2
2
# -*- mode: python; coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
17
# This file is part of Mandos.
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
32
31
# Contact the authors at <mandos@recompile.se>.
35
34
from __future__ import (division, absolute_import, print_function,
247
230
'--passphrase-file',
249
232
+ self.gnupgargs,
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
ciphertext, err = proc.communicate(input = data)
254
237
if proc.returncode != 0:
255
238
raise PGPError(err)
256
239
return ciphertext
258
241
def decrypt(self, data, password):
259
242
passphrase = self.password_encode(password)
260
243
with tempfile.NamedTemporaryFile(
261
dir=self.tempdir) as passfile:
244
dir = self.tempdir) as passfile:
262
245
passfile.write(passphrase)
264
247
proc = subprocess.Popen([self.gpg, '--decrypt',
265
248
'--passphrase-file',
267
250
+ self.gnupgargs,
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
251
stdin = subprocess.PIPE,
252
stdout = subprocess.PIPE,
253
stderr = subprocess.PIPE)
254
decrypted_plaintext, err = proc.communicate(input = data)
272
255
if proc.returncode != 0:
273
256
raise PGPError(err)
274
257
return decrypted_plaintext
277
259
# Pretend that we have an Avahi module
278
260
class Avahi(object):
279
261
"""This isn't so much a class as it is a module-like namespace.
280
262
It is instantiated once, and simulates having an Avahi module."""
281
IF_UNSPEC = -1 # avahi-common/address.h
282
PROTO_UNSPEC = -1 # avahi-common/address.h
283
PROTO_INET = 0 # avahi-common/address.h
284
PROTO_INET6 = 1 # avahi-common/address.h
263
IF_UNSPEC = -1 # avahi-common/address.h
264
PROTO_UNSPEC = -1 # avahi-common/address.h
265
PROTO_INET = 0 # avahi-common/address.h
266
PROTO_INET6 = 1 # avahi-common/address.h
285
267
DBUS_NAME = "org.freedesktop.Avahi"
286
268
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
287
269
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
288
270
DBUS_PATH_SERVER = "/"
290
271
def string_array_to_txt_array(self, t):
291
272
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
273
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
274
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
275
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
276
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
277
SERVER_INVALID = 0 # avahi-common/defs.h
278
SERVER_REGISTERING = 1 # avahi-common/defs.h
279
SERVER_RUNNING = 2 # avahi-common/defs.h
280
SERVER_COLLISION = 3 # avahi-common/defs.h
281
SERVER_FAILURE = 4 # avahi-common/defs.h
304
284
class AvahiError(Exception):
305
285
def __init__(self, value, *args, **kwargs):
306
286
self.value = value
496
476
class AvahiServiceToSyslog(AvahiService):
497
477
def rename(self, *args, **kwargs):
498
478
"""Add the new name to the syslog messages"""
499
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
479
ret = AvahiService.rename(self, *args, **kwargs)
500
480
syslogger.setFormatter(logging.Formatter(
501
481
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
502
482
.format(self.name)))
506
485
# Pretend that we have a GnuTLS module
507
486
class GnuTLS(object):
508
487
"""This isn't so much a class as it is a module-like namespace.
509
488
It is instantiated once, and simulates having a GnuTLS module."""
511
library = ctypes.util.find_library("gnutls")
513
library = ctypes.util.find_library("gnutls-deb0")
514
_library = ctypes.cdll.LoadLibrary(library)
490
_library = ctypes.cdll.LoadLibrary(
491
ctypes.util.find_library("gnutls"))
516
492
_need_version = b"3.3.0"
517
_tls_rawpk_version = b"3.6.6"
519
493
def __init__(self):
520
# Need to use "self" here, since this method is called before
521
# the assignment to the "gnutls" global variable happens.
522
if self.check_version(self._need_version) is None:
523
raise self.Error("Needs GnuTLS {} or later"
524
.format(self._need_version))
494
# Need to use class name "GnuTLS" here, since this method is
495
# called before the assignment to the "gnutls" global variable
497
if GnuTLS.check_version(self._need_version) is None:
498
raise GnuTLS.Error("Needs GnuTLS {} or later"
499
.format(self._need_version))
526
501
# Unless otherwise indicated, the constants and types below are
527
502
# all from the gnutls/gnutls.h C header file.
531
506
E_INTERRUPTED = -52
537
511
CRD_CERTIFICATE = 1
538
512
E_NO_CERTIFICATE_FOUND = -49
543
KEYID_USE_SHA256 = 1 # gnutls/x509.h
544
513
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
547
516
class session_int(ctypes.Structure):
549
518
session_t = ctypes.POINTER(session_int)
551
519
class certificate_credentials_st(ctypes.Structure):
553
521
certificate_credentials_t = ctypes.POINTER(
554
522
certificate_credentials_st)
555
523
certificate_type_t = ctypes.c_int
557
524
class datum_t(ctypes.Structure):
558
525
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
559
526
('size', ctypes.c_uint)]
561
527
class openpgp_crt_int(ctypes.Structure):
563
529
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
564
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
530
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
565
531
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
566
532
credentials_type_t = ctypes.c_int
567
533
transport_ptr_t = ctypes.c_void_p
568
534
close_request_t = ctypes.c_int
571
537
class Error(Exception):
572
538
# We need to use the class name "GnuTLS" here, since this
573
539
# exception might be raised from within GnuTLS.__init__,
574
540
# which is called before the assignment to the "gnutls"
575
541
# global variable has happened.
576
def __init__(self, message=None, code=None, args=()):
542
def __init__(self, message = None, code = None, args=()):
577
543
# Default usage is by a message string, but if a return
578
544
# code is passed, convert it to a string with
579
545
# gnutls.strerror()
654
614
return _error_code(result)
655
615
result = func(*arguments)
658
618
# Unless otherwise indicated, the function declarations below are
659
619
# all from the gnutls/gnutls.h C header file.
662
622
priority_set_direct = _library.gnutls_priority_set_direct
663
623
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
664
624
ctypes.POINTER(ctypes.c_char_p)]
665
625
priority_set_direct.restype = _error_code
667
627
init = _library.gnutls_init
668
628
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
669
629
init.restype = _error_code
671
631
set_default_priority = _library.gnutls_set_default_priority
672
632
set_default_priority.argtypes = [session_t]
673
633
set_default_priority.restype = _error_code
675
635
record_send = _library.gnutls_record_send
676
636
record_send.argtypes = [session_t, ctypes.c_void_p,
678
638
record_send.restype = ctypes.c_ssize_t
679
639
record_send.errcheck = _retry_on_error
681
641
certificate_allocate_credentials = (
682
642
_library.gnutls_certificate_allocate_credentials)
683
643
certificate_allocate_credentials.argtypes = [
684
644
ctypes.POINTER(certificate_credentials_t)]
685
645
certificate_allocate_credentials.restype = _error_code
687
647
certificate_free_credentials = (
688
648
_library.gnutls_certificate_free_credentials)
689
certificate_free_credentials.argtypes = [
690
certificate_credentials_t]
649
certificate_free_credentials.argtypes = [certificate_credentials_t]
691
650
certificate_free_credentials.restype = None
693
652
handshake_set_private_extensions = (
694
653
_library.gnutls_handshake_set_private_extensions)
695
654
handshake_set_private_extensions.argtypes = [session_t,
697
656
handshake_set_private_extensions.restype = None
699
658
credentials_set = _library.gnutls_credentials_set
700
659
credentials_set.argtypes = [session_t, credentials_type_t,
702
661
credentials_set.restype = _error_code
704
663
strerror = _library.gnutls_strerror
705
664
strerror.argtypes = [ctypes.c_int]
706
665
strerror.restype = ctypes.c_char_p
708
667
certificate_type_get = _library.gnutls_certificate_type_get
709
668
certificate_type_get.argtypes = [session_t]
710
669
certificate_type_get.restype = _error_code
712
671
certificate_get_peers = _library.gnutls_certificate_get_peers
713
672
certificate_get_peers.argtypes = [session_t,
714
673
ctypes.POINTER(ctypes.c_uint)]
715
674
certificate_get_peers.restype = ctypes.POINTER(datum_t)
717
676
global_set_log_level = _library.gnutls_global_set_log_level
718
677
global_set_log_level.argtypes = [ctypes.c_int]
719
678
global_set_log_level.restype = None
721
680
global_set_log_function = _library.gnutls_global_set_log_function
722
681
global_set_log_function.argtypes = [log_func]
723
682
global_set_log_function.restype = None
725
684
deinit = _library.gnutls_deinit
726
685
deinit.argtypes = [session_t]
727
686
deinit.restype = None
729
688
handshake = _library.gnutls_handshake
730
689
handshake.argtypes = [session_t]
731
690
handshake.restype = _error_code
732
691
handshake.errcheck = _retry_on_error
734
693
transport_set_ptr = _library.gnutls_transport_set_ptr
735
694
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
736
695
transport_set_ptr.restype = None
738
697
bye = _library.gnutls_bye
739
698
bye.argtypes = [session_t, close_request_t]
740
699
bye.restype = _error_code
741
700
bye.errcheck = _retry_on_error
743
702
check_version = _library.gnutls_check_version
744
703
check_version.argtypes = [ctypes.c_char_p]
745
704
check_version.restype = ctypes.c_char_p
747
has_rawpk = bool(check_version(_tls_rawpk_version))
751
class pubkey_st(ctypes.Structure):
753
pubkey_t = ctypes.POINTER(pubkey_st)
755
x509_crt_fmt_t = ctypes.c_int
757
# All the function declarations below are from gnutls/abstract.h
758
pubkey_init = _library.gnutls_pubkey_init
759
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
760
pubkey_init.restype = _error_code
762
pubkey_import = _library.gnutls_pubkey_import
763
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
765
pubkey_import.restype = _error_code
767
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
768
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
769
ctypes.POINTER(ctypes.c_ubyte),
770
ctypes.POINTER(ctypes.c_size_t)]
771
pubkey_get_key_id.restype = _error_code
773
pubkey_deinit = _library.gnutls_pubkey_deinit
774
pubkey_deinit.argtypes = [pubkey_t]
775
pubkey_deinit.restype = None
777
# All the function declarations below are from gnutls/openpgp.h
779
openpgp_crt_init = _library.gnutls_openpgp_crt_init
780
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
781
openpgp_crt_init.restype = _error_code
783
openpgp_crt_import = _library.gnutls_openpgp_crt_import
784
openpgp_crt_import.argtypes = [openpgp_crt_t,
785
ctypes.POINTER(datum_t),
787
openpgp_crt_import.restype = _error_code
789
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
790
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
791
ctypes.POINTER(ctypes.c_uint)]
792
openpgp_crt_verify_self.restype = _error_code
794
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
795
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
796
openpgp_crt_deinit.restype = None
798
openpgp_crt_get_fingerprint = (
799
_library.gnutls_openpgp_crt_get_fingerprint)
800
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
804
openpgp_crt_get_fingerprint.restype = _error_code
806
if check_version("3.6.4"):
807
certificate_type_get2 = _library.gnutls_certificate_type_get2
808
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
809
certificate_type_get2.restype = _error_code
706
# All the function declarations below are from gnutls/openpgp.h
708
openpgp_crt_init = _library.gnutls_openpgp_crt_init
709
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
710
openpgp_crt_init.restype = _error_code
712
openpgp_crt_import = _library.gnutls_openpgp_crt_import
713
openpgp_crt_import.argtypes = [openpgp_crt_t,
714
ctypes.POINTER(datum_t),
716
openpgp_crt_import.restype = _error_code
718
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
719
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
720
ctypes.POINTER(ctypes.c_uint)]
721
openpgp_crt_verify_self.restype = _error_code
723
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
724
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
725
openpgp_crt_deinit.restype = None
727
openpgp_crt_get_fingerprint = (
728
_library.gnutls_openpgp_crt_get_fingerprint)
729
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
733
openpgp_crt_get_fingerprint.restype = _error_code
811
735
# Remove non-public functions
812
736
del _error_code, _retry_on_error
813
737
# Create the global "gnutls" object, simulating a module
814
738
gnutls = GnuTLS()
817
740
def call_pipe(connection, # : multiprocessing.Connection
818
741
func, *args, **kwargs):
819
742
"""This function is meant to be called by multiprocessing.Process
821
744
This function runs func(*args, **kwargs), and writes the resulting
822
745
return value on the provided multiprocessing.Connection.
824
747
connection.send(func(*args, **kwargs))
825
748
connection.close()
828
750
class Client(object):
829
751
"""A representation of a client host served by this server.
832
754
approved: bool(); 'None' if not yet approved/disapproved
833
755
approval_delay: datetime.timedelta(); Time to wait for approval
835
757
checker: subprocess.Popen(); a running checker process used
836
758
to see if the client lives.
837
759
'None' if no process is running.
838
checker_callback_tag: a GLib event source tag, or None
760
checker_callback_tag: a GObject event source tag, or None
839
761
checker_command: string; External command which is run to check
840
762
if client lives. %() expansions are done at
841
763
runtime with vars(self) as dict, so that for
842
764
instance %(name)s can be used in the command.
843
checker_initiator_tag: a GLib event source tag, or None
765
checker_initiator_tag: a GObject event source tag, or None
844
766
created: datetime.datetime(); (UTC) object creation
845
767
client_structure: Object describing what attributes a client has
846
768
and is used for storing the client at exit
847
769
current_checker_command: string; current running checker_command
848
disable_initiator_tag: a GLib event source tag, or None
770
disable_initiator_tag: a GObject event source tag, or None
850
772
fingerprint: string (40 or 32 hexadecimal digits); used to
851
uniquely identify an OpenPGP client
852
key_id: string (64 hexadecimal digits); used to uniquely identify
853
a client using raw public keys
773
uniquely identify the client
854
774
host: string; available for use by the checker command
855
775
interval: datetime.timedelta(); How often to start a new checker
856
776
last_approval_request: datetime.datetime(); (UTC) or None
1013
930
logger.info("Disabling client %s", self.name)
1014
931
if getattr(self, "disable_initiator_tag", None) is not None:
1015
GLib.source_remove(self.disable_initiator_tag)
932
GObject.source_remove(self.disable_initiator_tag)
1016
933
self.disable_initiator_tag = None
1017
934
self.expires = None
1018
935
if getattr(self, "checker_initiator_tag", None) is not None:
1019
GLib.source_remove(self.checker_initiator_tag)
936
GObject.source_remove(self.checker_initiator_tag)
1020
937
self.checker_initiator_tag = None
1021
938
self.stop_checker()
1022
939
self.enabled = False
1024
941
self.send_changedstate()
1025
# Do not run this again if called by a GLib.timeout_add
942
# Do not run this again if called by a GObject.timeout_add
1028
945
def __del__(self):
1031
948
def init_checker(self):
1032
949
# Schedule a new checker to be started an 'interval' from now,
1033
950
# and every interval from then on.
1034
951
if self.checker_initiator_tag is not None:
1035
GLib.source_remove(self.checker_initiator_tag)
1036
self.checker_initiator_tag = GLib.timeout_add(
952
GObject.source_remove(self.checker_initiator_tag)
953
self.checker_initiator_tag = GObject.timeout_add(
1037
954
int(self.interval.total_seconds() * 1000),
1038
955
self.start_checker)
1039
956
# Schedule a disable() when 'timeout' has passed
1040
957
if self.disable_initiator_tag is not None:
1041
GLib.source_remove(self.disable_initiator_tag)
1042
self.disable_initiator_tag = GLib.timeout_add(
958
GObject.source_remove(self.disable_initiator_tag)
959
self.disable_initiator_tag = GObject.timeout_add(
1043
960
int(self.timeout.total_seconds() * 1000), self.disable)
1044
961
# Also start a new checker *right now*.
1045
962
self.start_checker()
1047
964
def checker_callback(self, source, condition, connection,
1049
966
"""The checker has completed, so take appropriate actions."""
1132
1049
# The exception is when not debugging but nevertheless
1133
1050
# running in the foreground; use the previously
1134
1051
# created wnull.
1135
popen_args = {"close_fds": True,
1052
popen_args = { "close_fds": True,
1138
1055
if (not self.server_settings["debug"]
1139
1056
and self.server_settings["foreground"]):
1140
1057
popen_args.update({"stdout": wnull,
1142
pipe = multiprocessing.Pipe(duplex=False)
1059
pipe = multiprocessing.Pipe(duplex = False)
1143
1060
self.checker = multiprocessing.Process(
1145
args=(pipe[1], subprocess.call, command),
1062
args = (pipe[1], subprocess.call, command),
1063
kwargs = popen_args)
1147
1064
self.checker.start()
1148
self.checker_callback_tag = GLib.io_add_watch(
1149
pipe[0].fileno(), GLib.IO_IN,
1065
self.checker_callback_tag = GObject.io_add_watch(
1066
pipe[0].fileno(), GObject.IO_IN,
1150
1067
self.checker_callback, pipe[0], command)
1151
# Re-run this periodically if run by GLib.timeout_add
1068
# Re-run this periodically if run by GObject.timeout_add
1154
1071
def stop_checker(self):
1155
1072
"""Force the checker process, if any, to stop."""
1156
1073
if self.checker_callback_tag:
1157
GLib.source_remove(self.checker_callback_tag)
1074
GObject.source_remove(self.checker_callback_tag)
1158
1075
self.checker_callback_tag = None
1159
1076
if getattr(self, "checker", None) is None:
1514
1431
exc_info=error)
1515
1432
return xmlstring
1519
1435
dbus.OBJECT_MANAGER_IFACE
1520
1436
except AttributeError:
1521
1437
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1524
1439
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1525
1440
"""A D-Bus object with an ObjectManager.
1527
1442
Classes inheriting from this exposes the standard
1528
1443
GetManagedObjects call and the InterfacesAdded and
1529
1444
InterfacesRemoved signals on the standard
1530
1445
"org.freedesktop.DBus.ObjectManager" interface.
1532
1447
Note: No signals are sent automatically; they must be sent
1535
1450
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1536
out_signature="a{oa{sa{sv}}}")
1451
out_signature = "a{oa{sa{sv}}}")
1537
1452
def GetManagedObjects(self):
1538
1453
"""This function must be overridden"""
1539
1454
raise NotImplementedError()
1541
1456
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1542
signature="oa{sa{sv}}")
1457
signature = "oa{sa{sv}}")
1543
1458
def InterfacesAdded(self, object_path, interfaces_and_properties):
1546
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1461
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1547
1462
def InterfacesRemoved(self, object_path, interfaces):
1550
1465
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1552
path_keyword='object_path',
1553
connection_keyword='connection')
1466
out_signature = "s",
1467
path_keyword = 'object_path',
1468
connection_keyword = 'connection')
1554
1469
def Introspect(self, object_path, connection):
1555
1470
"""Overloading of standard D-Bus method.
1557
1472
Override return argument name of GetManagedObjects to be
1558
1473
"objpath_interfaces_and_properties"
1853
1765
"ApprovedByDefault")
1854
1766
approval_delay = notifychangeproperty(
1855
1767
dbus.UInt64, "ApprovalDelay",
1856
type_func=lambda td: td.total_seconds() * 1000)
1768
type_func = lambda td: td.total_seconds() * 1000)
1857
1769
approval_duration = notifychangeproperty(
1858
1770
dbus.UInt64, "ApprovalDuration",
1859
type_func=lambda td: td.total_seconds() * 1000)
1771
type_func = lambda td: td.total_seconds() * 1000)
1860
1772
host = notifychangeproperty(dbus.String, "Host")
1861
1773
timeout = notifychangeproperty(
1862
1774
dbus.UInt64, "Timeout",
1863
type_func=lambda td: td.total_seconds() * 1000)
1775
type_func = lambda td: td.total_seconds() * 1000)
1864
1776
extended_timeout = notifychangeproperty(
1865
1777
dbus.UInt64, "ExtendedTimeout",
1866
type_func=lambda td: td.total_seconds() * 1000)
1778
type_func = lambda td: td.total_seconds() * 1000)
1867
1779
interval = notifychangeproperty(
1868
1780
dbus.UInt64, "Interval",
1869
type_func=lambda td: td.total_seconds() * 1000)
1781
type_func = lambda td: td.total_seconds() * 1000)
1870
1782
checker_command = notifychangeproperty(dbus.String, "Checker")
1871
1783
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1872
1784
invalidate_only=True)
1874
1786
del notifychangeproperty
1876
1788
def __del__(self, *args, **kwargs):
1878
1790
self.remove_from_connection()
2250
2155
class ClientHandler(socketserver.BaseRequestHandler, object):
2251
2156
"""A class to handle client connections.
2253
2158
Instantiated once for each connection to handle it.
2254
2159
Note: This will run in its own forked process."""
2256
2161
def handle(self):
2257
2162
with contextlib.closing(self.server.child_pipe) as child_pipe:
2258
2163
logger.info("TCP connection from: %s",
2259
2164
str(self.client_address))
2260
2165
logger.debug("Pipe FD: %d",
2261
2166
self.server.child_pipe.fileno())
2263
2168
session = gnutls.ClientSession(self.request)
2265
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2266
# "+AES-256-CBC", "+SHA1",
2267
# "+COMP-NULL", "+CTYPE-OPENPGP",
2170
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2171
# "+AES-256-CBC", "+SHA1",
2172
# "+COMP-NULL", "+CTYPE-OPENPGP",
2269
2174
# Use a fallback default, since this MUST be set.
2270
2175
priority = self.server.gnutls_priority
2271
2176
if priority is None:
2272
2177
priority = "NORMAL"
2273
gnutls.priority_set_direct(session._c_object,
2274
priority.encode("utf-8"),
2178
gnutls.priority_set_direct(session._c_object, priority,
2277
2181
# Start communication using the Mandos protocol
2278
2182
# Get protocol number
2279
2183
line = self.request.makefile().readline()
2427
2309
cert = cert_list[0]
2428
2310
return ctypes.string_at(cert.data, cert.size)
2431
def key_id(certificate):
2432
"Convert a certificate bytestring to a hexdigit key ID"
2433
# New GnuTLS "datum" with the public key
2434
datum = gnutls.datum_t(
2435
ctypes.cast(ctypes.c_char_p(certificate),
2436
ctypes.POINTER(ctypes.c_ubyte)),
2437
ctypes.c_uint(len(certificate)))
2438
# XXX all these need to be created in the gnutls "module"
2439
# New empty GnuTLS certificate
2440
pubkey = gnutls.pubkey_t()
2441
gnutls.pubkey_init(ctypes.byref(pubkey))
2442
# Import the raw public key into the certificate
2443
gnutls.pubkey_import(pubkey,
2444
ctypes.byref(datum),
2445
gnutls.X509_FMT_DER)
2446
# New buffer for the key ID
2447
buf = ctypes.create_string_buffer(32)
2448
buf_len = ctypes.c_size_t(len(buf))
2449
# Get the key ID from the raw public key into the buffer
2450
gnutls.pubkey_get_key_id(pubkey,
2451
gnutls.KEYID_USE_SHA256,
2452
ctypes.cast(ctypes.byref(buf),
2453
ctypes.POINTER(ctypes.c_ubyte)),
2454
ctypes.byref(buf_len))
2455
# Deinit the certificate
2456
gnutls.pubkey_deinit(pubkey)
2458
# Convert the buffer to a Python bytestring
2459
key_id = ctypes.string_at(buf, buf_len.value)
2460
# Convert the bytestring to hexadecimal notation
2461
hex_key_id = binascii.hexlify(key_id).upper()
2465
2313
def fingerprint(openpgp):
2466
2314
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2501
2348
class MultiprocessingMixIn(object):
2502
2349
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2504
2351
def sub_process_main(self, request, address):
2506
2353
self.finish_request(request, address)
2507
2354
except Exception:
2508
2355
self.handle_error(request, address)
2509
2356
self.close_request(request)
2511
2358
def process_request(self, request, address):
2512
2359
"""Start a new process to process the request."""
2513
proc = multiprocessing.Process(target=self.sub_process_main,
2514
args=(request, address))
2360
proc = multiprocessing.Process(target = self.sub_process_main,
2361
args = (request, address))
2519
2366
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2520
2367
""" adds a pipe to the MixIn """
2522
2369
def process_request(self, request, client_address):
2523
2370
"""Overrides and wraps the original process_request().
2525
2372
This function creates a new pipe in self.pipe
2527
2374
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2529
2376
proc = MultiprocessingMixIn.process_request(self, request,
2530
2377
client_address)
2531
2378
self.child_pipe.close()
2532
2379
self.add_pipe(parent_pipe, proc)
2534
2381
def add_pipe(self, parent_pipe, proc):
2535
2382
"""Dummy function; override as necessary"""
2536
2383
raise NotImplementedError()
2585
2431
# socket_wrapper(), if socketfd was set.
2586
2432
socketserver.TCPServer.__init__(self, server_address,
2587
2433
RequestHandlerClass)
2589
2435
def server_bind(self):
2590
2436
"""This overrides the normal server_bind() function
2591
2437
to bind to an interface if one was specified, and also NOT to
2592
2438
bind to an address or port if they were not specified."""
2593
global SO_BINDTODEVICE
2594
2439
if self.interface is not None:
2595
2440
if SO_BINDTODEVICE is None:
2596
# Fall back to a hard-coded value which seems to be
2598
logger.warning("SO_BINDTODEVICE not found, trying 25")
2599
SO_BINDTODEVICE = 25
2601
self.socket.setsockopt(
2602
socket.SOL_SOCKET, SO_BINDTODEVICE,
2603
(self.interface + "\0").encode("utf-8"))
2604
except socket.error as error:
2605
if error.errno == errno.EPERM:
2606
logger.error("No permission to bind to"
2607
" interface %s", self.interface)
2608
elif error.errno == errno.ENOPROTOOPT:
2609
logger.error("SO_BINDTODEVICE not available;"
2610
" cannot bind to interface %s",
2612
elif error.errno == errno.ENODEV:
2613
logger.error("Interface %s does not exist,"
2614
" cannot bind", self.interface)
2441
logger.error("SO_BINDTODEVICE does not exist;"
2442
" cannot bind to interface %s",
2446
self.socket.setsockopt(
2447
socket.SOL_SOCKET, SO_BINDTODEVICE,
2448
(self.interface + "\0").encode("utf-8"))
2449
except socket.error as error:
2450
if error.errno == errno.EPERM:
2451
logger.error("No permission to bind to"
2452
" interface %s", self.interface)
2453
elif error.errno == errno.ENOPROTOOPT:
2454
logger.error("SO_BINDTODEVICE not available;"
2455
" cannot bind to interface %s",
2457
elif error.errno == errno.ENODEV:
2458
logger.error("Interface %s does not exist,"
2459
" cannot bind", self.interface)
2617
2462
# Only bind(2) the socket if we really need to.
2618
2463
if self.server_address[0] or self.server_address[1]:
2619
2464
if not self.server_address[0]:
2620
2465
if self.address_family == socket.AF_INET6:
2621
any_address = "::" # in6addr_any
2466
any_address = "::" # in6addr_any
2623
any_address = "0.0.0.0" # INADDR_ANY
2468
any_address = "0.0.0.0" # INADDR_ANY
2624
2469
self.server_address = (any_address,
2625
2470
self.server_address[1])
2626
2471
elif not self.server_address[1]:
2660
2505
self.gnutls_priority = gnutls_priority
2661
2506
IPv6_TCPServer.__init__(self, server_address,
2662
2507
RequestHandlerClass,
2663
interface=interface,
2508
interface = interface,
2509
use_ipv6 = use_ipv6,
2510
socketfd = socketfd)
2667
2512
def server_activate(self):
2668
2513
if self.enabled:
2669
2514
return socketserver.TCPServer.server_activate(self)
2671
2516
def enable(self):
2672
2517
self.enabled = True
2674
2519
def add_pipe(self, parent_pipe, proc):
2675
2520
# Call "handle_ipc" for both data and EOF events
2521
GObject.io_add_watch(
2677
2522
parent_pipe.fileno(),
2678
GLib.IO_IN | GLib.IO_HUP,
2523
GObject.IO_IN | GObject.IO_HUP,
2679
2524
functools.partial(self.handle_ipc,
2680
parent_pipe=parent_pipe,
2525
parent_pipe = parent_pipe,
2683
2528
def handle_ipc(self, source, condition,
2684
2529
parent_pipe=None,
2686
2531
client_object=None):
2687
2532
# error, or the other end of multiprocessing.Pipe has closed
2688
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2533
if condition & (GObject.IO_ERR | GObject.IO_HUP):
2689
2534
# Wait for other process to exit
2693
2538
# Read a request from the child
2694
2539
request = parent_pipe.recv()
2695
2540
command = request[0]
2697
2542
if command == 'init':
2698
key_id = request[1].decode("ascii")
2699
fpr = request[2].decode("ascii")
2700
address = request[3]
2544
address = request[2]
2702
2546
for c in self.clients.values():
2703
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2705
if key_id and c.key_id == key_id:
2708
if fpr and c.fingerprint == fpr:
2547
if c.fingerprint == fpr:
2712
logger.info("Client not found for key ID: %s, address"
2713
": %s", key_id or fpr, address)
2551
logger.info("Client not found for fingerprint: %s, ad"
2552
"dress: %s", fpr, address)
2714
2553
if self.use_dbus:
2715
2554
# Emit D-Bus signal
2716
mandos_dbus_service.ClientNotFound(key_id or fpr,
2555
mandos_dbus_service.ClientNotFound(fpr,
2718
2557
parent_pipe.send(False)
2560
GObject.io_add_watch(
2722
2561
parent_pipe.fileno(),
2723
GLib.IO_IN | GLib.IO_HUP,
2562
GObject.IO_IN | GObject.IO_HUP,
2724
2563
functools.partial(self.handle_ipc,
2725
parent_pipe=parent_pipe,
2727
client_object=client))
2564
parent_pipe = parent_pipe,
2566
client_object = client))
2728
2567
parent_pipe.send(True)
2729
2568
# remove the old hook in favor of the new above hook on
3192
3022
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3193
3023
service = AvahiServiceToSyslog(
3194
name=server_settings["servicename"],
3195
servicetype="_mandos._tcp",
3024
name = server_settings["servicename"],
3025
servicetype = "_mandos._tcp",
3026
protocol = protocol,
3198
3028
if server_settings["interface"]:
3199
3029
service.interface = if_nametoindex(
3200
3030
server_settings["interface"].encode("utf-8"))
3202
3032
global multiprocessing_manager
3203
3033
multiprocessing_manager = multiprocessing.Manager()
3205
3035
client_class = Client
3207
client_class = functools.partial(ClientDBus, bus=bus)
3037
client_class = functools.partial(ClientDBus, bus = bus)
3209
3039
client_settings = Client.config_parser(client_config)
3210
3040
old_client_settings = {}
3211
3041
clients_data = {}
3213
3043
# This is used to redirect stdout and stderr for checker processes
3215
wnull = open(os.devnull, "w") # A writable /dev/null
3045
wnull = open(os.devnull, "w") # A writable /dev/null
3216
3046
# Only used if server is running in foreground but not in debug
3218
3048
if debug or not foreground:
3221
3051
# Get client data and settings from last running state.
3222
3052
if server_settings["restore"]:
3224
3054
with open(stored_state_path, "rb") as stored_state:
3225
if sys.version_info.major == 2:
3055
if sys.version_info.major == 2:
3226
3056
clients_data, old_client_settings = pickle.load(
3229
3059
bytes_clients_data, bytes_old_client_settings = (
3230
pickle.load(stored_state, encoding="bytes"))
3231
# Fix bytes to strings
3060
pickle.load(stored_state, encoding = "bytes"))
3061
### Fix bytes to strings
3234
clients_data = {(key.decode("utf-8")
3235
if isinstance(key, bytes)
3238
bytes_clients_data.items()}
3064
clients_data = { (key.decode("utf-8")
3065
if isinstance(key, bytes)
3068
bytes_clients_data.items() }
3239
3069
del bytes_clients_data
3240
3070
for key in clients_data:
3241
value = {(k.decode("utf-8")
3242
if isinstance(k, bytes) else k): v
3244
clients_data[key].items()}
3071
value = { (k.decode("utf-8")
3072
if isinstance(k, bytes) else k): v
3074
clients_data[key].items() }
3245
3075
clients_data[key] = value
3246
3076
# .client_structure
3247
3077
value["client_structure"] = [
3248
3078
(s.decode("utf-8")
3249
3079
if isinstance(s, bytes)
3250
3080
else s) for s in
3251
value["client_structure"]]
3081
value["client_structure"] ]
3252
3082
# .name & .host
3253
3083
for k in ("name", "host"):
3254
3084
if isinstance(value[k], bytes):
3255
3085
value[k] = value[k].decode("utf-8")
3256
if not value.has_key("key_id"):
3257
value["key_id"] = ""
3258
elif not value.has_key("fingerprint"):
3259
value["fingerprint"] = ""
3260
# old_client_settings
3086
## old_client_settings
3262
3088
old_client_settings = {
3263
3089
(key.decode("utf-8")
3264
3090
if isinstance(key, bytes)
3265
3091
else key): value
3266
3092
for key, value in
3267
bytes_old_client_settings.items()}
3093
bytes_old_client_settings.items() }
3268
3094
del bytes_old_client_settings
3270
3096
for value in old_client_settings.values():
3376
3202
pidfilename, pid)
3378
3204
del pidfilename
3380
for termsig in (signal.SIGHUP, signal.SIGTERM):
3381
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3382
lambda: main_loop.quit() and False)
3206
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3207
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3386
3211
@alternate_dbus_interfaces(
3387
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3212
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3388
3213
class MandosDBusService(DBusObjectWithObjectManager):
3389
3214
"""A D-Bus proxy object"""
3391
3216
def __init__(self):
3392
3217
dbus.service.Object.__init__(self, bus, "/")
3394
3219
_interface = "se.recompile.Mandos"
3396
3221
@dbus.service.signal(_interface, signature="o")
3397
3222
def ClientAdded(self, objpath):
3401
3226
@dbus.service.signal(_interface, signature="ss")
3402
def ClientNotFound(self, key_id, address):
3227
def ClientNotFound(self, fingerprint, address):
3406
3231
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3408
3233
@dbus.service.signal(_interface, signature="os")
3409
3234
def ClientRemoved(self, objpath, name):
3413
3238
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3415
3240
@dbus.service.method(_interface, out_signature="ao")