2
2
# -*- mode: python; coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
17
# This file is part of Mandos.
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
32
31
# Contact the authors at <mandos@recompile.se>.
35
34
from __future__ import (division, absolute_import, print_function,
39
from future_builtins import *
37
from future_builtins import *
44
40
import SocketServer as socketserver
247
212
'--passphrase-file',
249
214
+ self.gnupgargs,
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
ciphertext, err = proc.communicate(input = data)
254
219
if proc.returncode != 0:
255
220
raise PGPError(err)
256
221
return ciphertext
258
223
def decrypt(self, data, password):
259
224
passphrase = self.password_encode(password)
260
225
with tempfile.NamedTemporaryFile(
261
dir=self.tempdir) as passfile:
226
dir = self.tempdir) as passfile:
262
227
passfile.write(passphrase)
264
229
proc = subprocess.Popen([self.gpg, '--decrypt',
265
230
'--passphrase-file',
267
232
+ self.gnupgargs,
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
decrypted_plaintext, err = proc.communicate(input = data)
272
237
if proc.returncode != 0:
273
238
raise PGPError(err)
274
239
return decrypted_plaintext
277
# Pretend that we have an Avahi module
279
"""This isn't so much a class as it is a module-like namespace.
280
It is instantiated once, and simulates having an Avahi module."""
281
IF_UNSPEC = -1 # avahi-common/address.h
282
PROTO_UNSPEC = -1 # avahi-common/address.h
283
PROTO_INET = 0 # avahi-common/address.h
284
PROTO_INET6 = 1 # avahi-common/address.h
285
DBUS_NAME = "org.freedesktop.Avahi"
286
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
287
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
288
DBUS_PATH_SERVER = "/"
290
def string_array_to_txt_array(self, t):
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
304
242
class AvahiError(Exception):
305
243
def __init__(self, value, *args, **kwargs):
306
244
self.value = value
496
434
class AvahiServiceToSyslog(AvahiService):
497
435
def rename(self, *args, **kwargs):
498
436
"""Add the new name to the syslog messages"""
499
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
437
ret = AvahiService.rename(self, *args, **kwargs)
500
438
syslogger.setFormatter(logging.Formatter(
501
439
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
502
440
.format(self.name)))
506
443
# Pretend that we have a GnuTLS module
507
444
class GnuTLS(object):
508
445
"""This isn't so much a class as it is a module-like namespace.
509
446
It is instantiated once, and simulates having a GnuTLS module."""
511
library = ctypes.util.find_library("gnutls")
513
library = ctypes.util.find_library("gnutls-deb0")
514
_library = ctypes.cdll.LoadLibrary(library)
516
_need_version = b"3.3.0"
517
_tls_rawpk_version = b"3.6.6"
448
_library = ctypes.cdll.LoadLibrary(
449
ctypes.util.find_library("gnutls"))
450
_need_version = "3.3.0"
519
451
def __init__(self):
520
# Need to use "self" here, since this method is called before
521
# the assignment to the "gnutls" global variable happens.
522
if self.check_version(self._need_version) is None:
523
raise self.Error("Needs GnuTLS {} or later"
524
.format(self._need_version))
452
# Need to use class name "GnuTLS" here, since this method is
453
# called before the assignment to the "gnutls" global variable
455
if GnuTLS.check_version(self._need_version) is None:
456
raise GnuTLS.Error("Needs GnuTLS {} or later"
457
.format(self._need_version))
526
459
# Unless otherwise indicated, the constants and types below are
527
460
# all from the gnutls/gnutls.h C header file.
531
464
E_INTERRUPTED = -52
537
469
CRD_CERTIFICATE = 1
538
470
E_NO_CERTIFICATE_FOUND = -49
543
KEYID_USE_SHA256 = 1 # gnutls/x509.h
544
471
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
547
474
class session_int(ctypes.Structure):
549
476
session_t = ctypes.POINTER(session_int)
551
477
class certificate_credentials_st(ctypes.Structure):
553
479
certificate_credentials_t = ctypes.POINTER(
554
480
certificate_credentials_st)
555
481
certificate_type_t = ctypes.c_int
557
482
class datum_t(ctypes.Structure):
558
483
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
559
484
('size', ctypes.c_uint)]
561
485
class openpgp_crt_int(ctypes.Structure):
563
487
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
564
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
488
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
565
489
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
566
credentials_type_t = ctypes.c_int
490
credentials_type_t = ctypes.c_int #
567
491
transport_ptr_t = ctypes.c_void_p
568
492
close_request_t = ctypes.c_int
571
495
class Error(Exception):
572
496
# We need to use the class name "GnuTLS" here, since this
573
497
# exception might be raised from within GnuTLS.__init__,
574
498
# which is called before the assignment to the "gnutls"
575
499
# global variable has happened.
576
def __init__(self, message=None, code=None, args=()):
500
def __init__(self, message = None, code = None, args=()):
577
501
# Default usage is by a message string, but if a return
578
502
# code is passed, convert it to a string with
579
503
# gnutls.strerror()
654
572
return _error_code(result)
655
573
result = func(*arguments)
658
576
# Unless otherwise indicated, the function declarations below are
659
577
# all from the gnutls/gnutls.h C header file.
662
580
priority_set_direct = _library.gnutls_priority_set_direct
663
581
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
664
582
ctypes.POINTER(ctypes.c_char_p)]
665
583
priority_set_direct.restype = _error_code
667
585
init = _library.gnutls_init
668
586
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
669
587
init.restype = _error_code
671
589
set_default_priority = _library.gnutls_set_default_priority
672
590
set_default_priority.argtypes = [session_t]
673
591
set_default_priority.restype = _error_code
675
593
record_send = _library.gnutls_record_send
676
594
record_send.argtypes = [session_t, ctypes.c_void_p,
678
596
record_send.restype = ctypes.c_ssize_t
679
597
record_send.errcheck = _retry_on_error
681
599
certificate_allocate_credentials = (
682
600
_library.gnutls_certificate_allocate_credentials)
683
601
certificate_allocate_credentials.argtypes = [
684
602
ctypes.POINTER(certificate_credentials_t)]
685
603
certificate_allocate_credentials.restype = _error_code
687
605
certificate_free_credentials = (
688
606
_library.gnutls_certificate_free_credentials)
689
certificate_free_credentials.argtypes = [
690
certificate_credentials_t]
607
certificate_free_credentials.argtypes = [certificate_credentials_t]
691
608
certificate_free_credentials.restype = None
693
610
handshake_set_private_extensions = (
694
611
_library.gnutls_handshake_set_private_extensions)
695
612
handshake_set_private_extensions.argtypes = [session_t,
697
614
handshake_set_private_extensions.restype = None
699
616
credentials_set = _library.gnutls_credentials_set
700
617
credentials_set.argtypes = [session_t, credentials_type_t,
702
619
credentials_set.restype = _error_code
704
621
strerror = _library.gnutls_strerror
705
622
strerror.argtypes = [ctypes.c_int]
706
623
strerror.restype = ctypes.c_char_p
708
625
certificate_type_get = _library.gnutls_certificate_type_get
709
626
certificate_type_get.argtypes = [session_t]
710
627
certificate_type_get.restype = _error_code
712
629
certificate_get_peers = _library.gnutls_certificate_get_peers
713
630
certificate_get_peers.argtypes = [session_t,
714
631
ctypes.POINTER(ctypes.c_uint)]
715
632
certificate_get_peers.restype = ctypes.POINTER(datum_t)
717
634
global_set_log_level = _library.gnutls_global_set_log_level
718
635
global_set_log_level.argtypes = [ctypes.c_int]
719
636
global_set_log_level.restype = None
721
638
global_set_log_function = _library.gnutls_global_set_log_function
722
639
global_set_log_function.argtypes = [log_func]
723
640
global_set_log_function.restype = None
725
642
deinit = _library.gnutls_deinit
726
643
deinit.argtypes = [session_t]
727
644
deinit.restype = None
729
646
handshake = _library.gnutls_handshake
730
647
handshake.argtypes = [session_t]
731
648
handshake.restype = _error_code
732
649
handshake.errcheck = _retry_on_error
734
651
transport_set_ptr = _library.gnutls_transport_set_ptr
735
652
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
736
653
transport_set_ptr.restype = None
738
655
bye = _library.gnutls_bye
739
656
bye.argtypes = [session_t, close_request_t]
740
657
bye.restype = _error_code
741
658
bye.errcheck = _retry_on_error
743
660
check_version = _library.gnutls_check_version
744
661
check_version.argtypes = [ctypes.c_char_p]
745
662
check_version.restype = ctypes.c_char_p
747
has_rawpk = bool(check_version(_tls_rawpk_version))
751
class pubkey_st(ctypes.Structure):
753
pubkey_t = ctypes.POINTER(pubkey_st)
755
x509_crt_fmt_t = ctypes.c_int
757
# All the function declarations below are from gnutls/abstract.h
758
pubkey_init = _library.gnutls_pubkey_init
759
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
760
pubkey_init.restype = _error_code
762
pubkey_import = _library.gnutls_pubkey_import
763
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
765
pubkey_import.restype = _error_code
767
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
768
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
769
ctypes.POINTER(ctypes.c_ubyte),
770
ctypes.POINTER(ctypes.c_size_t)]
771
pubkey_get_key_id.restype = _error_code
773
pubkey_deinit = _library.gnutls_pubkey_deinit
774
pubkey_deinit.argtypes = [pubkey_t]
775
pubkey_deinit.restype = None
777
# All the function declarations below are from gnutls/openpgp.h
779
openpgp_crt_init = _library.gnutls_openpgp_crt_init
780
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
781
openpgp_crt_init.restype = _error_code
783
openpgp_crt_import = _library.gnutls_openpgp_crt_import
784
openpgp_crt_import.argtypes = [openpgp_crt_t,
785
ctypes.POINTER(datum_t),
787
openpgp_crt_import.restype = _error_code
789
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
790
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
791
ctypes.POINTER(ctypes.c_uint)]
792
openpgp_crt_verify_self.restype = _error_code
794
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
795
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
796
openpgp_crt_deinit.restype = None
798
openpgp_crt_get_fingerprint = (
799
_library.gnutls_openpgp_crt_get_fingerprint)
800
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
804
openpgp_crt_get_fingerprint.restype = _error_code
806
if check_version("3.6.4"):
807
certificate_type_get2 = _library.gnutls_certificate_type_get2
808
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
809
certificate_type_get2.restype = _error_code
664
# All the function declarations below are from gnutls/openpgp.h
666
openpgp_crt_init = _library.gnutls_openpgp_crt_init
667
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
668
openpgp_crt_init.restype = _error_code
670
openpgp_crt_import = _library.gnutls_openpgp_crt_import
671
openpgp_crt_import.argtypes = [openpgp_crt_t,
672
ctypes.POINTER(datum_t),
674
openpgp_crt_import.restype = _error_code
676
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
677
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
678
ctypes.POINTER(ctypes.c_uint)]
679
openpgp_crt_verify_self.restype = _error_code
681
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
682
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
683
openpgp_crt_deinit.restype = None
685
openpgp_crt_get_fingerprint = (
686
_library.gnutls_openpgp_crt_get_fingerprint)
687
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
691
openpgp_crt_get_fingerprint.restype = _error_code
811
693
# Remove non-public functions
812
694
del _error_code, _retry_on_error
813
695
# Create the global "gnutls" object, simulating a module
814
696
gnutls = GnuTLS()
817
698
def call_pipe(connection, # : multiprocessing.Connection
818
699
func, *args, **kwargs):
819
700
"""This function is meant to be called by multiprocessing.Process
821
702
This function runs func(*args, **kwargs), and writes the resulting
822
703
return value on the provided multiprocessing.Connection.
824
705
connection.send(func(*args, **kwargs))
825
706
connection.close()
828
708
class Client(object):
829
709
"""A representation of a client host served by this server.
832
712
approved: bool(); 'None' if not yet approved/disapproved
833
713
approval_delay: datetime.timedelta(); Time to wait for approval
835
715
checker: subprocess.Popen(); a running checker process used
836
716
to see if the client lives.
837
717
'None' if no process is running.
838
checker_callback_tag: a GLib event source tag, or None
718
checker_callback_tag: a gobject event source tag, or None
839
719
checker_command: string; External command which is run to check
840
720
if client lives. %() expansions are done at
841
721
runtime with vars(self) as dict, so that for
842
722
instance %(name)s can be used in the command.
843
checker_initiator_tag: a GLib event source tag, or None
723
checker_initiator_tag: a gobject event source tag, or None
844
724
created: datetime.datetime(); (UTC) object creation
845
725
client_structure: Object describing what attributes a client has
846
726
and is used for storing the client at exit
847
727
current_checker_command: string; current running checker_command
848
disable_initiator_tag: a GLib event source tag, or None
728
disable_initiator_tag: a gobject event source tag, or None
850
730
fingerprint: string (40 or 32 hexadecimal digits); used to
851
uniquely identify an OpenPGP client
852
key_id: string (64 hexadecimal digits); used to uniquely identify
853
a client using raw public keys
731
uniquely identify the client
854
732
host: string; available for use by the checker command
855
733
interval: datetime.timedelta(); How often to start a new checker
856
734
last_approval_request: datetime.datetime(); (UTC) or None
1013
886
logger.info("Disabling client %s", self.name)
1014
887
if getattr(self, "disable_initiator_tag", None) is not None:
1015
GLib.source_remove(self.disable_initiator_tag)
888
gobject.source_remove(self.disable_initiator_tag)
1016
889
self.disable_initiator_tag = None
1017
890
self.expires = None
1018
891
if getattr(self, "checker_initiator_tag", None) is not None:
1019
GLib.source_remove(self.checker_initiator_tag)
892
gobject.source_remove(self.checker_initiator_tag)
1020
893
self.checker_initiator_tag = None
1021
894
self.stop_checker()
1022
895
self.enabled = False
1024
897
self.send_changedstate()
1025
# Do not run this again if called by a GLib.timeout_add
898
# Do not run this again if called by a gobject.timeout_add
1028
901
def __del__(self):
1031
904
def init_checker(self):
1032
905
# Schedule a new checker to be started an 'interval' from now,
1033
906
# and every interval from then on.
1034
907
if self.checker_initiator_tag is not None:
1035
GLib.source_remove(self.checker_initiator_tag)
1036
self.checker_initiator_tag = GLib.timeout_add(
908
gobject.source_remove(self.checker_initiator_tag)
909
self.checker_initiator_tag = gobject.timeout_add(
1037
910
int(self.interval.total_seconds() * 1000),
1038
911
self.start_checker)
1039
912
# Schedule a disable() when 'timeout' has passed
1040
913
if self.disable_initiator_tag is not None:
1041
GLib.source_remove(self.disable_initiator_tag)
1042
self.disable_initiator_tag = GLib.timeout_add(
914
gobject.source_remove(self.disable_initiator_tag)
915
self.disable_initiator_tag = gobject.timeout_add(
1043
916
int(self.timeout.total_seconds() * 1000), self.disable)
1044
917
# Also start a new checker *right now*.
1045
918
self.start_checker()
1047
920
def checker_callback(self, source, condition, connection,
1049
922
"""The checker has completed, so take appropriate actions."""
1132
1005
# The exception is when not debugging but nevertheless
1133
1006
# running in the foreground; use the previously
1134
1007
# created wnull.
1135
popen_args = {"close_fds": True,
1008
popen_args = { "close_fds": True,
1138
1011
if (not self.server_settings["debug"]
1139
1012
and self.server_settings["foreground"]):
1140
1013
popen_args.update({"stdout": wnull,
1142
pipe = multiprocessing.Pipe(duplex=False)
1015
pipe = multiprocessing.Pipe(duplex = False)
1143
1016
self.checker = multiprocessing.Process(
1145
args=(pipe[1], subprocess.call, command),
1018
args = (pipe[1], subprocess.call, command),
1019
kwargs = popen_args)
1147
1020
self.checker.start()
1148
self.checker_callback_tag = GLib.io_add_watch(
1149
pipe[0].fileno(), GLib.IO_IN,
1021
self.checker_callback_tag = gobject.io_add_watch(
1022
pipe[0].fileno(), gobject.IO_IN,
1150
1023
self.checker_callback, pipe[0], command)
1151
# Re-run this periodically if run by GLib.timeout_add
1024
# Re-run this periodically if run by gobject.timeout_add
1154
1027
def stop_checker(self):
1155
1028
"""Force the checker process, if any, to stop."""
1156
1029
if self.checker_callback_tag:
1157
GLib.source_remove(self.checker_callback_tag)
1030
gobject.source_remove(self.checker_callback_tag)
1158
1031
self.checker_callback_tag = None
1159
1032
if getattr(self, "checker", None) is None:
1514
1387
exc_info=error)
1515
1388
return xmlstring
1519
1391
dbus.OBJECT_MANAGER_IFACE
1520
1392
except AttributeError:
1521
1393
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1524
1395
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1525
1396
"""A D-Bus object with an ObjectManager.
1527
1398
Classes inheriting from this exposes the standard
1528
1399
GetManagedObjects call and the InterfacesAdded and
1529
1400
InterfacesRemoved signals on the standard
1530
1401
"org.freedesktop.DBus.ObjectManager" interface.
1532
1403
Note: No signals are sent automatically; they must be sent
1535
1406
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1536
out_signature="a{oa{sa{sv}}}")
1407
out_signature = "a{oa{sa{sv}}}")
1537
1408
def GetManagedObjects(self):
1538
1409
"""This function must be overridden"""
1539
1410
raise NotImplementedError()
1541
1412
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1542
signature="oa{sa{sv}}")
1413
signature = "oa{sa{sv}}")
1543
1414
def InterfacesAdded(self, object_path, interfaces_and_properties):
1546
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1417
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1547
1418
def InterfacesRemoved(self, object_path, interfaces):
1550
1421
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1552
path_keyword='object_path',
1553
connection_keyword='connection')
1422
out_signature = "s",
1423
path_keyword = 'object_path',
1424
connection_keyword = 'connection')
1554
1425
def Introspect(self, object_path, connection):
1555
1426
"""Overloading of standard D-Bus method.
1557
1428
Override return argument name of GetManagedObjects to be
1558
1429
"objpath_interfaces_and_properties"
1637
1507
interface_names.add(alt_interface)
1638
1508
# Is this a D-Bus signal?
1639
1509
if getattr(attribute, "_dbus_is_signal", False):
1640
# Extract the original non-method undecorated
1641
# function by black magic
1642
1510
if sys.version_info.major == 2:
1511
# Extract the original non-method undecorated
1512
# function by black magic
1643
1513
nonmethod_func = (dict(
1644
1514
zip(attribute.func_code.co_freevars,
1645
1515
attribute.__closure__))
1646
1516
["func"].cell_contents)
1648
nonmethod_func = (dict(
1649
zip(attribute.__code__.co_freevars,
1650
attribute.__closure__))
1651
["func"].cell_contents)
1518
nonmethod_func = attribute
1652
1519
# Create a new, but exactly alike, function
1653
1520
# object, and decorate it to be a new D-Bus signal
1654
1521
# with the alternate D-Bus interface name
1655
new_function = copy_function(nonmethod_func)
1522
if sys.version_info.major == 2:
1523
new_function = types.FunctionType(
1524
nonmethod_func.func_code,
1525
nonmethod_func.func_globals,
1526
nonmethod_func.func_name,
1527
nonmethod_func.func_defaults,
1528
nonmethod_func.func_closure)
1530
new_function = types.FunctionType(
1531
nonmethod_func.__code__,
1532
nonmethod_func.__globals__,
1533
nonmethod_func.__name__,
1534
nonmethod_func.__defaults__,
1535
nonmethod_func.__closure__)
1656
1536
new_function = (dbus.service.signal(
1658
1538
attribute._dbus_signature)(new_function))
1853
1740
"ApprovedByDefault")
1854
1741
approval_delay = notifychangeproperty(
1855
1742
dbus.UInt64, "ApprovalDelay",
1856
type_func=lambda td: td.total_seconds() * 1000)
1743
type_func = lambda td: td.total_seconds() * 1000)
1857
1744
approval_duration = notifychangeproperty(
1858
1745
dbus.UInt64, "ApprovalDuration",
1859
type_func=lambda td: td.total_seconds() * 1000)
1746
type_func = lambda td: td.total_seconds() * 1000)
1860
1747
host = notifychangeproperty(dbus.String, "Host")
1861
1748
timeout = notifychangeproperty(
1862
1749
dbus.UInt64, "Timeout",
1863
type_func=lambda td: td.total_seconds() * 1000)
1750
type_func = lambda td: td.total_seconds() * 1000)
1864
1751
extended_timeout = notifychangeproperty(
1865
1752
dbus.UInt64, "ExtendedTimeout",
1866
type_func=lambda td: td.total_seconds() * 1000)
1753
type_func = lambda td: td.total_seconds() * 1000)
1867
1754
interval = notifychangeproperty(
1868
1755
dbus.UInt64, "Interval",
1869
type_func=lambda td: td.total_seconds() * 1000)
1756
type_func = lambda td: td.total_seconds() * 1000)
1870
1757
checker_command = notifychangeproperty(dbus.String, "Checker")
1871
1758
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1872
1759
invalidate_only=True)
1874
1761
del notifychangeproperty
1876
1763
def __del__(self, *args, **kwargs):
1878
1765
self.remove_from_connection()
2250
2130
class ClientHandler(socketserver.BaseRequestHandler, object):
2251
2131
"""A class to handle client connections.
2253
2133
Instantiated once for each connection to handle it.
2254
2134
Note: This will run in its own forked process."""
2256
2136
def handle(self):
2257
2137
with contextlib.closing(self.server.child_pipe) as child_pipe:
2258
2138
logger.info("TCP connection from: %s",
2259
2139
str(self.client_address))
2260
2140
logger.debug("Pipe FD: %d",
2261
2141
self.server.child_pipe.fileno())
2263
2143
session = gnutls.ClientSession(self.request)
2265
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2266
# "+AES-256-CBC", "+SHA1",
2267
# "+COMP-NULL", "+CTYPE-OPENPGP",
2145
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2146
# "+AES-256-CBC", "+SHA1",
2147
# "+COMP-NULL", "+CTYPE-OPENPGP",
2269
2149
# Use a fallback default, since this MUST be set.
2270
2150
priority = self.server.gnutls_priority
2271
2151
if priority is None:
2272
2152
priority = "NORMAL"
2273
gnutls.priority_set_direct(session._c_object,
2274
priority.encode("utf-8"),
2153
gnutls.priority_set_direct(session._c_object, priority,
2277
2156
# Start communication using the Mandos protocol
2278
2157
# Get protocol number
2279
2158
line = self.request.makefile().readline()
2427
2284
cert = cert_list[0]
2428
2285
return ctypes.string_at(cert.data, cert.size)
2431
def key_id(certificate):
2432
"Convert a certificate bytestring to a hexdigit key ID"
2433
# New GnuTLS "datum" with the public key
2434
datum = gnutls.datum_t(
2435
ctypes.cast(ctypes.c_char_p(certificate),
2436
ctypes.POINTER(ctypes.c_ubyte)),
2437
ctypes.c_uint(len(certificate)))
2438
# XXX all these need to be created in the gnutls "module"
2439
# New empty GnuTLS certificate
2440
pubkey = gnutls.pubkey_t()
2441
gnutls.pubkey_init(ctypes.byref(pubkey))
2442
# Import the raw public key into the certificate
2443
gnutls.pubkey_import(pubkey,
2444
ctypes.byref(datum),
2445
gnutls.X509_FMT_DER)
2446
# New buffer for the key ID
2447
buf = ctypes.create_string_buffer(32)
2448
buf_len = ctypes.c_size_t(len(buf))
2449
# Get the key ID from the raw public key into the buffer
2450
gnutls.pubkey_get_key_id(pubkey,
2451
gnutls.KEYID_USE_SHA256,
2452
ctypes.cast(ctypes.byref(buf),
2453
ctypes.POINTER(ctypes.c_ubyte)),
2454
ctypes.byref(buf_len))
2455
# Deinit the certificate
2456
gnutls.pubkey_deinit(pubkey)
2458
# Convert the buffer to a Python bytestring
2459
key_id = ctypes.string_at(buf, buf_len.value)
2460
# Convert the bytestring to hexadecimal notation
2461
hex_key_id = binascii.hexlify(key_id).upper()
2465
2288
def fingerprint(openpgp):
2466
2289
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2501
2323
class MultiprocessingMixIn(object):
2502
2324
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2504
2326
def sub_process_main(self, request, address):
2506
2328
self.finish_request(request, address)
2507
2329
except Exception:
2508
2330
self.handle_error(request, address)
2509
2331
self.close_request(request)
2511
2333
def process_request(self, request, address):
2512
2334
"""Start a new process to process the request."""
2513
proc = multiprocessing.Process(target=self.sub_process_main,
2514
args=(request, address))
2335
proc = multiprocessing.Process(target = self.sub_process_main,
2336
args = (request, address))
2519
2341
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2520
2342
""" adds a pipe to the MixIn """
2522
2344
def process_request(self, request, client_address):
2523
2345
"""Overrides and wraps the original process_request().
2525
2347
This function creates a new pipe in self.pipe
2527
2349
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2529
2351
proc = MultiprocessingMixIn.process_request(self, request,
2530
2352
client_address)
2531
2353
self.child_pipe.close()
2532
2354
self.add_pipe(parent_pipe, proc)
2534
2356
def add_pipe(self, parent_pipe, proc):
2535
2357
"""Dummy function; override as necessary"""
2536
2358
raise NotImplementedError()
2585
2406
# socket_wrapper(), if socketfd was set.
2586
2407
socketserver.TCPServer.__init__(self, server_address,
2587
2408
RequestHandlerClass)
2589
2410
def server_bind(self):
2590
2411
"""This overrides the normal server_bind() function
2591
2412
to bind to an interface if one was specified, and also NOT to
2592
2413
bind to an address or port if they were not specified."""
2593
global SO_BINDTODEVICE
2594
2414
if self.interface is not None:
2595
2415
if SO_BINDTODEVICE is None:
2596
# Fall back to a hard-coded value which seems to be
2598
logger.warning("SO_BINDTODEVICE not found, trying 25")
2599
SO_BINDTODEVICE = 25
2601
self.socket.setsockopt(
2602
socket.SOL_SOCKET, SO_BINDTODEVICE,
2603
(self.interface + "\0").encode("utf-8"))
2604
except socket.error as error:
2605
if error.errno == errno.EPERM:
2606
logger.error("No permission to bind to"
2607
" interface %s", self.interface)
2608
elif error.errno == errno.ENOPROTOOPT:
2609
logger.error("SO_BINDTODEVICE not available;"
2610
" cannot bind to interface %s",
2612
elif error.errno == errno.ENODEV:
2613
logger.error("Interface %s does not exist,"
2614
" cannot bind", self.interface)
2416
logger.error("SO_BINDTODEVICE does not exist;"
2417
" cannot bind to interface %s",
2421
self.socket.setsockopt(
2422
socket.SOL_SOCKET, SO_BINDTODEVICE,
2423
(self.interface + "\0").encode("utf-8"))
2424
except socket.error as error:
2425
if error.errno == errno.EPERM:
2426
logger.error("No permission to bind to"
2427
" interface %s", self.interface)
2428
elif error.errno == errno.ENOPROTOOPT:
2429
logger.error("SO_BINDTODEVICE not available;"
2430
" cannot bind to interface %s",
2432
elif error.errno == errno.ENODEV:
2433
logger.error("Interface %s does not exist,"
2434
" cannot bind", self.interface)
2617
2437
# Only bind(2) the socket if we really need to.
2618
2438
if self.server_address[0] or self.server_address[1]:
2619
2439
if not self.server_address[0]:
2620
2440
if self.address_family == socket.AF_INET6:
2621
any_address = "::" # in6addr_any
2441
any_address = "::" # in6addr_any
2623
any_address = "0.0.0.0" # INADDR_ANY
2443
any_address = "0.0.0.0" # INADDR_ANY
2624
2444
self.server_address = (any_address,
2625
2445
self.server_address[1])
2626
2446
elif not self.server_address[1]:
2660
2480
self.gnutls_priority = gnutls_priority
2661
2481
IPv6_TCPServer.__init__(self, server_address,
2662
2482
RequestHandlerClass,
2663
interface=interface,
2483
interface = interface,
2484
use_ipv6 = use_ipv6,
2485
socketfd = socketfd)
2667
2487
def server_activate(self):
2668
2488
if self.enabled:
2669
2489
return socketserver.TCPServer.server_activate(self)
2671
2491
def enable(self):
2672
2492
self.enabled = True
2674
2494
def add_pipe(self, parent_pipe, proc):
2675
2495
# Call "handle_ipc" for both data and EOF events
2496
gobject.io_add_watch(
2677
2497
parent_pipe.fileno(),
2678
GLib.IO_IN | GLib.IO_HUP,
2498
gobject.IO_IN | gobject.IO_HUP,
2679
2499
functools.partial(self.handle_ipc,
2680
parent_pipe=parent_pipe,
2500
parent_pipe = parent_pipe,
2683
2503
def handle_ipc(self, source, condition,
2684
2504
parent_pipe=None,
2686
2506
client_object=None):
2687
2507
# error, or the other end of multiprocessing.Pipe has closed
2688
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2508
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2689
2509
# Wait for other process to exit
2693
2513
# Read a request from the child
2694
2514
request = parent_pipe.recv()
2695
2515
command = request[0]
2697
2517
if command == 'init':
2698
key_id = request[1].decode("ascii")
2699
fpr = request[2].decode("ascii")
2700
address = request[3]
2702
for c in self.clients.values():
2703
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2705
if key_id and c.key_id == key_id:
2708
if fpr and c.fingerprint == fpr:
2519
address = request[2]
2521
for c in self.clients.itervalues():
2522
if c.fingerprint == fpr:
2712
logger.info("Client not found for key ID: %s, address"
2713
": %s", key_id or fpr, address)
2526
logger.info("Client not found for fingerprint: %s, ad"
2527
"dress: %s", fpr, address)
2714
2528
if self.use_dbus:
2715
2529
# Emit D-Bus signal
2716
mandos_dbus_service.ClientNotFound(key_id or fpr,
2530
mandos_dbus_service.ClientNotFound(fpr,
2718
2532
parent_pipe.send(False)
2535
gobject.io_add_watch(
2722
2536
parent_pipe.fileno(),
2723
GLib.IO_IN | GLib.IO_HUP,
2537
gobject.IO_IN | gobject.IO_HUP,
2724
2538
functools.partial(self.handle_ipc,
2725
parent_pipe=parent_pipe,
2727
client_object=client))
2539
parent_pipe = parent_pipe,
2541
client_object = client))
2728
2542
parent_pipe.send(True)
2729
2543
# remove the old hook in favor of the new above hook on
3136
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3138
2938
except OSError as error:
3139
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3140
.format(uid, gid, os.strerror(error.errno)))
3141
2939
if error.errno != errno.EPERM:
3145
2943
# Enable all possible GnuTLS debugging
3147
2945
# "Use a log level over 10 to enable all debugging options."
3148
2946
# - GnuTLS manual
3149
2947
gnutls.global_set_log_level(11)
3151
2949
@gnutls.log_func
3152
2950
def debug_gnutls(level, string):
3153
2951
logger.debug("GnuTLS: %s", string[:-1])
3155
2953
gnutls.global_set_log_function(debug_gnutls)
3157
2955
# Redirect stdin so all checkers get /dev/null
3158
2956
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3159
2957
os.dup2(null, sys.stdin.fileno())
3163
2961
# Need to fork before connecting to D-Bus
3164
2962
if not foreground:
3165
2963
# Close all input and output, do double fork, etc.
3168
# multiprocessing will use threads, so before we use GLib we need
3169
# to inform GLib that threads will be used.
2966
# multiprocessing will use threads, so before we use gobject we
2967
# need to inform gobject that threads will be used.
2968
gobject.threads_init()
3172
2970
global main_loop
3173
2971
# From the Avahi example code
3174
2972
DBusGMainLoop(set_as_default=True)
3175
main_loop = GLib.MainLoop()
2973
main_loop = gobject.MainLoop()
3176
2974
bus = dbus.SystemBus()
3177
2975
# End of Avahi example code
3192
2990
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3193
2991
service = AvahiServiceToSyslog(
3194
name=server_settings["servicename"],
3195
servicetype="_mandos._tcp",
2992
name = server_settings["servicename"],
2993
servicetype = "_mandos._tcp",
2994
protocol = protocol,
3198
2996
if server_settings["interface"]:
3199
2997
service.interface = if_nametoindex(
3200
2998
server_settings["interface"].encode("utf-8"))
3202
3000
global multiprocessing_manager
3203
3001
multiprocessing_manager = multiprocessing.Manager()
3205
3003
client_class = Client
3207
client_class = functools.partial(ClientDBus, bus=bus)
3005
client_class = functools.partial(ClientDBus, bus = bus)
3209
3007
client_settings = Client.config_parser(client_config)
3210
3008
old_client_settings = {}
3211
3009
clients_data = {}
3213
3011
# This is used to redirect stdout and stderr for checker processes
3215
wnull = open(os.devnull, "w") # A writable /dev/null
3013
wnull = open(os.devnull, "w") # A writable /dev/null
3216
3014
# Only used if server is running in foreground but not in debug
3218
3016
if debug or not foreground:
3221
3019
# Get client data and settings from last running state.
3222
3020
if server_settings["restore"]:
3224
3022
with open(stored_state_path, "rb") as stored_state:
3225
if sys.version_info.major == 2:
3226
clients_data, old_client_settings = pickle.load(
3229
bytes_clients_data, bytes_old_client_settings = (
3230
pickle.load(stored_state, encoding="bytes"))
3231
# Fix bytes to strings
3234
clients_data = {(key.decode("utf-8")
3235
if isinstance(key, bytes)
3238
bytes_clients_data.items()}
3239
del bytes_clients_data
3240
for key in clients_data:
3241
value = {(k.decode("utf-8")
3242
if isinstance(k, bytes) else k): v
3244
clients_data[key].items()}
3245
clients_data[key] = value
3247
value["client_structure"] = [
3249
if isinstance(s, bytes)
3251
value["client_structure"]]
3253
for k in ("name", "host"):
3254
if isinstance(value[k], bytes):
3255
value[k] = value[k].decode("utf-8")
3256
if not value.has_key("key_id"):
3257
value["key_id"] = ""
3258
elif not value.has_key("fingerprint"):
3259
value["fingerprint"] = ""
3260
# old_client_settings
3262
old_client_settings = {
3263
(key.decode("utf-8")
3264
if isinstance(key, bytes)
3267
bytes_old_client_settings.items()}
3268
del bytes_old_client_settings
3270
for value in old_client_settings.values():
3271
if isinstance(value["host"], bytes):
3272
value["host"] = (value["host"]
3023
clients_data, old_client_settings = pickle.load(
3274
3025
os.remove(stored_state_path)
3275
3026
except IOError as e:
3276
3027
if e.errno == errno.ENOENT:
3376
3127
pidfilename, pid)
3378
3129
del pidfilename
3380
for termsig in (signal.SIGHUP, signal.SIGTERM):
3381
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3382
lambda: main_loop.quit() and False)
3131
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3132
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3386
3136
@alternate_dbus_interfaces(
3387
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3137
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3388
3138
class MandosDBusService(DBusObjectWithObjectManager):
3389
3139
"""A D-Bus proxy object"""
3391
3141
def __init__(self):
3392
3142
dbus.service.Object.__init__(self, bus, "/")
3394
3144
_interface = "se.recompile.Mandos"
3396
3146
@dbus.service.signal(_interface, signature="o")
3397
3147
def ClientAdded(self, objpath):
3401
3151
@dbus.service.signal(_interface, signature="ss")
3402
def ClientNotFound(self, key_id, address):
3152
def ClientNotFound(self, fingerprint, address):
3406
3156
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3408
3158
@dbus.service.signal(_interface, signature="os")
3409
3159
def ClientRemoved(self, objpath, name):
3413
3163
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3415
3165
@dbus.service.method(_interface, out_signature="ao")
3416
3166
def GetAllClients(self):
3418
3168
return dbus.Array(c.dbus_object_path for c in
3419
tcp_server.clients.values())
3169
tcp_server.clients.itervalues())
3421
3171
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3423
3173
@dbus.service.method(_interface,
3482
3232
self.ClientRemoved(client.dbus_object_path,
3485
3235
mandos_dbus_service = MandosDBusService()
3487
# Save modules to variables to exempt the modules from being
3488
# unloaded before the function registered with atexit() is run.
3489
mp = multiprocessing
3493
3238
"Cleanup function; run on exit"
3495
3240
service.cleanup()
3497
mp.active_children()
3242
multiprocessing.active_children()
3499
3244
if not (tcp_server.clients or client_settings):
3502
3247
# Store client before exiting. Secrets are encrypted with key
3503
3248
# based on what config file has. If config file is
3504
3249
# removed/edited, old secret will thus be unrecovable.
3506
3251
with PGPEngine() as pgp:
3507
for client in tcp_server.clients.values():
3252
for client in tcp_server.clients.itervalues():
3508
3253
key = client_settings[client.name]["secret"]
3509
3254
client.encrypted_secret = pgp.encrypt(client.secret,
3511
3256
client_dict = {}
3513
3258
# A list of attributes that can not be pickled
3515
exclude = {"bus", "changedstate", "secret",
3516
"checker", "server_settings"}
3260
exclude = { "bus", "changedstate", "secret",
3261
"checker", "server_settings" }
3517
3262
for name, typ in inspect.getmembers(dbus.service
3519
3264
exclude.add(name)
3521
3266
client_dict["encrypted_secret"] = (client
3522
3267
.encrypted_secret)
3523
3268
for attr in client.client_structure:
3524
3269
if attr not in exclude:
3525
3270
client_dict[attr] = getattr(client, attr)
3527
3272
clients[client.name] = client_dict
3528
3273
del client_settings[client.name]["secret"]
3531
3276
with tempfile.NamedTemporaryFile(