2
2
# -*- mode: python; coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
17
# This file is part of Mandos.
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
32
31
# Contact the authors at <mandos@recompile.se>.
35
34
from __future__ import (division, absolute_import, print_function,
247
227
'--passphrase-file',
249
229
+ self.gnupgargs,
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
230
stdin = subprocess.PIPE,
231
stdout = subprocess.PIPE,
232
stderr = subprocess.PIPE)
233
ciphertext, err = proc.communicate(input = data)
254
234
if proc.returncode != 0:
255
235
raise PGPError(err)
256
236
return ciphertext
258
238
def decrypt(self, data, password):
259
239
passphrase = self.password_encode(password)
260
240
with tempfile.NamedTemporaryFile(
261
dir=self.tempdir) as passfile:
241
dir = self.tempdir) as passfile:
262
242
passfile.write(passphrase)
264
244
proc = subprocess.Popen([self.gpg, '--decrypt',
265
245
'--passphrase-file',
267
247
+ self.gnupgargs,
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
248
stdin = subprocess.PIPE,
249
stdout = subprocess.PIPE,
250
stderr = subprocess.PIPE)
251
decrypted_plaintext, err = proc.communicate(input = data)
272
252
if proc.returncode != 0:
273
253
raise PGPError(err)
274
254
return decrypted_plaintext
277
256
# Pretend that we have an Avahi module
279
"""This isn't so much a class as it is a module-like namespace."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
258
"""This isn't so much a class as it is a module-like namespace.
259
It is instantiated once, and simulates having an Avahi module."""
260
IF_UNSPEC = -1 # avahi-common/address.h
261
PROTO_UNSPEC = -1 # avahi-common/address.h
262
PROTO_INET = 0 # avahi-common/address.h
263
PROTO_INET6 = 1 # avahi-common/address.h
284
264
DBUS_NAME = "org.freedesktop.Avahi"
285
265
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
266
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
267
DBUS_PATH_SERVER = "/"
290
def string_array_to_txt_array(t):
268
def string_array_to_txt_array(self, t):
291
269
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
270
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
271
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
272
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
273
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
274
SERVER_INVALID = 0 # avahi-common/defs.h
275
SERVER_REGISTERING = 1 # avahi-common/defs.h
276
SERVER_RUNNING = 2 # avahi-common/defs.h
277
SERVER_COLLISION = 3 # avahi-common/defs.h
278
SERVER_FAILURE = 4 # avahi-common/defs.h
303
281
class AvahiError(Exception):
304
282
def __init__(self, value, *args, **kwargs):
495
473
class AvahiServiceToSyslog(AvahiService):
496
474
def rename(self, *args, **kwargs):
497
475
"""Add the new name to the syslog messages"""
498
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
476
ret = AvahiService.rename(self, *args, **kwargs)
499
477
syslogger.setFormatter(logging.Formatter(
500
478
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
501
479
.format(self.name)))
505
482
# Pretend that we have a GnuTLS module
506
class gnutls(object):
507
"""This isn't so much a class as it is a module-like namespace."""
509
library = ctypes.util.find_library("gnutls")
511
library = ctypes.util.find_library("gnutls-deb0")
512
_library = ctypes.cdll.LoadLibrary(library)
483
class GnuTLS(object):
484
"""This isn't so much a class as it is a module-like namespace.
485
It is instantiated once, and simulates having a GnuTLS module."""
487
_library = ctypes.cdll.LoadLibrary(
488
ctypes.util.find_library("gnutls"))
489
_need_version = b"3.3.0"
491
# Need to use class name "GnuTLS" here, since this method is
492
# called before the assignment to the "gnutls" global variable
494
if GnuTLS.check_version(self._need_version) is None:
495
raise GnuTLS.Error("Needs GnuTLS {} or later"
496
.format(self._need_version))
515
498
# Unless otherwise indicated, the constants and types below are
516
499
# all from the gnutls/gnutls.h C header file.
520
503
E_INTERRUPTED = -52
526
508
CRD_CERTIFICATE = 1
527
509
E_NO_CERTIFICATE_FOUND = -49
532
KEYID_USE_SHA256 = 1 # gnutls/x509.h
533
510
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
536
513
class session_int(ctypes.Structure):
538
515
session_t = ctypes.POINTER(session_int)
540
516
class certificate_credentials_st(ctypes.Structure):
542
518
certificate_credentials_t = ctypes.POINTER(
543
519
certificate_credentials_st)
544
520
certificate_type_t = ctypes.c_int
546
521
class datum_t(ctypes.Structure):
547
522
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
548
523
('size', ctypes.c_uint)]
550
524
class openpgp_crt_int(ctypes.Structure):
552
526
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
553
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
527
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
554
528
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
555
529
credentials_type_t = ctypes.c_int
556
530
transport_ptr_t = ctypes.c_void_p
557
531
close_request_t = ctypes.c_int
560
534
class Error(Exception):
561
def __init__(self, message=None, code=None, args=()):
535
# We need to use the class name "GnuTLS" here, since this
536
# exception might be raised from within GnuTLS.__init__,
537
# which is called before the assignment to the "gnutls"
538
# global variable has happened.
539
def __init__(self, message = None, code = None, args=()):
562
540
# Default usage is by a message string, but if a return
563
541
# code is passed, convert it to a string with
564
542
# gnutls.strerror()
566
544
if message is None and code is not None:
567
message = gnutls.strerror(code)
568
return super(gnutls.Error, self).__init__(
545
message = GnuTLS.strerror(code)
546
return super(GnuTLS.Error, self).__init__(
571
549
class CertificateSecurityError(Error):
575
553
class Credentials(object):
576
554
def __init__(self):
639
611
return _error_code(result)
640
612
result = func(*arguments)
643
615
# Unless otherwise indicated, the function declarations below are
644
616
# all from the gnutls/gnutls.h C header file.
647
619
priority_set_direct = _library.gnutls_priority_set_direct
648
620
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
649
621
ctypes.POINTER(ctypes.c_char_p)]
650
622
priority_set_direct.restype = _error_code
652
624
init = _library.gnutls_init
653
625
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
654
626
init.restype = _error_code
656
628
set_default_priority = _library.gnutls_set_default_priority
657
629
set_default_priority.argtypes = [session_t]
658
630
set_default_priority.restype = _error_code
660
632
record_send = _library.gnutls_record_send
661
633
record_send.argtypes = [session_t, ctypes.c_void_p,
663
635
record_send.restype = ctypes.c_ssize_t
664
636
record_send.errcheck = _retry_on_error
666
638
certificate_allocate_credentials = (
667
639
_library.gnutls_certificate_allocate_credentials)
668
640
certificate_allocate_credentials.argtypes = [
669
641
ctypes.POINTER(certificate_credentials_t)]
670
642
certificate_allocate_credentials.restype = _error_code
672
644
certificate_free_credentials = (
673
645
_library.gnutls_certificate_free_credentials)
674
certificate_free_credentials.argtypes = [
675
certificate_credentials_t]
646
certificate_free_credentials.argtypes = [certificate_credentials_t]
676
647
certificate_free_credentials.restype = None
678
649
handshake_set_private_extensions = (
679
650
_library.gnutls_handshake_set_private_extensions)
680
651
handshake_set_private_extensions.argtypes = [session_t,
682
653
handshake_set_private_extensions.restype = None
684
655
credentials_set = _library.gnutls_credentials_set
685
656
credentials_set.argtypes = [session_t, credentials_type_t,
687
658
credentials_set.restype = _error_code
689
660
strerror = _library.gnutls_strerror
690
661
strerror.argtypes = [ctypes.c_int]
691
662
strerror.restype = ctypes.c_char_p
693
664
certificate_type_get = _library.gnutls_certificate_type_get
694
665
certificate_type_get.argtypes = [session_t]
695
666
certificate_type_get.restype = _error_code
697
668
certificate_get_peers = _library.gnutls_certificate_get_peers
698
669
certificate_get_peers.argtypes = [session_t,
699
670
ctypes.POINTER(ctypes.c_uint)]
700
671
certificate_get_peers.restype = ctypes.POINTER(datum_t)
702
673
global_set_log_level = _library.gnutls_global_set_log_level
703
674
global_set_log_level.argtypes = [ctypes.c_int]
704
675
global_set_log_level.restype = None
706
677
global_set_log_function = _library.gnutls_global_set_log_function
707
678
global_set_log_function.argtypes = [log_func]
708
679
global_set_log_function.restype = None
710
681
deinit = _library.gnutls_deinit
711
682
deinit.argtypes = [session_t]
712
683
deinit.restype = None
714
685
handshake = _library.gnutls_handshake
715
686
handshake.argtypes = [session_t]
716
687
handshake.restype = _error_code
717
688
handshake.errcheck = _retry_on_error
719
690
transport_set_ptr = _library.gnutls_transport_set_ptr
720
691
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
721
692
transport_set_ptr.restype = None
723
694
bye = _library.gnutls_bye
724
695
bye.argtypes = [session_t, close_request_t]
725
696
bye.restype = _error_code
726
697
bye.errcheck = _retry_on_error
728
699
check_version = _library.gnutls_check_version
729
700
check_version.argtypes = [ctypes.c_char_p]
730
701
check_version.restype = ctypes.c_char_p
732
_need_version = b"3.3.0"
733
if check_version(_need_version) is None:
734
raise self.Error("Needs GnuTLS {} or later"
735
.format(_need_version))
737
_tls_rawpk_version = b"3.6.6"
738
has_rawpk = bool(check_version(_tls_rawpk_version))
742
class pubkey_st(ctypes.Structure):
744
pubkey_t = ctypes.POINTER(pubkey_st)
746
x509_crt_fmt_t = ctypes.c_int
748
# All the function declarations below are from gnutls/abstract.h
749
pubkey_init = _library.gnutls_pubkey_init
750
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
751
pubkey_init.restype = _error_code
753
pubkey_import = _library.gnutls_pubkey_import
754
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
756
pubkey_import.restype = _error_code
758
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
759
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
760
ctypes.POINTER(ctypes.c_ubyte),
761
ctypes.POINTER(ctypes.c_size_t)]
762
pubkey_get_key_id.restype = _error_code
764
pubkey_deinit = _library.gnutls_pubkey_deinit
765
pubkey_deinit.argtypes = [pubkey_t]
766
pubkey_deinit.restype = None
768
# All the function declarations below are from gnutls/openpgp.h
770
openpgp_crt_init = _library.gnutls_openpgp_crt_init
771
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
772
openpgp_crt_init.restype = _error_code
774
openpgp_crt_import = _library.gnutls_openpgp_crt_import
775
openpgp_crt_import.argtypes = [openpgp_crt_t,
776
ctypes.POINTER(datum_t),
778
openpgp_crt_import.restype = _error_code
780
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
781
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
782
ctypes.POINTER(ctypes.c_uint)]
783
openpgp_crt_verify_self.restype = _error_code
785
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
786
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
787
openpgp_crt_deinit.restype = None
789
openpgp_crt_get_fingerprint = (
790
_library.gnutls_openpgp_crt_get_fingerprint)
791
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
795
openpgp_crt_get_fingerprint.restype = _error_code
797
if check_version(b"3.6.4"):
798
certificate_type_get2 = _library.gnutls_certificate_type_get2
799
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
800
certificate_type_get2.restype = _error_code
703
# All the function declarations below are from gnutls/openpgp.h
705
openpgp_crt_init = _library.gnutls_openpgp_crt_init
706
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
707
openpgp_crt_init.restype = _error_code
709
openpgp_crt_import = _library.gnutls_openpgp_crt_import
710
openpgp_crt_import.argtypes = [openpgp_crt_t,
711
ctypes.POINTER(datum_t),
713
openpgp_crt_import.restype = _error_code
715
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
716
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
717
ctypes.POINTER(ctypes.c_uint)]
718
openpgp_crt_verify_self.restype = _error_code
720
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
721
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
722
openpgp_crt_deinit.restype = None
724
openpgp_crt_get_fingerprint = (
725
_library.gnutls_openpgp_crt_get_fingerprint)
726
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
730
openpgp_crt_get_fingerprint.restype = _error_code
802
732
# Remove non-public functions
803
733
del _error_code, _retry_on_error
734
# Create the global "gnutls" object, simulating a module
806
737
def call_pipe(connection, # : multiprocessing.Connection
807
738
func, *args, **kwargs):
808
739
"""This function is meant to be called by multiprocessing.Process
810
741
This function runs func(*args, **kwargs), and writes the resulting
811
742
return value on the provided multiprocessing.Connection.
813
744
connection.send(func(*args, **kwargs))
814
745
connection.close()
817
747
class Client(object):
818
748
"""A representation of a client host served by this server.
821
751
approved: bool(); 'None' if not yet approved/disapproved
822
752
approval_delay: datetime.timedelta(); Time to wait for approval
823
753
approval_duration: datetime.timedelta(); Duration of one approval
824
checker: multiprocessing.Process(); a running checker process used
825
to see if the client lives. 'None' if no process is
754
checker: subprocess.Popen(); a running checker process used
755
to see if the client lives.
756
'None' if no process is running.
827
757
checker_callback_tag: a GLib event source tag, or None
828
758
checker_command: string; External command which is run to check
829
759
if client lives. %() expansions are done at
1504
1428
exc_info=error)
1505
1429
return xmlstring
1509
1432
dbus.OBJECT_MANAGER_IFACE
1510
1433
except AttributeError:
1511
1434
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1514
1436
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1515
1437
"""A D-Bus object with an ObjectManager.
1517
1439
Classes inheriting from this exposes the standard
1518
1440
GetManagedObjects call and the InterfacesAdded and
1519
1441
InterfacesRemoved signals on the standard
1520
1442
"org.freedesktop.DBus.ObjectManager" interface.
1522
1444
Note: No signals are sent automatically; they must be sent
1525
1447
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1526
out_signature="a{oa{sa{sv}}}")
1448
out_signature = "a{oa{sa{sv}}}")
1527
1449
def GetManagedObjects(self):
1528
1450
"""This function must be overridden"""
1529
1451
raise NotImplementedError()
1531
1453
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1532
signature="oa{sa{sv}}")
1454
signature = "oa{sa{sv}}")
1533
1455
def InterfacesAdded(self, object_path, interfaces_and_properties):
1536
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1458
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1537
1459
def InterfacesRemoved(self, object_path, interfaces):
1540
1462
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1542
path_keyword='object_path',
1543
connection_keyword='connection')
1463
out_signature = "s",
1464
path_keyword = 'object_path',
1465
connection_keyword = 'connection')
1544
1466
def Introspect(self, object_path, connection):
1545
1467
"""Overloading of standard D-Bus method.
1547
1469
Override return argument name of GetManagedObjects to be
1548
1470
"objpath_interfaces_and_properties"
2240
2152
class ClientHandler(socketserver.BaseRequestHandler, object):
2241
2153
"""A class to handle client connections.
2243
2155
Instantiated once for each connection to handle it.
2244
2156
Note: This will run in its own forked process."""
2246
2158
def handle(self):
2247
2159
with contextlib.closing(self.server.child_pipe) as child_pipe:
2248
2160
logger.info("TCP connection from: %s",
2249
2161
str(self.client_address))
2250
2162
logger.debug("Pipe FD: %d",
2251
2163
self.server.child_pipe.fileno())
2253
2165
session = gnutls.ClientSession(self.request)
2255
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2256
# "+AES-256-CBC", "+SHA1",
2257
# "+COMP-NULL", "+CTYPE-OPENPGP",
2167
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2168
# "+AES-256-CBC", "+SHA1",
2169
# "+COMP-NULL", "+CTYPE-OPENPGP",
2259
2171
# Use a fallback default, since this MUST be set.
2260
2172
priority = self.server.gnutls_priority
2261
2173
if priority is None:
2262
2174
priority = "NORMAL"
2263
gnutls.priority_set_direct(session._c_object,
2264
priority.encode("utf-8"),
2175
gnutls.priority_set_direct(session._c_object, priority,
2267
2178
# Start communication using the Mandos protocol
2268
2179
# Get protocol number
2269
2180
line = self.request.makefile().readline()
2491
2345
class MultiprocessingMixIn(object):
2492
2346
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2494
2348
def sub_process_main(self, request, address):
2496
2350
self.finish_request(request, address)
2497
2351
except Exception:
2498
2352
self.handle_error(request, address)
2499
2353
self.close_request(request)
2501
2355
def process_request(self, request, address):
2502
2356
"""Start a new process to process the request."""
2503
proc = multiprocessing.Process(target=self.sub_process_main,
2504
args=(request, address))
2357
proc = multiprocessing.Process(target = self.sub_process_main,
2358
args = (request, address))
2509
2363
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2510
2364
""" adds a pipe to the MixIn """
2512
2366
def process_request(self, request, client_address):
2513
2367
"""Overrides and wraps the original process_request().
2515
2369
This function creates a new pipe in self.pipe
2517
2371
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2519
2373
proc = MultiprocessingMixIn.process_request(self, request,
2520
2374
client_address)
2521
2375
self.child_pipe.close()
2522
2376
self.add_pipe(parent_pipe, proc)
2524
2378
def add_pipe(self, parent_pipe, proc):
2525
2379
"""Dummy function; override as necessary"""
2526
2380
raise NotImplementedError()
2575
2428
# socket_wrapper(), if socketfd was set.
2576
2429
socketserver.TCPServer.__init__(self, server_address,
2577
2430
RequestHandlerClass)
2579
2432
def server_bind(self):
2580
2433
"""This overrides the normal server_bind() function
2581
2434
to bind to an interface if one was specified, and also NOT to
2582
2435
bind to an address or port if they were not specified."""
2583
global SO_BINDTODEVICE
2584
2436
if self.interface is not None:
2585
2437
if SO_BINDTODEVICE is None:
2586
# Fall back to a hard-coded value which seems to be
2588
logger.warning("SO_BINDTODEVICE not found, trying 25")
2589
SO_BINDTODEVICE = 25
2591
self.socket.setsockopt(
2592
socket.SOL_SOCKET, SO_BINDTODEVICE,
2593
(self.interface + "\0").encode("utf-8"))
2594
except socket.error as error:
2595
if error.errno == errno.EPERM:
2596
logger.error("No permission to bind to"
2597
" interface %s", self.interface)
2598
elif error.errno == errno.ENOPROTOOPT:
2599
logger.error("SO_BINDTODEVICE not available;"
2600
" cannot bind to interface %s",
2602
elif error.errno == errno.ENODEV:
2603
logger.error("Interface %s does not exist,"
2604
" cannot bind", self.interface)
2438
logger.error("SO_BINDTODEVICE does not exist;"
2439
" cannot bind to interface %s",
2443
self.socket.setsockopt(
2444
socket.SOL_SOCKET, SO_BINDTODEVICE,
2445
(self.interface + "\0").encode("utf-8"))
2446
except socket.error as error:
2447
if error.errno == errno.EPERM:
2448
logger.error("No permission to bind to"
2449
" interface %s", self.interface)
2450
elif error.errno == errno.ENOPROTOOPT:
2451
logger.error("SO_BINDTODEVICE not available;"
2452
" cannot bind to interface %s",
2454
elif error.errno == errno.ENODEV:
2455
logger.error("Interface %s does not exist,"
2456
" cannot bind", self.interface)
2607
2459
# Only bind(2) the socket if we really need to.
2608
2460
if self.server_address[0] or self.server_address[1]:
2609
if self.server_address[1]:
2610
self.allow_reuse_address = True
2611
2461
if not self.server_address[0]:
2612
2462
if self.address_family == socket.AF_INET6:
2613
any_address = "::" # in6addr_any
2463
any_address = "::" # in6addr_any
2615
any_address = "0.0.0.0" # INADDR_ANY
2465
any_address = "0.0.0.0" # INADDR_ANY
2616
2466
self.server_address = (any_address,
2617
2467
self.server_address[1])
2618
2468
elif not self.server_address[1]:
2652
2502
self.gnutls_priority = gnutls_priority
2653
2503
IPv6_TCPServer.__init__(self, server_address,
2654
2504
RequestHandlerClass,
2655
interface=interface,
2505
interface = interface,
2506
use_ipv6 = use_ipv6,
2507
socketfd = socketfd)
2659
2509
def server_activate(self):
2660
2510
if self.enabled:
2661
2511
return socketserver.TCPServer.server_activate(self)
2663
2513
def enable(self):
2664
2514
self.enabled = True
2666
2516
def add_pipe(self, parent_pipe, proc):
2667
2517
# Call "handle_ipc" for both data and EOF events
2668
2518
GLib.io_add_watch(
2669
2519
parent_pipe.fileno(),
2670
2520
GLib.IO_IN | GLib.IO_HUP,
2671
2521
functools.partial(self.handle_ipc,
2672
parent_pipe=parent_pipe,
2522
parent_pipe = parent_pipe,
2675
2525
def handle_ipc(self, source, condition,
2676
2526
parent_pipe=None,
2678
2528
client_object=None):
2679
2529
# error, or the other end of multiprocessing.Pipe has closed
2680
2530
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2681
2531
# Wait for other process to exit
2685
2535
# Read a request from the child
2686
2536
request = parent_pipe.recv()
2687
2537
command = request[0]
2689
2539
if command == 'init':
2690
key_id = request[1].decode("ascii")
2691
fpr = request[2].decode("ascii")
2692
address = request[3]
2541
address = request[2]
2694
2543
for c in self.clients.values():
2695
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2697
if key_id and c.key_id == key_id:
2700
if fpr and c.fingerprint == fpr:
2544
if c.fingerprint == fpr:
2704
logger.info("Client not found for key ID: %s, address"
2705
": %s", key_id or fpr, address)
2548
logger.info("Client not found for fingerprint: %s, ad"
2549
"dress: %s", fpr, address)
2706
2550
if self.use_dbus:
2707
2551
# Emit D-Bus signal
2708
mandos_dbus_service.ClientNotFound(key_id or fpr,
2552
mandos_dbus_service.ClientNotFound(fpr,
2710
2554
parent_pipe.send(False)
2713
2557
GLib.io_add_watch(
2714
2558
parent_pipe.fileno(),
2715
2559
GLib.IO_IN | GLib.IO_HUP,
2716
2560
functools.partial(self.handle_ipc,
2717
parent_pipe=parent_pipe,
2719
client_object=client))
2561
parent_pipe = parent_pipe,
2563
client_object = client))
2720
2564
parent_pipe.send(True)
2721
2565
# remove the old hook in favor of the new above hook on
3184
3019
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3185
3020
service = AvahiServiceToSyslog(
3186
name=server_settings["servicename"],
3187
servicetype="_mandos._tcp",
3021
name = server_settings["servicename"],
3022
servicetype = "_mandos._tcp",
3023
protocol = protocol,
3190
3025
if server_settings["interface"]:
3191
3026
service.interface = if_nametoindex(
3192
3027
server_settings["interface"].encode("utf-8"))
3194
3029
global multiprocessing_manager
3195
3030
multiprocessing_manager = multiprocessing.Manager()
3197
3032
client_class = Client
3199
client_class = functools.partial(ClientDBus, bus=bus)
3034
client_class = functools.partial(ClientDBus, bus = bus)
3201
3036
client_settings = Client.config_parser(client_config)
3202
3037
old_client_settings = {}
3203
3038
clients_data = {}
3205
3040
# This is used to redirect stdout and stderr for checker processes
3207
wnull = open(os.devnull, "w") # A writable /dev/null
3042
wnull = open(os.devnull, "w") # A writable /dev/null
3208
3043
# Only used if server is running in foreground but not in debug
3210
3045
if debug or not foreground:
3213
3048
# Get client data and settings from last running state.
3214
3049
if server_settings["restore"]:
3216
3051
with open(stored_state_path, "rb") as stored_state:
3217
if sys.version_info.major == 2:
3052
if sys.version_info.major == 2:
3218
3053
clients_data, old_client_settings = pickle.load(
3221
3056
bytes_clients_data, bytes_old_client_settings = (
3222
pickle.load(stored_state, encoding="bytes"))
3223
# Fix bytes to strings
3057
pickle.load(stored_state, encoding = "bytes"))
3058
### Fix bytes to strings
3226
clients_data = {(key.decode("utf-8")
3227
if isinstance(key, bytes)
3230
bytes_clients_data.items()}
3061
clients_data = { (key.decode("utf-8")
3062
if isinstance(key, bytes)
3065
bytes_clients_data.items() }
3231
3066
del bytes_clients_data
3232
3067
for key in clients_data:
3233
value = {(k.decode("utf-8")
3234
if isinstance(k, bytes) else k): v
3236
clients_data[key].items()}
3068
value = { (k.decode("utf-8")
3069
if isinstance(k, bytes) else k): v
3071
clients_data[key].items() }
3237
3072
clients_data[key] = value
3238
3073
# .client_structure
3239
3074
value["client_structure"] = [
3240
3075
(s.decode("utf-8")
3241
3076
if isinstance(s, bytes)
3242
3077
else s) for s in
3243
value["client_structure"]]
3078
value["client_structure"] ]
3244
3079
# .name & .host
3245
3080
for k in ("name", "host"):
3246
3081
if isinstance(value[k], bytes):
3247
3082
value[k] = value[k].decode("utf-8")
3248
if "key_id" not in value:
3249
value["key_id"] = ""
3250
elif "fingerprint" not in value:
3251
value["fingerprint"] = ""
3252
# old_client_settings
3083
## old_client_settings
3254
3085
old_client_settings = {
3255
3086
(key.decode("utf-8")
3256
3087
if isinstance(key, bytes)
3257
3088
else key): value
3258
3089
for key, value in
3259
bytes_old_client_settings.items()}
3090
bytes_old_client_settings.items() }
3260
3091
del bytes_old_client_settings
3262
3093
for value in old_client_settings.values():
3368
3199
pidfilename, pid)
3370
3201
del pidfilename
3372
for termsig in (signal.SIGHUP, signal.SIGTERM):
3373
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3374
lambda: main_loop.quit() and False)
3203
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3204
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3378
3208
@alternate_dbus_interfaces(
3379
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3209
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3380
3210
class MandosDBusService(DBusObjectWithObjectManager):
3381
3211
"""A D-Bus proxy object"""
3383
3213
def __init__(self):
3384
3214
dbus.service.Object.__init__(self, bus, "/")
3386
3216
_interface = "se.recompile.Mandos"
3388
3218
@dbus.service.signal(_interface, signature="o")
3389
3219
def ClientAdded(self, objpath):
3393
3223
@dbus.service.signal(_interface, signature="ss")
3394
def ClientNotFound(self, key_id, address):
3224
def ClientNotFound(self, fingerprint, address):
3398
3228
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3400
3230
@dbus.service.signal(_interface, signature="os")
3401
3231
def ClientRemoved(self, objpath, name):
3405
3235
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3407
3237
@dbus.service.method(_interface, out_signature="ao")