2
2
# -*- mode: python; coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
17
# This file is part of Mandos.
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
32
31
# Contact the authors at <mandos@recompile.se>.
35
34
from __future__ import (division, absolute_import, print_function,
251
230
'--passphrase-file',
253
232
+ self.gnupgargs,
254
stdin=subprocess.PIPE,
255
stdout=subprocess.PIPE,
256
stderr=subprocess.PIPE)
257
ciphertext, err = proc.communicate(input=data)
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
ciphertext, err = proc.communicate(input = data)
258
237
if proc.returncode != 0:
259
238
raise PGPError(err)
260
239
return ciphertext
262
241
def decrypt(self, data, password):
263
242
passphrase = self.password_encode(password)
264
243
with tempfile.NamedTemporaryFile(
265
dir=self.tempdir) as passfile:
244
dir = self.tempdir) as passfile:
266
245
passfile.write(passphrase)
268
247
proc = subprocess.Popen([self.gpg, '--decrypt',
269
248
'--passphrase-file',
271
250
+ self.gnupgargs,
272
stdin=subprocess.PIPE,
273
stdout=subprocess.PIPE,
274
stderr=subprocess.PIPE)
275
decrypted_plaintext, err = proc.communicate(input=data)
251
stdin = subprocess.PIPE,
252
stdout = subprocess.PIPE,
253
stderr = subprocess.PIPE)
254
decrypted_plaintext, err = proc.communicate(input = data)
276
255
if proc.returncode != 0:
277
256
raise PGPError(err)
278
257
return decrypted_plaintext
281
259
# Pretend that we have an Avahi module
283
"""This isn't so much a class as it is a module-like namespace."""
284
IF_UNSPEC = -1 # avahi-common/address.h
285
PROTO_UNSPEC = -1 # avahi-common/address.h
286
PROTO_INET = 0 # avahi-common/address.h
287
PROTO_INET6 = 1 # avahi-common/address.h
261
"""This isn't so much a class as it is a module-like namespace.
262
It is instantiated once, and simulates having an Avahi module."""
263
IF_UNSPEC = -1 # avahi-common/address.h
264
PROTO_UNSPEC = -1 # avahi-common/address.h
265
PROTO_INET = 0 # avahi-common/address.h
266
PROTO_INET6 = 1 # avahi-common/address.h
288
267
DBUS_NAME = "org.freedesktop.Avahi"
289
268
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
290
269
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
291
270
DBUS_PATH_SERVER = "/"
294
def string_array_to_txt_array(t):
271
def string_array_to_txt_array(self, t):
295
272
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
296
273
for s in t), signature="ay")
297
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
298
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
299
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
300
SERVER_INVALID = 0 # avahi-common/defs.h
301
SERVER_REGISTERING = 1 # avahi-common/defs.h
302
SERVER_RUNNING = 2 # avahi-common/defs.h
303
SERVER_COLLISION = 3 # avahi-common/defs.h
304
SERVER_FAILURE = 4 # avahi-common/defs.h
274
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
275
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
276
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
277
SERVER_INVALID = 0 # avahi-common/defs.h
278
SERVER_REGISTERING = 1 # avahi-common/defs.h
279
SERVER_RUNNING = 2 # avahi-common/defs.h
280
SERVER_COLLISION = 3 # avahi-common/defs.h
281
SERVER_FAILURE = 4 # avahi-common/defs.h
307
284
class AvahiError(Exception):
308
285
def __init__(self, value, *args, **kwargs):
499
476
class AvahiServiceToSyslog(AvahiService):
500
477
def rename(self, *args, **kwargs):
501
478
"""Add the new name to the syslog messages"""
502
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
479
ret = AvahiService.rename(self, *args, **kwargs)
503
480
syslogger.setFormatter(logging.Formatter(
504
481
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
505
482
.format(self.name)))
509
485
# Pretend that we have a GnuTLS module
510
class gnutls(object):
511
"""This isn't so much a class as it is a module-like namespace."""
513
library = ctypes.util.find_library("gnutls")
515
library = ctypes.util.find_library("gnutls-deb0")
516
_library = ctypes.cdll.LoadLibrary(library)
486
class GnuTLS(object):
487
"""This isn't so much a class as it is a module-like namespace.
488
It is instantiated once, and simulates having a GnuTLS module."""
490
_library = ctypes.cdll.LoadLibrary(
491
ctypes.util.find_library("gnutls"))
492
_need_version = b"3.3.0"
494
# Need to use class name "GnuTLS" here, since this method is
495
# called before the assignment to the "gnutls" global variable
497
if GnuTLS.check_version(self._need_version) is None:
498
raise GnuTLS.Error("Needs GnuTLS {} or later"
499
.format(self._need_version))
519
501
# Unless otherwise indicated, the constants and types below are
520
502
# all from the gnutls/gnutls.h C header file.
524
506
E_INTERRUPTED = -52
530
511
CRD_CERTIFICATE = 1
531
512
E_NO_CERTIFICATE_FOUND = -49
536
KEYID_USE_SHA256 = 1 # gnutls/x509.h
537
513
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
540
516
class session_int(ctypes.Structure):
542
518
session_t = ctypes.POINTER(session_int)
544
519
class certificate_credentials_st(ctypes.Structure):
546
521
certificate_credentials_t = ctypes.POINTER(
547
522
certificate_credentials_st)
548
523
certificate_type_t = ctypes.c_int
550
524
class datum_t(ctypes.Structure):
551
525
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
552
526
('size', ctypes.c_uint)]
554
527
class openpgp_crt_int(ctypes.Structure):
556
529
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
557
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
530
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
558
531
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
559
532
credentials_type_t = ctypes.c_int
560
533
transport_ptr_t = ctypes.c_void_p
561
534
close_request_t = ctypes.c_int
564
537
class Error(Exception):
565
def __init__(self, message=None, code=None, args=()):
538
# We need to use the class name "GnuTLS" here, since this
539
# exception might be raised from within GnuTLS.__init__,
540
# which is called before the assignment to the "gnutls"
541
# global variable has happened.
542
def __init__(self, message = None, code = None, args=()):
566
543
# Default usage is by a message string, but if a return
567
544
# code is passed, convert it to a string with
568
545
# gnutls.strerror()
570
547
if message is None and code is not None:
571
message = gnutls.strerror(code)
572
return super(gnutls.Error, self).__init__(
548
message = GnuTLS.strerror(code)
549
return super(GnuTLS.Error, self).__init__(
575
552
class CertificateSecurityError(Error):
579
556
class Credentials(object):
580
557
def __init__(self):
643
614
return _error_code(result)
644
615
result = func(*arguments)
647
618
# Unless otherwise indicated, the function declarations below are
648
619
# all from the gnutls/gnutls.h C header file.
651
622
priority_set_direct = _library.gnutls_priority_set_direct
652
623
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
653
624
ctypes.POINTER(ctypes.c_char_p)]
654
625
priority_set_direct.restype = _error_code
656
627
init = _library.gnutls_init
657
628
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
658
629
init.restype = _error_code
660
631
set_default_priority = _library.gnutls_set_default_priority
661
632
set_default_priority.argtypes = [session_t]
662
633
set_default_priority.restype = _error_code
664
635
record_send = _library.gnutls_record_send
665
636
record_send.argtypes = [session_t, ctypes.c_void_p,
667
638
record_send.restype = ctypes.c_ssize_t
668
639
record_send.errcheck = _retry_on_error
670
641
certificate_allocate_credentials = (
671
642
_library.gnutls_certificate_allocate_credentials)
672
643
certificate_allocate_credentials.argtypes = [
673
644
ctypes.POINTER(certificate_credentials_t)]
674
645
certificate_allocate_credentials.restype = _error_code
676
647
certificate_free_credentials = (
677
648
_library.gnutls_certificate_free_credentials)
678
certificate_free_credentials.argtypes = [
679
certificate_credentials_t]
649
certificate_free_credentials.argtypes = [certificate_credentials_t]
680
650
certificate_free_credentials.restype = None
682
652
handshake_set_private_extensions = (
683
653
_library.gnutls_handshake_set_private_extensions)
684
654
handshake_set_private_extensions.argtypes = [session_t,
686
656
handshake_set_private_extensions.restype = None
688
658
credentials_set = _library.gnutls_credentials_set
689
659
credentials_set.argtypes = [session_t, credentials_type_t,
691
661
credentials_set.restype = _error_code
693
663
strerror = _library.gnutls_strerror
694
664
strerror.argtypes = [ctypes.c_int]
695
665
strerror.restype = ctypes.c_char_p
697
667
certificate_type_get = _library.gnutls_certificate_type_get
698
668
certificate_type_get.argtypes = [session_t]
699
669
certificate_type_get.restype = _error_code
701
671
certificate_get_peers = _library.gnutls_certificate_get_peers
702
672
certificate_get_peers.argtypes = [session_t,
703
673
ctypes.POINTER(ctypes.c_uint)]
704
674
certificate_get_peers.restype = ctypes.POINTER(datum_t)
706
676
global_set_log_level = _library.gnutls_global_set_log_level
707
677
global_set_log_level.argtypes = [ctypes.c_int]
708
678
global_set_log_level.restype = None
710
680
global_set_log_function = _library.gnutls_global_set_log_function
711
681
global_set_log_function.argtypes = [log_func]
712
682
global_set_log_function.restype = None
714
684
deinit = _library.gnutls_deinit
715
685
deinit.argtypes = [session_t]
716
686
deinit.restype = None
718
688
handshake = _library.gnutls_handshake
719
689
handshake.argtypes = [session_t]
720
690
handshake.restype = _error_code
721
691
handshake.errcheck = _retry_on_error
723
693
transport_set_ptr = _library.gnutls_transport_set_ptr
724
694
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
725
695
transport_set_ptr.restype = None
727
697
bye = _library.gnutls_bye
728
698
bye.argtypes = [session_t, close_request_t]
729
699
bye.restype = _error_code
730
700
bye.errcheck = _retry_on_error
732
702
check_version = _library.gnutls_check_version
733
703
check_version.argtypes = [ctypes.c_char_p]
734
704
check_version.restype = ctypes.c_char_p
736
_need_version = b"3.3.0"
737
if check_version(_need_version) is None:
738
raise self.Error("Needs GnuTLS {} or later"
739
.format(_need_version))
741
_tls_rawpk_version = b"3.6.6"
742
has_rawpk = bool(check_version(_tls_rawpk_version))
746
class pubkey_st(ctypes.Structure):
748
pubkey_t = ctypes.POINTER(pubkey_st)
750
x509_crt_fmt_t = ctypes.c_int
752
# All the function declarations below are from gnutls/abstract.h
753
pubkey_init = _library.gnutls_pubkey_init
754
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
755
pubkey_init.restype = _error_code
757
pubkey_import = _library.gnutls_pubkey_import
758
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
760
pubkey_import.restype = _error_code
762
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
763
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
764
ctypes.POINTER(ctypes.c_ubyte),
765
ctypes.POINTER(ctypes.c_size_t)]
766
pubkey_get_key_id.restype = _error_code
768
pubkey_deinit = _library.gnutls_pubkey_deinit
769
pubkey_deinit.argtypes = [pubkey_t]
770
pubkey_deinit.restype = None
772
# All the function declarations below are from gnutls/openpgp.h
774
openpgp_crt_init = _library.gnutls_openpgp_crt_init
775
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
776
openpgp_crt_init.restype = _error_code
778
openpgp_crt_import = _library.gnutls_openpgp_crt_import
779
openpgp_crt_import.argtypes = [openpgp_crt_t,
780
ctypes.POINTER(datum_t),
782
openpgp_crt_import.restype = _error_code
784
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
785
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
786
ctypes.POINTER(ctypes.c_uint)]
787
openpgp_crt_verify_self.restype = _error_code
789
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
790
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
791
openpgp_crt_deinit.restype = None
793
openpgp_crt_get_fingerprint = (
794
_library.gnutls_openpgp_crt_get_fingerprint)
795
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
799
openpgp_crt_get_fingerprint.restype = _error_code
801
if check_version(b"3.6.4"):
802
certificate_type_get2 = _library.gnutls_certificate_type_get2
803
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
804
certificate_type_get2.restype = _error_code
706
# All the function declarations below are from gnutls/openpgp.h
708
openpgp_crt_init = _library.gnutls_openpgp_crt_init
709
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
710
openpgp_crt_init.restype = _error_code
712
openpgp_crt_import = _library.gnutls_openpgp_crt_import
713
openpgp_crt_import.argtypes = [openpgp_crt_t,
714
ctypes.POINTER(datum_t),
716
openpgp_crt_import.restype = _error_code
718
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
719
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
720
ctypes.POINTER(ctypes.c_uint)]
721
openpgp_crt_verify_self.restype = _error_code
723
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
724
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
725
openpgp_crt_deinit.restype = None
727
openpgp_crt_get_fingerprint = (
728
_library.gnutls_openpgp_crt_get_fingerprint)
729
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
733
openpgp_crt_get_fingerprint.restype = _error_code
806
735
# Remove non-public functions
807
736
del _error_code, _retry_on_error
737
# Create the global "gnutls" object, simulating a module
810
740
def call_pipe(connection, # : multiprocessing.Connection
811
741
func, *args, **kwargs):
812
742
"""This function is meant to be called by multiprocessing.Process
814
744
This function runs func(*args, **kwargs), and writes the resulting
815
745
return value on the provided multiprocessing.Connection.
817
747
connection.send(func(*args, **kwargs))
818
748
connection.close()
821
750
class Client(object):
822
751
"""A representation of a client host served by this server.
825
754
approved: bool(); 'None' if not yet approved/disapproved
826
755
approval_delay: datetime.timedelta(); Time to wait for approval
827
756
approval_duration: datetime.timedelta(); Duration of one approval
828
checker: multiprocessing.Process(); a running checker process used
829
to see if the client lives. 'None' if no process is
831
checker_callback_tag: a GLib event source tag, or None
757
checker: subprocess.Popen(); a running checker process used
758
to see if the client lives.
759
'None' if no process is running.
760
checker_callback_tag: a GObject event source tag, or None
832
761
checker_command: string; External command which is run to check
833
762
if client lives. %() expansions are done at
834
763
runtime with vars(self) as dict, so that for
835
764
instance %(name)s can be used in the command.
836
checker_initiator_tag: a GLib event source tag, or None
765
checker_initiator_tag: a GObject event source tag, or None
837
766
created: datetime.datetime(); (UTC) object creation
838
767
client_structure: Object describing what attributes a client has
839
768
and is used for storing the client at exit
840
769
current_checker_command: string; current running checker_command
841
disable_initiator_tag: a GLib event source tag, or None
770
disable_initiator_tag: a GObject event source tag, or None
843
772
fingerprint: string (40 or 32 hexadecimal digits); used to
844
uniquely identify an OpenPGP client
845
key_id: string (64 hexadecimal digits); used to uniquely identify
846
a client using raw public keys
773
uniquely identify the client
847
774
host: string; available for use by the checker command
848
775
interval: datetime.timedelta(); How often to start a new checker
849
776
last_approval_request: datetime.datetime(); (UTC) or None
1006
930
logger.info("Disabling client %s", self.name)
1007
931
if getattr(self, "disable_initiator_tag", None) is not None:
1008
GLib.source_remove(self.disable_initiator_tag)
932
GObject.source_remove(self.disable_initiator_tag)
1009
933
self.disable_initiator_tag = None
1010
934
self.expires = None
1011
935
if getattr(self, "checker_initiator_tag", None) is not None:
1012
GLib.source_remove(self.checker_initiator_tag)
936
GObject.source_remove(self.checker_initiator_tag)
1013
937
self.checker_initiator_tag = None
1014
938
self.stop_checker()
1015
939
self.enabled = False
1017
941
self.send_changedstate()
1018
# Do not run this again if called by a GLib.timeout_add
942
# Do not run this again if called by a GObject.timeout_add
1021
945
def __del__(self):
1024
948
def init_checker(self):
1025
949
# Schedule a new checker to be started an 'interval' from now,
1026
950
# and every interval from then on.
1027
951
if self.checker_initiator_tag is not None:
1028
GLib.source_remove(self.checker_initiator_tag)
1029
self.checker_initiator_tag = GLib.timeout_add(
952
GObject.source_remove(self.checker_initiator_tag)
953
self.checker_initiator_tag = GObject.timeout_add(
1030
954
int(self.interval.total_seconds() * 1000),
1031
955
self.start_checker)
1032
956
# Schedule a disable() when 'timeout' has passed
1033
957
if self.disable_initiator_tag is not None:
1034
GLib.source_remove(self.disable_initiator_tag)
1035
self.disable_initiator_tag = GLib.timeout_add(
958
GObject.source_remove(self.disable_initiator_tag)
959
self.disable_initiator_tag = GObject.timeout_add(
1036
960
int(self.timeout.total_seconds() * 1000), self.disable)
1037
961
# Also start a new checker *right now*.
1038
962
self.start_checker()
1040
964
def checker_callback(self, source, condition, connection,
1042
966
"""The checker has completed, so take appropriate actions."""
967
self.checker_callback_tag = None
1043
969
# Read return code from connection (see call_pipe)
1044
970
returncode = connection.recv()
1045
971
connection.close()
1047
self.checker_callback_tag = None
1050
973
if returncode >= 0:
1051
974
self.last_checker_status = returncode
1052
975
self.last_checker_signal = None
1508
1431
exc_info=error)
1509
1432
return xmlstring
1513
1435
dbus.OBJECT_MANAGER_IFACE
1514
1436
except AttributeError:
1515
1437
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1518
1439
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1519
1440
"""A D-Bus object with an ObjectManager.
1521
1442
Classes inheriting from this exposes the standard
1522
1443
GetManagedObjects call and the InterfacesAdded and
1523
1444
InterfacesRemoved signals on the standard
1524
1445
"org.freedesktop.DBus.ObjectManager" interface.
1526
1447
Note: No signals are sent automatically; they must be sent
1529
1450
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1530
out_signature="a{oa{sa{sv}}}")
1451
out_signature = "a{oa{sa{sv}}}")
1531
1452
def GetManagedObjects(self):
1532
1453
"""This function must be overridden"""
1533
1454
raise NotImplementedError()
1535
1456
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1536
signature="oa{sa{sv}}")
1457
signature = "oa{sa{sv}}")
1537
1458
def InterfacesAdded(self, object_path, interfaces_and_properties):
1540
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1461
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1541
1462
def InterfacesRemoved(self, object_path, interfaces):
1544
1465
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1546
path_keyword='object_path',
1547
connection_keyword='connection')
1466
out_signature = "s",
1467
path_keyword = 'object_path',
1468
connection_keyword = 'connection')
1548
1469
def Introspect(self, object_path, connection):
1549
1470
"""Overloading of standard D-Bus method.
1551
1472
Override return argument name of GetManagedObjects to be
1552
1473
"objpath_interfaces_and_properties"
2579
2431
# socket_wrapper(), if socketfd was set.
2580
2432
socketserver.TCPServer.__init__(self, server_address,
2581
2433
RequestHandlerClass)
2583
2435
def server_bind(self):
2584
2436
"""This overrides the normal server_bind() function
2585
2437
to bind to an interface if one was specified, and also NOT to
2586
2438
bind to an address or port if they were not specified."""
2587
global SO_BINDTODEVICE
2588
2439
if self.interface is not None:
2589
2440
if SO_BINDTODEVICE is None:
2590
# Fall back to a hard-coded value which seems to be
2592
logger.warning("SO_BINDTODEVICE not found, trying 25")
2593
SO_BINDTODEVICE = 25
2595
self.socket.setsockopt(
2596
socket.SOL_SOCKET, SO_BINDTODEVICE,
2597
(self.interface + "\0").encode("utf-8"))
2598
except socket.error as error:
2599
if error.errno == errno.EPERM:
2600
logger.error("No permission to bind to"
2601
" interface %s", self.interface)
2602
elif error.errno == errno.ENOPROTOOPT:
2603
logger.error("SO_BINDTODEVICE not available;"
2604
" cannot bind to interface %s",
2606
elif error.errno == errno.ENODEV:
2607
logger.error("Interface %s does not exist,"
2608
" cannot bind", self.interface)
2441
logger.error("SO_BINDTODEVICE does not exist;"
2442
" cannot bind to interface %s",
2446
self.socket.setsockopt(
2447
socket.SOL_SOCKET, SO_BINDTODEVICE,
2448
(self.interface + "\0").encode("utf-8"))
2449
except socket.error as error:
2450
if error.errno == errno.EPERM:
2451
logger.error("No permission to bind to"
2452
" interface %s", self.interface)
2453
elif error.errno == errno.ENOPROTOOPT:
2454
logger.error("SO_BINDTODEVICE not available;"
2455
" cannot bind to interface %s",
2457
elif error.errno == errno.ENODEV:
2458
logger.error("Interface %s does not exist,"
2459
" cannot bind", self.interface)
2611
2462
# Only bind(2) the socket if we really need to.
2612
2463
if self.server_address[0] or self.server_address[1]:
2613
if self.server_address[1]:
2614
self.allow_reuse_address = True
2615
2464
if not self.server_address[0]:
2616
2465
if self.address_family == socket.AF_INET6:
2617
any_address = "::" # in6addr_any
2466
any_address = "::" # in6addr_any
2619
any_address = "0.0.0.0" # INADDR_ANY
2468
any_address = "0.0.0.0" # INADDR_ANY
2620
2469
self.server_address = (any_address,
2621
2470
self.server_address[1])
2622
2471
elif not self.server_address[1]:
2656
2505
self.gnutls_priority = gnutls_priority
2657
2506
IPv6_TCPServer.__init__(self, server_address,
2658
2507
RequestHandlerClass,
2659
interface=interface,
2508
interface = interface,
2509
use_ipv6 = use_ipv6,
2510
socketfd = socketfd)
2663
2512
def server_activate(self):
2664
2513
if self.enabled:
2665
2514
return socketserver.TCPServer.server_activate(self)
2667
2516
def enable(self):
2668
2517
self.enabled = True
2670
2519
def add_pipe(self, parent_pipe, proc):
2671
2520
# Call "handle_ipc" for both data and EOF events
2521
GObject.io_add_watch(
2673
2522
parent_pipe.fileno(),
2674
GLib.IO_IN | GLib.IO_HUP,
2523
GObject.IO_IN | GObject.IO_HUP,
2675
2524
functools.partial(self.handle_ipc,
2676
parent_pipe=parent_pipe,
2525
parent_pipe = parent_pipe,
2679
2528
def handle_ipc(self, source, condition,
2680
2529
parent_pipe=None,
2682
2531
client_object=None):
2683
2532
# error, or the other end of multiprocessing.Pipe has closed
2684
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2533
if condition & (GObject.IO_ERR | GObject.IO_HUP):
2685
2534
# Wait for other process to exit
2689
2538
# Read a request from the child
2690
2539
request = parent_pipe.recv()
2691
2540
command = request[0]
2693
2542
if command == 'init':
2694
key_id = request[1].decode("ascii")
2695
fpr = request[2].decode("ascii")
2696
address = request[3]
2544
address = request[2]
2698
2546
for c in self.clients.values():
2699
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2701
if key_id and c.key_id == key_id:
2704
if fpr and c.fingerprint == fpr:
2547
if c.fingerprint == fpr:
2708
logger.info("Client not found for key ID: %s, address"
2709
": %s", key_id or fpr, address)
2551
logger.info("Client not found for fingerprint: %s, ad"
2552
"dress: %s", fpr, address)
2710
2553
if self.use_dbus:
2711
2554
# Emit D-Bus signal
2712
mandos_dbus_service.ClientNotFound(key_id or fpr,
2555
mandos_dbus_service.ClientNotFound(fpr,
2714
2557
parent_pipe.send(False)
2560
GObject.io_add_watch(
2718
2561
parent_pipe.fileno(),
2719
GLib.IO_IN | GLib.IO_HUP,
2562
GObject.IO_IN | GObject.IO_HUP,
2720
2563
functools.partial(self.handle_ipc,
2721
parent_pipe=parent_pipe,
2723
client_object=client))
2564
parent_pipe = parent_pipe,
2566
client_object = client))
2724
2567
parent_pipe.send(True)
2725
2568
# remove the old hook in favor of the new above hook on
2969
2809
parser.add_argument("--no-zeroconf", action="store_false",
2970
2810
dest="zeroconf", help="Do not use Zeroconf",
2973
2813
options = parser.parse_args()
2975
2815
if options.check:
2977
2817
fail_count, test_count = doctest.testmod()
2978
2818
sys.exit(os.EX_OK if fail_count == 0 else 1)
2980
2820
# Default values for config file for server-global settings
2981
if gnutls.has_rawpk:
2982
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2983
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2985
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2986
":+SIGN-DSA-SHA256")
2987
server_defaults = {"interface": "",
2991
"priority": priority,
2992
"servicename": "Mandos",
2998
"statedir": "/var/lib/mandos",
2999
"foreground": "False",
2821
server_defaults = { "interface": "",
2826
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2827
":+SIGN-DSA-SHA256",
2828
"servicename": "Mandos",
2834
"statedir": "/var/lib/mandos",
2835
"foreground": "False",
3004
2839
# Parse config file for server-global settings
3005
server_config = configparser.ConfigParser(server_defaults)
2840
server_config = configparser.SafeConfigParser(server_defaults)
3006
2841
del server_defaults
3007
2842
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3008
# Convert the ConfigParser object to a dict
2843
# Convert the SafeConfigParser object to a dict
3009
2844
server_settings = server_config.defaults()
3010
2845
# Use the appropriate methods on the non-string config options
3011
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3012
"foreground", "zeroconf"):
2846
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3013
2847
server_settings[option] = server_config.getboolean("DEFAULT",
3015
2849
if server_settings["port"]:
3188
3022
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3189
3023
service = AvahiServiceToSyslog(
3190
name=server_settings["servicename"],
3191
servicetype="_mandos._tcp",
3024
name = server_settings["servicename"],
3025
servicetype = "_mandos._tcp",
3026
protocol = protocol,
3194
3028
if server_settings["interface"]:
3195
3029
service.interface = if_nametoindex(
3196
3030
server_settings["interface"].encode("utf-8"))
3198
3032
global multiprocessing_manager
3199
3033
multiprocessing_manager = multiprocessing.Manager()
3201
3035
client_class = Client
3203
client_class = functools.partial(ClientDBus, bus=bus)
3037
client_class = functools.partial(ClientDBus, bus = bus)
3205
3039
client_settings = Client.config_parser(client_config)
3206
3040
old_client_settings = {}
3207
3041
clients_data = {}
3209
3043
# This is used to redirect stdout and stderr for checker processes
3211
wnull = open(os.devnull, "w") # A writable /dev/null
3045
wnull = open(os.devnull, "w") # A writable /dev/null
3212
3046
# Only used if server is running in foreground but not in debug
3214
3048
if debug or not foreground:
3217
3051
# Get client data and settings from last running state.
3218
3052
if server_settings["restore"]:
3220
3054
with open(stored_state_path, "rb") as stored_state:
3221
if sys.version_info.major == 2:
3055
if sys.version_info.major == 2:
3222
3056
clients_data, old_client_settings = pickle.load(
3225
3059
bytes_clients_data, bytes_old_client_settings = (
3226
pickle.load(stored_state, encoding="bytes"))
3227
# Fix bytes to strings
3060
pickle.load(stored_state, encoding = "bytes"))
3061
### Fix bytes to strings
3230
clients_data = {(key.decode("utf-8")
3231
if isinstance(key, bytes)
3234
bytes_clients_data.items()}
3235
del bytes_clients_data
3064
clients_data = { (key.decode("utf-8")
3065
if isinstance(key, bytes)
3068
bytes_clients_data.items() }
3236
3069
for key in clients_data:
3237
value = {(k.decode("utf-8")
3238
if isinstance(k, bytes) else k): v
3240
clients_data[key].items()}
3070
value = { (k.decode("utf-8")
3071
if isinstance(k, bytes) else k): v
3073
clients_data[key].items() }
3241
3074
clients_data[key] = value
3242
3075
# .client_structure
3243
3076
value["client_structure"] = [
3244
3077
(s.decode("utf-8")
3245
3078
if isinstance(s, bytes)
3246
3079
else s) for s in
3247
value["client_structure"]]
3080
value["client_structure"] ]
3248
3081
# .name & .host
3249
3082
for k in ("name", "host"):
3250
3083
if isinstance(value[k], bytes):
3251
3084
value[k] = value[k].decode("utf-8")
3252
if "key_id" not in value:
3253
value["key_id"] = ""
3254
elif "fingerprint" not in value:
3255
value["fingerprint"] = ""
3256
# old_client_settings
3085
## old_client_settings
3258
3087
old_client_settings = {
3259
3088
(key.decode("utf-8")
3260
3089
if isinstance(key, bytes)
3261
3090
else key): value
3262
3091
for key, value in
3263
bytes_old_client_settings.items()}
3264
del bytes_old_client_settings
3092
bytes_old_client_settings.items() }
3266
3094
for value in old_client_settings.values():
3267
if isinstance(value["host"], bytes):
3268
value["host"] = (value["host"]
3095
value["host"] = value["host"].decode("utf-8")
3270
3096
os.remove(stored_state_path)
3271
3097
except IOError as e:
3272
3098
if e.errno == errno.ENOENT: