To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 789
- compare with another revision
- download diff
- download tarball
- view history from revision 789
- Committer: Teddy Hogeborn
- Date: 2015-10-04 13:44:03 UTC
- Revision ID: teddy@recompile.se-20151004134403-jn72bwgbw3aocllk
* initramfs-tools-hook: Don't try to chmod symlinks.
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
try:
38
from future_builtins import *
39
except ImportError:
40
pass
37
from future_builtins import *
41
38
42
39
try:
43
40
import SocketServer as socketserver
47
44
import argparse
48
45
import datetime
49
46
import errno
47
import gnutls.crypto
48
import gnutls.connection
49
import gnutls.errors
50
import gnutls.library.functions
51
import gnutls.library.constants
52
import gnutls.library.types
50
53
try:
51
54
import ConfigParser as configparser
52
55
except ImportError:
79
82
80
83
import dbus
81
84
import dbus.service
82
from gi.repository import GLib
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
89
import avahi
83
90
from dbus.mainloop.glib import DBusGMainLoop
84
91
import ctypes
85
92
import ctypes.util
97
104
if sys.version_info.major == 2:
98
105
str = unicode
99
106
100
version = "1.7.6"
107
version = "1.7.0"
101
108
stored_state_file = "clients.pickle"
102
109
103
110
logger = logging.getLogger()
118
125
return interface_index
119
126
120
127
121
def copy_function(func):
122
"""Make a copy of a function"""
123
if sys.version_info.major == 2:
124
return types.FunctionType(func.func_code,
125
func.func_globals,
126
func.func_name,
127
func.func_defaults,
128
func.func_closure)
129
else:
130
return types.FunctionType(func.__code__,
131
func.__globals__,
132
func.__name__,
133
func.__defaults__,
134
func.__closure__)
135
136
137
128
def initlogger(debug, level=logging.WARNING):
138
129
"""init logger and add loglevel"""
139
130
166
157
167
158
def __init__(self):
168
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
169
self.gpg = "gpg"
170
try:
171
output = subprocess.check_output(["gpgconf"])
172
for line in output.splitlines():
173
name, text, path = line.split(b":")
174
if name == "gpg":
175
self.gpg = path
176
break
177
except OSError as e:
178
if e.errno != errno.ENOENT:
179
raise
180
160
self.gnupgargs = ['--batch',
181
'--homedir', self.tempdir,
161
'--home', self.tempdir,
182
162
'--force-mdc',
183
163
'--quiet',
184
164
'--no-use-agent']
223
203
dir=self.tempdir) as passfile:
224
204
passfile.write(passphrase)
225
205
passfile.flush()
226
proc = subprocess.Popen([self.gpg, '--symmetric',
206
proc = subprocess.Popen(['gpg', '--symmetric',
227
207
'--passphrase-file',
228
208
passfile.name]
229
209
+ self.gnupgargs,
241
221
dir = self.tempdir) as passfile:
242
222
passfile.write(passphrase)
243
223
passfile.flush()
244
proc = subprocess.Popen([self.gpg, '--decrypt',
224
proc = subprocess.Popen(['gpg', '--decrypt',
245
225
'--passphrase-file',
246
226
passfile.name]
247
227
+ self.gnupgargs,
253
233
raise PGPError(err)
254
234
return decrypted_plaintext
255
235
256
# Pretend that we have an Avahi module
257
class Avahi(object):
258
"""This isn't so much a class as it is a module-like namespace.
259
It is instantiated once, and simulates having an Avahi module."""
260
IF_UNSPEC = -1 # avahi-common/address.h
261
PROTO_UNSPEC = -1 # avahi-common/address.h
262
PROTO_INET = 0 # avahi-common/address.h
263
PROTO_INET6 = 1 # avahi-common/address.h
264
DBUS_NAME = "org.freedesktop.Avahi"
265
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
266
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
267
DBUS_PATH_SERVER = "/"
268
def string_array_to_txt_array(self, t):
269
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
270
for s in t), signature="ay")
271
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
272
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
273
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
274
SERVER_INVALID = 0 # avahi-common/defs.h
275
SERVER_REGISTERING = 1 # avahi-common/defs.h
276
SERVER_RUNNING = 2 # avahi-common/defs.h
277
SERVER_COLLISION = 3 # avahi-common/defs.h
278
SERVER_FAILURE = 4 # avahi-common/defs.h
279
avahi = Avahi()
280
236
281
237
class AvahiError(Exception):
282
238
def __init__(self, value, *args, **kwargs):
479
435
.format(self.name)))
480
436
return ret
481
437
482
# Pretend that we have a GnuTLS module
483
class GnuTLS(object):
484
"""This isn't so much a class as it is a module-like namespace.
485
It is instantiated once, and simulates having a GnuTLS module."""
486
487
_library = ctypes.cdll.LoadLibrary(
488
ctypes.util.find_library("gnutls"))
489
_need_version = b"3.3.0"
490
def __init__(self):
491
# Need to use class name "GnuTLS" here, since this method is
492
# called before the assignment to the "gnutls" global variable
493
# happens.
494
if GnuTLS.check_version(self._need_version) is None:
495
raise GnuTLS.Error("Needs GnuTLS {} or later"
496
.format(self._need_version))
497
498
# Unless otherwise indicated, the constants and types below are
499
# all from the gnutls/gnutls.h C header file.
500
501
# Constants
502
E_SUCCESS = 0
503
E_INTERRUPTED = -52
504
E_AGAIN = -28
505
CRT_OPENPGP = 2
506
CLIENT = 2
507
SHUT_RDWR = 0
508
CRD_CERTIFICATE = 1
509
E_NO_CERTIFICATE_FOUND = -49
510
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
511
512
# Types
513
class session_int(ctypes.Structure):
514
_fields_ = []
515
session_t = ctypes.POINTER(session_int)
516
class certificate_credentials_st(ctypes.Structure):
517
_fields_ = []
518
certificate_credentials_t = ctypes.POINTER(
519
certificate_credentials_st)
520
certificate_type_t = ctypes.c_int
521
class datum_t(ctypes.Structure):
522
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
523
('size', ctypes.c_uint)]
524
class openpgp_crt_int(ctypes.Structure):
525
_fields_ = []
526
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
527
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
528
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
529
credentials_type_t = ctypes.c_int
530
transport_ptr_t = ctypes.c_void_p
531
close_request_t = ctypes.c_int
532
533
# Exceptions
534
class Error(Exception):
535
# We need to use the class name "GnuTLS" here, since this
536
# exception might be raised from within GnuTLS.__init__,
537
# which is called before the assignment to the "gnutls"
538
# global variable has happened.
539
def __init__(self, message = None, code = None, args=()):
540
# Default usage is by a message string, but if a return
541
# code is passed, convert it to a string with
542
# gnutls.strerror()
543
self.code = code
544
if message is None and code is not None:
545
message = GnuTLS.strerror(code)
546
return super(GnuTLS.Error, self).__init__(
547
message, *args)
548
549
class CertificateSecurityError(Error):
550
pass
551
552
# Classes
553
class Credentials(object):
554
def __init__(self):
555
self._c_object = gnutls.certificate_credentials_t()
556
gnutls.certificate_allocate_credentials(
557
ctypes.byref(self._c_object))
558
self.type = gnutls.CRD_CERTIFICATE
559
560
def __del__(self):
561
gnutls.certificate_free_credentials(self._c_object)
562
563
class ClientSession(object):
564
def __init__(self, socket, credentials = None):
565
self._c_object = gnutls.session_t()
566
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
567
gnutls.set_default_priority(self._c_object)
568
gnutls.transport_set_ptr(self._c_object, socket.fileno())
569
gnutls.handshake_set_private_extensions(self._c_object,
570
True)
571
self.socket = socket
572
if credentials is None:
573
credentials = gnutls.Credentials()
574
gnutls.credentials_set(self._c_object, credentials.type,
575
ctypes.cast(credentials._c_object,
576
ctypes.c_void_p))
577
self.credentials = credentials
578
579
def __del__(self):
580
gnutls.deinit(self._c_object)
581
582
def handshake(self):
583
return gnutls.handshake(self._c_object)
584
585
def send(self, data):
586
data = bytes(data)
587
data_len = len(data)
588
while data_len > 0:
589
data_len -= gnutls.record_send(self._c_object,
590
data[-data_len:],
591
data_len)
592
593
def bye(self):
594
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
595
596
# Error handling functions
597
def _error_code(result):
598
"""A function to raise exceptions on errors, suitable
599
for the 'restype' attribute on ctypes functions"""
600
if result >= 0:
601
return result
602
if result == gnutls.E_NO_CERTIFICATE_FOUND:
603
raise gnutls.CertificateSecurityError(code = result)
604
raise gnutls.Error(code = result)
605
606
def _retry_on_error(result, func, arguments):
607
"""A function to retry on some errors, suitable
608
for the 'errcheck' attribute on ctypes functions"""
609
while result < 0:
610
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
611
return _error_code(result)
612
result = func(*arguments)
613
return result
614
615
# Unless otherwise indicated, the function declarations below are
616
# all from the gnutls/gnutls.h C header file.
617
618
# Functions
619
priority_set_direct = _library.gnutls_priority_set_direct
620
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
621
ctypes.POINTER(ctypes.c_char_p)]
622
priority_set_direct.restype = _error_code
623
624
init = _library.gnutls_init
625
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
626
init.restype = _error_code
627
628
set_default_priority = _library.gnutls_set_default_priority
629
set_default_priority.argtypes = [session_t]
630
set_default_priority.restype = _error_code
631
632
record_send = _library.gnutls_record_send
633
record_send.argtypes = [session_t, ctypes.c_void_p,
634
ctypes.c_size_t]
635
record_send.restype = ctypes.c_ssize_t
636
record_send.errcheck = _retry_on_error
637
638
certificate_allocate_credentials = (
639
_library.gnutls_certificate_allocate_credentials)
640
certificate_allocate_credentials.argtypes = [
641
ctypes.POINTER(certificate_credentials_t)]
642
certificate_allocate_credentials.restype = _error_code
643
644
certificate_free_credentials = (
645
_library.gnutls_certificate_free_credentials)
646
certificate_free_credentials.argtypes = [certificate_credentials_t]
647
certificate_free_credentials.restype = None
648
649
handshake_set_private_extensions = (
650
_library.gnutls_handshake_set_private_extensions)
651
handshake_set_private_extensions.argtypes = [session_t,
652
ctypes.c_int]
653
handshake_set_private_extensions.restype = None
654
655
credentials_set = _library.gnutls_credentials_set
656
credentials_set.argtypes = [session_t, credentials_type_t,
657
ctypes.c_void_p]
658
credentials_set.restype = _error_code
659
660
strerror = _library.gnutls_strerror
661
strerror.argtypes = [ctypes.c_int]
662
strerror.restype = ctypes.c_char_p
663
664
certificate_type_get = _library.gnutls_certificate_type_get
665
certificate_type_get.argtypes = [session_t]
666
certificate_type_get.restype = _error_code
667
668
certificate_get_peers = _library.gnutls_certificate_get_peers
669
certificate_get_peers.argtypes = [session_t,
670
ctypes.POINTER(ctypes.c_uint)]
671
certificate_get_peers.restype = ctypes.POINTER(datum_t)
672
673
global_set_log_level = _library.gnutls_global_set_log_level
674
global_set_log_level.argtypes = [ctypes.c_int]
675
global_set_log_level.restype = None
676
677
global_set_log_function = _library.gnutls_global_set_log_function
678
global_set_log_function.argtypes = [log_func]
679
global_set_log_function.restype = None
680
681
deinit = _library.gnutls_deinit
682
deinit.argtypes = [session_t]
683
deinit.restype = None
684
685
handshake = _library.gnutls_handshake
686
handshake.argtypes = [session_t]
687
handshake.restype = _error_code
688
handshake.errcheck = _retry_on_error
689
690
transport_set_ptr = _library.gnutls_transport_set_ptr
691
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
692
transport_set_ptr.restype = None
693
694
bye = _library.gnutls_bye
695
bye.argtypes = [session_t, close_request_t]
696
bye.restype = _error_code
697
bye.errcheck = _retry_on_error
698
699
check_version = _library.gnutls_check_version
700
check_version.argtypes = [ctypes.c_char_p]
701
check_version.restype = ctypes.c_char_p
702
703
# All the function declarations below are from gnutls/openpgp.h
704
705
openpgp_crt_init = _library.gnutls_openpgp_crt_init
706
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
707
openpgp_crt_init.restype = _error_code
708
709
openpgp_crt_import = _library.gnutls_openpgp_crt_import
710
openpgp_crt_import.argtypes = [openpgp_crt_t,
711
ctypes.POINTER(datum_t),
712
openpgp_crt_fmt_t]
713
openpgp_crt_import.restype = _error_code
714
715
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
716
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
717
ctypes.POINTER(ctypes.c_uint)]
718
openpgp_crt_verify_self.restype = _error_code
719
720
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
721
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
722
openpgp_crt_deinit.restype = None
723
724
openpgp_crt_get_fingerprint = (
725
_library.gnutls_openpgp_crt_get_fingerprint)
726
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
727
ctypes.c_void_p,
728
ctypes.POINTER(
729
ctypes.c_size_t)]
730
openpgp_crt_get_fingerprint.restype = _error_code
731
732
# Remove non-public functions
733
del _error_code, _retry_on_error
734
# Create the global "gnutls" object, simulating a module
735
gnutls = GnuTLS()
736
737
438
def call_pipe(connection, # : multiprocessing.Connection
738
439
func, *args, **kwargs):
739
440
"""This function is meant to be called by multiprocessing.Process
754
455
checker: subprocess.Popen(); a running checker process used
755
456
to see if the client lives.
756
457
'None' if no process is running.
757
checker_callback_tag: a GLib event source tag, or None
458
checker_callback_tag: a gobject event source tag, or None
758
459
checker_command: string; External command which is run to check
759
460
if client lives. %() expansions are done at
760
461
runtime with vars(self) as dict, so that for
761
462
instance %(name)s can be used in the command.
762
checker_initiator_tag: a GLib event source tag, or None
463
checker_initiator_tag: a gobject event source tag, or None
763
464
created: datetime.datetime(); (UTC) object creation
764
465
client_structure: Object describing what attributes a client has
765
466
and is used for storing the client at exit
766
467
current_checker_command: string; current running checker_command
767
disable_initiator_tag: a GLib event source tag, or None
468
disable_initiator_tag: a gobject event source tag, or None
768
469
enabled: bool()
769
470
fingerprint: string (40 or 32 hexadecimal digits); used to
770
471
uniquely identify the client
833
534
client["fingerprint"] = (section["fingerprint"].upper()
834
535
.replace(" ", ""))
835
536
if "secret" in section:
836
client["secret"] = codecs.decode(section["secret"]
837
.encode("utf-8"),
838
"base64")
537
client["secret"] = section["secret"].decode("base64")
839
538
elif "secfile" in section:
840
539
with open(os.path.expanduser(os.path.expandvars
841
540
(section["secfile"])),
894
593
self.changedstate = multiprocessing_manager.Condition(
895
594
multiprocessing_manager.Lock())
896
595
self.client_structure = [attr
897
for attr in self.__dict__.keys()
596
for attr in self.__dict__.iterkeys()
898
597
if not attr.startswith("_")]
899
598
self.client_structure.append("client_structure")
900
599
926
625
if not quiet:
927
626
logger.info("Disabling client %s", self.name)
928
627
if getattr(self, "disable_initiator_tag", None) is not None:
929
GLib.source_remove(self.disable_initiator_tag)
628
gobject.source_remove(self.disable_initiator_tag)
930
629
self.disable_initiator_tag = None
931
630
self.expires = None
932
631
if getattr(self, "checker_initiator_tag", None) is not None:
933
GLib.source_remove(self.checker_initiator_tag)
632
gobject.source_remove(self.checker_initiator_tag)
934
633
self.checker_initiator_tag = None
935
634
self.stop_checker()
936
635
self.enabled = False
937
636
if not quiet:
938
637
self.send_changedstate()
939
# Do not run this again if called by a GLib.timeout_add
638
# Do not run this again if called by a gobject.timeout_add
940
639
return False
941
640
942
641
def __del__(self):
946
645
# Schedule a new checker to be started an 'interval' from now,
947
646
# and every interval from then on.
948
647
if self.checker_initiator_tag is not None:
949
GLib.source_remove(self.checker_initiator_tag)
950
self.checker_initiator_tag = GLib.timeout_add(
648
gobject.source_remove(self.checker_initiator_tag)
649
self.checker_initiator_tag = gobject.timeout_add(
951
650
int(self.interval.total_seconds() * 1000),
952
651
self.start_checker)
953
652
# Schedule a disable() when 'timeout' has passed
954
653
if self.disable_initiator_tag is not None:
955
GLib.source_remove(self.disable_initiator_tag)
956
self.disable_initiator_tag = GLib.timeout_add(
654
gobject.source_remove(self.disable_initiator_tag)
655
self.disable_initiator_tag = gobject.timeout_add(
957
656
int(self.timeout.total_seconds() * 1000), self.disable)
958
657
# Also start a new checker *right now*.
959
658
self.start_checker()
995
694
if timeout is None:
996
695
timeout = self.timeout
997
696
if self.disable_initiator_tag is not None:
998
GLib.source_remove(self.disable_initiator_tag)
697
gobject.source_remove(self.disable_initiator_tag)
999
698
self.disable_initiator_tag = None
1000
699
if getattr(self, "enabled", False):
1001
self.disable_initiator_tag = GLib.timeout_add(
700
self.disable_initiator_tag = gobject.timeout_add(
1002
701
int(timeout.total_seconds() * 1000), self.disable)
1003
702
self.expires = datetime.datetime.utcnow() + timeout
1004
703
1059
758
args = (pipe[1], subprocess.call, command),
1060
759
kwargs = popen_args)
1061
760
self.checker.start()
1062
self.checker_callback_tag = GLib.io_add_watch(
1063
pipe[0].fileno(), GLib.IO_IN,
761
self.checker_callback_tag = gobject.io_add_watch(
762
pipe[0].fileno(), gobject.IO_IN,
1064
763
self.checker_callback, pipe[0], command)
1065
# Re-run this periodically if run by GLib.timeout_add
764
# Re-run this periodically if run by gobject.timeout_add
1066
765
return True
1067
766
1068
767
def stop_checker(self):
1069
768
"""Force the checker process, if any, to stop."""
1070
769
if self.checker_callback_tag:
1071
GLib.source_remove(self.checker_callback_tag)
770
gobject.source_remove(self.checker_callback_tag)
1072
771
self.checker_callback_tag = None
1073
772
if getattr(self, "checker", None) is None:
1074
773
return
1548
1247
interface_names.add(alt_interface)
1549
1248
# Is this a D-Bus signal?
1550
1249
if getattr(attribute, "_dbus_is_signal", False):
1551
# Extract the original non-method undecorated
1552
# function by black magic
1553
1250
if sys.version_info.major == 2:
1251
# Extract the original non-method undecorated
1252
# function by black magic
1554
1253
nonmethod_func = (dict(
1555
1254
zip(attribute.func_code.co_freevars,
1556
1255
attribute.__closure__))
1557
1256
["func"].cell_contents)
1558
1257
else:
1559
nonmethod_func = (dict(
1560
zip(attribute.__code__.co_freevars,
1561
attribute.__closure__))
1562
["func"].cell_contents)
1258
nonmethod_func = attribute
1563
1259
# Create a new, but exactly alike, function
1564
1260
# object, and decorate it to be a new D-Bus signal
1565
1261
# with the alternate D-Bus interface name
1566
new_function = copy_function(nonmethod_func)
1262
if sys.version_info.major == 2:
1263
new_function = types.FunctionType(
1264
nonmethod_func.func_code,
1265
nonmethod_func.func_globals,
1266
nonmethod_func.func_name,
1267
nonmethod_func.func_defaults,
1268
nonmethod_func.func_closure)
1269
else:
1270
new_function = types.FunctionType(
1271
nonmethod_func.__code__,
1272
nonmethod_func.__globals__,
1273
nonmethod_func.__name__,
1274
nonmethod_func.__defaults__,
1275
nonmethod_func.__closure__)
1567
1276
new_function = (dbus.service.signal(
1568
1277
alt_interface,
1569
1278
attribute._dbus_signature)(new_function))
1608
1317
alt_interface,
1609
1318
attribute._dbus_in_signature,
1610
1319
attribute._dbus_out_signature)
1611
(copy_function(attribute)))
1320
(types.FunctionType(attribute.func_code,
1321
attribute.func_globals,
1322
attribute.func_name,
1323
attribute.func_defaults,
1324
attribute.func_closure)))
1612
1325
# Copy annotations, if any
1613
1326
try:
1614
1327
attr[attrname]._dbus_annotations = dict(
1626
1339
attribute._dbus_access,
1627
1340
attribute._dbus_get_args_options
1628
1341
["byte_arrays"])
1629
(copy_function(attribute)))
1342
(types.FunctionType(
1343
attribute.func_code,
1344
attribute.func_globals,
1345
attribute.func_name,
1346
attribute.func_defaults,
1347
attribute.func_closure)))
1630
1348
# Copy annotations, if any
1631
1349
try:
1632
1350
attr[attrname]._dbus_annotations = dict(
1641
1359
# to the class.
1642
1360
attr[attrname] = (
1643
1361
dbus_interface_annotations(alt_interface)
1644
(copy_function(attribute)))
1362
(types.FunctionType(attribute.func_code,
1363
attribute.func_globals,
1364
attribute.func_name,
1365
attribute.func_defaults,
1366
attribute.func_closure)))
1645
1367
if deprecate:
1646
1368
# Deprecate all alternate interfaces
1647
1369
iname="_AlternateDBusNames_interface_annotation{}"
1660
1382
if interface_names:
1661
1383
# Replace the class with a new subclass of it with
1662
1384
# methods, signals, etc. as created above.
1663
if sys.version_info.major == 2:
1664
cls = type(b"{}Alternate".format(cls.__name__),
1665
(cls, ), attr)
1666
else:
1667
cls = type("{}Alternate".format(cls.__name__),
1668
(cls, ), attr)
1385
cls = type(b"{}Alternate".format(cls.__name__),
1386
(cls, ), attr)
1669
1387
return cls
1670
1388
1671
1389
return wrapper
1829
1547
1830
1548
def approve(self, value=True):
1831
1549
self.approved = value
1832
GLib.timeout_add(int(self.approval_duration.total_seconds()
1833
* 1000), self._reset_approved)
1550
gobject.timeout_add(int(self.approval_duration.total_seconds()
1551
* 1000), self._reset_approved)
1834
1552
self.send_changedstate()
1835
1553
1836
1554
## D-Bus methods, signals & properties
2046
1764
if (getattr(self, "disable_initiator_tag", None)
2047
1765
is None):
2048
1766
return
2049
GLib.source_remove(self.disable_initiator_tag)
2050
self.disable_initiator_tag = GLib.timeout_add(
1767
gobject.source_remove(self.disable_initiator_tag)
1768
self.disable_initiator_tag = gobject.timeout_add(
2051
1769
int((self.expires - now).total_seconds() * 1000),
2052
1770
self.disable)
2053
1771
2073
1791
return
2074
1792
if self.enabled:
2075
1793
# Reschedule checker run
2076
GLib.source_remove(self.checker_initiator_tag)
2077
self.checker_initiator_tag = GLib.timeout_add(
1794
gobject.source_remove(self.checker_initiator_tag)
1795
self.checker_initiator_tag = gobject.timeout_add(
2078
1796
value, self.start_checker)
2079
1797
self.start_checker() # Start one now, too
2080
1798
2162
1880
logger.debug("Pipe FD: %d",
2163
1881
self.server.child_pipe.fileno())
2164
1882
2165
session = gnutls.ClientSession(self.request)
1883
session = gnutls.connection.ClientSession(
1884
self.request, gnutls.connection .X509Credentials())
1885
1886
# Note: gnutls.connection.X509Credentials is really a
1887
# generic GnuTLS certificate credentials object so long as
1888
# no X.509 keys are added to it. Therefore, we can use it
1889
# here despite using OpenPGP certificates.
2166
1890
2167
1891
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2168
1892
# "+AES-256-CBC", "+SHA1",
2172
1896
priority = self.server.gnutls_priority
2173
1897
if priority is None:
2174
1898
priority = "NORMAL"
2175
gnutls.priority_set_direct(session._c_object, priority,
2176
None)
1899
gnutls.library.functions.gnutls_priority_set_direct(
1900
session._c_object, priority, None)
2177
1901
2178
1902
# Start communication using the Mandos protocol
2179
1903
# Get protocol number
2189
1913
# Start GnuTLS connection
2190
1914
try:
2191
1915
session.handshake()
2192
except gnutls.Error as error:
1916
except gnutls.errors.GNUTLSError as error:
2193
1917
logger.warning("Handshake failed: %s", error)
2194
1918
# Do not run session.bye() here: the session is not
2195
1919
# established. Just abandon the request.
2201
1925
try:
2202
1926
fpr = self.fingerprint(
2203
1927
self.peer_certificate(session))
2204
except (TypeError, gnutls.Error) as error:
1928
except (TypeError,
1929
gnutls.errors.GNUTLSError) as error:
2205
1930
logger.warning("Bad certificate: %s", error)
2206
1931
return
2207
1932
logger.debug("Fingerprint: %s", fpr)
2265
1990
else:
2266
1991
delay -= time2 - time
2267
1992
2268
try:
2269
session.send(client.secret)
2270
except gnutls.Error as error:
2271
logger.warning("gnutls send failed",
2272
exc_info = error)
2273
return
1993
sent_size = 0
1994
while sent_size < len(client.secret):
1995
try:
1996
sent = session.send(client.secret[sent_size:])
1997
except gnutls.errors.GNUTLSError as error:
1998
logger.warning("gnutls send failed",
1999
exc_info=error)
2000
return
2001
logger.debug("Sent: %d, remaining: %d", sent,
2002
len(client.secret) - (sent_size
2003
+ sent))
2004
sent_size += sent
2274
2005
2275
2006
logger.info("Sending secret to %s", client.name)
2276
2007
# bump the timeout using extended_timeout
2284
2015
client.approvals_pending -= 1
2285
2016
try:
2286
2017
session.bye()
2287
except gnutls.Error as error:
2018
except gnutls.errors.GNUTLSError as error:
2288
2019
logger.warning("GnuTLS bye failed",
2289
2020
exc_info=error)
2290
2021
2292
2023
def peer_certificate(session):
2293
2024
"Return the peer's OpenPGP certificate as a bytestring"
2294
2025
# If not an OpenPGP certificate...
2295
if (gnutls.certificate_type_get(session._c_object)
2296
!= gnutls.CRT_OPENPGP):
2297
# ...return invalid data
2298
return b""
2026
if (gnutls.library.functions.gnutls_certificate_type_get(
2027
session._c_object)
2028
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
2029
# ...do the normal thing
2030
return session.peer_certificate
2299
2031
list_size = ctypes.c_uint(1)
2300
cert_list = (gnutls.certificate_get_peers
2032
cert_list = (gnutls.library.functions
2033
.gnutls_certificate_get_peers
2301
2034
(session._c_object, ctypes.byref(list_size)))
2302
2035
if not bool(cert_list) and list_size.value != 0:
2303
raise gnutls.Error("error getting peer certificate")
2036
raise gnutls.errors.GNUTLSError("error getting peer"
2037
" certificate")
2304
2038
if list_size.value == 0:
2305
2039
return None
2306
2040
cert = cert_list[0]
2310
2044
def fingerprint(openpgp):
2311
2045
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2312
2046
# New GnuTLS "datum" with the OpenPGP public key
2313
datum = gnutls.datum_t(
2047
datum = gnutls.library.types.gnutls_datum_t(
2314
2048
ctypes.cast(ctypes.c_char_p(openpgp),
2315
2049
ctypes.POINTER(ctypes.c_ubyte)),
2316
2050
ctypes.c_uint(len(openpgp)))
2317
2051
# New empty GnuTLS certificate
2318
crt = gnutls.openpgp_crt_t()
2319
gnutls.openpgp_crt_init(ctypes.byref(crt))
2052
crt = gnutls.library.types.gnutls_openpgp_crt_t()
2053
gnutls.library.functions.gnutls_openpgp_crt_init(
2054
ctypes.byref(crt))
2320
2055
# Import the OpenPGP public key into the certificate
2321
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2322
gnutls.OPENPGP_FMT_RAW)
2056
gnutls.library.functions.gnutls_openpgp_crt_import(
2057
crt, ctypes.byref(datum),
2058
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2323
2059
# Verify the self signature in the key
2324
2060
crtverify = ctypes.c_uint()
2325
gnutls.openpgp_crt_verify_self(crt, 0,
2326
ctypes.byref(crtverify))
2061
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
2062
crt, 0, ctypes.byref(crtverify))
2327
2063
if crtverify.value != 0:
2328
gnutls.openpgp_crt_deinit(crt)
2329
raise gnutls.CertificateSecurityError("Verify failed")
2064
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2065
raise gnutls.errors.CertificateSecurityError(
2066
"Verify failed")
2330
2067
# New buffer for the fingerprint
2331
2068
buf = ctypes.create_string_buffer(20)
2332
2069
buf_len = ctypes.c_size_t()
2333
2070
# Get the fingerprint from the certificate into the buffer
2334
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2335
ctypes.byref(buf_len))
2071
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
2072
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2336
2073
# Deinit the certificate
2337
gnutls.openpgp_crt_deinit(crt)
2074
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2338
2075
# Convert the buffer to a Python bytestring
2339
2076
fpr = ctypes.string_at(buf, buf_len.value)
2340
2077
# Convert the bytestring to hexadecimal notation
2484
2221
gnutls_priority GnuTLS priority string
2485
2222
use_dbus: Boolean; to emit D-Bus signals or not
2486
2223
2487
Assumes a GLib.MainLoop event loop.
2224
Assumes a gobject.MainLoop event loop.
2488
2225
"""
2489
2226
2490
2227
def __init__(self, server_address, RequestHandlerClass,
2515
2252
2516
2253
def add_pipe(self, parent_pipe, proc):
2517
2254
# Call "handle_ipc" for both data and EOF events
2518
GLib.io_add_watch(
2255
gobject.io_add_watch(
2519
2256
parent_pipe.fileno(),
2520
GLib.IO_IN | GLib.IO_HUP,
2257
gobject.IO_IN | gobject.IO_HUP,
2521
2258
functools.partial(self.handle_ipc,
2522
2259
parent_pipe = parent_pipe,
2523
2260
proc = proc))
2527
2264
proc = None,
2528
2265
client_object=None):
2529
2266
# error, or the other end of multiprocessing.Pipe has closed
2530
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2267
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2531
2268
# Wait for other process to exit
2532
2269
proc.join()
2533
2270
return False
2540
2277
fpr = request[1]
2541
2278
address = request[2]
2542
2279
2543
for c in self.clients.values():
2280
for c in self.clients.itervalues():
2544
2281
if c.fingerprint == fpr:
2545
2282
client = c
2546
2283
break
2554
2291
parent_pipe.send(False)
2555
2292
return False
2556
2293
2557
GLib.io_add_watch(
2294
gobject.io_add_watch(
2558
2295
parent_pipe.fileno(),
2559
GLib.IO_IN | GLib.IO_HUP,
2296
gobject.IO_IN | gobject.IO_HUP,
2560
2297
functools.partial(self.handle_ipc,
2561
2298
parent_pipe = parent_pipe,
2562
2299
proc = proc,
2944
2681
logger.error("Could not open file %r", pidfilename,
2945
2682
exc_info=e)
2946
2683
2947
for name, group in (("_mandos", "_mandos"),
2948
("mandos", "mandos"),
2949
("nobody", "nogroup")):
2684
for name in ("_mandos", "mandos", "nobody"):
2950
2685
try:
2951
2686
uid = pwd.getpwnam(name).pw_uid
2952
gid = pwd.getpwnam(group).pw_gid
2687
gid = pwd.getpwnam(name).pw_gid
2953
2688
break
2954
2689
except KeyError:
2955
2690
continue
2959
2694
try:
2960
2695
os.setgid(gid)
2961
2696
os.setuid(uid)
2962
if debug:
2963
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2964
gid))
2965
2697
except OSError as error:
2966
logger.warning("Failed to setuid/setgid to {}:{}: {}"
2967
.format(uid, gid, os.strerror(error.errno)))
2968
2698
if error.errno != errno.EPERM:
2969
2699
raise
2970
2700
2973
2703
2974
2704
# "Use a log level over 10 to enable all debugging options."
2975
2705
# - GnuTLS manual
2976
gnutls.global_set_log_level(11)
2706
gnutls.library.functions.gnutls_global_set_log_level(11)
2977
2707
2978
@gnutls.log_func
2708
@gnutls.library.types.gnutls_log_func
2979
2709
def debug_gnutls(level, string):
2980
2710
logger.debug("GnuTLS: %s", string[:-1])
2981
2711
2982
gnutls.global_set_log_function(debug_gnutls)
2712
gnutls.library.functions.gnutls_global_set_log_function(
2713
debug_gnutls)
2983
2714
2984
2715
# Redirect stdin so all checkers get /dev/null
2985
2716
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2992
2723
# Close all input and output, do double fork, etc.
2993
2724
daemon()
2994
2725
2995
# multiprocessing will use threads, so before we use GLib we need
2996
# to inform GLib that threads will be used.
2997
GLib.threads_init()
2726
# multiprocessing will use threads, so before we use gobject we
2727
# need to inform gobject that threads will be used.
2728
gobject.threads_init()
2998
2729
2999
2730
global main_loop
3000
2731
# From the Avahi example code
3001
2732
DBusGMainLoop(set_as_default=True)
3002
main_loop = GLib.MainLoop()
2733
main_loop = gobject.MainLoop()
3003
2734
bus = dbus.SystemBus()
3004
2735
# End of Avahi example code
3005
2736
if use_dbus:
3049
2780
if server_settings["restore"]:
3050
2781
try:
3051
2782
with open(stored_state_path, "rb") as stored_state:
3052
if sys.version_info.major == 2:
3053
clients_data, old_client_settings = pickle.load(
3054
stored_state)
3055
else:
3056
bytes_clients_data, bytes_old_client_settings = (
3057
pickle.load(stored_state, encoding = "bytes"))
3058
### Fix bytes to strings
3059
## clients_data
3060
# .keys()
3061
clients_data = { (key.decode("utf-8")
3062
if isinstance(key, bytes)
3063
else key): value
3064
for key, value in
3065
bytes_clients_data.items() }
3066
del bytes_clients_data
3067
for key in clients_data:
3068
value = { (k.decode("utf-8")
3069
if isinstance(k, bytes) else k): v
3070
for k, v in
3071
clients_data[key].items() }
3072
clients_data[key] = value
3073
# .client_structure
3074
value["client_structure"] = [
3075
(s.decode("utf-8")
3076
if isinstance(s, bytes)
3077
else s) for s in
3078
value["client_structure"] ]
3079
# .name & .host
3080
for k in ("name", "host"):
3081
if isinstance(value[k], bytes):
3082
value[k] = value[k].decode("utf-8")
3083
## old_client_settings
3084
# .keys()
3085
old_client_settings = {
3086
(key.decode("utf-8")
3087
if isinstance(key, bytes)
3088
else key): value
3089
for key, value in
3090
bytes_old_client_settings.items() }
3091
del bytes_old_client_settings
3092
# .host
3093
for value in old_client_settings.values():
3094
if isinstance(value["host"], bytes):
3095
value["host"] = (value["host"]
3096
.decode("utf-8"))
2783
clients_data, old_client_settings = pickle.load(
2784
stored_state)
3097
2785
os.remove(stored_state_path)
3098
2786
except IOError as e:
3099
2787
if e.errno == errno.ENOENT:
3200
2888
del pidfile
3201
2889
del pidfilename
3202
2890
3203
for termsig in (signal.SIGHUP, signal.SIGTERM):
3204
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3205
lambda: main_loop.quit() and False)
2891
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2892
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3206
2893
3207
2894
if use_dbus:
3208
2895
3239
2926
def GetAllClients(self):
3240
2927
"D-Bus method"
3241
2928
return dbus.Array(c.dbus_object_path for c in
3242
tcp_server.clients.values())
2929
tcp_server.clients.itervalues())
3243
2930
3244
2931
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3245
2932
"true"})
3250
2937
return dbus.Dictionary(
3251
2938
{ c.dbus_object_path: c.GetAll(
3252
2939
"se.recompile.Mandos.Client")
3253
for c in tcp_server.clients.values() },
2940
for c in tcp_server.clients.itervalues() },
3254
2941
signature="oa{sv}")
3255
2942
3256
2943
@dbus.service.method(_interface, in_signature="o")
3257
2944
def RemoveClient(self, object_path):
3258
2945
"D-Bus method"
3259
for c in tcp_server.clients.values():
2946
for c in tcp_server.clients.itervalues():
3260
2947
if c.dbus_object_path == object_path:
3261
2948
del tcp_server.clients[c.name]
3262
2949
c.remove_from_connection()
3322
3009
# removed/edited, old secret will thus be unrecovable.
3323
3010
clients = {}
3324
3011
with PGPEngine() as pgp:
3325
for client in tcp_server.clients.values():
3012
for client in tcp_server.clients.itervalues():
3326
3013
key = client_settings[client.name]["secret"]
3327
3014
client.encrypted_secret = pgp.encrypt(client.secret,
3328
3015
key)
3352
3039
prefix='clients-',
3353
3040
dir=os.path.dirname(stored_state_path),
3354
3041
delete=False) as stored_state:
3355
pickle.dump((clients, client_settings), stored_state,
3356
protocol = 2)
3042
pickle.dump((clients, client_settings), stored_state)
3357
3043
tempname = stored_state.name
3358
3044
os.rename(tempname, stored_state_path)
3359
3045
except (IOError, OSError) as e:
3378
3064
# Don't signal the disabling
3379
3065
client.disable(quiet=True)
3380
3066
# Emit D-Bus signal for removal
3381
if use_dbus:
3382
mandos_dbus_service.client_removed_signal(client)
3067
mandos_dbus_service.client_removed_signal(client)
3383
3068
client_settings.clear()
3384
3069
3385
3070
atexit.register(cleanup)
3386
3071
3387
for client in tcp_server.clients.values():
3072
for client in tcp_server.clients.itervalues():
3388
3073
if use_dbus:
3389
3074
# Emit D-Bus signal for adding
3390
3075
mandos_dbus_service.client_added_signal(client)
3419
3104
sys.exit(1)
3420
3105
# End of Avahi example code
3421
3106
3422
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3423
lambda *args, **kwargs:
3424
(tcp_server.handle_request
3425
(*args[2:], **kwargs) or True))
3107
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3108
lambda *args, **kwargs:
3109
(tcp_server.handle_request
3110
(*args[2:], **kwargs) or True))
3426
3111
3427
3112
logger.debug("Starting main loop")
3428
3113
main_loop.run()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0