2
2
# -*- mode: python; coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
17
# This file is part of Mandos.
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
32
31
# Contact the authors at <mandos@recompile.se>.
35
34
from __future__ import (division, absolute_import, print_function,
251
227
'--passphrase-file',
253
229
+ self.gnupgargs,
254
stdin=subprocess.PIPE,
255
stdout=subprocess.PIPE,
256
stderr=subprocess.PIPE)
257
ciphertext, err = proc.communicate(input=data)
230
stdin = subprocess.PIPE,
231
stdout = subprocess.PIPE,
232
stderr = subprocess.PIPE)
233
ciphertext, err = proc.communicate(input = data)
258
234
if proc.returncode != 0:
259
235
raise PGPError(err)
260
236
return ciphertext
262
238
def decrypt(self, data, password):
263
239
passphrase = self.password_encode(password)
264
240
with tempfile.NamedTemporaryFile(
265
dir=self.tempdir) as passfile:
241
dir = self.tempdir) as passfile:
266
242
passfile.write(passphrase)
268
244
proc = subprocess.Popen([self.gpg, '--decrypt',
269
245
'--passphrase-file',
271
247
+ self.gnupgargs,
272
stdin=subprocess.PIPE,
273
stdout=subprocess.PIPE,
274
stderr=subprocess.PIPE)
275
decrypted_plaintext, err = proc.communicate(input=data)
248
stdin = subprocess.PIPE,
249
stdout = subprocess.PIPE,
250
stderr = subprocess.PIPE)
251
decrypted_plaintext, err = proc.communicate(input = data)
276
252
if proc.returncode != 0:
277
253
raise PGPError(err)
278
254
return decrypted_plaintext
281
256
# Pretend that we have an Avahi module
283
"""This isn't so much a class as it is a module-like namespace."""
284
IF_UNSPEC = -1 # avahi-common/address.h
285
PROTO_UNSPEC = -1 # avahi-common/address.h
286
PROTO_INET = 0 # avahi-common/address.h
287
PROTO_INET6 = 1 # avahi-common/address.h
258
"""This isn't so much a class as it is a module-like namespace.
259
It is instantiated once, and simulates having an Avahi module."""
260
IF_UNSPEC = -1 # avahi-common/address.h
261
PROTO_UNSPEC = -1 # avahi-common/address.h
262
PROTO_INET = 0 # avahi-common/address.h
263
PROTO_INET6 = 1 # avahi-common/address.h
288
264
DBUS_NAME = "org.freedesktop.Avahi"
289
265
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
290
266
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
291
267
DBUS_PATH_SERVER = "/"
294
def string_array_to_txt_array(t):
268
def string_array_to_txt_array(self, t):
295
269
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
296
270
for s in t), signature="ay")
297
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
298
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
299
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
300
SERVER_INVALID = 0 # avahi-common/defs.h
301
SERVER_REGISTERING = 1 # avahi-common/defs.h
302
SERVER_RUNNING = 2 # avahi-common/defs.h
303
SERVER_COLLISION = 3 # avahi-common/defs.h
304
SERVER_FAILURE = 4 # avahi-common/defs.h
271
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
272
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
273
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
274
SERVER_INVALID = 0 # avahi-common/defs.h
275
SERVER_REGISTERING = 1 # avahi-common/defs.h
276
SERVER_RUNNING = 2 # avahi-common/defs.h
277
SERVER_COLLISION = 3 # avahi-common/defs.h
278
SERVER_FAILURE = 4 # avahi-common/defs.h
307
281
class AvahiError(Exception):
308
282
def __init__(self, value, *args, **kwargs):
499
473
class AvahiServiceToSyslog(AvahiService):
500
474
def rename(self, *args, **kwargs):
501
475
"""Add the new name to the syslog messages"""
502
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
476
ret = AvahiService.rename(self, *args, **kwargs)
503
477
syslogger.setFormatter(logging.Formatter(
504
478
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
505
479
.format(self.name)))
509
482
# Pretend that we have a GnuTLS module
510
class gnutls(object):
511
"""This isn't so much a class as it is a module-like namespace."""
513
library = ctypes.util.find_library("gnutls")
515
library = ctypes.util.find_library("gnutls-deb0")
516
_library = ctypes.cdll.LoadLibrary(library)
483
class GnuTLS(object):
484
"""This isn't so much a class as it is a module-like namespace.
485
It is instantiated once, and simulates having a GnuTLS module."""
487
_library = ctypes.cdll.LoadLibrary(
488
ctypes.util.find_library("gnutls"))
489
_need_version = b"3.3.0"
491
# Need to use class name "GnuTLS" here, since this method is
492
# called before the assignment to the "gnutls" global variable
494
if GnuTLS.check_version(self._need_version) is None:
495
raise GnuTLS.Error("Needs GnuTLS {} or later"
496
.format(self._need_version))
519
498
# Unless otherwise indicated, the constants and types below are
520
499
# all from the gnutls/gnutls.h C header file.
524
503
E_INTERRUPTED = -52
530
508
CRD_CERTIFICATE = 1
531
509
E_NO_CERTIFICATE_FOUND = -49
536
KEYID_USE_SHA256 = 1 # gnutls/x509.h
537
510
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
540
513
class session_int(ctypes.Structure):
542
515
session_t = ctypes.POINTER(session_int)
544
516
class certificate_credentials_st(ctypes.Structure):
546
518
certificate_credentials_t = ctypes.POINTER(
547
519
certificate_credentials_st)
548
520
certificate_type_t = ctypes.c_int
550
521
class datum_t(ctypes.Structure):
551
522
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
552
523
('size', ctypes.c_uint)]
554
524
class openpgp_crt_int(ctypes.Structure):
556
526
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
557
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
527
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
558
528
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
559
529
credentials_type_t = ctypes.c_int
560
530
transport_ptr_t = ctypes.c_void_p
561
531
close_request_t = ctypes.c_int
564
534
class Error(Exception):
565
def __init__(self, message=None, code=None, args=()):
535
# We need to use the class name "GnuTLS" here, since this
536
# exception might be raised from within GnuTLS.__init__,
537
# which is called before the assignment to the "gnutls"
538
# global variable has happened.
539
def __init__(self, message = None, code = None, args=()):
566
540
# Default usage is by a message string, but if a return
567
541
# code is passed, convert it to a string with
568
542
# gnutls.strerror()
570
544
if message is None and code is not None:
571
message = gnutls.strerror(code)
572
return super(gnutls.Error, self).__init__(
545
message = GnuTLS.strerror(code)
546
return super(GnuTLS.Error, self).__init__(
575
549
class CertificateSecurityError(Error):
579
553
class Credentials(object):
580
554
def __init__(self):
643
611
return _error_code(result)
644
612
result = func(*arguments)
647
615
# Unless otherwise indicated, the function declarations below are
648
616
# all from the gnutls/gnutls.h C header file.
651
619
priority_set_direct = _library.gnutls_priority_set_direct
652
620
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
653
621
ctypes.POINTER(ctypes.c_char_p)]
654
622
priority_set_direct.restype = _error_code
656
624
init = _library.gnutls_init
657
625
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
658
626
init.restype = _error_code
660
628
set_default_priority = _library.gnutls_set_default_priority
661
629
set_default_priority.argtypes = [session_t]
662
630
set_default_priority.restype = _error_code
664
632
record_send = _library.gnutls_record_send
665
633
record_send.argtypes = [session_t, ctypes.c_void_p,
667
635
record_send.restype = ctypes.c_ssize_t
668
636
record_send.errcheck = _retry_on_error
670
638
certificate_allocate_credentials = (
671
639
_library.gnutls_certificate_allocate_credentials)
672
640
certificate_allocate_credentials.argtypes = [
673
641
ctypes.POINTER(certificate_credentials_t)]
674
642
certificate_allocate_credentials.restype = _error_code
676
644
certificate_free_credentials = (
677
645
_library.gnutls_certificate_free_credentials)
678
certificate_free_credentials.argtypes = [
679
certificate_credentials_t]
646
certificate_free_credentials.argtypes = [certificate_credentials_t]
680
647
certificate_free_credentials.restype = None
682
649
handshake_set_private_extensions = (
683
650
_library.gnutls_handshake_set_private_extensions)
684
651
handshake_set_private_extensions.argtypes = [session_t,
686
653
handshake_set_private_extensions.restype = None
688
655
credentials_set = _library.gnutls_credentials_set
689
656
credentials_set.argtypes = [session_t, credentials_type_t,
691
658
credentials_set.restype = _error_code
693
660
strerror = _library.gnutls_strerror
694
661
strerror.argtypes = [ctypes.c_int]
695
662
strerror.restype = ctypes.c_char_p
697
664
certificate_type_get = _library.gnutls_certificate_type_get
698
665
certificate_type_get.argtypes = [session_t]
699
666
certificate_type_get.restype = _error_code
701
668
certificate_get_peers = _library.gnutls_certificate_get_peers
702
669
certificate_get_peers.argtypes = [session_t,
703
670
ctypes.POINTER(ctypes.c_uint)]
704
671
certificate_get_peers.restype = ctypes.POINTER(datum_t)
706
673
global_set_log_level = _library.gnutls_global_set_log_level
707
674
global_set_log_level.argtypes = [ctypes.c_int]
708
675
global_set_log_level.restype = None
710
677
global_set_log_function = _library.gnutls_global_set_log_function
711
678
global_set_log_function.argtypes = [log_func]
712
679
global_set_log_function.restype = None
714
681
deinit = _library.gnutls_deinit
715
682
deinit.argtypes = [session_t]
716
683
deinit.restype = None
718
685
handshake = _library.gnutls_handshake
719
686
handshake.argtypes = [session_t]
720
687
handshake.restype = _error_code
721
688
handshake.errcheck = _retry_on_error
723
690
transport_set_ptr = _library.gnutls_transport_set_ptr
724
691
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
725
692
transport_set_ptr.restype = None
727
694
bye = _library.gnutls_bye
728
695
bye.argtypes = [session_t, close_request_t]
729
696
bye.restype = _error_code
730
697
bye.errcheck = _retry_on_error
732
699
check_version = _library.gnutls_check_version
733
700
check_version.argtypes = [ctypes.c_char_p]
734
701
check_version.restype = ctypes.c_char_p
736
_need_version = b"3.3.0"
737
if check_version(_need_version) is None:
738
raise self.Error("Needs GnuTLS {} or later"
739
.format(_need_version))
741
_tls_rawpk_version = b"3.6.6"
742
has_rawpk = bool(check_version(_tls_rawpk_version))
746
class pubkey_st(ctypes.Structure):
748
pubkey_t = ctypes.POINTER(pubkey_st)
750
x509_crt_fmt_t = ctypes.c_int
752
# All the function declarations below are from gnutls/abstract.h
753
pubkey_init = _library.gnutls_pubkey_init
754
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
755
pubkey_init.restype = _error_code
757
pubkey_import = _library.gnutls_pubkey_import
758
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
760
pubkey_import.restype = _error_code
762
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
763
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
764
ctypes.POINTER(ctypes.c_ubyte),
765
ctypes.POINTER(ctypes.c_size_t)]
766
pubkey_get_key_id.restype = _error_code
768
pubkey_deinit = _library.gnutls_pubkey_deinit
769
pubkey_deinit.argtypes = [pubkey_t]
770
pubkey_deinit.restype = None
772
# All the function declarations below are from gnutls/openpgp.h
774
openpgp_crt_init = _library.gnutls_openpgp_crt_init
775
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
776
openpgp_crt_init.restype = _error_code
778
openpgp_crt_import = _library.gnutls_openpgp_crt_import
779
openpgp_crt_import.argtypes = [openpgp_crt_t,
780
ctypes.POINTER(datum_t),
782
openpgp_crt_import.restype = _error_code
784
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
785
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
786
ctypes.POINTER(ctypes.c_uint)]
787
openpgp_crt_verify_self.restype = _error_code
789
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
790
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
791
openpgp_crt_deinit.restype = None
793
openpgp_crt_get_fingerprint = (
794
_library.gnutls_openpgp_crt_get_fingerprint)
795
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
799
openpgp_crt_get_fingerprint.restype = _error_code
801
if check_version(b"3.6.4"):
802
certificate_type_get2 = _library.gnutls_certificate_type_get2
803
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
804
certificate_type_get2.restype = _error_code
703
# All the function declarations below are from gnutls/openpgp.h
705
openpgp_crt_init = _library.gnutls_openpgp_crt_init
706
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
707
openpgp_crt_init.restype = _error_code
709
openpgp_crt_import = _library.gnutls_openpgp_crt_import
710
openpgp_crt_import.argtypes = [openpgp_crt_t,
711
ctypes.POINTER(datum_t),
713
openpgp_crt_import.restype = _error_code
715
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
716
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
717
ctypes.POINTER(ctypes.c_uint)]
718
openpgp_crt_verify_self.restype = _error_code
720
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
721
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
722
openpgp_crt_deinit.restype = None
724
openpgp_crt_get_fingerprint = (
725
_library.gnutls_openpgp_crt_get_fingerprint)
726
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
730
openpgp_crt_get_fingerprint.restype = _error_code
806
732
# Remove non-public functions
807
733
del _error_code, _retry_on_error
734
# Create the global "gnutls" object, simulating a module
810
737
def call_pipe(connection, # : multiprocessing.Connection
811
738
func, *args, **kwargs):
812
739
"""This function is meant to be called by multiprocessing.Process
814
741
This function runs func(*args, **kwargs), and writes the resulting
815
742
return value on the provided multiprocessing.Connection.
817
744
connection.send(func(*args, **kwargs))
818
745
connection.close()
821
747
class Client(object):
822
748
"""A representation of a client host served by this server.
825
751
approved: bool(); 'None' if not yet approved/disapproved
826
752
approval_delay: datetime.timedelta(); Time to wait for approval
827
753
approval_duration: datetime.timedelta(); Duration of one approval
828
checker: multiprocessing.Process(); a running checker process used
829
to see if the client lives. 'None' if no process is
754
checker: subprocess.Popen(); a running checker process used
755
to see if the client lives.
756
'None' if no process is running.
831
757
checker_callback_tag: a GLib event source tag, or None
832
758
checker_command: string; External command which is run to check
833
759
if client lives. %() expansions are done at
1508
1428
exc_info=error)
1509
1429
return xmlstring
1513
1432
dbus.OBJECT_MANAGER_IFACE
1514
1433
except AttributeError:
1515
1434
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1518
1436
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1519
1437
"""A D-Bus object with an ObjectManager.
1521
1439
Classes inheriting from this exposes the standard
1522
1440
GetManagedObjects call and the InterfacesAdded and
1523
1441
InterfacesRemoved signals on the standard
1524
1442
"org.freedesktop.DBus.ObjectManager" interface.
1526
1444
Note: No signals are sent automatically; they must be sent
1529
1447
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1530
out_signature="a{oa{sa{sv}}}")
1448
out_signature = "a{oa{sa{sv}}}")
1531
1449
def GetManagedObjects(self):
1532
1450
"""This function must be overridden"""
1533
1451
raise NotImplementedError()
1535
1453
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1536
signature="oa{sa{sv}}")
1454
signature = "oa{sa{sv}}")
1537
1455
def InterfacesAdded(self, object_path, interfaces_and_properties):
1540
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1458
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1541
1459
def InterfacesRemoved(self, object_path, interfaces):
1544
1462
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1546
path_keyword='object_path',
1547
connection_keyword='connection')
1463
out_signature = "s",
1464
path_keyword = 'object_path',
1465
connection_keyword = 'connection')
1548
1466
def Introspect(self, object_path, connection):
1549
1467
"""Overloading of standard D-Bus method.
1551
1469
Override return argument name of GetManagedObjects to be
1552
1470
"objpath_interfaces_and_properties"
2244
2152
class ClientHandler(socketserver.BaseRequestHandler, object):
2245
2153
"""A class to handle client connections.
2247
2155
Instantiated once for each connection to handle it.
2248
2156
Note: This will run in its own forked process."""
2250
2158
def handle(self):
2251
2159
with contextlib.closing(self.server.child_pipe) as child_pipe:
2252
2160
logger.info("TCP connection from: %s",
2253
2161
str(self.client_address))
2254
2162
logger.debug("Pipe FD: %d",
2255
2163
self.server.child_pipe.fileno())
2257
2165
session = gnutls.ClientSession(self.request)
2259
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2260
# "+AES-256-CBC", "+SHA1",
2261
# "+COMP-NULL", "+CTYPE-OPENPGP",
2167
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2168
# "+AES-256-CBC", "+SHA1",
2169
# "+COMP-NULL", "+CTYPE-OPENPGP",
2263
2171
# Use a fallback default, since this MUST be set.
2264
2172
priority = self.server.gnutls_priority
2265
2173
if priority is None:
2266
2174
priority = "NORMAL"
2267
gnutls.priority_set_direct(session._c_object,
2268
priority.encode("utf-8"),
2175
gnutls.priority_set_direct(session._c_object, priority,
2271
2178
# Start communication using the Mandos protocol
2272
2179
# Get protocol number
2273
2180
line = self.request.makefile().readline()
2495
2345
class MultiprocessingMixIn(object):
2496
2346
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2498
2348
def sub_process_main(self, request, address):
2500
2350
self.finish_request(request, address)
2501
2351
except Exception:
2502
2352
self.handle_error(request, address)
2503
2353
self.close_request(request)
2505
2355
def process_request(self, request, address):
2506
2356
"""Start a new process to process the request."""
2507
proc = multiprocessing.Process(target=self.sub_process_main,
2508
args=(request, address))
2357
proc = multiprocessing.Process(target = self.sub_process_main,
2358
args = (request, address))
2513
2363
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2514
2364
""" adds a pipe to the MixIn """
2516
2366
def process_request(self, request, client_address):
2517
2367
"""Overrides and wraps the original process_request().
2519
2369
This function creates a new pipe in self.pipe
2521
2371
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2523
2373
proc = MultiprocessingMixIn.process_request(self, request,
2524
2374
client_address)
2525
2375
self.child_pipe.close()
2526
2376
self.add_pipe(parent_pipe, proc)
2528
2378
def add_pipe(self, parent_pipe, proc):
2529
2379
"""Dummy function; override as necessary"""
2530
2380
raise NotImplementedError()
2579
2428
# socket_wrapper(), if socketfd was set.
2580
2429
socketserver.TCPServer.__init__(self, server_address,
2581
2430
RequestHandlerClass)
2583
2432
def server_bind(self):
2584
2433
"""This overrides the normal server_bind() function
2585
2434
to bind to an interface if one was specified, and also NOT to
2586
2435
bind to an address or port if they were not specified."""
2587
global SO_BINDTODEVICE
2588
2436
if self.interface is not None:
2589
2437
if SO_BINDTODEVICE is None:
2590
# Fall back to a hard-coded value which seems to be
2592
logger.warning("SO_BINDTODEVICE not found, trying 25")
2593
SO_BINDTODEVICE = 25
2595
self.socket.setsockopt(
2596
socket.SOL_SOCKET, SO_BINDTODEVICE,
2597
(self.interface + "\0").encode("utf-8"))
2598
except socket.error as error:
2599
if error.errno == errno.EPERM:
2600
logger.error("No permission to bind to"
2601
" interface %s", self.interface)
2602
elif error.errno == errno.ENOPROTOOPT:
2603
logger.error("SO_BINDTODEVICE not available;"
2604
" cannot bind to interface %s",
2606
elif error.errno == errno.ENODEV:
2607
logger.error("Interface %s does not exist,"
2608
" cannot bind", self.interface)
2438
logger.error("SO_BINDTODEVICE does not exist;"
2439
" cannot bind to interface %s",
2443
self.socket.setsockopt(
2444
socket.SOL_SOCKET, SO_BINDTODEVICE,
2445
(self.interface + "\0").encode("utf-8"))
2446
except socket.error as error:
2447
if error.errno == errno.EPERM:
2448
logger.error("No permission to bind to"
2449
" interface %s", self.interface)
2450
elif error.errno == errno.ENOPROTOOPT:
2451
logger.error("SO_BINDTODEVICE not available;"
2452
" cannot bind to interface %s",
2454
elif error.errno == errno.ENODEV:
2455
logger.error("Interface %s does not exist,"
2456
" cannot bind", self.interface)
2611
2459
# Only bind(2) the socket if we really need to.
2612
2460
if self.server_address[0] or self.server_address[1]:
2613
if self.server_address[1]:
2614
self.allow_reuse_address = True
2615
2461
if not self.server_address[0]:
2616
2462
if self.address_family == socket.AF_INET6:
2617
any_address = "::" # in6addr_any
2463
any_address = "::" # in6addr_any
2619
any_address = "0.0.0.0" # INADDR_ANY
2465
any_address = "0.0.0.0" # INADDR_ANY
2620
2466
self.server_address = (any_address,
2621
2467
self.server_address[1])
2622
2468
elif not self.server_address[1]:
2656
2502
self.gnutls_priority = gnutls_priority
2657
2503
IPv6_TCPServer.__init__(self, server_address,
2658
2504
RequestHandlerClass,
2659
interface=interface,
2505
interface = interface,
2506
use_ipv6 = use_ipv6,
2507
socketfd = socketfd)
2663
2509
def server_activate(self):
2664
2510
if self.enabled:
2665
2511
return socketserver.TCPServer.server_activate(self)
2667
2513
def enable(self):
2668
2514
self.enabled = True
2670
2516
def add_pipe(self, parent_pipe, proc):
2671
2517
# Call "handle_ipc" for both data and EOF events
2672
2518
GLib.io_add_watch(
2673
2519
parent_pipe.fileno(),
2674
2520
GLib.IO_IN | GLib.IO_HUP,
2675
2521
functools.partial(self.handle_ipc,
2676
parent_pipe=parent_pipe,
2522
parent_pipe = parent_pipe,
2679
2525
def handle_ipc(self, source, condition,
2680
2526
parent_pipe=None,
2682
2528
client_object=None):
2683
2529
# error, or the other end of multiprocessing.Pipe has closed
2684
2530
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2685
2531
# Wait for other process to exit
2689
2535
# Read a request from the child
2690
2536
request = parent_pipe.recv()
2691
2537
command = request[0]
2693
2539
if command == 'init':
2694
key_id = request[1].decode("ascii")
2695
fpr = request[2].decode("ascii")
2696
address = request[3]
2541
address = request[2]
2698
2543
for c in self.clients.values():
2699
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2701
if key_id and c.key_id == key_id:
2704
if fpr and c.fingerprint == fpr:
2544
if c.fingerprint == fpr:
2708
logger.info("Client not found for key ID: %s, address"
2709
": %s", key_id or fpr, address)
2548
logger.info("Client not found for fingerprint: %s, ad"
2549
"dress: %s", fpr, address)
2710
2550
if self.use_dbus:
2711
2551
# Emit D-Bus signal
2712
mandos_dbus_service.ClientNotFound(key_id or fpr,
2552
mandos_dbus_service.ClientNotFound(fpr,
2714
2554
parent_pipe.send(False)
2717
2557
GLib.io_add_watch(
2718
2558
parent_pipe.fileno(),
2719
2559
GLib.IO_IN | GLib.IO_HUP,
2720
2560
functools.partial(self.handle_ipc,
2721
parent_pipe=parent_pipe,
2723
client_object=client))
2561
parent_pipe = parent_pipe,
2563
client_object = client))
2724
2564
parent_pipe.send(True)
2725
2565
# remove the old hook in favor of the new above hook on
2969
2806
parser.add_argument("--no-zeroconf", action="store_false",
2970
2807
dest="zeroconf", help="Do not use Zeroconf",
2973
2810
options = parser.parse_args()
2975
2812
if options.check:
2977
2814
fail_count, test_count = doctest.testmod()
2978
2815
sys.exit(os.EX_OK if fail_count == 0 else 1)
2980
2817
# Default values for config file for server-global settings
2981
if gnutls.has_rawpk:
2982
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2983
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2985
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2986
":+SIGN-DSA-SHA256")
2987
server_defaults = {"interface": "",
2991
"priority": priority,
2992
"servicename": "Mandos",
2998
"statedir": "/var/lib/mandos",
2999
"foreground": "False",
2818
server_defaults = { "interface": "",
2823
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2824
":+SIGN-DSA-SHA256",
2825
"servicename": "Mandos",
2831
"statedir": "/var/lib/mandos",
2832
"foreground": "False",
3004
2836
# Parse config file for server-global settings
3005
server_config = configparser.ConfigParser(server_defaults)
2837
server_config = configparser.SafeConfigParser(server_defaults)
3006
2838
del server_defaults
3007
2839
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3008
# Convert the ConfigParser object to a dict
2840
# Convert the SafeConfigParser object to a dict
3009
2841
server_settings = server_config.defaults()
3010
2842
# Use the appropriate methods on the non-string config options
3011
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3012
"foreground", "zeroconf"):
2843
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3013
2844
server_settings[option] = server_config.getboolean("DEFAULT",
3015
2846
if server_settings["port"]:
3188
3019
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3189
3020
service = AvahiServiceToSyslog(
3190
name=server_settings["servicename"],
3191
servicetype="_mandos._tcp",
3021
name = server_settings["servicename"],
3022
servicetype = "_mandos._tcp",
3023
protocol = protocol,
3194
3025
if server_settings["interface"]:
3195
3026
service.interface = if_nametoindex(
3196
3027
server_settings["interface"].encode("utf-8"))
3198
3029
global multiprocessing_manager
3199
3030
multiprocessing_manager = multiprocessing.Manager()
3201
3032
client_class = Client
3203
client_class = functools.partial(ClientDBus, bus=bus)
3034
client_class = functools.partial(ClientDBus, bus = bus)
3205
3036
client_settings = Client.config_parser(client_config)
3206
3037
old_client_settings = {}
3207
3038
clients_data = {}
3209
3040
# This is used to redirect stdout and stderr for checker processes
3211
wnull = open(os.devnull, "w") # A writable /dev/null
3042
wnull = open(os.devnull, "w") # A writable /dev/null
3212
3043
# Only used if server is running in foreground but not in debug
3214
3045
if debug or not foreground:
3217
3048
# Get client data and settings from last running state.
3218
3049
if server_settings["restore"]:
3220
3051
with open(stored_state_path, "rb") as stored_state:
3221
if sys.version_info.major == 2:
3052
if sys.version_info.major == 2:
3222
3053
clients_data, old_client_settings = pickle.load(
3225
3056
bytes_clients_data, bytes_old_client_settings = (
3226
pickle.load(stored_state, encoding="bytes"))
3227
# Fix bytes to strings
3057
pickle.load(stored_state, encoding = "bytes"))
3058
### Fix bytes to strings
3230
clients_data = {(key.decode("utf-8")
3231
if isinstance(key, bytes)
3234
bytes_clients_data.items()}
3061
clients_data = { (key.decode("utf-8")
3062
if isinstance(key, bytes)
3065
bytes_clients_data.items() }
3235
3066
del bytes_clients_data
3236
3067
for key in clients_data:
3237
value = {(k.decode("utf-8")
3238
if isinstance(k, bytes) else k): v
3240
clients_data[key].items()}
3068
value = { (k.decode("utf-8")
3069
if isinstance(k, bytes) else k): v
3071
clients_data[key].items() }
3241
3072
clients_data[key] = value
3242
3073
# .client_structure
3243
3074
value["client_structure"] = [
3244
3075
(s.decode("utf-8")
3245
3076
if isinstance(s, bytes)
3246
3077
else s) for s in
3247
value["client_structure"]]
3078
value["client_structure"] ]
3248
3079
# .name & .host
3249
3080
for k in ("name", "host"):
3250
3081
if isinstance(value[k], bytes):
3251
3082
value[k] = value[k].decode("utf-8")
3252
if "key_id" not in value:
3253
value["key_id"] = ""
3254
elif "fingerprint" not in value:
3255
value["fingerprint"] = ""
3256
# old_client_settings
3083
## old_client_settings
3258
3085
old_client_settings = {
3259
3086
(key.decode("utf-8")
3260
3087
if isinstance(key, bytes)
3261
3088
else key): value
3262
3089
for key, value in
3263
bytes_old_client_settings.items()}
3090
bytes_old_client_settings.items() }
3264
3091
del bytes_old_client_settings
3266
3093
for value in old_client_settings.values():
3372
3199
pidfilename, pid)
3374
3201
del pidfilename
3376
for termsig in (signal.SIGHUP, signal.SIGTERM):
3377
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3378
lambda: main_loop.quit() and False)
3203
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3204
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3382
3208
@alternate_dbus_interfaces(
3383
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3209
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3384
3210
class MandosDBusService(DBusObjectWithObjectManager):
3385
3211
"""A D-Bus proxy object"""
3387
3213
def __init__(self):
3388
3214
dbus.service.Object.__init__(self, bus, "/")
3390
3216
_interface = "se.recompile.Mandos"
3392
3218
@dbus.service.signal(_interface, signature="o")
3393
3219
def ClientAdded(self, objpath):
3397
3223
@dbus.service.signal(_interface, signature="ss")
3398
def ClientNotFound(self, key_id, address):
3224
def ClientNotFound(self, fingerprint, address):
3402
3228
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3404
3230
@dbus.service.signal(_interface, signature="os")
3405
3231
def ClientRemoved(self, objpath, name):
3409
3235
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3411
3237
@dbus.service.method(_interface, out_signature="ao")