2
2
# -*- mode: python; coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
17
# This file is part of Mandos.
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
32
31
# Contact the authors at <mandos@recompile.se>.
35
34
from __future__ import (division, absolute_import, print_function,
39
from future_builtins import *
37
from future_builtins import *
44
40
import SocketServer as socketserver
236
195
.replace(b"\n", b"\\n")
237
196
.replace(b"\0", b"\\x00"))
240
199
def encrypt(self, data, password):
241
200
passphrase = self.password_encode(password)
242
201
with tempfile.NamedTemporaryFile(
243
202
dir=self.tempdir) as passfile:
244
203
passfile.write(passphrase)
246
proc = subprocess.Popen([self.gpg, '--symmetric',
205
proc = subprocess.Popen(['gpg', '--symmetric',
247
206
'--passphrase-file',
249
208
+ self.gnupgargs,
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
209
stdin = subprocess.PIPE,
210
stdout = subprocess.PIPE,
211
stderr = subprocess.PIPE)
212
ciphertext, err = proc.communicate(input = data)
254
213
if proc.returncode != 0:
255
214
raise PGPError(err)
256
215
return ciphertext
258
217
def decrypt(self, data, password):
259
218
passphrase = self.password_encode(password)
260
219
with tempfile.NamedTemporaryFile(
261
dir=self.tempdir) as passfile:
220
dir = self.tempdir) as passfile:
262
221
passfile.write(passphrase)
264
proc = subprocess.Popen([self.gpg, '--decrypt',
223
proc = subprocess.Popen(['gpg', '--decrypt',
265
224
'--passphrase-file',
267
226
+ self.gnupgargs,
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
227
stdin = subprocess.PIPE,
228
stdout = subprocess.PIPE,
229
stderr = subprocess.PIPE)
230
decrypted_plaintext, err = proc.communicate(input = data)
272
231
if proc.returncode != 0:
273
232
raise PGPError(err)
274
233
return decrypted_plaintext
277
# Pretend that we have an Avahi module
279
"""This isn't so much a class as it is a module-like namespace."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
290
def string_array_to_txt_array(t):
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
303
236
class AvahiError(Exception):
304
237
def __init__(self, value, *args, **kwargs):
305
238
self.value = value
495
417
class AvahiServiceToSyslog(AvahiService):
496
418
def rename(self, *args, **kwargs):
497
419
"""Add the new name to the syslog messages"""
498
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
420
ret = AvahiService.rename(self, *args, **kwargs)
499
421
syslogger.setFormatter(logging.Formatter(
500
422
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
501
423
.format(self.name)))
505
# Pretend that we have a GnuTLS module
506
class gnutls(object):
507
"""This isn't so much a class as it is a module-like namespace."""
509
library = ctypes.util.find_library("gnutls")
511
library = ctypes.util.find_library("gnutls-deb0")
512
_library = ctypes.cdll.LoadLibrary(library)
515
# Unless otherwise indicated, the constants and types below are
516
# all from the gnutls/gnutls.h C header file.
527
E_NO_CERTIFICATE_FOUND = -49
532
KEYID_USE_SHA256 = 1 # gnutls/x509.h
533
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
536
class session_int(ctypes.Structure):
538
session_t = ctypes.POINTER(session_int)
540
class certificate_credentials_st(ctypes.Structure):
542
certificate_credentials_t = ctypes.POINTER(
543
certificate_credentials_st)
544
certificate_type_t = ctypes.c_int
546
class datum_t(ctypes.Structure):
547
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
548
('size', ctypes.c_uint)]
550
class openpgp_crt_int(ctypes.Structure):
552
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
553
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
554
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
555
credentials_type_t = ctypes.c_int
556
transport_ptr_t = ctypes.c_void_p
557
close_request_t = ctypes.c_int
560
class Error(Exception):
561
def __init__(self, message=None, code=None, args=()):
562
# Default usage is by a message string, but if a return
563
# code is passed, convert it to a string with
566
if message is None and code is not None:
567
message = gnutls.strerror(code)
568
return super(gnutls.Error, self).__init__(
571
class CertificateSecurityError(Error):
575
class Credentials(object):
577
self._c_object = gnutls.certificate_credentials_t()
578
gnutls.certificate_allocate_credentials(
579
ctypes.byref(self._c_object))
580
self.type = gnutls.CRD_CERTIFICATE
583
gnutls.certificate_free_credentials(self._c_object)
585
class ClientSession(object):
586
def __init__(self, socket, credentials=None):
587
self._c_object = gnutls.session_t()
588
gnutls_flags = gnutls.CLIENT
589
if gnutls.check_version(b"3.5.6"):
590
gnutls_flags |= gnutls.NO_TICKETS
592
gnutls_flags |= gnutls.ENABLE_RAWPK
593
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
595
gnutls.set_default_priority(self._c_object)
596
gnutls.transport_set_ptr(self._c_object, socket.fileno())
597
gnutls.handshake_set_private_extensions(self._c_object,
600
if credentials is None:
601
credentials = gnutls.Credentials()
602
gnutls.credentials_set(self._c_object, credentials.type,
603
ctypes.cast(credentials._c_object,
605
self.credentials = credentials
608
gnutls.deinit(self._c_object)
611
return gnutls.handshake(self._c_object)
613
def send(self, data):
617
data_len -= gnutls.record_send(self._c_object,
622
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
624
# Error handling functions
625
def _error_code(result):
626
"""A function to raise exceptions on errors, suitable
627
for the 'restype' attribute on ctypes functions"""
630
if result == gnutls.E_NO_CERTIFICATE_FOUND:
631
raise gnutls.CertificateSecurityError(code=result)
632
raise gnutls.Error(code=result)
634
def _retry_on_error(result, func, arguments):
635
"""A function to retry on some errors, suitable
636
for the 'errcheck' attribute on ctypes functions"""
638
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
639
return _error_code(result)
640
result = func(*arguments)
643
# Unless otherwise indicated, the function declarations below are
644
# all from the gnutls/gnutls.h C header file.
647
priority_set_direct = _library.gnutls_priority_set_direct
648
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
649
ctypes.POINTER(ctypes.c_char_p)]
650
priority_set_direct.restype = _error_code
652
init = _library.gnutls_init
653
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
654
init.restype = _error_code
656
set_default_priority = _library.gnutls_set_default_priority
657
set_default_priority.argtypes = [session_t]
658
set_default_priority.restype = _error_code
660
record_send = _library.gnutls_record_send
661
record_send.argtypes = [session_t, ctypes.c_void_p,
663
record_send.restype = ctypes.c_ssize_t
664
record_send.errcheck = _retry_on_error
666
certificate_allocate_credentials = (
667
_library.gnutls_certificate_allocate_credentials)
668
certificate_allocate_credentials.argtypes = [
669
ctypes.POINTER(certificate_credentials_t)]
670
certificate_allocate_credentials.restype = _error_code
672
certificate_free_credentials = (
673
_library.gnutls_certificate_free_credentials)
674
certificate_free_credentials.argtypes = [
675
certificate_credentials_t]
676
certificate_free_credentials.restype = None
678
handshake_set_private_extensions = (
679
_library.gnutls_handshake_set_private_extensions)
680
handshake_set_private_extensions.argtypes = [session_t,
682
handshake_set_private_extensions.restype = None
684
credentials_set = _library.gnutls_credentials_set
685
credentials_set.argtypes = [session_t, credentials_type_t,
687
credentials_set.restype = _error_code
689
strerror = _library.gnutls_strerror
690
strerror.argtypes = [ctypes.c_int]
691
strerror.restype = ctypes.c_char_p
693
certificate_type_get = _library.gnutls_certificate_type_get
694
certificate_type_get.argtypes = [session_t]
695
certificate_type_get.restype = _error_code
697
certificate_get_peers = _library.gnutls_certificate_get_peers
698
certificate_get_peers.argtypes = [session_t,
699
ctypes.POINTER(ctypes.c_uint)]
700
certificate_get_peers.restype = ctypes.POINTER(datum_t)
702
global_set_log_level = _library.gnutls_global_set_log_level
703
global_set_log_level.argtypes = [ctypes.c_int]
704
global_set_log_level.restype = None
706
global_set_log_function = _library.gnutls_global_set_log_function
707
global_set_log_function.argtypes = [log_func]
708
global_set_log_function.restype = None
710
deinit = _library.gnutls_deinit
711
deinit.argtypes = [session_t]
712
deinit.restype = None
714
handshake = _library.gnutls_handshake
715
handshake.argtypes = [session_t]
716
handshake.restype = _error_code
717
handshake.errcheck = _retry_on_error
719
transport_set_ptr = _library.gnutls_transport_set_ptr
720
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
721
transport_set_ptr.restype = None
723
bye = _library.gnutls_bye
724
bye.argtypes = [session_t, close_request_t]
725
bye.restype = _error_code
726
bye.errcheck = _retry_on_error
728
check_version = _library.gnutls_check_version
729
check_version.argtypes = [ctypes.c_char_p]
730
check_version.restype = ctypes.c_char_p
732
_need_version = b"3.3.0"
733
if check_version(_need_version) is None:
734
raise self.Error("Needs GnuTLS {} or later"
735
.format(_need_version))
737
_tls_rawpk_version = b"3.6.6"
738
has_rawpk = bool(check_version(_tls_rawpk_version))
742
class pubkey_st(ctypes.Structure):
744
pubkey_t = ctypes.POINTER(pubkey_st)
746
x509_crt_fmt_t = ctypes.c_int
748
# All the function declarations below are from gnutls/abstract.h
749
pubkey_init = _library.gnutls_pubkey_init
750
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
751
pubkey_init.restype = _error_code
753
pubkey_import = _library.gnutls_pubkey_import
754
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
756
pubkey_import.restype = _error_code
758
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
759
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
760
ctypes.POINTER(ctypes.c_ubyte),
761
ctypes.POINTER(ctypes.c_size_t)]
762
pubkey_get_key_id.restype = _error_code
764
pubkey_deinit = _library.gnutls_pubkey_deinit
765
pubkey_deinit.argtypes = [pubkey_t]
766
pubkey_deinit.restype = None
768
# All the function declarations below are from gnutls/openpgp.h
770
openpgp_crt_init = _library.gnutls_openpgp_crt_init
771
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
772
openpgp_crt_init.restype = _error_code
774
openpgp_crt_import = _library.gnutls_openpgp_crt_import
775
openpgp_crt_import.argtypes = [openpgp_crt_t,
776
ctypes.POINTER(datum_t),
778
openpgp_crt_import.restype = _error_code
780
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
781
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
782
ctypes.POINTER(ctypes.c_uint)]
783
openpgp_crt_verify_self.restype = _error_code
785
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
786
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
787
openpgp_crt_deinit.restype = None
789
openpgp_crt_get_fingerprint = (
790
_library.gnutls_openpgp_crt_get_fingerprint)
791
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
795
openpgp_crt_get_fingerprint.restype = _error_code
797
if check_version(b"3.6.4"):
798
certificate_type_get2 = _library.gnutls_certificate_type_get2
799
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
800
certificate_type_get2.restype = _error_code
802
# Remove non-public functions
803
del _error_code, _retry_on_error
806
def call_pipe(connection, # : multiprocessing.Connection
807
func, *args, **kwargs):
808
"""This function is meant to be called by multiprocessing.Process
810
This function runs func(*args, **kwargs), and writes the resulting
811
return value on the provided multiprocessing.Connection.
813
connection.send(func(*args, **kwargs))
817
427
class Client(object):
818
428
"""A representation of a client host served by this server.
821
431
approved: bool(); 'None' if not yet approved/disapproved
822
432
approval_delay: datetime.timedelta(); Time to wait for approval
1002
603
logger.info("Disabling client %s", self.name)
1003
604
if getattr(self, "disable_initiator_tag", None) is not None:
1004
GLib.source_remove(self.disable_initiator_tag)
605
gobject.source_remove(self.disable_initiator_tag)
1005
606
self.disable_initiator_tag = None
1006
607
self.expires = None
1007
608
if getattr(self, "checker_initiator_tag", None) is not None:
1008
GLib.source_remove(self.checker_initiator_tag)
609
gobject.source_remove(self.checker_initiator_tag)
1009
610
self.checker_initiator_tag = None
1010
611
self.stop_checker()
1011
612
self.enabled = False
1013
614
self.send_changedstate()
1014
# Do not run this again if called by a GLib.timeout_add
615
# Do not run this again if called by a gobject.timeout_add
1017
618
def __del__(self):
1020
621
def init_checker(self):
1021
622
# Schedule a new checker to be started an 'interval' from now,
1022
623
# and every interval from then on.
1023
624
if self.checker_initiator_tag is not None:
1024
GLib.source_remove(self.checker_initiator_tag)
1025
self.checker_initiator_tag = GLib.timeout_add(
625
gobject.source_remove(self.checker_initiator_tag)
626
self.checker_initiator_tag = gobject.timeout_add(
1026
627
int(self.interval.total_seconds() * 1000),
1027
628
self.start_checker)
1028
629
# Schedule a disable() when 'timeout' has passed
1029
630
if self.disable_initiator_tag is not None:
1030
GLib.source_remove(self.disable_initiator_tag)
1031
self.disable_initiator_tag = GLib.timeout_add(
631
gobject.source_remove(self.disable_initiator_tag)
632
self.disable_initiator_tag = gobject.timeout_add(
1032
633
int(self.timeout.total_seconds() * 1000), self.disable)
1033
634
# Also start a new checker *right now*.
1034
635
self.start_checker()
1036
def checker_callback(self, source, condition, connection,
637
def checker_callback(self, pid, condition, command):
1038
638
"""The checker has completed, so take appropriate actions."""
1039
639
self.checker_callback_tag = None
1040
640
self.checker = None
1041
# Read return code from connection (see call_pipe)
1042
returncode = connection.recv()
1046
self.last_checker_status = returncode
1047
self.last_checker_signal = None
641
if os.WIFEXITED(condition):
642
self.last_checker_status = os.WEXITSTATUS(condition)
1048
643
if self.last_checker_status == 0:
1049
644
logger.info("Checker for %(name)s succeeded",
1113
715
return True # Try again later
1114
716
self.current_checker_command = command
1115
logger.info("Starting checker %r for %s", command,
1117
# We don't need to redirect stdout and stderr, since
1118
# in normal mode, that is already done by daemon(),
1119
# and in debug mode we don't want to. (Stdin is
1120
# always replaced by /dev/null.)
1121
# The exception is when not debugging but nevertheless
1122
# running in the foreground; use the previously
1124
popen_args = {"close_fds": True,
1127
if (not self.server_settings["debug"]
1128
and self.server_settings["foreground"]):
1129
popen_args.update({"stdout": wnull,
1131
pipe = multiprocessing.Pipe(duplex=False)
1132
self.checker = multiprocessing.Process(
1134
args=(pipe[1], subprocess.call, command),
1136
self.checker.start()
1137
self.checker_callback_tag = GLib.io_add_watch(
1138
pipe[0].fileno(), GLib.IO_IN,
1139
self.checker_callback, pipe[0], command)
1140
# Re-run this periodically if run by GLib.timeout_add
718
logger.info("Starting checker %r for %s", command,
720
# We don't need to redirect stdout and stderr, since
721
# in normal mode, that is already done by daemon(),
722
# and in debug mode we don't want to. (Stdin is
723
# always replaced by /dev/null.)
724
# The exception is when not debugging but nevertheless
725
# running in the foreground; use the previously
728
if (not self.server_settings["debug"]
729
and self.server_settings["foreground"]):
730
popen_args.update({"stdout": wnull,
732
self.checker = subprocess.Popen(command,
737
except OSError as error:
738
logger.error("Failed to start subprocess",
741
self.checker_callback_tag = gobject.child_watch_add(
742
self.checker.pid, self.checker_callback, data=command)
743
# The checker may have completed before the gobject
744
# watch was added. Check for this.
746
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
747
except OSError as error:
748
if error.errno == errno.ECHILD:
749
# This should never happen
750
logger.error("Child process vanished",
755
gobject.source_remove(self.checker_callback_tag)
756
self.checker_callback(pid, status, command)
757
# Re-run this periodically if run by gobject.timeout_add
1143
760
def stop_checker(self):
1144
761
"""Force the checker process, if any, to stop."""
1145
762
if self.checker_callback_tag:
1146
GLib.source_remove(self.checker_callback_tag)
763
gobject.source_remove(self.checker_callback_tag)
1147
764
self.checker_callback_tag = None
1148
765
if getattr(self, "checker", None) is None:
1150
767
logger.debug("Stopping checker for %(name)s", vars(self))
1151
self.checker.terminate()
769
self.checker.terminate()
771
#if self.checker.poll() is None:
772
# self.checker.kill()
773
except OSError as error:
774
if error.errno != errno.ESRCH: # No such process
1152
776
self.checker = None
1272
895
for cls in self.__class__.__mro__
1273
896
for name, athing in
1274
897
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1276
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1278
path_keyword='object_path',
1279
connection_keyword='connection')
1280
def Introspect(self, object_path, connection):
1281
"""Overloading of standard D-Bus method.
1283
Inserts annotation tags on methods and signals.
1285
xmlstring = dbus.service.Object.Introspect(self, object_path,
1288
document = xml.dom.minidom.parseString(xmlstring)
1290
for if_tag in document.getElementsByTagName("interface"):
1291
# Add annotation tags
1292
for typ in ("method", "signal"):
1293
for tag in if_tag.getElementsByTagName(typ):
1295
for name, prop in (self.
1296
_get_all_dbus_things(typ)):
1297
if (name == tag.getAttribute("name")
1298
and prop._dbus_interface
1299
== if_tag.getAttribute("name")):
1300
annots.update(getattr(
1301
prop, "_dbus_annotations", {}))
1302
for name, value in annots.items():
1303
ann_tag = document.createElement(
1305
ann_tag.setAttribute("name", name)
1306
ann_tag.setAttribute("value", value)
1307
tag.appendChild(ann_tag)
1308
# Add interface annotation tags
1309
for annotation, value in dict(
1310
itertools.chain.from_iterable(
1311
annotations().items()
1312
for name, annotations
1313
in self._get_all_dbus_things("interface")
1314
if name == if_tag.getAttribute("name")
1316
ann_tag = document.createElement("annotation")
1317
ann_tag.setAttribute("name", annotation)
1318
ann_tag.setAttribute("value", value)
1319
if_tag.appendChild(ann_tag)
1320
# Fix argument name for the Introspect method itself
1321
if (if_tag.getAttribute("name")
1322
== dbus.INTROSPECTABLE_IFACE):
1323
for cn in if_tag.getElementsByTagName("method"):
1324
if cn.getAttribute("name") == "Introspect":
1325
for arg in cn.getElementsByTagName("arg"):
1326
if (arg.getAttribute("direction")
1328
arg.setAttribute("name",
1330
xmlstring = document.toxml("utf-8")
1332
except (AttributeError, xml.dom.DOMException,
1333
xml.parsers.expat.ExpatError) as error:
1334
logger.error("Failed to override Introspection method",
1339
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1340
"""A D-Bus object with properties.
1342
Classes inheriting from this can use the dbus_service_property
1343
decorator to expose methods as D-Bus properties. It exposes the
1344
standard Get(), Set(), and GetAll() methods on the D-Bus.
1347
899
def _get_dbus_property(self, interface_name, property_name):
1348
900
"""Returns a bound method if one exists which is a D-Bus
1349
901
property with the specified name and interface.
1504
1059
return xmlstring
1508
dbus.OBJECT_MANAGER_IFACE
1509
except AttributeError:
1510
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1513
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1514
"""A D-Bus object with an ObjectManager.
1516
Classes inheriting from this exposes the standard
1517
GetManagedObjects call and the InterfacesAdded and
1518
InterfacesRemoved signals on the standard
1519
"org.freedesktop.DBus.ObjectManager" interface.
1521
Note: No signals are sent automatically; they must be sent
1524
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1525
out_signature="a{oa{sa{sv}}}")
1526
def GetManagedObjects(self):
1527
"""This function must be overridden"""
1528
raise NotImplementedError()
1530
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1531
signature="oa{sa{sv}}")
1532
def InterfacesAdded(self, object_path, interfaces_and_properties):
1535
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1536
def InterfacesRemoved(self, object_path, interfaces):
1539
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1541
path_keyword='object_path',
1542
connection_keyword='connection')
1543
def Introspect(self, object_path, connection):
1544
"""Overloading of standard D-Bus method.
1546
Override return argument name of GetManagedObjects to be
1547
"objpath_interfaces_and_properties"
1549
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1553
document = xml.dom.minidom.parseString(xmlstring)
1555
for if_tag in document.getElementsByTagName("interface"):
1556
# Fix argument name for the GetManagedObjects method
1557
if (if_tag.getAttribute("name")
1558
== dbus.OBJECT_MANAGER_IFACE):
1559
for cn in if_tag.getElementsByTagName("method"):
1560
if (cn.getAttribute("name")
1561
== "GetManagedObjects"):
1562
for arg in cn.getElementsByTagName("arg"):
1563
if (arg.getAttribute("direction")
1567
"objpath_interfaces"
1569
xmlstring = document.toxml("utf-8")
1571
except (AttributeError, xml.dom.DOMException,
1572
xml.parsers.expat.ExpatError) as error:
1573
logger.error("Failed to override Introspection method",
1578
1062
def datetime_to_dbus(dt, variant_level=0):
1579
1063
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1581
return dbus.String("", variant_level=variant_level)
1065
return dbus.String("", variant_level = variant_level)
1582
1066
return dbus.String(dt.isoformat(), variant_level=variant_level)
2366
1818
delay -= time2 - time
2369
session.send(client.secret)
2370
except gnutls.Error as error:
2371
logger.warning("gnutls send failed",
1821
while sent_size < len(client.secret):
1823
sent = session.send(client.secret[sent_size:])
1824
except gnutls.errors.GNUTLSError as error:
1825
logger.warning("gnutls send failed",
1828
logger.debug("Sent: %d, remaining: %d", sent,
1829
len(client.secret) - (sent_size
2375
1833
logger.info("Sending secret to %s", client.name)
2376
1834
# bump the timeout using extended_timeout
2377
1835
client.bump_timeout(client.extended_timeout)
2378
1836
if self.server.use_dbus:
2379
1837
# Emit D-Bus signal
2380
1838
client.GotSecret()
2383
1841
if approval_required:
2384
1842
client.approvals_pending -= 1
2387
except gnutls.Error as error:
1845
except gnutls.errors.GNUTLSError as error:
2388
1846
logger.warning("GnuTLS bye failed",
2389
1847
exc_info=error)
2392
1850
def peer_certificate(session):
2393
"Return the peer's certificate as a bytestring"
2395
cert_type = gnutls.certificate_type_get2(session._c_object,
2397
except AttributeError:
2398
cert_type = gnutls.certificate_type_get(session._c_object)
2399
if gnutls.has_rawpk:
2400
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2402
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2403
# If not a valid certificate type...
2404
if cert_type not in valid_cert_types:
2405
logger.info("Cert type %r not in %r", cert_type,
2407
# ...return invalid data
1851
"Return the peer's OpenPGP certificate as a bytestring"
1852
# If not an OpenPGP certificate...
1853
if (gnutls.library.functions.gnutls_certificate_type_get(
1855
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1856
# ...do the normal thing
1857
return session.peer_certificate
2409
1858
list_size = ctypes.c_uint(1)
2410
cert_list = (gnutls.certificate_get_peers
1859
cert_list = (gnutls.library.functions
1860
.gnutls_certificate_get_peers
2411
1861
(session._c_object, ctypes.byref(list_size)))
2412
1862
if not bool(cert_list) and list_size.value != 0:
2413
raise gnutls.Error("error getting peer certificate")
1863
raise gnutls.errors.GNUTLSError("error getting peer"
2414
1865
if list_size.value == 0:
2416
1867
cert = cert_list[0]
2417
1868
return ctypes.string_at(cert.data, cert.size)
2420
def key_id(certificate):
2421
"Convert a certificate bytestring to a hexdigit key ID"
2422
# New GnuTLS "datum" with the public key
2423
datum = gnutls.datum_t(
2424
ctypes.cast(ctypes.c_char_p(certificate),
2425
ctypes.POINTER(ctypes.c_ubyte)),
2426
ctypes.c_uint(len(certificate)))
2427
# XXX all these need to be created in the gnutls "module"
2428
# New empty GnuTLS certificate
2429
pubkey = gnutls.pubkey_t()
2430
gnutls.pubkey_init(ctypes.byref(pubkey))
2431
# Import the raw public key into the certificate
2432
gnutls.pubkey_import(pubkey,
2433
ctypes.byref(datum),
2434
gnutls.X509_FMT_DER)
2435
# New buffer for the key ID
2436
buf = ctypes.create_string_buffer(32)
2437
buf_len = ctypes.c_size_t(len(buf))
2438
# Get the key ID from the raw public key into the buffer
2439
gnutls.pubkey_get_key_id(pubkey,
2440
gnutls.KEYID_USE_SHA256,
2441
ctypes.cast(ctypes.byref(buf),
2442
ctypes.POINTER(ctypes.c_ubyte)),
2443
ctypes.byref(buf_len))
2444
# Deinit the certificate
2445
gnutls.pubkey_deinit(pubkey)
2447
# Convert the buffer to a Python bytestring
2448
key_id = ctypes.string_at(buf, buf_len.value)
2449
# Convert the bytestring to hexadecimal notation
2450
hex_key_id = binascii.hexlify(key_id).upper()
2454
1871
def fingerprint(openpgp):
2455
1872
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2456
1873
# New GnuTLS "datum" with the OpenPGP public key
2457
datum = gnutls.datum_t(
1874
datum = gnutls.library.types.gnutls_datum_t(
2458
1875
ctypes.cast(ctypes.c_char_p(openpgp),
2459
1876
ctypes.POINTER(ctypes.c_ubyte)),
2460
1877
ctypes.c_uint(len(openpgp)))
2461
1878
# New empty GnuTLS certificate
2462
crt = gnutls.openpgp_crt_t()
2463
gnutls.openpgp_crt_init(ctypes.byref(crt))
1879
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1880
gnutls.library.functions.gnutls_openpgp_crt_init(
2464
1882
# Import the OpenPGP public key into the certificate
2465
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2466
gnutls.OPENPGP_FMT_RAW)
1883
gnutls.library.functions.gnutls_openpgp_crt_import(
1884
crt, ctypes.byref(datum),
1885
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2467
1886
# Verify the self signature in the key
2468
1887
crtverify = ctypes.c_uint()
2469
gnutls.openpgp_crt_verify_self(crt, 0,
2470
ctypes.byref(crtverify))
1888
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1889
crt, 0, ctypes.byref(crtverify))
2471
1890
if crtverify.value != 0:
2472
gnutls.openpgp_crt_deinit(crt)
2473
raise gnutls.CertificateSecurityError(code
1891
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1892
raise gnutls.errors.CertificateSecurityError(
2475
1894
# New buffer for the fingerprint
2476
1895
buf = ctypes.create_string_buffer(20)
2477
1896
buf_len = ctypes.c_size_t()
2478
1897
# Get the fingerprint from the certificate into the buffer
2479
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2480
ctypes.byref(buf_len))
1898
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1899
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2481
1900
# Deinit the certificate
2482
gnutls.openpgp_crt_deinit(crt)
1901
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2483
1902
# Convert the buffer to a Python bytestring
2484
1903
fpr = ctypes.string_at(buf, buf_len.value)
2485
1904
# Convert the bytestring to hexadecimal notation
2574
1992
# socket_wrapper(), if socketfd was set.
2575
1993
socketserver.TCPServer.__init__(self, server_address,
2576
1994
RequestHandlerClass)
2578
1996
def server_bind(self):
2579
1997
"""This overrides the normal server_bind() function
2580
1998
to bind to an interface if one was specified, and also NOT to
2581
1999
bind to an address or port if they were not specified."""
2582
global SO_BINDTODEVICE
2583
2000
if self.interface is not None:
2584
2001
if SO_BINDTODEVICE is None:
2585
# Fall back to a hard-coded value which seems to be
2587
logger.warning("SO_BINDTODEVICE not found, trying 25")
2588
SO_BINDTODEVICE = 25
2590
self.socket.setsockopt(
2591
socket.SOL_SOCKET, SO_BINDTODEVICE,
2592
(self.interface + "\0").encode("utf-8"))
2593
except socket.error as error:
2594
if error.errno == errno.EPERM:
2595
logger.error("No permission to bind to"
2596
" interface %s", self.interface)
2597
elif error.errno == errno.ENOPROTOOPT:
2598
logger.error("SO_BINDTODEVICE not available;"
2599
" cannot bind to interface %s",
2601
elif error.errno == errno.ENODEV:
2602
logger.error("Interface %s does not exist,"
2603
" cannot bind", self.interface)
2002
logger.error("SO_BINDTODEVICE does not exist;"
2003
" cannot bind to interface %s",
2007
self.socket.setsockopt(
2008
socket.SOL_SOCKET, SO_BINDTODEVICE,
2009
(self.interface + "\0").encode("utf-8"))
2010
except socket.error as error:
2011
if error.errno == errno.EPERM:
2012
logger.error("No permission to bind to"
2013
" interface %s", self.interface)
2014
elif error.errno == errno.ENOPROTOOPT:
2015
logger.error("SO_BINDTODEVICE not available;"
2016
" cannot bind to interface %s",
2018
elif error.errno == errno.ENODEV:
2019
logger.error("Interface %s does not exist,"
2020
" cannot bind", self.interface)
2606
2023
# Only bind(2) the socket if we really need to.
2607
2024
if self.server_address[0] or self.server_address[1]:
2608
if self.server_address[1]:
2609
self.allow_reuse_address = True
2610
2025
if not self.server_address[0]:
2611
2026
if self.address_family == socket.AF_INET6:
2612
any_address = "::" # in6addr_any
2027
any_address = "::" # in6addr_any
2614
any_address = "0.0.0.0" # INADDR_ANY
2029
any_address = "0.0.0.0" # INADDR_ANY
2615
2030
self.server_address = (any_address,
2616
2031
self.server_address[1])
2617
2032
elif not self.server_address[1]:
2651
2066
self.gnutls_priority = gnutls_priority
2652
2067
IPv6_TCPServer.__init__(self, server_address,
2653
2068
RequestHandlerClass,
2654
interface=interface,
2069
interface = interface,
2070
use_ipv6 = use_ipv6,
2071
socketfd = socketfd)
2658
2073
def server_activate(self):
2659
2074
if self.enabled:
2660
2075
return socketserver.TCPServer.server_activate(self)
2662
2077
def enable(self):
2663
2078
self.enabled = True
2665
2080
def add_pipe(self, parent_pipe, proc):
2666
2081
# Call "handle_ipc" for both data and EOF events
2082
gobject.io_add_watch(
2668
2083
parent_pipe.fileno(),
2669
GLib.IO_IN | GLib.IO_HUP,
2084
gobject.IO_IN | gobject.IO_HUP,
2670
2085
functools.partial(self.handle_ipc,
2671
parent_pipe=parent_pipe,
2086
parent_pipe = parent_pipe,
2674
2089
def handle_ipc(self, source, condition,
2675
2090
parent_pipe=None,
2677
2092
client_object=None):
2678
2093
# error, or the other end of multiprocessing.Pipe has closed
2679
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2094
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2680
2095
# Wait for other process to exit
2684
2099
# Read a request from the child
2685
2100
request = parent_pipe.recv()
2686
2101
command = request[0]
2688
2103
if command == 'init':
2689
key_id = request[1].decode("ascii")
2690
fpr = request[2].decode("ascii")
2691
address = request[3]
2693
for c in self.clients.values():
2694
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2696
if key_id and c.key_id == key_id:
2699
if fpr and c.fingerprint == fpr:
2105
address = request[2]
2107
for c in self.clients.itervalues():
2108
if c.fingerprint == fpr:
2703
logger.info("Client not found for key ID: %s, address"
2704
": %s", key_id or fpr, address)
2112
logger.info("Client not found for fingerprint: %s, ad"
2113
"dress: %s", fpr, address)
2705
2114
if self.use_dbus:
2706
2115
# Emit D-Bus signal
2707
mandos_dbus_service.ClientNotFound(key_id or fpr,
2116
mandos_dbus_service.ClientNotFound(fpr,
2709
2118
parent_pipe.send(False)
2121
gobject.io_add_watch(
2713
2122
parent_pipe.fileno(),
2714
GLib.IO_IN | GLib.IO_HUP,
2123
gobject.IO_IN | gobject.IO_HUP,
2715
2124
functools.partial(self.handle_ipc,
2716
parent_pipe=parent_pipe,
2718
client_object=client))
2125
parent_pipe = parent_pipe,
2127
client_object = client))
2719
2128
parent_pipe.send(True)
2720
2129
# remove the old hook in favor of the new above hook on
3183
2584
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3184
2585
service = AvahiServiceToSyslog(
3185
name=server_settings["servicename"],
3186
servicetype="_mandos._tcp",
2586
name = server_settings["servicename"],
2587
servicetype = "_mandos._tcp",
2588
protocol = protocol,
3189
2590
if server_settings["interface"]:
3190
2591
service.interface = if_nametoindex(
3191
2592
server_settings["interface"].encode("utf-8"))
3193
2594
global multiprocessing_manager
3194
2595
multiprocessing_manager = multiprocessing.Manager()
3196
2597
client_class = Client
3198
client_class = functools.partial(ClientDBus, bus=bus)
2599
client_class = functools.partial(ClientDBus, bus = bus)
3200
2601
client_settings = Client.config_parser(client_config)
3201
2602
old_client_settings = {}
3202
2603
clients_data = {}
3204
2605
# This is used to redirect stdout and stderr for checker processes
3206
wnull = open(os.devnull, "w") # A writable /dev/null
2607
wnull = open(os.devnull, "w") # A writable /dev/null
3207
2608
# Only used if server is running in foreground but not in debug
3209
2610
if debug or not foreground:
3212
2613
# Get client data and settings from last running state.
3213
2614
if server_settings["restore"]:
3215
2616
with open(stored_state_path, "rb") as stored_state:
3216
if sys.version_info.major == 2:
3217
clients_data, old_client_settings = pickle.load(
3220
bytes_clients_data, bytes_old_client_settings = (
3221
pickle.load(stored_state, encoding="bytes"))
3222
# Fix bytes to strings
3225
clients_data = {(key.decode("utf-8")
3226
if isinstance(key, bytes)
3229
bytes_clients_data.items()}
3230
del bytes_clients_data
3231
for key in clients_data:
3232
value = {(k.decode("utf-8")
3233
if isinstance(k, bytes) else k): v
3235
clients_data[key].items()}
3236
clients_data[key] = value
3238
value["client_structure"] = [
3240
if isinstance(s, bytes)
3242
value["client_structure"]]
3244
for k in ("name", "host"):
3245
if isinstance(value[k], bytes):
3246
value[k] = value[k].decode("utf-8")
3247
if "key_id" not in value:
3248
value["key_id"] = ""
3249
elif "fingerprint" not in value:
3250
value["fingerprint"] = ""
3251
# old_client_settings
3253
old_client_settings = {
3254
(key.decode("utf-8")
3255
if isinstance(key, bytes)
3258
bytes_old_client_settings.items()}
3259
del bytes_old_client_settings
3261
for value in old_client_settings.values():
3262
if isinstance(value["host"], bytes):
3263
value["host"] = (value["host"]
2617
clients_data, old_client_settings = pickle.load(
3265
2619
os.remove(stored_state_path)
3266
2620
except IOError as e:
3267
2621
if e.errno == errno.ENOENT:
3345
2699
for client_name in (set(client_settings)
3346
2700
- set(old_client_settings)):
3347
2701
clients_data[client_name] = client_settings[client_name]
3349
2703
# Create all client objects
3350
2704
for client_name, client in clients_data.items():
3351
2705
tcp_server.clients[client_name] = client_class(
3354
server_settings=server_settings)
2708
server_settings = server_settings)
3356
2710
if not tcp_server.clients:
3357
2711
logger.warning("No clients defined")
3359
2713
if not foreground:
3360
2714
if pidfile is not None:
3364
print(pid, file=pidfile)
2718
pidfile.write("{}\n".format(pid).encode("utf-8"))
3365
2719
except IOError:
3366
2720
logger.error("Could not write to file %r with PID %d",
3367
2721
pidfilename, pid)
3369
2723
del pidfilename
3371
for termsig in (signal.SIGHUP, signal.SIGTERM):
3372
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3373
lambda: main_loop.quit() and False)
2725
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2726
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3377
2730
@alternate_dbus_interfaces(
3378
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3379
class MandosDBusService(DBusObjectWithObjectManager):
2731
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2732
class MandosDBusService(DBusObjectWithProperties):
3380
2733
"""A D-Bus proxy object"""
3382
2735
def __init__(self):
3383
2736
dbus.service.Object.__init__(self, bus, "/")
3385
2738
_interface = "se.recompile.Mandos"
2740
@dbus_interface_annotations(_interface)
2743
"org.freedesktop.DBus.Property.EmitsChangedSignal":
3387
2746
@dbus.service.signal(_interface, signature="o")
3388
2747
def ClientAdded(self, objpath):
3392
2751
@dbus.service.signal(_interface, signature="ss")
3393
def ClientNotFound(self, key_id, address):
2752
def ClientNotFound(self, fingerprint, address):
3397
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3399
2756
@dbus.service.signal(_interface, signature="os")
3400
2757
def ClientRemoved(self, objpath, name):
3404
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3406
2761
@dbus.service.method(_interface, out_signature="ao")
3407
2762
def GetAllClients(self):
3409
2764
return dbus.Array(c.dbus_object_path for c in
3410
tcp_server.clients.values())
3412
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2765
tcp_server.clients.itervalues())
3414
2767
@dbus.service.method(_interface,
3415
2768
out_signature="a{oa{sv}}")
3416
2769
def GetAllClientsWithProperties(self):
3418
2771
return dbus.Dictionary(
3419
{c.dbus_object_path: c.GetAll(
3420
"se.recompile.Mandos.Client")
3421
for c in tcp_server.clients.values()},
2772
{ c.dbus_object_path: c.GetAll("")
2773
for c in tcp_server.clients.itervalues() },
3422
2774
signature="oa{sv}")
3424
2776
@dbus.service.method(_interface, in_signature="o")
3425
2777
def RemoveClient(self, object_path):
3427
for c in tcp_server.clients.values():
2779
for c in tcp_server.clients.itervalues():
3428
2780
if c.dbus_object_path == object_path:
3429
2781
del tcp_server.clients[c.name]
3430
2782
c.remove_from_connection()
3431
# Don't signal the disabling
2783
# Don't signal anything except ClientRemoved
3432
2784
c.disable(quiet=True)
3433
# Emit D-Bus signal for removal
3434
self.client_removed_signal(c)
2786
self.ClientRemoved(object_path, c.name)
3436
2788
raise KeyError(object_path)
3440
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3441
out_signature="a{oa{sa{sv}}}")
3442
def GetManagedObjects(self):
3444
return dbus.Dictionary(
3445
{client.dbus_object_path:
3447
{interface: client.GetAll(interface)
3449
client._get_all_interface_names()})
3450
for client in tcp_server.clients.values()})
3452
def client_added_signal(self, client):
3453
"""Send the new standard signal and the old signal"""
3455
# New standard signal
3456
self.InterfacesAdded(
3457
client.dbus_object_path,
3459
{interface: client.GetAll(interface)
3461
client._get_all_interface_names()}))
3463
self.ClientAdded(client.dbus_object_path)
3465
def client_removed_signal(self, client):
3466
"""Send the new standard signal and the old signal"""
3468
# New standard signal
3469
self.InterfacesRemoved(
3470
client.dbus_object_path,
3471
client._get_all_interface_names())
3473
self.ClientRemoved(client.dbus_object_path,
3476
2792
mandos_dbus_service = MandosDBusService()
3478
# Save modules to variables to exempt the modules from being
3479
# unloaded before the function registered with atexit() is run.
3480
mp = multiprocessing
3484
2795
"Cleanup function; run on exit"
3486
2797
service.cleanup()
3488
mp.active_children()
2799
multiprocessing.active_children()
3490
2801
if not (tcp_server.clients or client_settings):
3493
2804
# Store client before exiting. Secrets are encrypted with key
3494
2805
# based on what config file has. If config file is
3495
2806
# removed/edited, old secret will thus be unrecovable.
3497
2808
with PGPEngine() as pgp:
3498
for client in tcp_server.clients.values():
2809
for client in tcp_server.clients.itervalues():
3499
2810
key = client_settings[client.name]["secret"]
3500
2811
client.encrypted_secret = pgp.encrypt(client.secret,
3502
2813
client_dict = {}
3504
2815
# A list of attributes that can not be pickled
3506
exclude = {"bus", "changedstate", "secret",
3507
"checker", "server_settings"}
2817
exclude = { "bus", "changedstate", "secret",
2818
"checker", "server_settings" }
3508
2819
for name, typ in inspect.getmembers(dbus.service
3510
2821
exclude.add(name)
3512
2823
client_dict["encrypted_secret"] = (client
3513
2824
.encrypted_secret)
3514
2825
for attr in client.client_structure:
3515
2826
if attr not in exclude:
3516
2827
client_dict[attr] = getattr(client, attr)
3518
2829
clients[client.name] = client_dict
3519
2830
del client_settings[client.name]["secret"]
3522
2833
with tempfile.NamedTemporaryFile(