2
2
# -*- mode: python; coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
# Copyright © 2008-2017 Teddy Hogeborn
15
# Copyright © 2008-2017 Björn Påhlsson
17
# This file is part of Mandos.
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
32
31
# Contact the authors at <mandos@recompile.se>.
35
34
from __future__ import (division, absolute_import, print_function,
39
from future_builtins import *
37
from future_builtins import *
44
40
import SocketServer as socketserver
236
195
.replace(b"\n", b"\\n")
237
196
.replace(b"\0", b"\\x00"))
240
199
def encrypt(self, data, password):
241
200
passphrase = self.password_encode(password)
242
201
with tempfile.NamedTemporaryFile(
243
202
dir=self.tempdir) as passfile:
244
203
passfile.write(passphrase)
246
proc = subprocess.Popen([self.gpg, '--symmetric',
205
proc = subprocess.Popen(['gpg', '--symmetric',
247
206
'--passphrase-file',
249
208
+ self.gnupgargs,
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
209
stdin = subprocess.PIPE,
210
stdout = subprocess.PIPE,
211
stderr = subprocess.PIPE)
212
ciphertext, err = proc.communicate(input = data)
254
213
if proc.returncode != 0:
255
214
raise PGPError(err)
256
215
return ciphertext
258
217
def decrypt(self, data, password):
259
218
passphrase = self.password_encode(password)
260
219
with tempfile.NamedTemporaryFile(
261
dir=self.tempdir) as passfile:
220
dir = self.tempdir) as passfile:
262
221
passfile.write(passphrase)
264
proc = subprocess.Popen([self.gpg, '--decrypt',
223
proc = subprocess.Popen(['gpg', '--decrypt',
265
224
'--passphrase-file',
267
226
+ self.gnupgargs,
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
227
stdin = subprocess.PIPE,
228
stdout = subprocess.PIPE,
229
stderr = subprocess.PIPE)
230
decrypted_plaintext, err = proc.communicate(input = data)
272
231
if proc.returncode != 0:
273
232
raise PGPError(err)
274
233
return decrypted_plaintext
277
# Pretend that we have an Avahi module
279
"""This isn't so much a class as it is a module-like namespace.
280
It is instantiated once, and simulates having an Avahi module."""
281
IF_UNSPEC = -1 # avahi-common/address.h
282
PROTO_UNSPEC = -1 # avahi-common/address.h
283
PROTO_INET = 0 # avahi-common/address.h
284
PROTO_INET6 = 1 # avahi-common/address.h
285
DBUS_NAME = "org.freedesktop.Avahi"
286
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
287
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
288
DBUS_PATH_SERVER = "/"
290
def string_array_to_txt_array(self, t):
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
304
236
class AvahiError(Exception):
305
237
def __init__(self, value, *args, **kwargs):
306
238
self.value = value
496
417
class AvahiServiceToSyslog(AvahiService):
497
418
def rename(self, *args, **kwargs):
498
419
"""Add the new name to the syslog messages"""
499
ret = super(AvahiServiceToSyslog, self).rename(self, *args,
420
ret = AvahiService.rename(self, *args, **kwargs)
501
421
syslogger.setFormatter(logging.Formatter(
502
422
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
503
423
.format(self.name)))
507
# Pretend that we have a GnuTLS module
508
class GnuTLS(object):
509
"""This isn't so much a class as it is a module-like namespace.
510
It is instantiated once, and simulates having a GnuTLS module."""
512
library = ctypes.util.find_library("gnutls")
514
library = ctypes.util.find_library("gnutls-deb0")
515
_library = ctypes.cdll.LoadLibrary(library)
517
_need_version = b"3.3.0"
520
# Need to use "self" here, since this method is called before
521
# the assignment to the "gnutls" global variable happens.
522
if self.check_version(self._need_version) is None:
523
raise self.Error("Needs GnuTLS {} or later"
524
.format(self._need_version))
526
# Unless otherwise indicated, the constants and types below are
527
# all from the gnutls/gnutls.h C header file.
537
E_NO_CERTIFICATE_FOUND = -49
538
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
541
class session_int(ctypes.Structure):
543
session_t = ctypes.POINTER(session_int)
545
class certificate_credentials_st(ctypes.Structure):
547
certificate_credentials_t = ctypes.POINTER(
548
certificate_credentials_st)
549
certificate_type_t = ctypes.c_int
551
class datum_t(ctypes.Structure):
552
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
553
('size', ctypes.c_uint)]
555
class openpgp_crt_int(ctypes.Structure):
557
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
558
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
559
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
560
credentials_type_t = ctypes.c_int
561
transport_ptr_t = ctypes.c_void_p
562
close_request_t = ctypes.c_int
565
class Error(Exception):
566
# We need to use the class name "GnuTLS" here, since this
567
# exception might be raised from within GnuTLS.__init__,
568
# which is called before the assignment to the "gnutls"
569
# global variable has happened.
570
def __init__(self, message=None, code=None, args=()):
571
# Default usage is by a message string, but if a return
572
# code is passed, convert it to a string with
575
if message is None and code is not None:
576
message = GnuTLS.strerror(code)
577
return super(GnuTLS.Error, self).__init__(
580
class CertificateSecurityError(Error):
584
class Credentials(object):
586
self._c_object = gnutls.certificate_credentials_t()
587
gnutls.certificate_allocate_credentials(
588
ctypes.byref(self._c_object))
589
self.type = gnutls.CRD_CERTIFICATE
592
gnutls.certificate_free_credentials(self._c_object)
594
class ClientSession(object):
595
def __init__(self, socket, credentials=None):
596
self._c_object = gnutls.session_t()
597
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
598
gnutls.set_default_priority(self._c_object)
599
gnutls.transport_set_ptr(self._c_object, socket.fileno())
600
gnutls.handshake_set_private_extensions(self._c_object,
603
if credentials is None:
604
credentials = gnutls.Credentials()
605
gnutls.credentials_set(self._c_object, credentials.type,
606
ctypes.cast(credentials._c_object,
608
self.credentials = credentials
611
gnutls.deinit(self._c_object)
614
return gnutls.handshake(self._c_object)
616
def send(self, data):
620
data_len -= gnutls.record_send(self._c_object,
625
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
627
# Error handling functions
628
def _error_code(result):
629
"""A function to raise exceptions on errors, suitable
630
for the 'restype' attribute on ctypes functions"""
633
if result == gnutls.E_NO_CERTIFICATE_FOUND:
634
raise gnutls.CertificateSecurityError(code=result)
635
raise gnutls.Error(code=result)
637
def _retry_on_error(result, func, arguments):
638
"""A function to retry on some errors, suitable
639
for the 'errcheck' attribute on ctypes functions"""
641
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
642
return _error_code(result)
643
result = func(*arguments)
646
# Unless otherwise indicated, the function declarations below are
647
# all from the gnutls/gnutls.h C header file.
650
priority_set_direct = _library.gnutls_priority_set_direct
651
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
652
ctypes.POINTER(ctypes.c_char_p)]
653
priority_set_direct.restype = _error_code
655
init = _library.gnutls_init
656
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
657
init.restype = _error_code
659
set_default_priority = _library.gnutls_set_default_priority
660
set_default_priority.argtypes = [session_t]
661
set_default_priority.restype = _error_code
663
record_send = _library.gnutls_record_send
664
record_send.argtypes = [session_t, ctypes.c_void_p,
666
record_send.restype = ctypes.c_ssize_t
667
record_send.errcheck = _retry_on_error
669
certificate_allocate_credentials = (
670
_library.gnutls_certificate_allocate_credentials)
671
certificate_allocate_credentials.argtypes = [
672
ctypes.POINTER(certificate_credentials_t)]
673
certificate_allocate_credentials.restype = _error_code
675
certificate_free_credentials = (
676
_library.gnutls_certificate_free_credentials)
677
certificate_free_credentials.argtypes = [
678
certificate_credentials_t]
679
certificate_free_credentials.restype = None
681
handshake_set_private_extensions = (
682
_library.gnutls_handshake_set_private_extensions)
683
handshake_set_private_extensions.argtypes = [session_t,
685
handshake_set_private_extensions.restype = None
687
credentials_set = _library.gnutls_credentials_set
688
credentials_set.argtypes = [session_t, credentials_type_t,
690
credentials_set.restype = _error_code
692
strerror = _library.gnutls_strerror
693
strerror.argtypes = [ctypes.c_int]
694
strerror.restype = ctypes.c_char_p
696
certificate_type_get = _library.gnutls_certificate_type_get
697
certificate_type_get.argtypes = [session_t]
698
certificate_type_get.restype = _error_code
700
certificate_get_peers = _library.gnutls_certificate_get_peers
701
certificate_get_peers.argtypes = [session_t,
702
ctypes.POINTER(ctypes.c_uint)]
703
certificate_get_peers.restype = ctypes.POINTER(datum_t)
705
global_set_log_level = _library.gnutls_global_set_log_level
706
global_set_log_level.argtypes = [ctypes.c_int]
707
global_set_log_level.restype = None
709
global_set_log_function = _library.gnutls_global_set_log_function
710
global_set_log_function.argtypes = [log_func]
711
global_set_log_function.restype = None
713
deinit = _library.gnutls_deinit
714
deinit.argtypes = [session_t]
715
deinit.restype = None
717
handshake = _library.gnutls_handshake
718
handshake.argtypes = [session_t]
719
handshake.restype = _error_code
720
handshake.errcheck = _retry_on_error
722
transport_set_ptr = _library.gnutls_transport_set_ptr
723
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
724
transport_set_ptr.restype = None
726
bye = _library.gnutls_bye
727
bye.argtypes = [session_t, close_request_t]
728
bye.restype = _error_code
729
bye.errcheck = _retry_on_error
731
check_version = _library.gnutls_check_version
732
check_version.argtypes = [ctypes.c_char_p]
733
check_version.restype = ctypes.c_char_p
735
# All the function declarations below are from gnutls/openpgp.h
737
openpgp_crt_init = _library.gnutls_openpgp_crt_init
738
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
739
openpgp_crt_init.restype = _error_code
741
openpgp_crt_import = _library.gnutls_openpgp_crt_import
742
openpgp_crt_import.argtypes = [openpgp_crt_t,
743
ctypes.POINTER(datum_t),
745
openpgp_crt_import.restype = _error_code
747
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
748
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
749
ctypes.POINTER(ctypes.c_uint)]
750
openpgp_crt_verify_self.restype = _error_code
752
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
753
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
754
openpgp_crt_deinit.restype = None
756
openpgp_crt_get_fingerprint = (
757
_library.gnutls_openpgp_crt_get_fingerprint)
758
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
762
openpgp_crt_get_fingerprint.restype = _error_code
764
# Remove non-public functions
765
del _error_code, _retry_on_error
766
# Create the global "gnutls" object, simulating a module
770
def call_pipe(connection, # : multiprocessing.Connection
771
func, *args, **kwargs):
772
"""This function is meant to be called by multiprocessing.Process
774
This function runs func(*args, **kwargs), and writes the resulting
775
return value on the provided multiprocessing.Connection.
777
connection.send(func(*args, **kwargs))
781
427
class Client(object):
782
428
"""A representation of a client host served by this server.
785
431
approved: bool(); 'None' if not yet approved/disapproved
786
432
approval_delay: datetime.timedelta(); Time to wait for approval
961
603
logger.info("Disabling client %s", self.name)
962
604
if getattr(self, "disable_initiator_tag", None) is not None:
963
GLib.source_remove(self.disable_initiator_tag)
605
gobject.source_remove(self.disable_initiator_tag)
964
606
self.disable_initiator_tag = None
965
607
self.expires = None
966
608
if getattr(self, "checker_initiator_tag", None) is not None:
967
GLib.source_remove(self.checker_initiator_tag)
609
gobject.source_remove(self.checker_initiator_tag)
968
610
self.checker_initiator_tag = None
969
611
self.stop_checker()
970
612
self.enabled = False
972
614
self.send_changedstate()
973
# Do not run this again if called by a GLib.timeout_add
615
# Do not run this again if called by a gobject.timeout_add
976
618
def __del__(self):
979
621
def init_checker(self):
980
622
# Schedule a new checker to be started an 'interval' from now,
981
623
# and every interval from then on.
982
624
if self.checker_initiator_tag is not None:
983
GLib.source_remove(self.checker_initiator_tag)
984
self.checker_initiator_tag = GLib.timeout_add(
625
gobject.source_remove(self.checker_initiator_tag)
626
self.checker_initiator_tag = gobject.timeout_add(
985
627
int(self.interval.total_seconds() * 1000),
986
628
self.start_checker)
987
629
# Schedule a disable() when 'timeout' has passed
988
630
if self.disable_initiator_tag is not None:
989
GLib.source_remove(self.disable_initiator_tag)
990
self.disable_initiator_tag = GLib.timeout_add(
631
gobject.source_remove(self.disable_initiator_tag)
632
self.disable_initiator_tag = gobject.timeout_add(
991
633
int(self.timeout.total_seconds() * 1000), self.disable)
992
634
# Also start a new checker *right now*.
993
635
self.start_checker()
995
def checker_callback(self, source, condition, connection,
637
def checker_callback(self, pid, condition, command):
997
638
"""The checker has completed, so take appropriate actions."""
998
639
self.checker_callback_tag = None
999
640
self.checker = None
1000
# Read return code from connection (see call_pipe)
1001
returncode = connection.recv()
1005
self.last_checker_status = returncode
1006
self.last_checker_signal = None
641
if os.WIFEXITED(condition):
642
self.last_checker_status = os.WEXITSTATUS(condition)
1007
643
if self.last_checker_status == 0:
1008
644
logger.info("Checker for %(name)s succeeded",
1072
715
return True # Try again later
1073
716
self.current_checker_command = command
1074
logger.info("Starting checker %r for %s", command,
1076
# We don't need to redirect stdout and stderr, since
1077
# in normal mode, that is already done by daemon(),
1078
# and in debug mode we don't want to. (Stdin is
1079
# always replaced by /dev/null.)
1080
# The exception is when not debugging but nevertheless
1081
# running in the foreground; use the previously
1083
popen_args = {"close_fds": True,
1086
if (not self.server_settings["debug"]
1087
and self.server_settings["foreground"]):
1088
popen_args.update({"stdout": wnull,
1090
pipe = multiprocessing.Pipe(duplex=False)
1091
self.checker = multiprocessing.Process(
1093
args=(pipe[1], subprocess.call, command),
1095
self.checker.start()
1096
self.checker_callback_tag = GLib.io_add_watch(
1097
pipe[0].fileno(), GLib.IO_IN,
1098
self.checker_callback, pipe[0], command)
1099
# Re-run this periodically if run by GLib.timeout_add
718
logger.info("Starting checker %r for %s", command,
720
# We don't need to redirect stdout and stderr, since
721
# in normal mode, that is already done by daemon(),
722
# and in debug mode we don't want to. (Stdin is
723
# always replaced by /dev/null.)
724
# The exception is when not debugging but nevertheless
725
# running in the foreground; use the previously
728
if (not self.server_settings["debug"]
729
and self.server_settings["foreground"]):
730
popen_args.update({"stdout": wnull,
732
self.checker = subprocess.Popen(command,
737
except OSError as error:
738
logger.error("Failed to start subprocess",
741
self.checker_callback_tag = gobject.child_watch_add(
742
self.checker.pid, self.checker_callback, data=command)
743
# The checker may have completed before the gobject
744
# watch was added. Check for this.
746
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
747
except OSError as error:
748
if error.errno == errno.ECHILD:
749
# This should never happen
750
logger.error("Child process vanished",
755
gobject.source_remove(self.checker_callback_tag)
756
self.checker_callback(pid, status, command)
757
# Re-run this periodically if run by gobject.timeout_add
1102
760
def stop_checker(self):
1103
761
"""Force the checker process, if any, to stop."""
1104
762
if self.checker_callback_tag:
1105
GLib.source_remove(self.checker_callback_tag)
763
gobject.source_remove(self.checker_callback_tag)
1106
764
self.checker_callback_tag = None
1107
765
if getattr(self, "checker", None) is None:
1109
767
logger.debug("Stopping checker for %(name)s", vars(self))
1110
self.checker.terminate()
769
self.checker.terminate()
771
#if self.checker.poll() is None:
772
# self.checker.kill()
773
except OSError as error:
774
if error.errno != errno.ESRCH: # No such process
1111
776
self.checker = None
1231
895
for cls in self.__class__.__mro__
1232
896
for name, athing in
1233
897
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1235
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1237
path_keyword='object_path',
1238
connection_keyword='connection')
1239
def Introspect(self, object_path, connection):
1240
"""Overloading of standard D-Bus method.
1242
Inserts annotation tags on methods and signals.
1244
xmlstring = dbus.service.Object.Introspect(self, object_path,
1247
document = xml.dom.minidom.parseString(xmlstring)
1249
for if_tag in document.getElementsByTagName("interface"):
1250
# Add annotation tags
1251
for typ in ("method", "signal"):
1252
for tag in if_tag.getElementsByTagName(typ):
1254
for name, prop in (self.
1255
_get_all_dbus_things(typ)):
1256
if (name == tag.getAttribute("name")
1257
and prop._dbus_interface
1258
== if_tag.getAttribute("name")):
1259
annots.update(getattr(
1260
prop, "_dbus_annotations", {}))
1261
for name, value in annots.items():
1262
ann_tag = document.createElement(
1264
ann_tag.setAttribute("name", name)
1265
ann_tag.setAttribute("value", value)
1266
tag.appendChild(ann_tag)
1267
# Add interface annotation tags
1268
for annotation, value in dict(
1269
itertools.chain.from_iterable(
1270
annotations().items()
1271
for name, annotations
1272
in self._get_all_dbus_things("interface")
1273
if name == if_tag.getAttribute("name")
1275
ann_tag = document.createElement("annotation")
1276
ann_tag.setAttribute("name", annotation)
1277
ann_tag.setAttribute("value", value)
1278
if_tag.appendChild(ann_tag)
1279
# Fix argument name for the Introspect method itself
1280
if (if_tag.getAttribute("name")
1281
== dbus.INTROSPECTABLE_IFACE):
1282
for cn in if_tag.getElementsByTagName("method"):
1283
if cn.getAttribute("name") == "Introspect":
1284
for arg in cn.getElementsByTagName("arg"):
1285
if (arg.getAttribute("direction")
1287
arg.setAttribute("name",
1289
xmlstring = document.toxml("utf-8")
1291
except (AttributeError, xml.dom.DOMException,
1292
xml.parsers.expat.ExpatError) as error:
1293
logger.error("Failed to override Introspection method",
1298
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1299
"""A D-Bus object with properties.
1301
Classes inheriting from this can use the dbus_service_property
1302
decorator to expose methods as D-Bus properties. It exposes the
1303
standard Get(), Set(), and GetAll() methods on the D-Bus.
1306
899
def _get_dbus_property(self, interface_name, property_name):
1307
900
"""Returns a bound method if one exists which is a D-Bus
1308
901
property with the specified name and interface.
1423
1006
if prop._dbus_interface
1424
1007
== if_tag.getAttribute("name")):
1425
1008
if_tag.appendChild(tag)
1426
# Add annotation tags for properties
1427
for tag in if_tag.getElementsByTagName("property"):
1429
for name, prop in self._get_all_dbus_things(
1431
if (name == tag.getAttribute("name")
1432
and prop._dbus_interface
1433
== if_tag.getAttribute("name")):
1434
annots.update(getattr(
1435
prop, "_dbus_annotations", {}))
1436
for name, value in annots.items():
1437
ann_tag = document.createElement(
1439
ann_tag.setAttribute("name", name)
1440
ann_tag.setAttribute("value", value)
1441
tag.appendChild(ann_tag)
1009
# Add annotation tags
1010
for typ in ("method", "signal", "property"):
1011
for tag in if_tag.getElementsByTagName(typ):
1013
for name, prop in (self.
1014
_get_all_dbus_things(typ)):
1015
if (name == tag.getAttribute("name")
1016
and prop._dbus_interface
1017
== if_tag.getAttribute("name")):
1018
annots.update(getattr(
1019
prop, "_dbus_annotations", {}))
1020
for name, value in annots.items():
1021
ann_tag = document.createElement(
1023
ann_tag.setAttribute("name", name)
1024
ann_tag.setAttribute("value", value)
1025
tag.appendChild(ann_tag)
1026
# Add interface annotation tags
1027
for annotation, value in dict(
1028
itertools.chain.from_iterable(
1029
annotations().items()
1030
for name, annotations
1031
in self._get_all_dbus_things("interface")
1032
if name == if_tag.getAttribute("name")
1034
ann_tag = document.createElement("annotation")
1035
ann_tag.setAttribute("name", annotation)
1036
ann_tag.setAttribute("value", value)
1037
if_tag.appendChild(ann_tag)
1442
1038
# Add the names to the return values for the
1443
1039
# "org.freedesktop.DBus.Properties" methods
1444
1040
if (if_tag.getAttribute("name")
1463
1059
return xmlstring
1467
dbus.OBJECT_MANAGER_IFACE
1468
except AttributeError:
1469
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1472
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1473
"""A D-Bus object with an ObjectManager.
1475
Classes inheriting from this exposes the standard
1476
GetManagedObjects call and the InterfacesAdded and
1477
InterfacesRemoved signals on the standard
1478
"org.freedesktop.DBus.ObjectManager" interface.
1480
Note: No signals are sent automatically; they must be sent
1483
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1484
out_signature="a{oa{sa{sv}}}")
1485
def GetManagedObjects(self):
1486
"""This function must be overridden"""
1487
raise NotImplementedError()
1489
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1490
signature="oa{sa{sv}}")
1491
def InterfacesAdded(self, object_path, interfaces_and_properties):
1494
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1495
def InterfacesRemoved(self, object_path, interfaces):
1498
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1500
path_keyword='object_path',
1501
connection_keyword='connection')
1502
def Introspect(self, object_path, connection):
1503
"""Overloading of standard D-Bus method.
1505
Override return argument name of GetManagedObjects to be
1506
"objpath_interfaces_and_properties"
1508
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1512
document = xml.dom.minidom.parseString(xmlstring)
1514
for if_tag in document.getElementsByTagName("interface"):
1515
# Fix argument name for the GetManagedObjects method
1516
if (if_tag.getAttribute("name")
1517
== dbus.OBJECT_MANAGER_IFACE):
1518
for cn in if_tag.getElementsByTagName("method"):
1519
if (cn.getAttribute("name")
1520
== "GetManagedObjects"):
1521
for arg in cn.getElementsByTagName("arg"):
1522
if (arg.getAttribute("direction")
1526
"objpath_interfaces"
1528
xmlstring = document.toxml("utf-8")
1530
except (AttributeError, xml.dom.DOMException,
1531
xml.parsers.expat.ExpatError) as error:
1532
logger.error("Failed to override Introspection method",
1537
1062
def datetime_to_dbus(dt, variant_level=0):
1538
1063
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1540
return dbus.String("", variant_level=variant_level)
1065
return dbus.String("", variant_level = variant_level)
1541
1066
return dbus.String(dt.isoformat(), variant_level=variant_level)
2191
1697
class ClientHandler(socketserver.BaseRequestHandler, object):
2192
1698
"""A class to handle client connections.
2194
1700
Instantiated once for each connection to handle it.
2195
1701
Note: This will run in its own forked process."""
2197
1703
def handle(self):
2198
1704
with contextlib.closing(self.server.child_pipe) as child_pipe:
2199
1705
logger.info("TCP connection from: %s",
2200
1706
str(self.client_address))
2201
1707
logger.debug("Pipe FD: %d",
2202
1708
self.server.child_pipe.fileno())
2204
session = gnutls.ClientSession(self.request)
2206
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2207
# "+AES-256-CBC", "+SHA1",
2208
# "+COMP-NULL", "+CTYPE-OPENPGP",
1710
session = gnutls.connection.ClientSession(
1711
self.request, gnutls.connection .X509Credentials())
1713
# Note: gnutls.connection.X509Credentials is really a
1714
# generic GnuTLS certificate credentials object so long as
1715
# no X.509 keys are added to it. Therefore, we can use it
1716
# here despite using OpenPGP certificates.
1718
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1719
# "+AES-256-CBC", "+SHA1",
1720
# "+COMP-NULL", "+CTYPE-OPENPGP",
2210
1722
# Use a fallback default, since this MUST be set.
2211
1723
priority = self.server.gnutls_priority
2212
1724
if priority is None:
2213
1725
priority = "NORMAL"
2214
gnutls.priority_set_direct(session._c_object,
2215
priority.encode("utf-8"),
1726
gnutls.library.functions.gnutls_priority_set_direct(
1727
session._c_object, priority, None)
2218
1729
# Start communication using the Mandos protocol
2219
1730
# Get protocol number
2220
1731
line = self.request.makefile().readline()
2306
1818
delay -= time2 - time
2309
session.send(client.secret)
2310
except gnutls.Error as error:
2311
logger.warning("gnutls send failed",
1821
while sent_size < len(client.secret):
1823
sent = session.send(client.secret[sent_size:])
1824
except gnutls.errors.GNUTLSError as error:
1825
logger.warning("gnutls send failed",
1828
logger.debug("Sent: %d, remaining: %d", sent,
1829
len(client.secret) - (sent_size
2315
1833
logger.info("Sending secret to %s", client.name)
2316
1834
# bump the timeout using extended_timeout
2317
1835
client.bump_timeout(client.extended_timeout)
2318
1836
if self.server.use_dbus:
2319
1837
# Emit D-Bus signal
2320
1838
client.GotSecret()
2323
1841
if approval_required:
2324
1842
client.approvals_pending -= 1
2327
except gnutls.Error as error:
1845
except gnutls.errors.GNUTLSError as error:
2328
1846
logger.warning("GnuTLS bye failed",
2329
1847
exc_info=error)
2332
1850
def peer_certificate(session):
2333
1851
"Return the peer's OpenPGP certificate as a bytestring"
2334
1852
# If not an OpenPGP certificate...
2335
if (gnutls.certificate_type_get(session._c_object)
2336
!= gnutls.CRT_OPENPGP):
2337
# ...return invalid data
1853
if (gnutls.library.functions.gnutls_certificate_type_get(
1855
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1856
# ...do the normal thing
1857
return session.peer_certificate
2339
1858
list_size = ctypes.c_uint(1)
2340
cert_list = (gnutls.certificate_get_peers
1859
cert_list = (gnutls.library.functions
1860
.gnutls_certificate_get_peers
2341
1861
(session._c_object, ctypes.byref(list_size)))
2342
1862
if not bool(cert_list) and list_size.value != 0:
2343
raise gnutls.Error("error getting peer certificate")
1863
raise gnutls.errors.GNUTLSError("error getting peer"
2344
1865
if list_size.value == 0:
2346
1867
cert = cert_list[0]
2347
1868
return ctypes.string_at(cert.data, cert.size)
2350
1871
def fingerprint(openpgp):
2351
1872
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2352
1873
# New GnuTLS "datum" with the OpenPGP public key
2353
datum = gnutls.datum_t(
1874
datum = gnutls.library.types.gnutls_datum_t(
2354
1875
ctypes.cast(ctypes.c_char_p(openpgp),
2355
1876
ctypes.POINTER(ctypes.c_ubyte)),
2356
1877
ctypes.c_uint(len(openpgp)))
2357
1878
# New empty GnuTLS certificate
2358
crt = gnutls.openpgp_crt_t()
2359
gnutls.openpgp_crt_init(ctypes.byref(crt))
1879
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1880
gnutls.library.functions.gnutls_openpgp_crt_init(
2360
1882
# Import the OpenPGP public key into the certificate
2361
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2362
gnutls.OPENPGP_FMT_RAW)
1883
gnutls.library.functions.gnutls_openpgp_crt_import(
1884
crt, ctypes.byref(datum),
1885
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2363
1886
# Verify the self signature in the key
2364
1887
crtverify = ctypes.c_uint()
2365
gnutls.openpgp_crt_verify_self(crt, 0,
2366
ctypes.byref(crtverify))
1888
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1889
crt, 0, ctypes.byref(crtverify))
2367
1890
if crtverify.value != 0:
2368
gnutls.openpgp_crt_deinit(crt)
2369
raise gnutls.CertificateSecurityError("Verify failed")
1891
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1892
raise gnutls.errors.CertificateSecurityError(
2370
1894
# New buffer for the fingerprint
2371
1895
buf = ctypes.create_string_buffer(20)
2372
1896
buf_len = ctypes.c_size_t()
2373
1897
# Get the fingerprint from the certificate into the buffer
2374
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2375
ctypes.byref(buf_len))
1898
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1899
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2376
1900
# Deinit the certificate
2377
gnutls.openpgp_crt_deinit(crt)
1901
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2378
1902
# Convert the buffer to a Python bytestring
2379
1903
fpr = ctypes.string_at(buf, buf_len.value)
2380
1904
# Convert the bytestring to hexadecimal notation
2469
1992
# socket_wrapper(), if socketfd was set.
2470
1993
socketserver.TCPServer.__init__(self, server_address,
2471
1994
RequestHandlerClass)
2473
1996
def server_bind(self):
2474
1997
"""This overrides the normal server_bind() function
2475
1998
to bind to an interface if one was specified, and also NOT to
2476
1999
bind to an address or port if they were not specified."""
2477
global SO_BINDTODEVICE
2478
2000
if self.interface is not None:
2479
2001
if SO_BINDTODEVICE is None:
2480
# Fall back to a hard-coded value which seems to be
2482
logger.warning("SO_BINDTODEVICE not found, trying 25")
2483
SO_BINDTODEVICE = 25
2485
self.socket.setsockopt(
2486
socket.SOL_SOCKET, SO_BINDTODEVICE,
2487
(self.interface + "\0").encode("utf-8"))
2488
except socket.error as error:
2489
if error.errno == errno.EPERM:
2490
logger.error("No permission to bind to"
2491
" interface %s", self.interface)
2492
elif error.errno == errno.ENOPROTOOPT:
2493
logger.error("SO_BINDTODEVICE not available;"
2494
" cannot bind to interface %s",
2496
elif error.errno == errno.ENODEV:
2497
logger.error("Interface %s does not exist,"
2498
" cannot bind", self.interface)
2002
logger.error("SO_BINDTODEVICE does not exist;"
2003
" cannot bind to interface %s",
2007
self.socket.setsockopt(
2008
socket.SOL_SOCKET, SO_BINDTODEVICE,
2009
(self.interface + "\0").encode("utf-8"))
2010
except socket.error as error:
2011
if error.errno == errno.EPERM:
2012
logger.error("No permission to bind to"
2013
" interface %s", self.interface)
2014
elif error.errno == errno.ENOPROTOOPT:
2015
logger.error("SO_BINDTODEVICE not available;"
2016
" cannot bind to interface %s",
2018
elif error.errno == errno.ENODEV:
2019
logger.error("Interface %s does not exist,"
2020
" cannot bind", self.interface)
2501
2023
# Only bind(2) the socket if we really need to.
2502
2024
if self.server_address[0] or self.server_address[1]:
2503
2025
if not self.server_address[0]:
2504
2026
if self.address_family == socket.AF_INET6:
2505
any_address = "::" # in6addr_any
2027
any_address = "::" # in6addr_any
2507
any_address = "0.0.0.0" # INADDR_ANY
2029
any_address = "0.0.0.0" # INADDR_ANY
2508
2030
self.server_address = (any_address,
2509
2031
self.server_address[1])
2510
2032
elif not self.server_address[1]:
3065
2584
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3066
2585
service = AvahiServiceToSyslog(
3067
name=server_settings["servicename"],
3068
servicetype="_mandos._tcp",
2586
name = server_settings["servicename"],
2587
servicetype = "_mandos._tcp",
2588
protocol = protocol,
3071
2590
if server_settings["interface"]:
3072
2591
service.interface = if_nametoindex(
3073
2592
server_settings["interface"].encode("utf-8"))
3075
2594
global multiprocessing_manager
3076
2595
multiprocessing_manager = multiprocessing.Manager()
3078
2597
client_class = Client
3080
client_class = functools.partial(ClientDBus, bus=bus)
2599
client_class = functools.partial(ClientDBus, bus = bus)
3082
2601
client_settings = Client.config_parser(client_config)
3083
2602
old_client_settings = {}
3084
2603
clients_data = {}
3086
2605
# This is used to redirect stdout and stderr for checker processes
3088
wnull = open(os.devnull, "w") # A writable /dev/null
2607
wnull = open(os.devnull, "w") # A writable /dev/null
3089
2608
# Only used if server is running in foreground but not in debug
3091
2610
if debug or not foreground:
3094
2613
# Get client data and settings from last running state.
3095
2614
if server_settings["restore"]:
3097
2616
with open(stored_state_path, "rb") as stored_state:
3098
if sys.version_info.major == 2:
3099
clients_data, old_client_settings = pickle.load(
3102
bytes_clients_data, bytes_old_client_settings = (
3103
pickle.load(stored_state, encoding="bytes"))
3104
# Fix bytes to strings
3107
clients_data = {(key.decode("utf-8")
3108
if isinstance(key, bytes)
3111
bytes_clients_data.items()}
3112
del bytes_clients_data
3113
for key in clients_data:
3114
value = {(k.decode("utf-8")
3115
if isinstance(k, bytes) else k): v
3117
clients_data[key].items()}
3118
clients_data[key] = value
3120
value["client_structure"] = [
3122
if isinstance(s, bytes)
3124
value["client_structure"]]
3126
for k in ("name", "host"):
3127
if isinstance(value[k], bytes):
3128
value[k] = value[k].decode("utf-8")
3129
# old_client_settings
3131
old_client_settings = {
3132
(key.decode("utf-8")
3133
if isinstance(key, bytes)
3136
bytes_old_client_settings.items()}
3137
del bytes_old_client_settings
3139
for value in old_client_settings.values():
3140
if isinstance(value["host"], bytes):
3141
value["host"] = (value["host"]
2617
clients_data, old_client_settings = pickle.load(
3143
2619
os.remove(stored_state_path)
3144
2620
except IOError as e:
3145
2621
if e.errno == errno.ENOENT:
3223
2699
for client_name in (set(client_settings)
3224
2700
- set(old_client_settings)):
3225
2701
clients_data[client_name] = client_settings[client_name]
3227
2703
# Create all client objects
3228
2704
for client_name, client in clients_data.items():
3229
2705
tcp_server.clients[client_name] = client_class(
3232
server_settings=server_settings)
2708
server_settings = server_settings)
3234
2710
if not tcp_server.clients:
3235
2711
logger.warning("No clients defined")
3237
2713
if not foreground:
3238
2714
if pidfile is not None:
3242
print(pid, file=pidfile)
2718
pidfile.write("{}\n".format(pid).encode("utf-8"))
3243
2719
except IOError:
3244
2720
logger.error("Could not write to file %r with PID %d",
3245
2721
pidfilename, pid)
3247
2723
del pidfilename
3249
for termsig in (signal.SIGHUP, signal.SIGTERM):
3250
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3251
lambda: main_loop.quit() and False)
2725
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2726
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3255
2730
@alternate_dbus_interfaces(
3256
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3257
class MandosDBusService(DBusObjectWithObjectManager):
2731
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2732
class MandosDBusService(DBusObjectWithProperties):
3258
2733
"""A D-Bus proxy object"""
3260
2735
def __init__(self):
3261
2736
dbus.service.Object.__init__(self, bus, "/")
3263
2738
_interface = "se.recompile.Mandos"
2740
@dbus_interface_annotations(_interface)
2743
"org.freedesktop.DBus.Property.EmitsChangedSignal":
3265
2746
@dbus.service.signal(_interface, signature="o")
3266
2747
def ClientAdded(self, objpath):
3270
2751
@dbus.service.signal(_interface, signature="ss")
3271
2752
def ClientNotFound(self, fingerprint, address):
3275
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3277
2756
@dbus.service.signal(_interface, signature="os")
3278
2757
def ClientRemoved(self, objpath, name):
3282
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3284
2761
@dbus.service.method(_interface, out_signature="ao")
3285
2762
def GetAllClients(self):
3287
2764
return dbus.Array(c.dbus_object_path for c in
3288
tcp_server.clients.values())
3290
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2765
tcp_server.clients.itervalues())
3292
2767
@dbus.service.method(_interface,
3293
2768
out_signature="a{oa{sv}}")
3294
2769
def GetAllClientsWithProperties(self):
3296
2771
return dbus.Dictionary(
3297
{c.dbus_object_path: c.GetAll(
3298
"se.recompile.Mandos.Client")
3299
for c in tcp_server.clients.values()},
2772
{ c.dbus_object_path: c.GetAll("")
2773
for c in tcp_server.clients.itervalues() },
3300
2774
signature="oa{sv}")
3302
2776
@dbus.service.method(_interface, in_signature="o")
3303
2777
def RemoveClient(self, object_path):
3305
for c in tcp_server.clients.values():
2779
for c in tcp_server.clients.itervalues():
3306
2780
if c.dbus_object_path == object_path:
3307
2781
del tcp_server.clients[c.name]
3308
2782
c.remove_from_connection()
3309
# Don't signal the disabling
2783
# Don't signal anything except ClientRemoved
3310
2784
c.disable(quiet=True)
3311
# Emit D-Bus signal for removal
3312
self.client_removed_signal(c)
2786
self.ClientRemoved(object_path, c.name)
3314
2788
raise KeyError(object_path)
3318
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3319
out_signature="a{oa{sa{sv}}}")
3320
def GetManagedObjects(self):
3322
return dbus.Dictionary(
3323
{client.dbus_object_path:
3325
{interface: client.GetAll(interface)
3327
client._get_all_interface_names()})
3328
for client in tcp_server.clients.values()})
3330
def client_added_signal(self, client):
3331
"""Send the new standard signal and the old signal"""
3333
# New standard signal
3334
self.InterfacesAdded(
3335
client.dbus_object_path,
3337
{interface: client.GetAll(interface)
3339
client._get_all_interface_names()}))
3341
self.ClientAdded(client.dbus_object_path)
3343
def client_removed_signal(self, client):
3344
"""Send the new standard signal and the old signal"""
3346
# New standard signal
3347
self.InterfacesRemoved(
3348
client.dbus_object_path,
3349
client._get_all_interface_names())
3351
self.ClientRemoved(client.dbus_object_path,
3354
2792
mandos_dbus_service = MandosDBusService()
3356
# Save modules to variables to exempt the modules from being
3357
# unloaded before the function registered with atexit() is run.
3358
mp = multiprocessing
3362
2795
"Cleanup function; run on exit"
3364
2797
service.cleanup()
3366
mp.active_children()
2799
multiprocessing.active_children()
3368
2801
if not (tcp_server.clients or client_settings):
3371
2804
# Store client before exiting. Secrets are encrypted with key
3372
2805
# based on what config file has. If config file is
3373
2806
# removed/edited, old secret will thus be unrecovable.
3375
2808
with PGPEngine() as pgp:
3376
for client in tcp_server.clients.values():
2809
for client in tcp_server.clients.itervalues():
3377
2810
key = client_settings[client.name]["secret"]
3378
2811
client.encrypted_secret = pgp.encrypt(client.secret,
3380
2813
client_dict = {}
3382
2815
# A list of attributes that can not be pickled
3384
exclude = {"bus", "changedstate", "secret",
3385
"checker", "server_settings"}
2817
exclude = { "bus", "changedstate", "secret",
2818
"checker", "server_settings" }
3386
2819
for name, typ in inspect.getmembers(dbus.service
3388
2821
exclude.add(name)
3390
2823
client_dict["encrypted_secret"] = (client
3391
2824
.encrypted_secret)
3392
2825
for attr in client.client_structure:
3393
2826
if attr not in exclude:
3394
2827
client_dict[attr] = getattr(client, attr)
3396
2829
clients[client.name] = client_dict
3397
2830
del client_settings[client.name]["secret"]
3400
2833
with tempfile.NamedTemporaryFile(