248
195
.replace(b"\n", b"\\n")
249
196
.replace(b"\0", b"\\x00"))
252
199
def encrypt(self, data, password):
253
200
passphrase = self.password_encode(password)
254
201
with tempfile.NamedTemporaryFile(
255
202
dir=self.tempdir) as passfile:
256
203
passfile.write(passphrase)
258
proc = subprocess.Popen([self.gpg, '--symmetric',
205
proc = subprocess.Popen(['gpg', '--symmetric',
259
206
'--passphrase-file',
261
208
+ self.gnupgargs,
262
stdin=subprocess.PIPE,
263
stdout=subprocess.PIPE,
264
stderr=subprocess.PIPE)
265
ciphertext, err = proc.communicate(input=data)
209
stdin = subprocess.PIPE,
210
stdout = subprocess.PIPE,
211
stderr = subprocess.PIPE)
212
ciphertext, err = proc.communicate(input = data)
266
213
if proc.returncode != 0:
267
214
raise PGPError(err)
268
215
return ciphertext
270
217
def decrypt(self, data, password):
271
218
passphrase = self.password_encode(password)
272
219
with tempfile.NamedTemporaryFile(
273
dir=self.tempdir) as passfile:
220
dir = self.tempdir) as passfile:
274
221
passfile.write(passphrase)
276
proc = subprocess.Popen([self.gpg, '--decrypt',
223
proc = subprocess.Popen(['gpg', '--decrypt',
277
224
'--passphrase-file',
279
226
+ self.gnupgargs,
280
stdin=subprocess.PIPE,
281
stdout=subprocess.PIPE,
282
stderr=subprocess.PIPE)
283
decrypted_plaintext, err = proc.communicate(input=data)
227
stdin = subprocess.PIPE,
228
stdout = subprocess.PIPE,
229
stderr = subprocess.PIPE)
230
decrypted_plaintext, err = proc.communicate(input = data)
284
231
if proc.returncode != 0:
285
232
raise PGPError(err)
286
233
return decrypted_plaintext
289
# Pretend that we have an Avahi module
291
"""This isn't so much a class as it is a module-like namespace."""
292
IF_UNSPEC = -1 # avahi-common/address.h
293
PROTO_UNSPEC = -1 # avahi-common/address.h
294
PROTO_INET = 0 # avahi-common/address.h
295
PROTO_INET6 = 1 # avahi-common/address.h
296
DBUS_NAME = "org.freedesktop.Avahi"
297
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
298
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
299
DBUS_PATH_SERVER = "/"
302
def string_array_to_txt_array(t):
303
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
304
for s in t), signature="ay")
305
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
306
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
307
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
308
SERVER_INVALID = 0 # avahi-common/defs.h
309
SERVER_REGISTERING = 1 # avahi-common/defs.h
310
SERVER_RUNNING = 2 # avahi-common/defs.h
311
SERVER_COLLISION = 3 # avahi-common/defs.h
312
SERVER_FAILURE = 4 # avahi-common/defs.h
315
236
class AvahiError(Exception):
316
237
def __init__(self, value, *args, **kwargs):
317
238
self.value = value
507
428
class AvahiServiceToSyslog(AvahiService):
508
429
def rename(self, *args, **kwargs):
509
430
"""Add the new name to the syslog messages"""
510
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
431
ret = AvahiService.rename(self, *args, **kwargs)
511
432
syslogger.setFormatter(logging.Formatter(
512
433
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
513
434
.format(self.name)))
517
# Pretend that we have a GnuTLS module
519
"""This isn't so much a class as it is a module-like namespace."""
521
library = ctypes.util.find_library("gnutls")
523
library = ctypes.util.find_library("gnutls-deb0")
524
_library = ctypes.cdll.LoadLibrary(library)
527
# Unless otherwise indicated, the constants and types below are
528
# all from the gnutls/gnutls.h C header file.
539
E_NO_CERTIFICATE_FOUND = -49
544
KEYID_USE_SHA256 = 1 # gnutls/x509.h
545
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
548
class session_int(ctypes.Structure):
550
session_t = ctypes.POINTER(session_int)
552
class certificate_credentials_st(ctypes.Structure):
554
certificate_credentials_t = ctypes.POINTER(
555
certificate_credentials_st)
556
certificate_type_t = ctypes.c_int
558
class datum_t(ctypes.Structure):
559
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
560
('size', ctypes.c_uint)]
562
class openpgp_crt_int(ctypes.Structure):
564
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
565
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
566
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
567
credentials_type_t = ctypes.c_int
568
transport_ptr_t = ctypes.c_void_p
569
close_request_t = ctypes.c_int
572
class Error(Exception):
573
def __init__(self, message=None, code=None, args=()):
574
# Default usage is by a message string, but if a return
575
# code is passed, convert it to a string with
578
if message is None and code is not None:
579
message = gnutls.strerror(code)
580
return super(gnutls.Error, self).__init__(
583
class CertificateSecurityError(Error):
589
self._c_object = gnutls.certificate_credentials_t()
590
gnutls.certificate_allocate_credentials(
591
ctypes.byref(self._c_object))
592
self.type = gnutls.CRD_CERTIFICATE
595
gnutls.certificate_free_credentials(self._c_object)
598
def __init__(self, socket, credentials=None):
599
self._c_object = gnutls.session_t()
600
gnutls_flags = gnutls.CLIENT
601
if gnutls.check_version(b"3.5.6"):
602
gnutls_flags |= gnutls.NO_TICKETS
604
gnutls_flags |= gnutls.ENABLE_RAWPK
605
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
607
gnutls.set_default_priority(self._c_object)
608
gnutls.transport_set_ptr(self._c_object, socket.fileno())
609
gnutls.handshake_set_private_extensions(self._c_object,
612
if credentials is None:
613
credentials = gnutls.Credentials()
614
gnutls.credentials_set(self._c_object, credentials.type,
615
ctypes.cast(credentials._c_object,
617
self.credentials = credentials
620
gnutls.deinit(self._c_object)
623
return gnutls.handshake(self._c_object)
625
def send(self, data):
629
data_len -= gnutls.record_send(self._c_object,
634
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
636
# Error handling functions
637
def _error_code(result):
638
"""A function to raise exceptions on errors, suitable
639
for the 'restype' attribute on ctypes functions"""
642
if result == gnutls.E_NO_CERTIFICATE_FOUND:
643
raise gnutls.CertificateSecurityError(code=result)
644
raise gnutls.Error(code=result)
646
def _retry_on_error(result, func, arguments):
647
"""A function to retry on some errors, suitable
648
for the 'errcheck' attribute on ctypes functions"""
650
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
651
return _error_code(result)
652
result = func(*arguments)
655
# Unless otherwise indicated, the function declarations below are
656
# all from the gnutls/gnutls.h C header file.
659
priority_set_direct = _library.gnutls_priority_set_direct
660
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
661
ctypes.POINTER(ctypes.c_char_p)]
662
priority_set_direct.restype = _error_code
664
init = _library.gnutls_init
665
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
666
init.restype = _error_code
668
set_default_priority = _library.gnutls_set_default_priority
669
set_default_priority.argtypes = [session_t]
670
set_default_priority.restype = _error_code
672
record_send = _library.gnutls_record_send
673
record_send.argtypes = [session_t, ctypes.c_void_p,
675
record_send.restype = ctypes.c_ssize_t
676
record_send.errcheck = _retry_on_error
678
certificate_allocate_credentials = (
679
_library.gnutls_certificate_allocate_credentials)
680
certificate_allocate_credentials.argtypes = [
681
ctypes.POINTER(certificate_credentials_t)]
682
certificate_allocate_credentials.restype = _error_code
684
certificate_free_credentials = (
685
_library.gnutls_certificate_free_credentials)
686
certificate_free_credentials.argtypes = [
687
certificate_credentials_t]
688
certificate_free_credentials.restype = None
690
handshake_set_private_extensions = (
691
_library.gnutls_handshake_set_private_extensions)
692
handshake_set_private_extensions.argtypes = [session_t,
694
handshake_set_private_extensions.restype = None
696
credentials_set = _library.gnutls_credentials_set
697
credentials_set.argtypes = [session_t, credentials_type_t,
699
credentials_set.restype = _error_code
701
strerror = _library.gnutls_strerror
702
strerror.argtypes = [ctypes.c_int]
703
strerror.restype = ctypes.c_char_p
705
certificate_type_get = _library.gnutls_certificate_type_get
706
certificate_type_get.argtypes = [session_t]
707
certificate_type_get.restype = _error_code
709
certificate_get_peers = _library.gnutls_certificate_get_peers
710
certificate_get_peers.argtypes = [session_t,
711
ctypes.POINTER(ctypes.c_uint)]
712
certificate_get_peers.restype = ctypes.POINTER(datum_t)
714
global_set_log_level = _library.gnutls_global_set_log_level
715
global_set_log_level.argtypes = [ctypes.c_int]
716
global_set_log_level.restype = None
718
global_set_log_function = _library.gnutls_global_set_log_function
719
global_set_log_function.argtypes = [log_func]
720
global_set_log_function.restype = None
722
deinit = _library.gnutls_deinit
723
deinit.argtypes = [session_t]
724
deinit.restype = None
726
handshake = _library.gnutls_handshake
727
handshake.argtypes = [session_t]
728
handshake.restype = _error_code
729
handshake.errcheck = _retry_on_error
731
transport_set_ptr = _library.gnutls_transport_set_ptr
732
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
733
transport_set_ptr.restype = None
735
bye = _library.gnutls_bye
736
bye.argtypes = [session_t, close_request_t]
737
bye.restype = _error_code
738
bye.errcheck = _retry_on_error
740
check_version = _library.gnutls_check_version
741
check_version.argtypes = [ctypes.c_char_p]
742
check_version.restype = ctypes.c_char_p
744
_need_version = b"3.3.0"
745
if check_version(_need_version) is None:
746
raise self.Error("Needs GnuTLS {} or later"
747
.format(_need_version))
749
_tls_rawpk_version = b"3.6.6"
750
has_rawpk = bool(check_version(_tls_rawpk_version))
754
class pubkey_st(ctypes.Structure):
756
pubkey_t = ctypes.POINTER(pubkey_st)
758
x509_crt_fmt_t = ctypes.c_int
760
# All the function declarations below are from gnutls/abstract.h
761
pubkey_init = _library.gnutls_pubkey_init
762
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
763
pubkey_init.restype = _error_code
765
pubkey_import = _library.gnutls_pubkey_import
766
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
768
pubkey_import.restype = _error_code
770
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
771
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
772
ctypes.POINTER(ctypes.c_ubyte),
773
ctypes.POINTER(ctypes.c_size_t)]
774
pubkey_get_key_id.restype = _error_code
776
pubkey_deinit = _library.gnutls_pubkey_deinit
777
pubkey_deinit.argtypes = [pubkey_t]
778
pubkey_deinit.restype = None
780
# All the function declarations below are from gnutls/openpgp.h
782
openpgp_crt_init = _library.gnutls_openpgp_crt_init
783
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
784
openpgp_crt_init.restype = _error_code
786
openpgp_crt_import = _library.gnutls_openpgp_crt_import
787
openpgp_crt_import.argtypes = [openpgp_crt_t,
788
ctypes.POINTER(datum_t),
790
openpgp_crt_import.restype = _error_code
792
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
793
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
794
ctypes.POINTER(ctypes.c_uint)]
795
openpgp_crt_verify_self.restype = _error_code
797
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
798
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
799
openpgp_crt_deinit.restype = None
801
openpgp_crt_get_fingerprint = (
802
_library.gnutls_openpgp_crt_get_fingerprint)
803
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
807
openpgp_crt_get_fingerprint.restype = _error_code
809
if check_version(b"3.6.4"):
810
certificate_type_get2 = _library.gnutls_certificate_type_get2
811
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
812
certificate_type_get2.restype = _error_code
814
# Remove non-public functions
815
del _error_code, _retry_on_error
818
437
def call_pipe(connection, # : multiprocessing.Connection
819
438
func, *args, **kwargs):
820
439
"""This function is meant to be called by multiprocessing.Process
822
441
This function runs func(*args, **kwargs), and writes the resulting
823
442
return value on the provided multiprocessing.Connection.
825
444
connection.send(func(*args, **kwargs))
826
445
connection.close()
447
class Client(object):
830
448
"""A representation of a client host served by this server.
833
451
approved: bool(); 'None' if not yet approved/disapproved
834
452
approval_delay: datetime.timedelta(); Time to wait for approval
835
453
approval_duration: datetime.timedelta(); Duration of one approval
836
checker: multiprocessing.Process(); a running checker process used
837
to see if the client lives. 'None' if no process is
839
checker_callback_tag: a GLib event source tag, or None
454
checker: subprocess.Popen(); a running checker process used
455
to see if the client lives.
456
'None' if no process is running.
457
checker_callback_tag: a gobject event source tag, or None
840
458
checker_command: string; External command which is run to check
841
459
if client lives. %() expansions are done at
842
460
runtime with vars(self) as dict, so that for
843
461
instance %(name)s can be used in the command.
844
checker_initiator_tag: a GLib event source tag, or None
462
checker_initiator_tag: a gobject event source tag, or None
845
463
created: datetime.datetime(); (UTC) object creation
846
464
client_structure: Object describing what attributes a client has
847
465
and is used for storing the client at exit
848
466
current_checker_command: string; current running checker_command
849
disable_initiator_tag: a GLib event source tag, or None
467
disable_initiator_tag: a gobject event source tag, or None
851
469
fingerprint: string (40 or 32 hexadecimal digits); used to
852
uniquely identify an OpenPGP client
853
key_id: string (64 hexadecimal digits); used to uniquely identify
854
a client using raw public keys
470
uniquely identify the client
855
471
host: string; available for use by the checker command
856
472
interval: datetime.timedelta(); How often to start a new checker
857
473
last_approval_request: datetime.datetime(); (UTC) or None
2380
1990
delay -= time2 - time
2383
session.send(client.secret)
2384
except gnutls.Error as error:
2385
logger.warning("gnutls send failed",
1993
while sent_size < len(client.secret):
1995
sent = session.send(client.secret[sent_size:])
1996
except gnutls.errors.GNUTLSError as error:
1997
logger.warning("gnutls send failed",
2000
logger.debug("Sent: %d, remaining: %d", sent,
2001
len(client.secret) - (sent_size
2389
2005
logger.info("Sending secret to %s", client.name)
2390
2006
# bump the timeout using extended_timeout
2391
2007
client.bump_timeout(client.extended_timeout)
2392
2008
if self.server.use_dbus:
2393
2009
# Emit D-Bus signal
2394
2010
client.GotSecret()
2397
2013
if approval_required:
2398
2014
client.approvals_pending -= 1
2401
except gnutls.Error as error:
2017
except gnutls.errors.GNUTLSError as error:
2402
2018
logger.warning("GnuTLS bye failed",
2403
2019
exc_info=error)
2406
2022
def peer_certificate(session):
2407
"Return the peer's certificate as a bytestring"
2409
cert_type = gnutls.certificate_type_get2(session._c_object,
2411
except AttributeError:
2412
cert_type = gnutls.certificate_type_get(session._c_object)
2413
if gnutls.has_rawpk:
2414
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2416
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2417
# If not a valid certificate type...
2418
if cert_type not in valid_cert_types:
2419
logger.info("Cert type %r not in %r", cert_type,
2421
# ...return invalid data
2023
"Return the peer's OpenPGP certificate as a bytestring"
2024
# If not an OpenPGP certificate...
2025
if (gnutls.library.functions.gnutls_certificate_type_get(
2027
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
2028
# ...do the normal thing
2029
return session.peer_certificate
2423
2030
list_size = ctypes.c_uint(1)
2424
cert_list = (gnutls.certificate_get_peers
2031
cert_list = (gnutls.library.functions
2032
.gnutls_certificate_get_peers
2425
2033
(session._c_object, ctypes.byref(list_size)))
2426
2034
if not bool(cert_list) and list_size.value != 0:
2427
raise gnutls.Error("error getting peer certificate")
2035
raise gnutls.errors.GNUTLSError("error getting peer"
2428
2037
if list_size.value == 0:
2430
2039
cert = cert_list[0]
2431
2040
return ctypes.string_at(cert.data, cert.size)
2434
def key_id(certificate):
2435
"Convert a certificate bytestring to a hexdigit key ID"
2436
# New GnuTLS "datum" with the public key
2437
datum = gnutls.datum_t(
2438
ctypes.cast(ctypes.c_char_p(certificate),
2439
ctypes.POINTER(ctypes.c_ubyte)),
2440
ctypes.c_uint(len(certificate)))
2441
# XXX all these need to be created in the gnutls "module"
2442
# New empty GnuTLS certificate
2443
pubkey = gnutls.pubkey_t()
2444
gnutls.pubkey_init(ctypes.byref(pubkey))
2445
# Import the raw public key into the certificate
2446
gnutls.pubkey_import(pubkey,
2447
ctypes.byref(datum),
2448
gnutls.X509_FMT_DER)
2449
# New buffer for the key ID
2450
buf = ctypes.create_string_buffer(32)
2451
buf_len = ctypes.c_size_t(len(buf))
2452
# Get the key ID from the raw public key into the buffer
2453
gnutls.pubkey_get_key_id(pubkey,
2454
gnutls.KEYID_USE_SHA256,
2455
ctypes.cast(ctypes.byref(buf),
2456
ctypes.POINTER(ctypes.c_ubyte)),
2457
ctypes.byref(buf_len))
2458
# Deinit the certificate
2459
gnutls.pubkey_deinit(pubkey)
2461
# Convert the buffer to a Python bytestring
2462
key_id = ctypes.string_at(buf, buf_len.value)
2463
# Convert the bytestring to hexadecimal notation
2464
hex_key_id = binascii.hexlify(key_id).upper()
2468
2043
def fingerprint(openpgp):
2469
2044
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2470
2045
# New GnuTLS "datum" with the OpenPGP public key
2471
datum = gnutls.datum_t(
2046
datum = gnutls.library.types.gnutls_datum_t(
2472
2047
ctypes.cast(ctypes.c_char_p(openpgp),
2473
2048
ctypes.POINTER(ctypes.c_ubyte)),
2474
2049
ctypes.c_uint(len(openpgp)))
2475
2050
# New empty GnuTLS certificate
2476
crt = gnutls.openpgp_crt_t()
2477
gnutls.openpgp_crt_init(ctypes.byref(crt))
2051
crt = gnutls.library.types.gnutls_openpgp_crt_t()
2052
gnutls.library.functions.gnutls_openpgp_crt_init(
2478
2054
# Import the OpenPGP public key into the certificate
2479
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2480
gnutls.OPENPGP_FMT_RAW)
2055
gnutls.library.functions.gnutls_openpgp_crt_import(
2056
crt, ctypes.byref(datum),
2057
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2481
2058
# Verify the self signature in the key
2482
2059
crtverify = ctypes.c_uint()
2483
gnutls.openpgp_crt_verify_self(crt, 0,
2484
ctypes.byref(crtverify))
2060
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
2061
crt, 0, ctypes.byref(crtverify))
2485
2062
if crtverify.value != 0:
2486
gnutls.openpgp_crt_deinit(crt)
2487
raise gnutls.CertificateSecurityError(code
2063
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2064
raise gnutls.errors.CertificateSecurityError(
2489
2066
# New buffer for the fingerprint
2490
2067
buf = ctypes.create_string_buffer(20)
2491
2068
buf_len = ctypes.c_size_t()
2492
2069
# Get the fingerprint from the certificate into the buffer
2493
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2494
ctypes.byref(buf_len))
2070
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
2071
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2495
2072
# Deinit the certificate
2496
gnutls.openpgp_crt_deinit(crt)
2073
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2497
2074
# Convert the buffer to a Python bytestring
2498
2075
fpr = ctypes.string_at(buf, buf_len.value)
2499
2076
# Convert the bytestring to hexadecimal notation
2588
2164
# socket_wrapper(), if socketfd was set.
2589
2165
socketserver.TCPServer.__init__(self, server_address,
2590
2166
RequestHandlerClass)
2592
2168
def server_bind(self):
2593
2169
"""This overrides the normal server_bind() function
2594
2170
to bind to an interface if one was specified, and also NOT to
2595
2171
bind to an address or port if they were not specified."""
2596
global SO_BINDTODEVICE
2597
2172
if self.interface is not None:
2598
2173
if SO_BINDTODEVICE is None:
2599
# Fall back to a hard-coded value which seems to be
2601
logger.warning("SO_BINDTODEVICE not found, trying 25")
2602
SO_BINDTODEVICE = 25
2604
self.socket.setsockopt(
2605
socket.SOL_SOCKET, SO_BINDTODEVICE,
2606
(self.interface + "\0").encode("utf-8"))
2607
except socket.error as error:
2608
if error.errno == errno.EPERM:
2609
logger.error("No permission to bind to"
2610
" interface %s", self.interface)
2611
elif error.errno == errno.ENOPROTOOPT:
2612
logger.error("SO_BINDTODEVICE not available;"
2613
" cannot bind to interface %s",
2615
elif error.errno == errno.ENODEV:
2616
logger.error("Interface %s does not exist,"
2617
" cannot bind", self.interface)
2174
logger.error("SO_BINDTODEVICE does not exist;"
2175
" cannot bind to interface %s",
2179
self.socket.setsockopt(
2180
socket.SOL_SOCKET, SO_BINDTODEVICE,
2181
(self.interface + "\0").encode("utf-8"))
2182
except socket.error as error:
2183
if error.errno == errno.EPERM:
2184
logger.error("No permission to bind to"
2185
" interface %s", self.interface)
2186
elif error.errno == errno.ENOPROTOOPT:
2187
logger.error("SO_BINDTODEVICE not available;"
2188
" cannot bind to interface %s",
2190
elif error.errno == errno.ENODEV:
2191
logger.error("Interface %s does not exist,"
2192
" cannot bind", self.interface)
2620
2195
# Only bind(2) the socket if we really need to.
2621
2196
if self.server_address[0] or self.server_address[1]:
2622
if self.server_address[1]:
2623
self.allow_reuse_address = True
2624
2197
if not self.server_address[0]:
2625
2198
if self.address_family == socket.AF_INET6:
2626
any_address = "::" # in6addr_any
2199
any_address = "::" # in6addr_any
2628
any_address = "0.0.0.0" # INADDR_ANY
2201
any_address = "0.0.0.0" # INADDR_ANY
2629
2202
self.server_address = (any_address,
2630
2203
self.server_address[1])
2631
2204
elif not self.server_address[1]:
2665
2238
self.gnutls_priority = gnutls_priority
2666
2239
IPv6_TCPServer.__init__(self, server_address,
2667
2240
RequestHandlerClass,
2668
interface=interface,
2241
interface = interface,
2242
use_ipv6 = use_ipv6,
2243
socketfd = socketfd)
2672
2245
def server_activate(self):
2673
2246
if self.enabled:
2674
2247
return socketserver.TCPServer.server_activate(self)
2676
2249
def enable(self):
2677
2250
self.enabled = True
2679
2252
def add_pipe(self, parent_pipe, proc):
2680
2253
# Call "handle_ipc" for both data and EOF events
2682
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2683
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2254
gobject.io_add_watch(
2255
parent_pipe.fileno(),
2256
gobject.IO_IN | gobject.IO_HUP,
2684
2257
functools.partial(self.handle_ipc,
2685
parent_pipe=parent_pipe,
2258
parent_pipe = parent_pipe,
2688
2261
def handle_ipc(self, source, condition,
2689
2262
parent_pipe=None,
2691
2264
client_object=None):
2692
2265
# error, or the other end of multiprocessing.Pipe has closed
2693
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2266
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2694
2267
# Wait for other process to exit
2698
2271
# Read a request from the child
2699
2272
request = parent_pipe.recv()
2700
2273
command = request[0]
2702
2275
if command == 'init':
2703
key_id = request[1].decode("ascii")
2704
fpr = request[2].decode("ascii")
2705
address = request[3]
2707
for c in self.clients.values():
2708
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2710
if key_id and c.key_id == key_id:
2713
if fpr and c.fingerprint == fpr:
2277
address = request[2]
2279
for c in self.clients.itervalues():
2280
if c.fingerprint == fpr:
2717
logger.info("Client not found for key ID: %s, address"
2718
": %s", key_id or fpr, address)
2284
logger.info("Client not found for fingerprint: %s, ad"
2285
"dress: %s", fpr, address)
2719
2286
if self.use_dbus:
2720
2287
# Emit D-Bus signal
2721
mandos_dbus_service.ClientNotFound(key_id or fpr,
2288
mandos_dbus_service.ClientNotFound(fpr,
2723
2290
parent_pipe.send(False)
2727
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2728
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2293
gobject.io_add_watch(
2294
parent_pipe.fileno(),
2295
gobject.IO_IN | gobject.IO_HUP,
2729
2296
functools.partial(self.handle_ipc,
2730
parent_pipe=parent_pipe,
2732
client_object=client))
2297
parent_pipe = parent_pipe,
2299
client_object = client))
2733
2300
parent_pipe.send(True)
2734
2301
# remove the old hook in favor of the new above hook on
3192
2749
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3193
2750
service = AvahiServiceToSyslog(
3194
name=server_settings["servicename"],
3195
servicetype="_mandos._tcp",
2751
name = server_settings["servicename"],
2752
servicetype = "_mandos._tcp",
2753
protocol = protocol,
3198
2755
if server_settings["interface"]:
3199
2756
service.interface = if_nametoindex(
3200
2757
server_settings["interface"].encode("utf-8"))
3202
2759
global multiprocessing_manager
3203
2760
multiprocessing_manager = multiprocessing.Manager()
3205
2762
client_class = Client
3207
client_class = functools.partial(ClientDBus, bus=bus)
2764
client_class = functools.partial(ClientDBus, bus = bus)
3209
2766
client_settings = Client.config_parser(client_config)
3210
2767
old_client_settings = {}
3211
2768
clients_data = {}
3213
2770
# This is used to redirect stdout and stderr for checker processes
3215
wnull = open(os.devnull, "w") # A writable /dev/null
2772
wnull = open(os.devnull, "w") # A writable /dev/null
3216
2773
# Only used if server is running in foreground but not in debug
3218
2775
if debug or not foreground:
3221
2778
# Get client data and settings from last running state.
3222
2779
if server_settings["restore"]:
3224
2781
with open(stored_state_path, "rb") as stored_state:
3225
if sys.version_info.major == 2:
3226
clients_data, old_client_settings = pickle.load(
3229
bytes_clients_data, bytes_old_client_settings = (
3230
pickle.load(stored_state, encoding="bytes"))
3231
# Fix bytes to strings
3234
clients_data = {(key.decode("utf-8")
3235
if isinstance(key, bytes)
3238
bytes_clients_data.items()}
3239
del bytes_clients_data
3240
for key in clients_data:
3241
value = {(k.decode("utf-8")
3242
if isinstance(k, bytes) else k): v
3244
clients_data[key].items()}
3245
clients_data[key] = value
3247
value["client_structure"] = [
3249
if isinstance(s, bytes)
3251
value["client_structure"]]
3252
# .name, .host, and .checker_command
3253
for k in ("name", "host", "checker_command"):
3254
if isinstance(value[k], bytes):
3255
value[k] = value[k].decode("utf-8")
3256
if "key_id" not in value:
3257
value["key_id"] = ""
3258
elif "fingerprint" not in value:
3259
value["fingerprint"] = ""
3260
# old_client_settings
3262
old_client_settings = {
3263
(key.decode("utf-8")
3264
if isinstance(key, bytes)
3267
bytes_old_client_settings.items()}
3268
del bytes_old_client_settings
3269
# .host and .checker_command
3270
for value in old_client_settings.values():
3271
for attribute in ("host", "checker_command"):
3272
if isinstance(value[attribute], bytes):
3273
value[attribute] = (value[attribute]
2782
clients_data, old_client_settings = pickle.load(
3275
2784
os.remove(stored_state_path)
3276
2785
except IOError as e:
3277
2786
if e.errno == errno.ENOENT: