523
434
class AvahiServiceToSyslog(AvahiService):
524
435
def rename(self, *args, **kwargs):
525
436
"""Add the new name to the syslog messages"""
526
ret = super(AvahiServiceToSyslog, self).rename(*args,
437
ret = AvahiService.rename(self, *args, **kwargs)
528
438
syslogger.setFormatter(logging.Formatter(
529
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
439
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
530
440
.format(self.name)))
534
443
# Pretend that we have a GnuTLS module
536
"""This isn't so much a class as it is a module-like namespace."""
538
library = ctypes.util.find_library("gnutls")
540
library = ctypes.util.find_library("gnutls-deb0")
541
_library = ctypes.cdll.LoadLibrary(library)
444
class GnuTLS(object):
445
"""This isn't so much a class as it is a module-like namespace.
446
It is instantiated once, and simulates having a GnuTLS module."""
448
_library = ctypes.cdll.LoadLibrary(
449
ctypes.util.find_library("gnutls"))
450
_need_version = "3.3.0"
452
# Need to use class name "GnuTLS" here, since this method is
453
# called before the assignment to the "gnutls" global variable
455
if GnuTLS.check_version(self._need_version) is None:
456
raise GnuTLS.Error("Needs GnuTLS {} or later"
457
.format(self._need_version))
544
459
# Unless otherwise indicated, the constants and types below are
545
460
# all from the gnutls/gnutls.h C header file.
549
464
E_INTERRUPTED = -52
555
469
CRD_CERTIFICATE = 1
556
470
E_NO_CERTIFICATE_FOUND = -49
561
KEYID_USE_SHA256 = 1 # gnutls/x509.h
562
471
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
565
class _session_int(ctypes.Structure):
474
class session_int(ctypes.Structure):
567
session_t = ctypes.POINTER(_session_int)
476
session_t = ctypes.POINTER(session_int)
569
477
class certificate_credentials_st(ctypes.Structure):
571
479
certificate_credentials_t = ctypes.POINTER(
572
480
certificate_credentials_st)
573
481
certificate_type_t = ctypes.c_int
575
482
class datum_t(ctypes.Structure):
576
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
577
("size", ctypes.c_uint)]
579
class _openpgp_crt_int(ctypes.Structure):
483
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
484
('size', ctypes.c_uint)]
485
class openpgp_crt_int(ctypes.Structure):
581
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
582
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
487
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
488
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
583
489
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
584
credentials_type_t = ctypes.c_int
490
credentials_type_t = ctypes.c_int #
585
491
transport_ptr_t = ctypes.c_void_p
586
492
close_request_t = ctypes.c_int
589
495
class Error(Exception):
590
def __init__(self, message=None, code=None, args=()):
496
# We need to use the class name "GnuTLS" here, since this
497
# exception might be raised from within GnuTLS.__init__,
498
# which is called before the assignment to the "gnutls"
499
# global variable has happened.
500
def __init__(self, message = None, code = None, args=()):
591
501
# Default usage is by a message string, but if a return
592
502
# code is passed, convert it to a string with
593
503
# gnutls.strerror()
595
505
if message is None and code is not None:
596
message = gnutls.strerror(code).decode(
597
"utf-8", errors="replace")
598
return super(gnutls.Error, self).__init__(
506
message = GnuTLS.strerror(code)
507
return super(GnuTLS.Error, self).__init__(
601
510
class CertificateSecurityError(Error):
605
def __init__(self, cls):
608
def from_param(self, obj):
609
if not isinstance(obj, self.cls):
610
raise TypeError("Not of type {}: {!r}"
611
.format(self.cls.__name__, obj))
612
return ctypes.byref(obj.from_param(obj))
614
class CastToVoidPointer:
615
def __init__(self, cls):
618
def from_param(self, obj):
619
if not isinstance(obj, self.cls):
620
raise TypeError("Not of type {}: {!r}"
621
.format(self.cls.__name__, obj))
622
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
624
class With_from_param:
626
def from_param(cls, obj):
627
return obj._as_parameter_
630
class Credentials(With_from_param):
514
class Credentials(object):
631
515
def __init__(self):
632
self._as_parameter_ = gnutls.certificate_credentials_t()
633
gnutls.certificate_allocate_credentials(self)
516
self._c_object = gnutls.certificate_credentials_t()
517
gnutls.certificate_allocate_credentials(
518
ctypes.byref(self._c_object))
634
519
self.type = gnutls.CRD_CERTIFICATE
636
521
def __del__(self):
637
gnutls.certificate_free_credentials(self)
639
class ClientSession(With_from_param):
640
def __init__(self, socket, credentials=None):
641
self._as_parameter_ = gnutls.session_t()
642
gnutls_flags = gnutls.CLIENT
643
if gnutls.check_version(b"3.5.6"):
644
gnutls_flags |= gnutls.NO_TICKETS
646
gnutls_flags |= gnutls.ENABLE_RAWPK
647
gnutls.init(self, gnutls_flags)
649
gnutls.set_default_priority(self)
650
gnutls.transport_set_ptr(self, socket.fileno())
651
gnutls.handshake_set_private_extensions(self, True)
522
gnutls.certificate_free_credentials(self._c_object)
524
class ClientSession(object):
525
def __init__(self, socket, credentials = None):
526
self._c_object = gnutls.session_t()
527
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
528
gnutls.set_default_priority(self._c_object)
529
gnutls.transport_set_ptr(self._c_object, socket.fileno())
530
gnutls.handshake_set_private_extensions(self._c_object,
652
532
self.socket = socket
653
533
if credentials is None:
654
534
credentials = gnutls.Credentials()
655
gnutls.credentials_set(self, credentials.type,
535
gnutls.credentials_set(self._c_object, credentials.type,
536
ctypes.cast(credentials._c_object,
657
538
self.credentials = credentials
659
540
def __del__(self):
541
gnutls.deinit(self._c_object)
662
543
def handshake(self):
663
return gnutls.handshake(self)
544
return gnutls.handshake(self._c_object)
665
546
def send(self, data):
666
547
data = bytes(data)
667
548
data_len = len(data)
668
549
while data_len > 0:
669
data_len -= gnutls.record_send(self, data[-data_len:],
550
data_len -= gnutls.record_send(self._c_object,
673
return gnutls.bye(self, gnutls.SHUT_RDWR)
555
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
675
557
# Error handling functions
676
558
def _error_code(result):
677
559
"""A function to raise exceptions on errors, suitable
678
for the "restype" attribute on ctypes functions"""
679
if result >= gnutls.E_SUCCESS:
560
for the 'restype' attribute on ctypes functions"""
681
563
if result == gnutls.E_NO_CERTIFICATE_FOUND:
682
raise gnutls.CertificateSecurityError(code=result)
683
raise gnutls.Error(code=result)
685
def _retry_on_error(result, func, arguments,
686
_error_code=_error_code):
564
raise gnutls.CertificateSecurityError(code = result)
565
raise gnutls.Error(code = result)
567
def _retry_on_error(result, func, arguments):
687
568
"""A function to retry on some errors, suitable
688
for the "errcheck" attribute on ctypes functions"""
689
while result < gnutls.E_SUCCESS:
569
for the 'errcheck' attribute on ctypes functions"""
690
571
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
691
572
return _error_code(result)
692
573
result = func(*arguments)
695
576
# Unless otherwise indicated, the function declarations below are
696
577
# all from the gnutls/gnutls.h C header file.
699
580
priority_set_direct = _library.gnutls_priority_set_direct
700
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
581
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
701
582
ctypes.POINTER(ctypes.c_char_p)]
702
583
priority_set_direct.restype = _error_code
704
585
init = _library.gnutls_init
705
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
586
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
706
587
init.restype = _error_code
708
589
set_default_priority = _library.gnutls_set_default_priority
709
set_default_priority.argtypes = [ClientSession]
590
set_default_priority.argtypes = [session_t]
710
591
set_default_priority.restype = _error_code
712
593
record_send = _library.gnutls_record_send
713
record_send.argtypes = [ClientSession, ctypes.c_void_p,
594
record_send.argtypes = [session_t, ctypes.c_void_p,
715
596
record_send.restype = ctypes.c_ssize_t
716
597
record_send.errcheck = _retry_on_error
718
599
certificate_allocate_credentials = (
719
600
_library.gnutls_certificate_allocate_credentials)
720
601
certificate_allocate_credentials.argtypes = [
721
PointerTo(Credentials)]
602
ctypes.POINTER(certificate_credentials_t)]
722
603
certificate_allocate_credentials.restype = _error_code
724
605
certificate_free_credentials = (
725
606
_library.gnutls_certificate_free_credentials)
726
certificate_free_credentials.argtypes = [Credentials]
607
certificate_free_credentials.argtypes = [certificate_credentials_t]
727
608
certificate_free_credentials.restype = None
729
610
handshake_set_private_extensions = (
730
611
_library.gnutls_handshake_set_private_extensions)
731
handshake_set_private_extensions.argtypes = [ClientSession,
612
handshake_set_private_extensions.argtypes = [session_t,
733
614
handshake_set_private_extensions.restype = None
735
616
credentials_set = _library.gnutls_credentials_set
736
credentials_set.argtypes = [ClientSession, credentials_type_t,
737
CastToVoidPointer(Credentials)]
617
credentials_set.argtypes = [session_t, credentials_type_t,
738
619
credentials_set.restype = _error_code
740
621
strerror = _library.gnutls_strerror
741
622
strerror.argtypes = [ctypes.c_int]
742
623
strerror.restype = ctypes.c_char_p
744
625
certificate_type_get = _library.gnutls_certificate_type_get
745
certificate_type_get.argtypes = [ClientSession]
626
certificate_type_get.argtypes = [session_t]
746
627
certificate_type_get.restype = _error_code
748
629
certificate_get_peers = _library.gnutls_certificate_get_peers
749
certificate_get_peers.argtypes = [ClientSession,
630
certificate_get_peers.argtypes = [session_t,
750
631
ctypes.POINTER(ctypes.c_uint)]
751
632
certificate_get_peers.restype = ctypes.POINTER(datum_t)
753
634
global_set_log_level = _library.gnutls_global_set_log_level
754
635
global_set_log_level.argtypes = [ctypes.c_int]
755
636
global_set_log_level.restype = None
757
638
global_set_log_function = _library.gnutls_global_set_log_function
758
639
global_set_log_function.argtypes = [log_func]
759
640
global_set_log_function.restype = None
761
642
deinit = _library.gnutls_deinit
762
deinit.argtypes = [ClientSession]
643
deinit.argtypes = [session_t]
763
644
deinit.restype = None
765
646
handshake = _library.gnutls_handshake
766
handshake.argtypes = [ClientSession]
767
handshake.restype = ctypes.c_int
647
handshake.argtypes = [session_t]
648
handshake.restype = _error_code
768
649
handshake.errcheck = _retry_on_error
770
651
transport_set_ptr = _library.gnutls_transport_set_ptr
771
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
652
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
772
653
transport_set_ptr.restype = None
774
655
bye = _library.gnutls_bye
775
bye.argtypes = [ClientSession, close_request_t]
776
bye.restype = ctypes.c_int
656
bye.argtypes = [session_t, close_request_t]
657
bye.restype = _error_code
777
658
bye.errcheck = _retry_on_error
779
660
check_version = _library.gnutls_check_version
780
661
check_version.argtypes = [ctypes.c_char_p]
781
662
check_version.restype = ctypes.c_char_p
783
_need_version = b"3.3.0"
784
if check_version(_need_version) is None:
785
raise self.Error("Needs GnuTLS {} or later"
786
.format(_need_version))
788
_tls_rawpk_version = b"3.6.6"
789
has_rawpk = bool(check_version(_tls_rawpk_version))
793
class pubkey_st(ctypes.Structure):
795
pubkey_t = ctypes.POINTER(pubkey_st)
797
x509_crt_fmt_t = ctypes.c_int
799
# All the function declarations below are from
801
pubkey_init = _library.gnutls_pubkey_init
802
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
803
pubkey_init.restype = _error_code
805
pubkey_import = _library.gnutls_pubkey_import
806
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
808
pubkey_import.restype = _error_code
810
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
811
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
812
ctypes.POINTER(ctypes.c_ubyte),
813
ctypes.POINTER(ctypes.c_size_t)]
814
pubkey_get_key_id.restype = _error_code
816
pubkey_deinit = _library.gnutls_pubkey_deinit
817
pubkey_deinit.argtypes = [pubkey_t]
818
pubkey_deinit.restype = None
820
# All the function declarations below are from
823
openpgp_crt_init = _library.gnutls_openpgp_crt_init
824
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
825
openpgp_crt_init.restype = _error_code
827
openpgp_crt_import = _library.gnutls_openpgp_crt_import
828
openpgp_crt_import.argtypes = [openpgp_crt_t,
829
ctypes.POINTER(datum_t),
831
openpgp_crt_import.restype = _error_code
833
openpgp_crt_verify_self = \
834
_library.gnutls_openpgp_crt_verify_self
835
openpgp_crt_verify_self.argtypes = [
838
ctypes.POINTER(ctypes.c_uint),
840
openpgp_crt_verify_self.restype = _error_code
842
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
843
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
844
openpgp_crt_deinit.restype = None
846
openpgp_crt_get_fingerprint = (
847
_library.gnutls_openpgp_crt_get_fingerprint)
848
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
852
openpgp_crt_get_fingerprint.restype = _error_code
854
if check_version(b"3.6.4"):
855
certificate_type_get2 = _library.gnutls_certificate_type_get2
856
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
857
certificate_type_get2.restype = _error_code
664
# All the function declarations below are from gnutls/openpgp.h
666
openpgp_crt_init = _library.gnutls_openpgp_crt_init
667
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
668
openpgp_crt_init.restype = _error_code
670
openpgp_crt_import = _library.gnutls_openpgp_crt_import
671
openpgp_crt_import.argtypes = [openpgp_crt_t,
672
ctypes.POINTER(datum_t),
674
openpgp_crt_import.restype = _error_code
676
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
677
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
678
ctypes.POINTER(ctypes.c_uint)]
679
openpgp_crt_verify_self.restype = _error_code
681
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
682
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
683
openpgp_crt_deinit.restype = None
685
openpgp_crt_get_fingerprint = (
686
_library.gnutls_openpgp_crt_get_fingerprint)
687
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
691
openpgp_crt_get_fingerprint.restype = _error_code
859
693
# Remove non-public functions
860
694
del _error_code, _retry_on_error
695
# Create the global "gnutls" object, simulating a module
863
698
def call_pipe(connection, # : multiprocessing.Connection
864
699
func, *args, **kwargs):
865
700
"""This function is meant to be called by multiprocessing.Process
867
702
This function runs func(*args, **kwargs), and writes the resulting
868
703
return value on the provided multiprocessing.Connection.
870
705
connection.send(func(*args, **kwargs))
871
706
connection.close()
708
class Client(object):
875
709
"""A representation of a client host served by this server.
878
approved: bool(); None if not yet approved/disapproved
712
approved: bool(); 'None' if not yet approved/disapproved
879
713
approval_delay: datetime.timedelta(); Time to wait for approval
880
714
approval_duration: datetime.timedelta(); Duration of one approval
881
checker: multiprocessing.Process(); a running checker process used
882
to see if the client lives. None if no process is
884
checker_callback_tag: a GLib event source tag, or None
715
checker: subprocess.Popen(); a running checker process used
716
to see if the client lives.
717
'None' if no process is running.
718
checker_callback_tag: a gobject event source tag, or None
885
719
checker_command: string; External command which is run to check
886
720
if client lives. %() expansions are done at
887
721
runtime with vars(self) as dict, so that for
888
722
instance %(name)s can be used in the command.
889
checker_initiator_tag: a GLib event source tag, or None
723
checker_initiator_tag: a gobject event source tag, or None
890
724
created: datetime.datetime(); (UTC) object creation
891
725
client_structure: Object describing what attributes a client has
892
726
and is used for storing the client at exit
893
727
current_checker_command: string; current running checker_command
894
disable_initiator_tag: a GLib event source tag, or None
728
disable_initiator_tag: a gobject event source tag, or None
896
730
fingerprint: string (40 or 32 hexadecimal digits); used to
897
uniquely identify an OpenPGP client
898
key_id: string (64 hexadecimal digits); used to uniquely identify
899
a client using raw public keys
731
uniquely identify the client
900
732
host: string; available for use by the checker command
901
733
interval: datetime.timedelta(); How often to start a new checker
902
734
last_approval_request: datetime.datetime(); (UTC) or None
1032
853
self.changedstate = multiprocessing_manager.Condition(
1033
854
multiprocessing_manager.Lock())
1034
855
self.client_structure = [attr
1035
for attr in self.__dict__.keys()
856
for attr in self.__dict__.iterkeys()
1036
857
if not attr.startswith("_")]
1037
858
self.client_structure.append("client_structure")
1039
860
for name, t in inspect.getmembers(
1040
861
type(self), lambda obj: isinstance(obj, property)):
1041
862
if not name.startswith("_"):
1042
863
self.client_structure.append(name)
1044
865
# Send notice to process children that client state has changed
1045
866
def send_changedstate(self):
1046
867
with self.changedstate:
1047
868
self.changedstate.notify_all()
1049
870
def enable(self):
1050
871
"""Start this client's checker and timeout hooks"""
1051
872
if getattr(self, "enabled", False):
1052
873
# Already enabled
875
self.expires = datetime.datetime.utcnow() + self.timeout
1054
876
self.enabled = True
1055
877
self.last_enabled = datetime.datetime.utcnow()
1056
878
self.init_checker()
1057
879
self.send_changedstate()
1059
881
def disable(self, quiet=True):
1060
882
"""Disable this client."""
1061
883
if not getattr(self, "enabled", False):
1064
log.info("Disabling client %s", self.name)
886
logger.info("Disabling client %s", self.name)
1065
887
if getattr(self, "disable_initiator_tag", None) is not None:
1066
GLib.source_remove(self.disable_initiator_tag)
888
gobject.source_remove(self.disable_initiator_tag)
1067
889
self.disable_initiator_tag = None
1068
890
self.expires = None
1069
891
if getattr(self, "checker_initiator_tag", None) is not None:
1070
GLib.source_remove(self.checker_initiator_tag)
892
gobject.source_remove(self.checker_initiator_tag)
1071
893
self.checker_initiator_tag = None
1072
894
self.stop_checker()
1073
895
self.enabled = False
1075
897
self.send_changedstate()
1076
# Do not run this again if called by a GLib.timeout_add
898
# Do not run this again if called by a gobject.timeout_add
1079
901
def __del__(self):
1082
def init_checker(self, randomize_start=False):
1083
# Schedule a new checker to be started a randomly selected
1084
# time (a fraction of 'interval') from now. This spreads out
1085
# the startup of checkers over time when the server is
904
def init_checker(self):
905
# Schedule a new checker to be started an 'interval' from now,
906
# and every interval from then on.
1087
907
if self.checker_initiator_tag is not None:
1088
GLib.source_remove(self.checker_initiator_tag)
1089
interval_milliseconds = int(self.interval.total_seconds()
1092
delay_milliseconds = random.randrange(
1093
interval_milliseconds + 1)
1095
delay_milliseconds = interval_milliseconds
1096
self.checker_initiator_tag = GLib.timeout_add(
1097
delay_milliseconds, self.start_checker, randomize_start)
1098
delay = datetime.timedelta(0, 0, 0, delay_milliseconds)
1099
# A checker might take up to an 'interval' of time, so we can
1100
# expire at the soonest one interval after a checker was
1101
# started. Since the initial checker is delayed, the expire
1102
# time might have to be extended.
1103
now = datetime.datetime.utcnow()
1104
self.expires = now + delay + self.interval
1105
# Schedule a disable() at expire time
908
gobject.source_remove(self.checker_initiator_tag)
909
self.checker_initiator_tag = gobject.timeout_add(
910
int(self.interval.total_seconds() * 1000),
912
# Schedule a disable() when 'timeout' has passed
1106
913
if self.disable_initiator_tag is not None:
1107
GLib.source_remove(self.disable_initiator_tag)
1108
self.disable_initiator_tag = GLib.timeout_add(
1109
int((self.expires - now).total_seconds() * 1000),
914
gobject.source_remove(self.disable_initiator_tag)
915
self.disable_initiator_tag = gobject.timeout_add(
916
int(self.timeout.total_seconds() * 1000), self.disable)
917
# Also start a new checker *right now*.
1112
920
def checker_callback(self, source, condition, connection,
1114
922
"""The checker has completed, so take appropriate actions."""
923
self.checker_callback_tag = None
1115
925
# Read return code from connection (see call_pipe)
1116
926
returncode = connection.recv()
1117
927
connection.close()
1118
if self.checker is not None:
1120
self.checker_callback_tag = None
1123
929
if returncode >= 0:
1124
930
self.last_checker_status = returncode
1125
931
self.last_checker_signal = None
1126
932
if self.last_checker_status == 0:
1127
log.info("Checker for %(name)s succeeded", vars(self))
933
logger.info("Checker for %(name)s succeeded",
1128
935
self.checked_ok()
1130
log.info("Checker for %(name)s failed", vars(self))
937
logger.info("Checker for %(name)s failed", vars(self))
1132
939
self.last_checker_status = -1
1133
940
self.last_checker_signal = -returncode
1134
log.warning("Checker for %(name)s crashed?", vars(self))
941
logger.warning("Checker for %(name)s crashed?",
1137
945
def checked_ok(self):
1138
946
"""Assert that the client has been seen, alive and well."""
1139
947
self.last_checked_ok = datetime.datetime.utcnow()
1140
948
self.last_checker_status = 0
1141
949
self.last_checker_signal = None
1142
950
self.bump_timeout()
1144
952
def bump_timeout(self, timeout=None):
1145
953
"""Bump up the timeout for this client."""
1146
954
if timeout is None:
1147
955
timeout = self.timeout
1148
956
if self.disable_initiator_tag is not None:
1149
GLib.source_remove(self.disable_initiator_tag)
957
gobject.source_remove(self.disable_initiator_tag)
1150
958
self.disable_initiator_tag = None
1151
959
if getattr(self, "enabled", False):
1152
self.disable_initiator_tag = GLib.timeout_add(
960
self.disable_initiator_tag = gobject.timeout_add(
1153
961
int(timeout.total_seconds() * 1000), self.disable)
1154
962
self.expires = datetime.datetime.utcnow() + timeout
1156
964
def need_approval(self):
1157
965
self.last_approval_request = datetime.datetime.utcnow()
1159
def start_checker(self, start_was_randomized=False):
967
def start_checker(self):
1160
968
"""Start a new checker subprocess if one is not running.
1162
970
If a checker already exists, leave it running and do
1164
972
# The reason for not killing a running checker is that if we
2289
2095
byte_arrays=True)
2290
2096
def Secret_dbus_property(self, value):
2291
2097
self.secret = bytes(value)
2297
def __init__(self, child_pipe, key_id, fpr, address):
2102
class ProxyClient(object):
2103
def __init__(self, child_pipe, fpr, address):
2298
2104
self._pipe = child_pipe
2299
self._pipe.send(("init", key_id, fpr, address))
2105
self._pipe.send(('init', fpr, address))
2300
2106
if not self._pipe.recv():
2301
raise KeyError(key_id or fpr)
2303
2109
def __getattribute__(self, name):
2305
2111
return super(ProxyClient, self).__getattribute__(name)
2306
self._pipe.send(("getattr", name))
2112
self._pipe.send(('getattr', name))
2307
2113
data = self._pipe.recv()
2308
if data[0] == "data":
2114
if data[0] == 'data':
2310
if data[0] == "function":
2116
if data[0] == 'function':
2312
2118
def func(*args, **kwargs):
2313
self._pipe.send(("funcall", name, args, kwargs))
2119
self._pipe.send(('funcall', name, args, kwargs))
2314
2120
return self._pipe.recv()[1]
2318
2124
def __setattr__(self, name, value):
2320
2126
return super(ProxyClient, self).__setattr__(name, value)
2321
self._pipe.send(("setattr", name, value))
2127
self._pipe.send(('setattr', name, value))
2324
2130
class ClientHandler(socketserver.BaseRequestHandler, object):
2325
2131
"""A class to handle client connections.
2327
2133
Instantiated once for each connection to handle it.
2328
2134
Note: This will run in its own forked process."""
2330
2136
def handle(self):
2331
2137
with contextlib.closing(self.server.child_pipe) as child_pipe:
2332
log.info("TCP connection from: %s",
2333
str(self.client_address))
2334
log.debug("Pipe FD: %d", self.server.child_pipe.fileno())
2138
logger.info("TCP connection from: %s",
2139
str(self.client_address))
2140
logger.debug("Pipe FD: %d",
2141
self.server.child_pipe.fileno())
2336
2143
session = gnutls.ClientSession(self.request)
2338
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2339
# "+AES-256-CBC", "+SHA1",
2340
# "+COMP-NULL", "+CTYPE-OPENPGP",
2145
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2146
# "+AES-256-CBC", "+SHA1",
2147
# "+COMP-NULL", "+CTYPE-OPENPGP",
2342
2149
# Use a fallback default, since this MUST be set.
2343
2150
priority = self.server.gnutls_priority
2344
2151
if priority is None:
2345
2152
priority = "NORMAL"
2346
gnutls.priority_set_direct(session,
2347
priority.encode("utf-8"), None)
2153
gnutls.priority_set_direct(session._c_object, priority,
2349
2156
# Start communication using the Mandos protocol
2350
2157
# Get protocol number
2351
2158
line = self.request.makefile().readline()
2352
log.debug("Protocol version: %r", line)
2159
logger.debug("Protocol version: %r", line)
2354
2161
if int(line.strip().split()[0]) > 1:
2355
2162
raise RuntimeError(line)
2356
2163
except (ValueError, IndexError, RuntimeError) as error:
2357
log.error("Unknown protocol version: %s", error)
2164
logger.error("Unknown protocol version: %s", error)
2360
2167
# Start GnuTLS connection
2362
2169
session.handshake()
2363
2170
except gnutls.Error as error:
2364
log.warning("Handshake failed: %s", error)
2171
logger.warning("Handshake failed: %s", error)
2365
2172
# Do not run session.bye() here: the session is not
2366
2173
# established. Just abandon the request.
2368
log.debug("Handshake succeeded")
2175
logger.debug("Handshake succeeded")
2370
2177
approval_required = False
2372
if gnutls.has_rawpk:
2375
key_id = self.key_id(
2376
self.peer_certificate(session))
2377
except (TypeError, gnutls.Error) as error:
2378
log.warning("Bad certificate: %s", error)
2380
log.debug("Key ID: %s",
2381
key_id.decode("utf-8",
2387
fpr = self.fingerprint(
2388
self.peer_certificate(session))
2389
except (TypeError, gnutls.Error) as error:
2390
log.warning("Bad certificate: %s", error)
2392
log.debug("Fingerprint: %s", fpr)
2395
client = ProxyClient(child_pipe, key_id, fpr,
2180
fpr = self.fingerprint(
2181
self.peer_certificate(session))
2182
except (TypeError, gnutls.Error) as error:
2183
logger.warning("Bad certificate: %s", error)
2185
logger.debug("Fingerprint: %s", fpr)
2188
client = ProxyClient(child_pipe, fpr,
2396
2189
self.client_address)
2397
2190
except KeyError:
2400
2193
if client.approval_delay:
2401
2194
delay = client.approval_delay
2402
2195
client.approvals_pending += 1
2403
2196
approval_required = True
2406
2199
if not client.enabled:
2407
log.info("Client %s is disabled", client.name)
2200
logger.info("Client %s is disabled",
2408
2202
if self.server.use_dbus:
2409
2203
# Emit D-Bus signal
2410
2204
client.Rejected("Disabled")
2413
2207
if client.approved or not client.approval_delay:
2414
# We are approved or approval is disabled
2208
#We are approved or approval is disabled
2416
2210
elif client.approved is None:
2417
log.info("Client %s needs approval",
2211
logger.info("Client %s needs approval",
2419
2213
if self.server.use_dbus:
2420
2214
# Emit D-Bus signal
2421
2215
client.NeedApproval(
2422
2216
client.approval_delay.total_seconds()
2423
2217
* 1000, client.approved_by_default)
2425
log.warning("Client %s was not approved",
2219
logger.warning("Client %s was not approved",
2427
2221
if self.server.use_dbus:
2428
2222
# Emit D-Bus signal
2429
2223
client.Rejected("Denied")
2432
# wait until timeout or approved
2226
#wait until timeout or approved
2433
2227
time = datetime.datetime.now()
2434
2228
client.changedstate.acquire()
2435
2229
client.changedstate.wait(delay.total_seconds())
2733
2480
self.gnutls_priority = gnutls_priority
2734
2481
IPv6_TCPServer.__init__(self, server_address,
2735
2482
RequestHandlerClass,
2736
interface=interface,
2483
interface = interface,
2484
use_ipv6 = use_ipv6,
2485
socketfd = socketfd)
2740
2487
def server_activate(self):
2741
2488
if self.enabled:
2742
2489
return socketserver.TCPServer.server_activate(self)
2744
2491
def enable(self):
2745
2492
self.enabled = True
2747
2494
def add_pipe(self, parent_pipe, proc):
2748
2495
# Call "handle_ipc" for both data and EOF events
2750
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2751
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2496
gobject.io_add_watch(
2497
parent_pipe.fileno(),
2498
gobject.IO_IN | gobject.IO_HUP,
2752
2499
functools.partial(self.handle_ipc,
2753
parent_pipe=parent_pipe,
2500
parent_pipe = parent_pipe,
2756
2503
def handle_ipc(self, source, condition,
2757
2504
parent_pipe=None,
2759
2506
client_object=None):
2760
2507
# error, or the other end of multiprocessing.Pipe has closed
2761
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2508
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2762
2509
# Wait for other process to exit
2766
2513
# Read a request from the child
2767
2514
request = parent_pipe.recv()
2768
2515
command = request[0]
2770
if command == "init":
2771
key_id = request[1].decode("ascii")
2772
fpr = request[2].decode("ascii")
2773
address = request[3]
2775
for c in self.clients.values():
2776
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2777
"27AE41E4649B934CA495991B7852B855"):
2779
if key_id and c.key_id == key_id:
2782
if fpr and c.fingerprint == fpr:
2517
if command == 'init':
2519
address = request[2]
2521
for c in self.clients.itervalues():
2522
if c.fingerprint == fpr:
2786
log.info("Client not found for key ID: %s, address:"
2787
" %s", key_id or fpr, address)
2526
logger.info("Client not found for fingerprint: %s, ad"
2527
"dress: %s", fpr, address)
2788
2528
if self.use_dbus:
2789
2529
# Emit D-Bus signal
2790
mandos_dbus_service.ClientNotFound(key_id or fpr,
2530
mandos_dbus_service.ClientNotFound(fpr,
2792
2532
parent_pipe.send(False)
2796
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2797
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2535
gobject.io_add_watch(
2536
parent_pipe.fileno(),
2537
gobject.IO_IN | gobject.IO_HUP,
2798
2538
functools.partial(self.handle_ipc,
2799
parent_pipe=parent_pipe,
2801
client_object=client))
2539
parent_pipe = parent_pipe,
2541
client_object = client))
2802
2542
parent_pipe.send(True)
2803
2543
# remove the old hook in favor of the new above hook on
2806
if command == "funcall":
2546
if command == 'funcall':
2807
2547
funcname = request[1]
2808
2548
args = request[2]
2809
2549
kwargs = request[3]
2811
parent_pipe.send(("data", getattr(client_object,
2551
parent_pipe.send(('data', getattr(client_object,
2812
2552
funcname)(*args,
2815
if command == "getattr":
2555
if command == 'getattr':
2816
2556
attrname = request[1]
2817
2557
if isinstance(client_object.__getattribute__(attrname),
2818
collections.abc.Callable):
2819
parent_pipe.send(("function", ))
2558
collections.Callable):
2559
parent_pipe.send(('function', ))
2821
2561
parent_pipe.send((
2822
"data", client_object.__getattribute__(attrname)))
2824
if command == "setattr":
2562
'data', client_object.__getattribute__(attrname)))
2564
if command == 'setattr':
2825
2565
attrname = request[1]
2826
2566
value = request[2]
2827
2567
setattr(client_object, attrname, value)
2832
2572
def rfc3339_duration_to_delta(duration):
2833
2573
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2835
>>> timedelta = datetime.timedelta
2836
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2838
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2840
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2842
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2844
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2846
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2848
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2575
>>> rfc3339_duration_to_delta("P7D")
2576
datetime.timedelta(7)
2577
>>> rfc3339_duration_to_delta("PT60S")
2578
datetime.timedelta(0, 60)
2579
>>> rfc3339_duration_to_delta("PT60M")
2580
datetime.timedelta(0, 3600)
2581
>>> rfc3339_duration_to_delta("PT24H")
2582
datetime.timedelta(1)
2583
>>> rfc3339_duration_to_delta("P1W")
2584
datetime.timedelta(7)
2585
>>> rfc3339_duration_to_delta("PT5M30S")
2586
datetime.timedelta(0, 330)
2587
>>> rfc3339_duration_to_delta("P1DT3M20S")
2588
datetime.timedelta(1, 200)
2853
2591
# Parsing an RFC 3339 duration with regular expressions is not
2854
2592
# possible - there would have to be multiple places for the same
2855
2593
# values, like seconds. The current code, while more esoteric, is
2856
2594
# cleaner without depending on a parsing library. If Python had a
2857
2595
# built-in library for parsing we would use it, but we'd like to
2858
2596
# avoid excessive use of external libraries.
2860
2598
# New type for defining tokens, syntax, and semantics all-in-one
2861
2599
Token = collections.namedtuple("Token", (
2862
2600
"regexp", # To match token; if "value" is not None, must have
3254
2984
"se.bsnet.fukt.Mandos", bus,
3255
2985
do_not_queue=True)
3256
2986
except dbus.exceptions.DBusException as e:
3257
log.error("Disabling D-Bus:", exc_info=e)
2987
logger.error("Disabling D-Bus:", exc_info=e)
3258
2988
use_dbus = False
3259
2989
server_settings["use_dbus"] = False
3260
2990
tcp_server.use_dbus = False
3262
2992
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3263
2993
service = AvahiServiceToSyslog(
3264
name=server_settings["servicename"],
3265
servicetype="_mandos._tcp",
2994
name = server_settings["servicename"],
2995
servicetype = "_mandos._tcp",
2996
protocol = protocol,
3268
2998
if server_settings["interface"]:
3269
2999
service.interface = if_nametoindex(
3270
3000
server_settings["interface"].encode("utf-8"))
3272
3002
global multiprocessing_manager
3273
3003
multiprocessing_manager = multiprocessing.Manager()
3275
3005
client_class = Client
3277
client_class = functools.partial(ClientDBus, bus=bus)
3007
client_class = functools.partial(ClientDBus, bus = bus)
3279
3009
client_settings = Client.config_parser(client_config)
3280
3010
old_client_settings = {}
3281
3011
clients_data = {}
3283
3013
# This is used to redirect stdout and stderr for checker processes
3285
wnull = open(os.devnull, "w") # A writable /dev/null
3015
wnull = open(os.devnull, "w") # A writable /dev/null
3286
3016
# Only used if server is running in foreground but not in debug
3288
3018
if debug or not foreground:
3291
3021
# Get client data and settings from last running state.
3292
3022
if server_settings["restore"]:
3294
3024
with open(stored_state_path, "rb") as stored_state:
3295
if sys.version_info.major == 2:
3296
clients_data, old_client_settings = pickle.load(
3299
bytes_clients_data, bytes_old_client_settings = (
3300
pickle.load(stored_state, encoding="bytes"))
3301
# Fix bytes to strings
3304
clients_data = {(key.decode("utf-8")
3305
if isinstance(key, bytes)
3308
bytes_clients_data.items()}
3309
del bytes_clients_data
3310
for key in clients_data:
3311
value = {(k.decode("utf-8")
3312
if isinstance(k, bytes) else k): v
3314
clients_data[key].items()}
3315
clients_data[key] = value
3317
value["client_structure"] = [
3319
if isinstance(s, bytes)
3321
value["client_structure"]]
3322
# .name, .host, and .checker_command
3323
for k in ("name", "host", "checker_command"):
3324
if isinstance(value[k], bytes):
3325
value[k] = value[k].decode("utf-8")
3326
if "key_id" not in value:
3327
value["key_id"] = ""
3328
elif "fingerprint" not in value:
3329
value["fingerprint"] = ""
3330
# old_client_settings
3332
old_client_settings = {
3333
(key.decode("utf-8")
3334
if isinstance(key, bytes)
3337
bytes_old_client_settings.items()}
3338
del bytes_old_client_settings
3339
# .host and .checker_command
3340
for value in old_client_settings.values():
3341
for attribute in ("host", "checker_command"):
3342
if isinstance(value[attribute], bytes):
3343
value[attribute] = (value[attribute]
3025
clients_data, old_client_settings = pickle.load(
3345
3027
os.remove(stored_state_path)
3346
3028
except IOError as e:
3347
3029
if e.errno == errno.ENOENT:
3348
log.warning("Could not load persistent state:"
3349
" %s", os.strerror(e.errno))
3030
logger.warning("Could not load persistent state:"
3031
" {}".format(os.strerror(e.errno)))
3351
log.critical("Could not load persistent state:",
3033
logger.critical("Could not load persistent state:",
3354
3036
except EOFError as e:
3355
log.warning("Could not load persistent state: EOFError:",
3037
logger.warning("Could not load persistent state: "
3358
3041
with PGPEngine() as pgp:
3359
3042
for client_name, client in clients_data.items():
3360
3043
# Skip removed clients
3361
3044
if client_name not in client_settings:
3364
3047
# Decide which value to use after restoring saved state.
3365
3048
# We have three different values: Old config file,
3366
3049
# new config file, and saved state.
3630
3310
mandos_dbus_service.client_removed_signal(client)
3631
3311
client_settings.clear()
3633
3313
atexit.register(cleanup)
3635
for client in tcp_server.clients.values():
3315
for client in tcp_server.clients.itervalues():
3637
3317
# Emit D-Bus signal for adding
3638
3318
mandos_dbus_service.client_added_signal(client)
3639
3319
# Need to initiate checking of clients
3640
3320
if client.enabled:
3641
client.init_checker(randomize_start=True)
3321
client.init_checker()
3643
3323
tcp_server.enable()
3644
3324
tcp_server.server_activate()
3646
3326
# Find out what port we got
3648
3328
service.port = tcp_server.socket.getsockname()[1]
3650
log.info("Now listening on address %r, port %d, flowinfo %d,"
3651
" scope_id %d", *tcp_server.socket.getsockname())
3330
logger.info("Now listening on address %r, port %d,"
3331
" flowinfo %d, scope_id %d",
3332
*tcp_server.socket.getsockname())
3653
log.info("Now listening on address %r, port %d",
3654
*tcp_server.socket.getsockname())
3656
# service.interface = tcp_server.socket.getsockname()[3]
3334
logger.info("Now listening on address %r, port %d",
3335
*tcp_server.socket.getsockname())
3337
#service.interface = tcp_server.socket.getsockname()[3]
3660
3341
# From the Avahi example code
3662
3343
service.activate()
3663
3344
except dbus.exceptions.DBusException as error:
3664
log.critical("D-Bus Exception", exc_info=error)
3345
logger.critical("D-Bus Exception", exc_info=error)
3667
3348
# End of Avahi example code
3670
GLib.IOChannel.unix_new(tcp_server.fileno()),
3671
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
3672
lambda *args, **kwargs: (tcp_server.handle_request
3673
(*args[2:], **kwargs) or True))
3675
log.debug("Starting main loop")
3350
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
3351
lambda *args, **kwargs:
3352
(tcp_server.handle_request
3353
(*args[2:], **kwargs) or True))
3355
logger.debug("Starting main loop")
3676
3356
main_loop.run()
3677
3357
except AvahiError as error:
3678
log.critical("Avahi Error", exc_info=error)
3358
logger.critical("Avahi Error", exc_info=error)
3681
3361
except KeyboardInterrupt:
3683
3363
print("", file=sys.stderr)
3684
log.debug("Server received KeyboardInterrupt")
3685
log.debug("Server exiting")
3364
logger.debug("Server received KeyboardInterrupt")
3365
logger.debug("Server exiting")
3686
3366
# Must run before the D-Bus bus name gets deregistered
3690
def parse_test_args():
3691
# type: () -> argparse.Namespace
3692
parser = argparse.ArgumentParser(add_help=False)
3693
parser.add_argument("--check", action="store_true")
3694
parser.add_argument("--prefix", )
3695
args, unknown_args = parser.parse_known_args()
3697
# Remove test options from sys.argv
3698
sys.argv[1:] = unknown_args
3701
# Add all tests from doctest strings
3702
def load_tests(loader, tests, none):
3704
tests.addTests(doctest.DocTestSuite())
3707
if __name__ == "__main__":
3708
options = parse_test_args()
3711
extra_test_prefix = options.prefix
3712
if extra_test_prefix is not None:
3713
if not (unittest.main(argv=[""], exit=False)
3714
.result.wasSuccessful()):
3716
class ExtraTestLoader(unittest.TestLoader):
3717
testMethodPrefix = extra_test_prefix
3718
# Call using ./scriptname --test [--verbose]
3719
unittest.main(argv=[""], testLoader=ExtraTestLoader())
3721
unittest.main(argv=[""])
3729
# (lambda (&optional extra)
3730
# (if (not (funcall run-tests-in-test-buffer default-directory
3732
# (funcall show-test-buffer-in-test-window)
3733
# (funcall remove-test-window)
3734
# (if extra (message "Extra tests run successfully!"))))
3735
# run-tests-in-test-buffer:
3736
# (lambda (dir &optional extra)
3737
# (with-current-buffer (get-buffer-create "*Test*")
3738
# (setq buffer-read-only nil
3739
# default-directory dir)
3741
# (compilation-mode))
3742
# (let ((process-result
3743
# (let ((inhibit-read-only t))
3744
# (process-file-shell-command
3745
# (funcall get-command-line extra) nil "*Test*"))))
3746
# (and (numberp process-result)
3747
# (= process-result 0))))
3749
# (lambda (&optional extra)
3750
# (let ((quoted-script
3751
# (shell-quote-argument (funcall get-script-name))))
3753
# (concat "%s --check" (if extra " --prefix=atest" ""))
3757
# (if (fboundp 'file-local-name)
3758
# (file-local-name (buffer-file-name))
3759
# (or (file-remote-p (buffer-file-name) 'localname)
3760
# (buffer-file-name))))
3761
# remove-test-window:
3763
# (let ((test-window (get-buffer-window "*Test*")))
3764
# (if test-window (delete-window test-window))))
3765
# show-test-buffer-in-test-window:
3767
# (when (not (get-buffer-window-list "*Test*"))
3768
# (setq next-error-last-buffer (get-buffer "*Test*"))
3769
# (let* ((side (if (>= (window-width) 146) 'right 'bottom))
3770
# (display-buffer-overriding-action
3771
# `((display-buffer-in-side-window) (side . ,side)
3772
# (window-height . fit-window-to-buffer)
3773
# (window-width . fit-window-to-buffer))))
3774
# (display-buffer "*Test*"))))
3777
# (let* ((run-extra-tests (lambda () (interactive)
3778
# (funcall run-tests t)))
3779
# (inner-keymap `(keymap (116 . ,run-extra-tests))) ; t
3780
# (outer-keymap `(keymap (3 . ,inner-keymap)))) ; C-c
3781
# (setq minor-mode-overriding-map-alist
3782
# (cons `(run-tests . ,outer-keymap)
3783
# minor-mode-overriding-map-alist)))
3784
# (add-hook 'after-save-hook run-tests 90 t))
3370
if __name__ == '__main__':