To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 794
- compare with another revision
- download diff
- download tarball
- view history from revision 794
- Committer: Teddy Hogeborn
- Date: 2015-12-05 02:00:01 UTC
- mfrom: (237.4.61 release)
- Revision ID: teddy@recompile.se-20151205020001-b0cpa52ame0usaul
Merge from release branch.
added
removed
mandos
1
#!/usr/bin/python
1
#!/usr/bin/python2.7
2
2
# -*- mode: python; coding: utf-8 -*-
3
3
#
4
4
# Mandos server - give out binary blobs to connecting clients.
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
34
34
from __future__ import (division, absolute_import, print_function,
35
35
unicode_literals)
36
36
37
try:
38
from future_builtins import *
39
except ImportError:
40
pass
37
from future_builtins import *
41
38
42
39
try:
43
40
import SocketServer as socketserver
47
44
import argparse
48
45
import datetime
49
46
import errno
47
import gnutls.crypto
48
import gnutls.connection
49
import gnutls.errors
50
import gnutls.library.functions
51
import gnutls.library.constants
52
import gnutls.library.types
50
53
try:
51
54
import ConfigParser as configparser
52
55
except ImportError:
79
82
80
83
import dbus
81
84
import dbus.service
82
from gi.repository import GLib
85
try:
86
import gobject
87
except ImportError:
88
from gi.repository import GObject as gobject
89
import avahi
83
90
from dbus.mainloop.glib import DBusGMainLoop
84
91
import ctypes
85
92
import ctypes.util
86
93
import xml.dom.minidom
87
94
import inspect
88
95
89
# Try to find the value of SO_BINDTODEVICE:
90
96
try:
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
92
# newer, and it is also the most natural place for it:
93
97
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
94
98
except AttributeError:
95
99
try:
96
# This is where SO_BINDTODEVICE was up to and including Python
97
# 2.6, and also 3.2:
98
100
from IN import SO_BINDTODEVICE
99
101
except ImportError:
100
# In Python 2.7 it seems to have been removed entirely.
101
# Try running the C preprocessor:
102
try:
103
cc = subprocess.Popen(["cc", "--language=c", "-E",
104
"/dev/stdin"],
105
stdin=subprocess.PIPE,
106
stdout=subprocess.PIPE)
107
stdout = cc.communicate(
108
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
109
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
110
except (OSError, ValueError, IndexError):
111
# No value found
112
SO_BINDTODEVICE = None
102
SO_BINDTODEVICE = None
113
103
114
104
if sys.version_info.major == 2:
115
105
str = unicode
116
106
117
version = "1.7.9"
107
version = "1.7.1"
118
108
stored_state_file = "clients.pickle"
119
109
120
110
logger = logging.getLogger()
135
125
return interface_index
136
126
137
127
138
def copy_function(func):
139
"""Make a copy of a function"""
140
if sys.version_info.major == 2:
141
return types.FunctionType(func.func_code,
142
func.func_globals,
143
func.func_name,
144
func.func_defaults,
145
func.func_closure)
146
else:
147
return types.FunctionType(func.__code__,
148
func.__globals__,
149
func.__name__,
150
func.__defaults__,
151
func.__closure__)
152
153
154
128
def initlogger(debug, level=logging.WARNING):
155
129
"""init logger and add loglevel"""
156
130
183
157
184
158
def __init__(self):
185
159
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
186
self.gpg = "gpg"
187
try:
188
output = subprocess.check_output(["gpgconf"])
189
for line in output.splitlines():
190
name, text, path = line.split(b":")
191
if name == "gpg":
192
self.gpg = path
193
break
194
except OSError as e:
195
if e.errno != errno.ENOENT:
196
raise
197
160
self.gnupgargs = ['--batch',
198
'--homedir', self.tempdir,
161
'--home', self.tempdir,
199
162
'--force-mdc',
200
'--quiet']
201
# Only GPG version 1 has the --no-use-agent option.
202
if self.gpg == "gpg" or self.gpg.endswith("/gpg"):
203
self.gnupgargs.append("--no-use-agent")
163
'--quiet',
164
'--no-use-agent']
204
165
205
166
def __enter__(self):
206
167
return self
242
203
dir=self.tempdir) as passfile:
243
204
passfile.write(passphrase)
244
205
passfile.flush()
245
proc = subprocess.Popen([self.gpg, '--symmetric',
206
proc = subprocess.Popen(['gpg', '--symmetric',
246
207
'--passphrase-file',
247
208
passfile.name]
248
209
+ self.gnupgargs,
260
221
dir = self.tempdir) as passfile:
261
222
passfile.write(passphrase)
262
223
passfile.flush()
263
proc = subprocess.Popen([self.gpg, '--decrypt',
224
proc = subprocess.Popen(['gpg', '--decrypt',
264
225
'--passphrase-file',
265
226
passfile.name]
266
227
+ self.gnupgargs,
272
233
raise PGPError(err)
273
234
return decrypted_plaintext
274
235
275
# Pretend that we have an Avahi module
276
class Avahi(object):
277
"""This isn't so much a class as it is a module-like namespace.
278
It is instantiated once, and simulates having an Avahi module."""
279
IF_UNSPEC = -1 # avahi-common/address.h
280
PROTO_UNSPEC = -1 # avahi-common/address.h
281
PROTO_INET = 0 # avahi-common/address.h
282
PROTO_INET6 = 1 # avahi-common/address.h
283
DBUS_NAME = "org.freedesktop.Avahi"
284
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
285
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
286
DBUS_PATH_SERVER = "/"
287
def string_array_to_txt_array(self, t):
288
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
289
for s in t), signature="ay")
290
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
291
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
292
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
293
SERVER_INVALID = 0 # avahi-common/defs.h
294
SERVER_REGISTERING = 1 # avahi-common/defs.h
295
SERVER_RUNNING = 2 # avahi-common/defs.h
296
SERVER_COLLISION = 3 # avahi-common/defs.h
297
SERVER_FAILURE = 4 # avahi-common/defs.h
298
avahi = Avahi()
299
236
300
237
class AvahiError(Exception):
301
238
def __init__(self, value, *args, **kwargs):
498
435
.format(self.name)))
499
436
return ret
500
437
501
# Pretend that we have a GnuTLS module
502
class GnuTLS(object):
503
"""This isn't so much a class as it is a module-like namespace.
504
It is instantiated once, and simulates having a GnuTLS module."""
505
506
_library = ctypes.cdll.LoadLibrary(
507
ctypes.util.find_library("gnutls"))
508
_need_version = b"3.3.0"
509
def __init__(self):
510
# Need to use class name "GnuTLS" here, since this method is
511
# called before the assignment to the "gnutls" global variable
512
# happens.
513
if GnuTLS.check_version(self._need_version) is None:
514
raise GnuTLS.Error("Needs GnuTLS {} or later"
515
.format(self._need_version))
516
517
# Unless otherwise indicated, the constants and types below are
518
# all from the gnutls/gnutls.h C header file.
519
520
# Constants
521
E_SUCCESS = 0
522
E_INTERRUPTED = -52
523
E_AGAIN = -28
524
CRT_OPENPGP = 2
525
CLIENT = 2
526
SHUT_RDWR = 0
527
CRD_CERTIFICATE = 1
528
E_NO_CERTIFICATE_FOUND = -49
529
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
530
531
# Types
532
class session_int(ctypes.Structure):
533
_fields_ = []
534
session_t = ctypes.POINTER(session_int)
535
class certificate_credentials_st(ctypes.Structure):
536
_fields_ = []
537
certificate_credentials_t = ctypes.POINTER(
538
certificate_credentials_st)
539
certificate_type_t = ctypes.c_int
540
class datum_t(ctypes.Structure):
541
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
542
('size', ctypes.c_uint)]
543
class openpgp_crt_int(ctypes.Structure):
544
_fields_ = []
545
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
546
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
547
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
548
credentials_type_t = ctypes.c_int
549
transport_ptr_t = ctypes.c_void_p
550
close_request_t = ctypes.c_int
551
552
# Exceptions
553
class Error(Exception):
554
# We need to use the class name "GnuTLS" here, since this
555
# exception might be raised from within GnuTLS.__init__,
556
# which is called before the assignment to the "gnutls"
557
# global variable has happened.
558
def __init__(self, message = None, code = None, args=()):
559
# Default usage is by a message string, but if a return
560
# code is passed, convert it to a string with
561
# gnutls.strerror()
562
self.code = code
563
if message is None and code is not None:
564
message = GnuTLS.strerror(code)
565
return super(GnuTLS.Error, self).__init__(
566
message, *args)
567
568
class CertificateSecurityError(Error):
569
pass
570
571
# Classes
572
class Credentials(object):
573
def __init__(self):
574
self._c_object = gnutls.certificate_credentials_t()
575
gnutls.certificate_allocate_credentials(
576
ctypes.byref(self._c_object))
577
self.type = gnutls.CRD_CERTIFICATE
578
579
def __del__(self):
580
gnutls.certificate_free_credentials(self._c_object)
581
582
class ClientSession(object):
583
def __init__(self, socket, credentials = None):
584
self._c_object = gnutls.session_t()
585
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
586
gnutls.set_default_priority(self._c_object)
587
gnutls.transport_set_ptr(self._c_object, socket.fileno())
588
gnutls.handshake_set_private_extensions(self._c_object,
589
True)
590
self.socket = socket
591
if credentials is None:
592
credentials = gnutls.Credentials()
593
gnutls.credentials_set(self._c_object, credentials.type,
594
ctypes.cast(credentials._c_object,
595
ctypes.c_void_p))
596
self.credentials = credentials
597
598
def __del__(self):
599
gnutls.deinit(self._c_object)
600
601
def handshake(self):
602
return gnutls.handshake(self._c_object)
603
604
def send(self, data):
605
data = bytes(data)
606
data_len = len(data)
607
while data_len > 0:
608
data_len -= gnutls.record_send(self._c_object,
609
data[-data_len:],
610
data_len)
611
612
def bye(self):
613
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
614
615
# Error handling functions
616
def _error_code(result):
617
"""A function to raise exceptions on errors, suitable
618
for the 'restype' attribute on ctypes functions"""
619
if result >= 0:
620
return result
621
if result == gnutls.E_NO_CERTIFICATE_FOUND:
622
raise gnutls.CertificateSecurityError(code = result)
623
raise gnutls.Error(code = result)
624
625
def _retry_on_error(result, func, arguments):
626
"""A function to retry on some errors, suitable
627
for the 'errcheck' attribute on ctypes functions"""
628
while result < 0:
629
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
630
return _error_code(result)
631
result = func(*arguments)
632
return result
633
634
# Unless otherwise indicated, the function declarations below are
635
# all from the gnutls/gnutls.h C header file.
636
637
# Functions
638
priority_set_direct = _library.gnutls_priority_set_direct
639
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
640
ctypes.POINTER(ctypes.c_char_p)]
641
priority_set_direct.restype = _error_code
642
643
init = _library.gnutls_init
644
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
645
init.restype = _error_code
646
647
set_default_priority = _library.gnutls_set_default_priority
648
set_default_priority.argtypes = [session_t]
649
set_default_priority.restype = _error_code
650
651
record_send = _library.gnutls_record_send
652
record_send.argtypes = [session_t, ctypes.c_void_p,
653
ctypes.c_size_t]
654
record_send.restype = ctypes.c_ssize_t
655
record_send.errcheck = _retry_on_error
656
657
certificate_allocate_credentials = (
658
_library.gnutls_certificate_allocate_credentials)
659
certificate_allocate_credentials.argtypes = [
660
ctypes.POINTER(certificate_credentials_t)]
661
certificate_allocate_credentials.restype = _error_code
662
663
certificate_free_credentials = (
664
_library.gnutls_certificate_free_credentials)
665
certificate_free_credentials.argtypes = [certificate_credentials_t]
666
certificate_free_credentials.restype = None
667
668
handshake_set_private_extensions = (
669
_library.gnutls_handshake_set_private_extensions)
670
handshake_set_private_extensions.argtypes = [session_t,
671
ctypes.c_int]
672
handshake_set_private_extensions.restype = None
673
674
credentials_set = _library.gnutls_credentials_set
675
credentials_set.argtypes = [session_t, credentials_type_t,
676
ctypes.c_void_p]
677
credentials_set.restype = _error_code
678
679
strerror = _library.gnutls_strerror
680
strerror.argtypes = [ctypes.c_int]
681
strerror.restype = ctypes.c_char_p
682
683
certificate_type_get = _library.gnutls_certificate_type_get
684
certificate_type_get.argtypes = [session_t]
685
certificate_type_get.restype = _error_code
686
687
certificate_get_peers = _library.gnutls_certificate_get_peers
688
certificate_get_peers.argtypes = [session_t,
689
ctypes.POINTER(ctypes.c_uint)]
690
certificate_get_peers.restype = ctypes.POINTER(datum_t)
691
692
global_set_log_level = _library.gnutls_global_set_log_level
693
global_set_log_level.argtypes = [ctypes.c_int]
694
global_set_log_level.restype = None
695
696
global_set_log_function = _library.gnutls_global_set_log_function
697
global_set_log_function.argtypes = [log_func]
698
global_set_log_function.restype = None
699
700
deinit = _library.gnutls_deinit
701
deinit.argtypes = [session_t]
702
deinit.restype = None
703
704
handshake = _library.gnutls_handshake
705
handshake.argtypes = [session_t]
706
handshake.restype = _error_code
707
handshake.errcheck = _retry_on_error
708
709
transport_set_ptr = _library.gnutls_transport_set_ptr
710
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
711
transport_set_ptr.restype = None
712
713
bye = _library.gnutls_bye
714
bye.argtypes = [session_t, close_request_t]
715
bye.restype = _error_code
716
bye.errcheck = _retry_on_error
717
718
check_version = _library.gnutls_check_version
719
check_version.argtypes = [ctypes.c_char_p]
720
check_version.restype = ctypes.c_char_p
721
722
# All the function declarations below are from gnutls/openpgp.h
723
724
openpgp_crt_init = _library.gnutls_openpgp_crt_init
725
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
726
openpgp_crt_init.restype = _error_code
727
728
openpgp_crt_import = _library.gnutls_openpgp_crt_import
729
openpgp_crt_import.argtypes = [openpgp_crt_t,
730
ctypes.POINTER(datum_t),
731
openpgp_crt_fmt_t]
732
openpgp_crt_import.restype = _error_code
733
734
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
735
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
736
ctypes.POINTER(ctypes.c_uint)]
737
openpgp_crt_verify_self.restype = _error_code
738
739
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
740
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
741
openpgp_crt_deinit.restype = None
742
743
openpgp_crt_get_fingerprint = (
744
_library.gnutls_openpgp_crt_get_fingerprint)
745
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
746
ctypes.c_void_p,
747
ctypes.POINTER(
748
ctypes.c_size_t)]
749
openpgp_crt_get_fingerprint.restype = _error_code
750
751
# Remove non-public functions
752
del _error_code, _retry_on_error
753
# Create the global "gnutls" object, simulating a module
754
gnutls = GnuTLS()
755
756
438
def call_pipe(connection, # : multiprocessing.Connection
757
439
func, *args, **kwargs):
758
440
"""This function is meant to be called by multiprocessing.Process
773
455
checker: subprocess.Popen(); a running checker process used
774
456
to see if the client lives.
775
457
'None' if no process is running.
776
checker_callback_tag: a GLib event source tag, or None
458
checker_callback_tag: a gobject event source tag, or None
777
459
checker_command: string; External command which is run to check
778
460
if client lives. %() expansions are done at
779
461
runtime with vars(self) as dict, so that for
780
462
instance %(name)s can be used in the command.
781
checker_initiator_tag: a GLib event source tag, or None
463
checker_initiator_tag: a gobject event source tag, or None
782
464
created: datetime.datetime(); (UTC) object creation
783
465
client_structure: Object describing what attributes a client has
784
466
and is used for storing the client at exit
785
467
current_checker_command: string; current running checker_command
786
disable_initiator_tag: a GLib event source tag, or None
468
disable_initiator_tag: a gobject event source tag, or None
787
469
enabled: bool()
788
470
fingerprint: string (40 or 32 hexadecimal digits); used to
789
471
uniquely identify the client
852
534
client["fingerprint"] = (section["fingerprint"].upper()
853
535
.replace(" ", ""))
854
536
if "secret" in section:
855
client["secret"] = codecs.decode(section["secret"]
856
.encode("utf-8"),
857
"base64")
537
client["secret"] = section["secret"].decode("base64")
858
538
elif "secfile" in section:
859
539
with open(os.path.expanduser(os.path.expandvars
860
540
(section["secfile"])),
913
593
self.changedstate = multiprocessing_manager.Condition(
914
594
multiprocessing_manager.Lock())
915
595
self.client_structure = [attr
916
for attr in self.__dict__.keys()
596
for attr in self.__dict__.iterkeys()
917
597
if not attr.startswith("_")]
918
598
self.client_structure.append("client_structure")
919
599
945
625
if not quiet:
946
626
logger.info("Disabling client %s", self.name)
947
627
if getattr(self, "disable_initiator_tag", None) is not None:
948
GLib.source_remove(self.disable_initiator_tag)
628
gobject.source_remove(self.disable_initiator_tag)
949
629
self.disable_initiator_tag = None
950
630
self.expires = None
951
631
if getattr(self, "checker_initiator_tag", None) is not None:
952
GLib.source_remove(self.checker_initiator_tag)
632
gobject.source_remove(self.checker_initiator_tag)
953
633
self.checker_initiator_tag = None
954
634
self.stop_checker()
955
635
self.enabled = False
956
636
if not quiet:
957
637
self.send_changedstate()
958
# Do not run this again if called by a GLib.timeout_add
638
# Do not run this again if called by a gobject.timeout_add
959
639
return False
960
640
961
641
def __del__(self):
965
645
# Schedule a new checker to be started an 'interval' from now,
966
646
# and every interval from then on.
967
647
if self.checker_initiator_tag is not None:
968
GLib.source_remove(self.checker_initiator_tag)
969
self.checker_initiator_tag = GLib.timeout_add(
648
gobject.source_remove(self.checker_initiator_tag)
649
self.checker_initiator_tag = gobject.timeout_add(
970
650
int(self.interval.total_seconds() * 1000),
971
651
self.start_checker)
972
652
# Schedule a disable() when 'timeout' has passed
973
653
if self.disable_initiator_tag is not None:
974
GLib.source_remove(self.disable_initiator_tag)
975
self.disable_initiator_tag = GLib.timeout_add(
654
gobject.source_remove(self.disable_initiator_tag)
655
self.disable_initiator_tag = gobject.timeout_add(
976
656
int(self.timeout.total_seconds() * 1000), self.disable)
977
657
# Also start a new checker *right now*.
978
658
self.start_checker()
1014
694
if timeout is None:
1015
695
timeout = self.timeout
1016
696
if self.disable_initiator_tag is not None:
1017
GLib.source_remove(self.disable_initiator_tag)
697
gobject.source_remove(self.disable_initiator_tag)
1018
698
self.disable_initiator_tag = None
1019
699
if getattr(self, "enabled", False):
1020
self.disable_initiator_tag = GLib.timeout_add(
700
self.disable_initiator_tag = gobject.timeout_add(
1021
701
int(timeout.total_seconds() * 1000), self.disable)
1022
702
self.expires = datetime.datetime.utcnow() + timeout
1023
703
1078
758
args = (pipe[1], subprocess.call, command),
1079
759
kwargs = popen_args)
1080
760
self.checker.start()
1081
self.checker_callback_tag = GLib.io_add_watch(
1082
pipe[0].fileno(), GLib.IO_IN,
761
self.checker_callback_tag = gobject.io_add_watch(
762
pipe[0].fileno(), gobject.IO_IN,
1083
763
self.checker_callback, pipe[0], command)
1084
# Re-run this periodically if run by GLib.timeout_add
764
# Re-run this periodically if run by gobject.timeout_add
1085
765
return True
1086
766
1087
767
def stop_checker(self):
1088
768
"""Force the checker process, if any, to stop."""
1089
769
if self.checker_callback_tag:
1090
GLib.source_remove(self.checker_callback_tag)
770
gobject.source_remove(self.checker_callback_tag)
1091
771
self.checker_callback_tag = None
1092
772
if getattr(self, "checker", None) is None:
1093
773
return
1567
1247
interface_names.add(alt_interface)
1568
1248
# Is this a D-Bus signal?
1569
1249
if getattr(attribute, "_dbus_is_signal", False):
1570
# Extract the original non-method undecorated
1571
# function by black magic
1572
1250
if sys.version_info.major == 2:
1251
# Extract the original non-method undecorated
1252
# function by black magic
1573
1253
nonmethod_func = (dict(
1574
1254
zip(attribute.func_code.co_freevars,
1575
1255
attribute.__closure__))
1576
1256
["func"].cell_contents)
1577
1257
else:
1578
nonmethod_func = (dict(
1579
zip(attribute.__code__.co_freevars,
1580
attribute.__closure__))
1581
["func"].cell_contents)
1258
nonmethod_func = attribute
1582
1259
# Create a new, but exactly alike, function
1583
1260
# object, and decorate it to be a new D-Bus signal
1584
1261
# with the alternate D-Bus interface name
1585
new_function = copy_function(nonmethod_func)
1262
if sys.version_info.major == 2:
1263
new_function = types.FunctionType(
1264
nonmethod_func.func_code,
1265
nonmethod_func.func_globals,
1266
nonmethod_func.func_name,
1267
nonmethod_func.func_defaults,
1268
nonmethod_func.func_closure)
1269
else:
1270
new_function = types.FunctionType(
1271
nonmethod_func.__code__,
1272
nonmethod_func.__globals__,
1273
nonmethod_func.__name__,
1274
nonmethod_func.__defaults__,
1275
nonmethod_func.__closure__)
1586
1276
new_function = (dbus.service.signal(
1587
1277
alt_interface,
1588
1278
attribute._dbus_signature)(new_function))
1627
1317
alt_interface,
1628
1318
attribute._dbus_in_signature,
1629
1319
attribute._dbus_out_signature)
1630
(copy_function(attribute)))
1320
(types.FunctionType(attribute.func_code,
1321
attribute.func_globals,
1322
attribute.func_name,
1323
attribute.func_defaults,
1324
attribute.func_closure)))
1631
1325
# Copy annotations, if any
1632
1326
try:
1633
1327
attr[attrname]._dbus_annotations = dict(
1645
1339
attribute._dbus_access,
1646
1340
attribute._dbus_get_args_options
1647
1341
["byte_arrays"])
1648
(copy_function(attribute)))
1342
(types.FunctionType(
1343
attribute.func_code,
1344
attribute.func_globals,
1345
attribute.func_name,
1346
attribute.func_defaults,
1347
attribute.func_closure)))
1649
1348
# Copy annotations, if any
1650
1349
try:
1651
1350
attr[attrname]._dbus_annotations = dict(
1660
1359
# to the class.
1661
1360
attr[attrname] = (
1662
1361
dbus_interface_annotations(alt_interface)
1663
(copy_function(attribute)))
1362
(types.FunctionType(attribute.func_code,
1363
attribute.func_globals,
1364
attribute.func_name,
1365
attribute.func_defaults,
1366
attribute.func_closure)))
1664
1367
if deprecate:
1665
1368
# Deprecate all alternate interfaces
1666
1369
iname="_AlternateDBusNames_interface_annotation{}"
1679
1382
if interface_names:
1680
1383
# Replace the class with a new subclass of it with
1681
1384
# methods, signals, etc. as created above.
1682
if sys.version_info.major == 2:
1683
cls = type(b"{}Alternate".format(cls.__name__),
1684
(cls, ), attr)
1685
else:
1686
cls = type("{}Alternate".format(cls.__name__),
1687
(cls, ), attr)
1385
cls = type(b"{}Alternate".format(cls.__name__),
1386
(cls, ), attr)
1688
1387
return cls
1689
1388
1690
1389
return wrapper
1848
1547
1849
1548
def approve(self, value=True):
1850
1549
self.approved = value
1851
GLib.timeout_add(int(self.approval_duration.total_seconds()
1852
* 1000), self._reset_approved)
1550
gobject.timeout_add(int(self.approval_duration.total_seconds()
1551
* 1000), self._reset_approved)
1853
1552
self.send_changedstate()
1854
1553
1855
1554
## D-Bus methods, signals & properties
2065
1764
if (getattr(self, "disable_initiator_tag", None)
2066
1765
is None):
2067
1766
return
2068
GLib.source_remove(self.disable_initiator_tag)
2069
self.disable_initiator_tag = GLib.timeout_add(
1767
gobject.source_remove(self.disable_initiator_tag)
1768
self.disable_initiator_tag = gobject.timeout_add(
2070
1769
int((self.expires - now).total_seconds() * 1000),
2071
1770
self.disable)
2072
1771
2092
1791
return
2093
1792
if self.enabled:
2094
1793
# Reschedule checker run
2095
GLib.source_remove(self.checker_initiator_tag)
2096
self.checker_initiator_tag = GLib.timeout_add(
1794
gobject.source_remove(self.checker_initiator_tag)
1795
self.checker_initiator_tag = gobject.timeout_add(
2097
1796
value, self.start_checker)
2098
1797
self.start_checker() # Start one now, too
2099
1798
2181
1880
logger.debug("Pipe FD: %d",
2182
1881
self.server.child_pipe.fileno())
2183
1882
2184
session = gnutls.ClientSession(self.request)
1883
session = gnutls.connection.ClientSession(
1884
self.request, gnutls.connection .X509Credentials())
1885
1886
# Note: gnutls.connection.X509Credentials is really a
1887
# generic GnuTLS certificate credentials object so long as
1888
# no X.509 keys are added to it. Therefore, we can use it
1889
# here despite using OpenPGP certificates.
2185
1890
2186
1891
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2187
1892
# "+AES-256-CBC", "+SHA1",
2191
1896
priority = self.server.gnutls_priority
2192
1897
if priority is None:
2193
1898
priority = "NORMAL"
2194
gnutls.priority_set_direct(session._c_object,
2195
priority.encode("utf-8"),
2196
None)
1899
gnutls.library.functions.gnutls_priority_set_direct(
1900
session._c_object, priority, None)
2197
1901
2198
1902
# Start communication using the Mandos protocol
2199
1903
# Get protocol number
2209
1913
# Start GnuTLS connection
2210
1914
try:
2211
1915
session.handshake()
2212
except gnutls.Error as error:
1916
except gnutls.errors.GNUTLSError as error:
2213
1917
logger.warning("Handshake failed: %s", error)
2214
1918
# Do not run session.bye() here: the session is not
2215
1919
# established. Just abandon the request.
2221
1925
try:
2222
1926
fpr = self.fingerprint(
2223
1927
self.peer_certificate(session))
2224
except (TypeError, gnutls.Error) as error:
1928
except (TypeError,
1929
gnutls.errors.GNUTLSError) as error:
2225
1930
logger.warning("Bad certificate: %s", error)
2226
1931
return
2227
1932
logger.debug("Fingerprint: %s", fpr)
2285
1990
else:
2286
1991
delay -= time2 - time
2287
1992
2288
try:
2289
session.send(client.secret)
2290
except gnutls.Error as error:
2291
logger.warning("gnutls send failed",
2292
exc_info = error)
2293
return
1993
sent_size = 0
1994
while sent_size < len(client.secret):
1995
try:
1996
sent = session.send(client.secret[sent_size:])
1997
except gnutls.errors.GNUTLSError as error:
1998
logger.warning("gnutls send failed",
1999
exc_info=error)
2000
return
2001
logger.debug("Sent: %d, remaining: %d", sent,
2002
len(client.secret) - (sent_size
2003
+ sent))
2004
sent_size += sent
2294
2005
2295
2006
logger.info("Sending secret to %s", client.name)
2296
2007
# bump the timeout using extended_timeout
2304
2015
client.approvals_pending -= 1
2305
2016
try:
2306
2017
session.bye()
2307
except gnutls.Error as error:
2018
except gnutls.errors.GNUTLSError as error:
2308
2019
logger.warning("GnuTLS bye failed",
2309
2020
exc_info=error)
2310
2021
2312
2023
def peer_certificate(session):
2313
2024
"Return the peer's OpenPGP certificate as a bytestring"
2314
2025
# If not an OpenPGP certificate...
2315
if (gnutls.certificate_type_get(session._c_object)
2316
!= gnutls.CRT_OPENPGP):
2317
# ...return invalid data
2318
return b""
2026
if (gnutls.library.functions.gnutls_certificate_type_get(
2027
session._c_object)
2028
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
2029
# ...do the normal thing
2030
return session.peer_certificate
2319
2031
list_size = ctypes.c_uint(1)
2320
cert_list = (gnutls.certificate_get_peers
2032
cert_list = (gnutls.library.functions
2033
.gnutls_certificate_get_peers
2321
2034
(session._c_object, ctypes.byref(list_size)))
2322
2035
if not bool(cert_list) and list_size.value != 0:
2323
raise gnutls.Error("error getting peer certificate")
2036
raise gnutls.errors.GNUTLSError("error getting peer"
2037
" certificate")
2324
2038
if list_size.value == 0:
2325
2039
return None
2326
2040
cert = cert_list[0]
2330
2044
def fingerprint(openpgp):
2331
2045
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2332
2046
# New GnuTLS "datum" with the OpenPGP public key
2333
datum = gnutls.datum_t(
2047
datum = gnutls.library.types.gnutls_datum_t(
2334
2048
ctypes.cast(ctypes.c_char_p(openpgp),
2335
2049
ctypes.POINTER(ctypes.c_ubyte)),
2336
2050
ctypes.c_uint(len(openpgp)))
2337
2051
# New empty GnuTLS certificate
2338
crt = gnutls.openpgp_crt_t()
2339
gnutls.openpgp_crt_init(ctypes.byref(crt))
2052
crt = gnutls.library.types.gnutls_openpgp_crt_t()
2053
gnutls.library.functions.gnutls_openpgp_crt_init(
2054
ctypes.byref(crt))
2340
2055
# Import the OpenPGP public key into the certificate
2341
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2342
gnutls.OPENPGP_FMT_RAW)
2056
gnutls.library.functions.gnutls_openpgp_crt_import(
2057
crt, ctypes.byref(datum),
2058
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2343
2059
# Verify the self signature in the key
2344
2060
crtverify = ctypes.c_uint()
2345
gnutls.openpgp_crt_verify_self(crt, 0,
2346
ctypes.byref(crtverify))
2061
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
2062
crt, 0, ctypes.byref(crtverify))
2347
2063
if crtverify.value != 0:
2348
gnutls.openpgp_crt_deinit(crt)
2349
raise gnutls.CertificateSecurityError("Verify failed")
2064
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2065
raise gnutls.errors.CertificateSecurityError(
2066
"Verify failed")
2350
2067
# New buffer for the fingerprint
2351
2068
buf = ctypes.create_string_buffer(20)
2352
2069
buf_len = ctypes.c_size_t()
2353
2070
# Get the fingerprint from the certificate into the buffer
2354
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2355
ctypes.byref(buf_len))
2071
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
2072
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2356
2073
# Deinit the certificate
2357
gnutls.openpgp_crt_deinit(crt)
2074
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2358
2075
# Convert the buffer to a Python bytestring
2359
2076
fpr = ctypes.string_at(buf, buf_len.value)
2360
2077
# Convert the bytestring to hexadecimal notation
2453
2170
"""This overrides the normal server_bind() function
2454
2171
to bind to an interface if one was specified, and also NOT to
2455
2172
bind to an address or port if they were not specified."""
2456
global SO_BINDTODEVICE
2457
2173
if self.interface is not None:
2458
2174
if SO_BINDTODEVICE is None:
2459
# Fall back to a hard-coded value which seems to be
2460
# common enough.
2461
logger.warning("SO_BINDTODEVICE not found, trying 25")
2462
SO_BINDTODEVICE = 25
2463
try:
2464
self.socket.setsockopt(
2465
socket.SOL_SOCKET, SO_BINDTODEVICE,
2466
(self.interface + "\0").encode("utf-8"))
2467
except socket.error as error:
2468
if error.errno == errno.EPERM:
2469
logger.error("No permission to bind to"
2470
" interface %s", self.interface)
2471
elif error.errno == errno.ENOPROTOOPT:
2472
logger.error("SO_BINDTODEVICE not available;"
2473
" cannot bind to interface %s",
2474
self.interface)
2475
elif error.errno == errno.ENODEV:
2476
logger.error("Interface %s does not exist,"
2477
" cannot bind", self.interface)
2478
else:
2479
raise
2175
logger.error("SO_BINDTODEVICE does not exist;"
2176
" cannot bind to interface %s",
2177
self.interface)
2178
else:
2179
try:
2180
self.socket.setsockopt(
2181
socket.SOL_SOCKET, SO_BINDTODEVICE,
2182
(self.interface + "\0").encode("utf-8"))
2183
except socket.error as error:
2184
if error.errno == errno.EPERM:
2185
logger.error("No permission to bind to"
2186
" interface %s", self.interface)
2187
elif error.errno == errno.ENOPROTOOPT:
2188
logger.error("SO_BINDTODEVICE not available;"
2189
" cannot bind to interface %s",
2190
self.interface)
2191
elif error.errno == errno.ENODEV:
2192
logger.error("Interface %s does not exist,"
2193
" cannot bind", self.interface)
2194
else:
2195
raise
2480
2196
# Only bind(2) the socket if we really need to.
2481
2197
if self.server_address[0] or self.server_address[1]:
2482
2198
if not self.server_address[0]:
2505
2221
gnutls_priority GnuTLS priority string
2506
2222
use_dbus: Boolean; to emit D-Bus signals or not
2507
2223
2508
Assumes a GLib.MainLoop event loop.
2224
Assumes a gobject.MainLoop event loop.
2509
2225
"""
2510
2226
2511
2227
def __init__(self, server_address, RequestHandlerClass,
2536
2252
2537
2253
def add_pipe(self, parent_pipe, proc):
2538
2254
# Call "handle_ipc" for both data and EOF events
2539
GLib.io_add_watch(
2255
gobject.io_add_watch(
2540
2256
parent_pipe.fileno(),
2541
GLib.IO_IN | GLib.IO_HUP,
2257
gobject.IO_IN | gobject.IO_HUP,
2542
2258
functools.partial(self.handle_ipc,
2543
2259
parent_pipe = parent_pipe,
2544
2260
proc = proc))
2548
2264
proc = None,
2549
2265
client_object=None):
2550
2266
# error, or the other end of multiprocessing.Pipe has closed
2551
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2267
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2552
2268
# Wait for other process to exit
2553
2269
proc.join()
2554
2270
return False
2561
2277
fpr = request[1]
2562
2278
address = request[2]
2563
2279
2564
for c in self.clients.values():
2280
for c in self.clients.itervalues():
2565
2281
if c.fingerprint == fpr:
2566
2282
client = c
2567
2283
break
2575
2291
parent_pipe.send(False)
2576
2292
return False
2577
2293
2578
GLib.io_add_watch(
2294
gobject.io_add_watch(
2579
2295
parent_pipe.fileno(),
2580
GLib.IO_IN | GLib.IO_HUP,
2296
gobject.IO_IN | gobject.IO_HUP,
2581
2297
functools.partial(self.handle_ipc,
2582
2298
parent_pipe = parent_pipe,
2583
2299
proc = proc,
2965
2681
logger.error("Could not open file %r", pidfilename,
2966
2682
exc_info=e)
2967
2683
2968
for name, group in (("_mandos", "_mandos"),
2969
("mandos", "mandos"),
2970
("nobody", "nogroup")):
2684
for name in ("_mandos", "mandos", "nobody"):
2971
2685
try:
2972
2686
uid = pwd.getpwnam(name).pw_uid
2973
gid = pwd.getpwnam(group).pw_gid
2687
gid = pwd.getpwnam(name).pw_gid
2974
2688
break
2975
2689
except KeyError:
2976
2690
continue
2980
2694
try:
2981
2695
os.setgid(gid)
2982
2696
os.setuid(uid)
2983
if debug:
2984
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2985
gid))
2986
2697
except OSError as error:
2987
logger.warning("Failed to setuid/setgid to {}:{}: {}"
2988
.format(uid, gid, os.strerror(error.errno)))
2989
2698
if error.errno != errno.EPERM:
2990
2699
raise
2991
2700
2994
2703
2995
2704
# "Use a log level over 10 to enable all debugging options."
2996
2705
# - GnuTLS manual
2997
gnutls.global_set_log_level(11)
2706
gnutls.library.functions.gnutls_global_set_log_level(11)
2998
2707
2999
@gnutls.log_func
2708
@gnutls.library.types.gnutls_log_func
3000
2709
def debug_gnutls(level, string):
3001
2710
logger.debug("GnuTLS: %s", string[:-1])
3002
2711
3003
gnutls.global_set_log_function(debug_gnutls)
2712
gnutls.library.functions.gnutls_global_set_log_function(
2713
debug_gnutls)
3004
2714
3005
2715
# Redirect stdin so all checkers get /dev/null
3006
2716
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3013
2723
# Close all input and output, do double fork, etc.
3014
2724
daemon()
3015
2725
3016
# multiprocessing will use threads, so before we use GLib we need
3017
# to inform GLib that threads will be used.
3018
GLib.threads_init()
2726
# multiprocessing will use threads, so before we use gobject we
2727
# need to inform gobject that threads will be used.
2728
gobject.threads_init()
3019
2729
3020
2730
global main_loop
3021
2731
# From the Avahi example code
3022
2732
DBusGMainLoop(set_as_default=True)
3023
main_loop = GLib.MainLoop()
2733
main_loop = gobject.MainLoop()
3024
2734
bus = dbus.SystemBus()
3025
2735
# End of Avahi example code
3026
2736
if use_dbus:
3070
2780
if server_settings["restore"]:
3071
2781
try:
3072
2782
with open(stored_state_path, "rb") as stored_state:
3073
if sys.version_info.major == 2:
3074
clients_data, old_client_settings = pickle.load(
3075
stored_state)
3076
else:
3077
bytes_clients_data, bytes_old_client_settings = (
3078
pickle.load(stored_state, encoding = "bytes"))
3079
### Fix bytes to strings
3080
## clients_data
3081
# .keys()
3082
clients_data = { (key.decode("utf-8")
3083
if isinstance(key, bytes)
3084
else key): value
3085
for key, value in
3086
bytes_clients_data.items() }
3087
del bytes_clients_data
3088
for key in clients_data:
3089
value = { (k.decode("utf-8")
3090
if isinstance(k, bytes) else k): v
3091
for k, v in
3092
clients_data[key].items() }
3093
clients_data[key] = value
3094
# .client_structure
3095
value["client_structure"] = [
3096
(s.decode("utf-8")
3097
if isinstance(s, bytes)
3098
else s) for s in
3099
value["client_structure"] ]
3100
# .name & .host
3101
for k in ("name", "host"):
3102
if isinstance(value[k], bytes):
3103
value[k] = value[k].decode("utf-8")
3104
## old_client_settings
3105
# .keys()
3106
old_client_settings = {
3107
(key.decode("utf-8")
3108
if isinstance(key, bytes)
3109
else key): value
3110
for key, value in
3111
bytes_old_client_settings.items() }
3112
del bytes_old_client_settings
3113
# .host
3114
for value in old_client_settings.values():
3115
if isinstance(value["host"], bytes):
3116
value["host"] = (value["host"]
3117
.decode("utf-8"))
2783
clients_data, old_client_settings = pickle.load(
2784
stored_state)
3118
2785
os.remove(stored_state_path)
3119
2786
except IOError as e:
3120
2787
if e.errno == errno.ENOENT:
3221
2888
del pidfile
3222
2889
del pidfilename
3223
2890
3224
for termsig in (signal.SIGHUP, signal.SIGTERM):
3225
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3226
lambda: main_loop.quit() and False)
2891
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2892
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3227
2893
3228
2894
if use_dbus:
3229
2895
3260
2926
def GetAllClients(self):
3261
2927
"D-Bus method"
3262
2928
return dbus.Array(c.dbus_object_path for c in
3263
tcp_server.clients.values())
2929
tcp_server.clients.itervalues())
3264
2930
3265
2931
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3266
2932
"true"})
3271
2937
return dbus.Dictionary(
3272
2938
{ c.dbus_object_path: c.GetAll(
3273
2939
"se.recompile.Mandos.Client")
3274
for c in tcp_server.clients.values() },
2940
for c in tcp_server.clients.itervalues() },
3275
2941
signature="oa{sv}")
3276
2942
3277
2943
@dbus.service.method(_interface, in_signature="o")
3278
2944
def RemoveClient(self, object_path):
3279
2945
"D-Bus method"
3280
for c in tcp_server.clients.values():
2946
for c in tcp_server.clients.itervalues():
3281
2947
if c.dbus_object_path == object_path:
3282
2948
del tcp_server.clients[c.name]
3283
2949
c.remove_from_connection()
3328
2994
3329
2995
mandos_dbus_service = MandosDBusService()
3330
2996
3331
# Save modules to variables to exempt the modules from being
3332
# unloaded before the function registered with atexit() is run.
3333
mp = multiprocessing
3334
wn = wnull
3335
2997
def cleanup():
3336
2998
"Cleanup function; run on exit"
3337
2999
if zeroconf:
3338
3000
service.cleanup()
3339
3001
3340
mp.active_children()
3341
wn.close()
3002
multiprocessing.active_children()
3003
wnull.close()
3342
3004
if not (tcp_server.clients or client_settings):
3343
3005
return
3344
3006
3347
3009
# removed/edited, old secret will thus be unrecovable.
3348
3010
clients = {}
3349
3011
with PGPEngine() as pgp:
3350
for client in tcp_server.clients.values():
3012
for client in tcp_server.clients.itervalues():
3351
3013
key = client_settings[client.name]["secret"]
3352
3014
client.encrypted_secret = pgp.encrypt(client.secret,
3353
3015
key)
3377
3039
prefix='clients-',
3378
3040
dir=os.path.dirname(stored_state_path),
3379
3041
delete=False) as stored_state:
3380
pickle.dump((clients, client_settings), stored_state,
3381
protocol = 2)
3042
pickle.dump((clients, client_settings), stored_state)
3382
3043
tempname = stored_state.name
3383
3044
os.rename(tempname, stored_state_path)
3384
3045
except (IOError, OSError) as e:
3403
3064
# Don't signal the disabling
3404
3065
client.disable(quiet=True)
3405
3066
# Emit D-Bus signal for removal
3406
if use_dbus:
3407
mandos_dbus_service.client_removed_signal(client)
3067
mandos_dbus_service.client_removed_signal(client)
3408
3068
client_settings.clear()
3409
3069
3410
3070
atexit.register(cleanup)
3411
3071
3412
for client in tcp_server.clients.values():
3072
for client in tcp_server.clients.itervalues():
3413
3073
if use_dbus:
3414
3074
# Emit D-Bus signal for adding
3415
3075
mandos_dbus_service.client_added_signal(client)
3444
3104
sys.exit(1)
3445
3105
# End of Avahi example code
3446
3106
3447
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3448
lambda *args, **kwargs:
3449
(tcp_server.handle_request
3450
(*args[2:], **kwargs) or True))
3107
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3108
lambda *args, **kwargs:
3109
(tcp_server.handle_request
3110
(*args[2:], **kwargs) or True))
3451
3111
3452
3112
logger.debug("Starting main loop")
3453
3113
main_loop.run()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0