprocessing_manager = multiprocessing.Manager()
3194
2541
client_class = Client
3196
client_class = functools.partial(ClientDBus, bus=bus)
2543
client_class = functools.partial(ClientDBus, bus = bus)
3198
2545
client_settings = Client.config_parser(client_config)
3199
2546
old_client_settings = {}
3200
2547
clients_data = {}
3202
2549
# This is used to redirect stdout and stderr for checker processes
3204
wnull = open(os.devnull, "w") # A writable /dev/null
2551
wnull = open(os.devnull, "w") # A writable /dev/null
3205
2552
# Only used if server is running in foreground but not in debug
3207
2554
if debug or not foreground:
3210
2557
# Get client data and settings from last running state.
3211
2558
if server_settings["restore"]:
3213
2560
with open(stored_state_path, "rb") as stored_state:
3214
if sys.version_info.major == 2:
3215
clients_data, old_client_settings = pickle.load(
3218
bytes_clients_data, bytes_old_client_settings = (
3219
pickle.load(stored_state, encoding="bytes"))
3220
# Fix bytes to strings
3223
clients_data = {(key.decode("utf-8")
3224
if isinstance(key, bytes)
3227
bytes_clients_data.items()}
3228
del bytes_clients_data
3229
for key in clients_data:
3230
value = {(k.decode("utf-8")
3231
if isinstance(k, bytes) else k): v
3233
clients_data[key].items()}
3234
clients_data[key] = value
3236
value["client_structure"] = [
3238
if isinstance(s, bytes)
3240
value["client_structure"]]
3242
for k in ("name", "host"):
3243
if isinstance(value[k], bytes):
3244
value[k] = value[k].decode("utf-8")
3245
if not value.has_key("key_id"):
3246
value["key_id"] = ""
3247
elif not value.has_key("fingerprint"):
3248
value["fingerprint"] = ""
3249
# old_client_settings
3251
old_client_settings = {
3252
(key.decode("utf-8")
3253
if isinstance(key, bytes)
3256
bytes_old_client_settings.items()}
3257
del bytes_old_client_settings
3259
for value in old_client_settings.values():
3260
if isinstance(value["host"], bytes):
3261
value["host"] = (value["host"]
2561
clients_data, old_client_settings = (pickle.load
3263
2563
os.remove(stored_state_path)
3264
2564
except IOError as e:
3265
2565
if e.errno == errno.ENOENT:
3266
logger.warning("Could not load persistent state:"
3267
" {}".format(os.strerror(e.errno)))
2566
logger.warning("Could not load persistent state: {}"
2567
.format(os.strerror(e.errno)))
3269
2569
logger.critical("Could not load persistent state:",
3272
2572
except EOFError as e:
3273
2573
logger.warning("Could not load persistent state: "
2574
"EOFError:", exc_info=e)
3277
2576
with PGPEngine() as pgp:
3278
2577
for client_name, client in clients_data.items():
3279
2578
# Skip removed clients
3280
2579
if client_name not in client_settings:
3283
2582
# Decide which value to use after restoring saved state.
3284
2583
# We have three different values: Old config file,
3285
2584
# new config file, and saved state.
3343
2642
for client_name in (set(client_settings)
3344
2643
- set(old_client_settings)):
3345
2644
clients_data[client_name] = client_settings[client_name]
3347
2646
# Create all client objects
3348
2647
for client_name, client in clients_data.items():
3349
2648
tcp_server.clients[client_name] = client_class(
3352
server_settings=server_settings)
2649
name = client_name, settings = client,
2650
server_settings = server_settings)
3354
2652
if not tcp_server.clients:
3355
2653
logger.warning("No clients defined")
3357
2655
if not foreground:
3358
2656
if pidfile is not None:
3362
print(pid, file=pidfile)
2660
pidfile.write(str(pid) + "\n".encode("utf-8"))
3363
2661
except IOError:
3364
2662
logger.error("Could not write to file %r with PID %d",
3365
2663
pidfilename, pid)
3367
2665
del pidfilename
3369
for termsig in (signal.SIGHUP, signal.SIGTERM):
3370
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3371
lambda: main_loop.quit() and False)
2667
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2668
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3375
@alternate_dbus_interfaces(
3376
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3377
class MandosDBusService(DBusObjectWithObjectManager):
2671
@alternate_dbus_interfaces({"se.recompile.Mandos":
2672
"se.bsnet.fukt.Mandos"})
2673
class MandosDBusService(DBusObjectWithProperties):
3378
2674
"""A D-Bus proxy object"""
3380
2675
def __init__(self):
3381
2676
dbus.service.Object.__init__(self, bus, "/")
3383
2677
_interface = "se.recompile.Mandos"
2679
@dbus_interface_annotations(_interface)
2681
return { "org.freedesktop.DBus.Property"
2682
".EmitsChangedSignal":
3385
2685
@dbus.service.signal(_interface, signature="o")
3386
2686
def ClientAdded(self, objpath):
3390
2690
@dbus.service.signal(_interface, signature="ss")
3391
def ClientNotFound(self, key_id, address):
2691
def ClientNotFound(self, fingerprint, address):
3395
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3397
2695
@dbus.service.signal(_interface, signature="os")
3398
2696
def ClientRemoved(self, objpath, name):
3402
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3404
2700
@dbus.service.method(_interface, out_signature="ao")
3405
2701
def GetAllClients(self):
3407
return dbus.Array(c.dbus_object_path for c in
3408
tcp_server.clients.values())
3410
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2703
return dbus.Array(c.dbus_object_path
2705
tcp_server.clients.itervalues())
3412
2707
@dbus.service.method(_interface,
3413
2708
out_signature="a{oa{sv}}")
3414
2709
def GetAllClientsWithProperties(self):
3416
2711
return dbus.Dictionary(
3417
{c.dbus_object_path: c.GetAll(
3418
"se.recompile.Mandos.Client")
3419
for c in tcp_server.clients.values()},
2712
((c.dbus_object_path, c.GetAll(""))
2713
for c in tcp_server.clients.itervalues()),
3420
2714
signature="oa{sv}")
3422
2716
@dbus.service.method(_interface, in_signature="o")
3423
2717
def RemoveClient(self, object_path):
3425
for c in tcp_server.clients.values():
2719
for c in tcp_server.clients.itervalues():
3426
2720
if c.dbus_object_path == object_path:
3427
2721
del tcp_server.clients[c.name]
3428
2722
c.remove_from_connection()
3429
# Don't signal the disabling
2723
# Don't signal anything except ClientRemoved
3430
2724
c.disable(quiet=True)
3431
# Emit D-Bus signal for removal
3432
self.client_removed_signal(c)
2726
self.ClientRemoved(object_path, c.name)
3434
2728
raise KeyError(object_path)
3438
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3439
out_signature="a{oa{sa{sv}}}")
3440
def GetManagedObjects(self):
3442
return dbus.Dictionary(
3443
{client.dbus_object_path:
3445
{interface: client.GetAll(interface)
3447
client._get_all_interface_names()})
3448
for client in tcp_server.clients.values()})
3450
def client_added_signal(self, client):
3451
"""Send the new standard signal and the old signal"""
3453
# New standard signal
3454
self.InterfacesAdded(
3455
client.dbus_object_path,
3457
{interface: client.GetAll(interface)
3459
client._get_all_interface_names()}))
3461
self.ClientAdded(client.dbus_object_path)
3463
def client_removed_signal(self, client):
3464
"""Send the new standard signal and the old signal"""
3466
# New standard signal
3467
self.InterfacesRemoved(
3468
client.dbus_object_path,
3469
client._get_all_interface_names())
3471
self.ClientRemoved(client.dbus_object_path,
3474
2732
mandos_dbus_service = MandosDBusService()
3476
# Save modules to variables to exempt the modules from being
3477
# unloaded before the function registered with atexit() is run.
3478
mp = multiprocessing
3482
2735
"Cleanup function; run on exit"
3484
2737
service.cleanup()
3486
mp.active_children()
2739
multiprocessing.active_children()
3488
2741
if not (tcp_server.clients or client_settings):
3491
2744
# Store client before exiting. Secrets are encrypted with key
3492
2745
# based on what config file has. If config file is
3493
2746
# removed/edited, old secret will thus be unrecovable.
3495
2748
with PGPEngine() as pgp:
3496
for client in tcp_server.clients.values():
2749
for client in tcp_server.clients.itervalues():
3497
2750
key = client_settings[client.name]["secret"]
3498
2751
client.encrypted_secret = pgp.encrypt(client.secret,
3500
2753
client_dict = {}
3502
2755
# A list of attributes that can not be pickled
3504
exclude = {"bus", "changedstate", "secret",
3505
"checker", "server_settings"}
3506
for name, typ in inspect.getmembers(dbus.service
2757
exclude = { "bus", "changedstate", "secret",
2758
"checker", "server_settings" }
2759
for name, typ in (inspect.getmembers
2760
(dbus.service.Object)):
3508
2761
exclude.add(name)
3510
2763
client_dict["encrypted_secret"] = (client
3511
2764
.encrypted_secret)
3512
2765
for attr in client.client_structure:
3513
2766
if attr not in exclude:
3514
2767
client_dict[attr] = getattr(client, attr)
3516
2769
clients[client.name] = client_dict
3517
2770
del client_settings[client.name]["secret"]
3520
with tempfile.NamedTemporaryFile(
3524
dir=os.path.dirname(stored_state_path),
3525
delete=False) as stored_state:
3526
pickle.dump((clients, client_settings), stored_state,
3528
tempname = stored_state.name
2773
with (tempfile.NamedTemporaryFile
2774
(mode='wb', suffix=".pickle", prefix='clients-',
2775
dir=os.path.dirname(stored_state_path),
2776
delete=False)) as stored_state:
2777
pickle.dump((clients, client_settings), stored_state)
2778
tempname=stored_state.name
3529
2779
os.rename(tempname, stored_state_path)
3530
2780
except (IOError, OSError) as e: