2
# -*- mode: python; after-save-hook: (lambda () (let ((command (if (fboundp 'file-local-name) (file-local-name (buffer-file-name)) (or (file-remote-p (buffer-file-name) 'localname) (buffer-file-name))))) (if (= (progn (if (get-buffer "*Test*") (kill-buffer "*Test*")) (process-file-shell-command (format "%s --check" (shell-quote-argument command)) nil "*Test*")) 0) (let ((w (get-buffer-window "*Test*"))) (if w (delete-window w))) (progn (with-current-buffer "*Test*" (compilation-mode)) (display-buffer "*Test*" '(display-buffer-in-side-window)))))); coding: utf-8 -*-
2
# -*- mode: python; coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
# Copyright © 2008-2019 Teddy Hogeborn
15
# Copyright © 2008-2019 Björn Påhlsson
17
# This file is part of Mandos.
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
21
19
# the Free Software Foundation, either version 3 of the License, or
22
20
# (at your option) any later version.
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
26
24
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
27
25
# GNU General Public License for more details.
29
27
# You should have received a copy of the GNU General Public License
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
32
31
# Contact the authors at <mandos@recompile.se>.
35
34
from __future__ import (division, absolute_import, print_function,
89
86
import xml.dom.minidom
92
if sys.version_info.major == 2:
96
# Show warnings by default
97
if not sys.warnoptions:
99
warnings.simplefilter("default")
101
# Try to find the value of SO_BINDTODEVICE:
103
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
104
# newer, and it is also the most natural place for it:
105
90
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
106
91
except AttributeError:
108
# This is where SO_BINDTODEVICE was up to and including Python
110
93
from IN import SO_BINDTODEVICE
111
94
except ImportError:
112
# In Python 2.7 it seems to have been removed entirely.
113
# Try running the C preprocessor:
115
cc = subprocess.Popen(["cc", "--language=c", "-E",
117
stdin=subprocess.PIPE,
118
stdout=subprocess.PIPE)
119
stdout = cc.communicate(
120
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
121
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
122
except (OSError, ValueError, IndexError):
124
SO_BINDTODEVICE = None
126
if sys.version_info < (3, 2):
127
configparser.Configparser = configparser.SafeConfigParser
95
SO_BINDTODEVICE = None
97
if sys.version_info.major == 2:
130
101
stored_state_file = "clients.pickle"
132
103
logger = logging.getLogger()
133
logging.captureWarnings(True) # Show warnings via the logging system
137
107
if_nametoindex = ctypes.cdll.LoadLibrary(
138
108
ctypes.util.find_library("c")).if_nametoindex
139
109
except (OSError, AttributeError):
141
111
def if_nametoindex(interface):
142
112
"Get an interface index the hard way, i.e. using fcntl()"
143
113
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
259
229
'--passphrase-file',
261
231
+ self.gnupgargs,
262
stdin=subprocess.PIPE,
263
stdout=subprocess.PIPE,
264
stderr=subprocess.PIPE)
265
ciphertext, err = proc.communicate(input=data)
232
stdin = subprocess.PIPE,
233
stdout = subprocess.PIPE,
234
stderr = subprocess.PIPE)
235
ciphertext, err = proc.communicate(input = data)
266
236
if proc.returncode != 0:
267
237
raise PGPError(err)
268
238
return ciphertext
270
240
def decrypt(self, data, password):
271
241
passphrase = self.password_encode(password)
272
242
with tempfile.NamedTemporaryFile(
273
dir=self.tempdir) as passfile:
243
dir = self.tempdir) as passfile:
274
244
passfile.write(passphrase)
276
246
proc = subprocess.Popen([self.gpg, '--decrypt',
277
247
'--passphrase-file',
279
249
+ self.gnupgargs,
280
stdin=subprocess.PIPE,
281
stdout=subprocess.PIPE,
282
stderr=subprocess.PIPE)
283
decrypted_plaintext, err = proc.communicate(input=data)
250
stdin = subprocess.PIPE,
251
stdout = subprocess.PIPE,
252
stderr = subprocess.PIPE)
253
decrypted_plaintext, err = proc.communicate(input = data)
284
254
if proc.returncode != 0:
285
255
raise PGPError(err)
286
256
return decrypted_plaintext
289
258
# Pretend that we have an Avahi module
291
"""This isn't so much a class as it is a module-like namespace."""
292
IF_UNSPEC = -1 # avahi-common/address.h
293
PROTO_UNSPEC = -1 # avahi-common/address.h
294
PROTO_INET = 0 # avahi-common/address.h
295
PROTO_INET6 = 1 # avahi-common/address.h
260
"""This isn't so much a class as it is a module-like namespace.
261
It is instantiated once, and simulates having an Avahi module."""
262
IF_UNSPEC = -1 # avahi-common/address.h
263
PROTO_UNSPEC = -1 # avahi-common/address.h
264
PROTO_INET = 0 # avahi-common/address.h
265
PROTO_INET6 = 1 # avahi-common/address.h
296
266
DBUS_NAME = "org.freedesktop.Avahi"
297
267
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
298
268
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
299
269
DBUS_PATH_SERVER = "/"
302
def string_array_to_txt_array(t):
270
def string_array_to_txt_array(self, t):
303
271
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
304
272
for s in t), signature="ay")
305
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
306
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
307
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
308
SERVER_INVALID = 0 # avahi-common/defs.h
309
SERVER_REGISTERING = 1 # avahi-common/defs.h
310
SERVER_RUNNING = 2 # avahi-common/defs.h
311
SERVER_COLLISION = 3 # avahi-common/defs.h
312
SERVER_FAILURE = 4 # avahi-common/defs.h
273
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
274
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
275
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
276
SERVER_INVALID = 0 # avahi-common/defs.h
277
SERVER_REGISTERING = 1 # avahi-common/defs.h
278
SERVER_RUNNING = 2 # avahi-common/defs.h
279
SERVER_COLLISION = 3 # avahi-common/defs.h
280
SERVER_FAILURE = 4 # avahi-common/defs.h
315
283
class AvahiError(Exception):
316
284
def __init__(self, value, *args, **kwargs):
507
475
class AvahiServiceToSyslog(AvahiService):
508
476
def rename(self, *args, **kwargs):
509
477
"""Add the new name to the syslog messages"""
510
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
478
ret = AvahiService.rename(self, *args, **kwargs)
511
479
syslogger.setFormatter(logging.Formatter(
512
480
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
513
481
.format(self.name)))
517
484
# Pretend that we have a GnuTLS module
519
"""This isn't so much a class as it is a module-like namespace."""
521
library = ctypes.util.find_library("gnutls")
523
library = ctypes.util.find_library("gnutls-deb0")
524
_library = ctypes.cdll.LoadLibrary(library)
485
class GnuTLS(object):
486
"""This isn't so much a class as it is a module-like namespace.
487
It is instantiated once, and simulates having a GnuTLS module."""
489
_library = ctypes.cdll.LoadLibrary(
490
ctypes.util.find_library("gnutls"))
491
_need_version = b"3.3.0"
493
# Need to use class name "GnuTLS" here, since this method is
494
# called before the assignment to the "gnutls" global variable
496
if GnuTLS.check_version(self._need_version) is None:
497
raise GnuTLS.Error("Needs GnuTLS {} or later"
498
.format(self._need_version))
527
500
# Unless otherwise indicated, the constants and types below are
528
501
# all from the gnutls/gnutls.h C header file.
532
505
E_INTERRUPTED = -52
538
510
CRD_CERTIFICATE = 1
539
511
E_NO_CERTIFICATE_FOUND = -49
544
KEYID_USE_SHA256 = 1 # gnutls/x509.h
545
512
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
548
515
class session_int(ctypes.Structure):
550
517
session_t = ctypes.POINTER(session_int)
552
518
class certificate_credentials_st(ctypes.Structure):
554
520
certificate_credentials_t = ctypes.POINTER(
555
521
certificate_credentials_st)
556
522
certificate_type_t = ctypes.c_int
558
523
class datum_t(ctypes.Structure):
559
524
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
560
525
('size', ctypes.c_uint)]
562
526
class openpgp_crt_int(ctypes.Structure):
564
528
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
565
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
529
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
566
530
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
567
531
credentials_type_t = ctypes.c_int
568
532
transport_ptr_t = ctypes.c_void_p
569
533
close_request_t = ctypes.c_int
572
536
class Error(Exception):
573
def __init__(self, message=None, code=None, args=()):
537
# We need to use the class name "GnuTLS" here, since this
538
# exception might be raised from within GnuTLS.__init__,
539
# which is called before the assignment to the "gnutls"
540
# global variable has happened.
541
def __init__(self, message = None, code = None, args=()):
574
542
# Default usage is by a message string, but if a return
575
543
# code is passed, convert it to a string with
576
544
# gnutls.strerror()
578
546
if message is None and code is not None:
579
message = gnutls.strerror(code)
580
return super(gnutls.Error, self).__init__(
547
message = GnuTLS.strerror(code)
548
return super(GnuTLS.Error, self).__init__(
583
551
class CertificateSecurityError(Error):
555
class Credentials(object):
588
556
def __init__(self):
589
557
self._c_object = gnutls.certificate_credentials_t()
590
558
gnutls.certificate_allocate_credentials(
591
559
ctypes.byref(self._c_object))
592
560
self.type = gnutls.CRD_CERTIFICATE
594
562
def __del__(self):
595
563
gnutls.certificate_free_credentials(self._c_object)
598
def __init__(self, socket, credentials=None):
565
class ClientSession(object):
566
def __init__(self, socket, credentials = None):
599
567
self._c_object = gnutls.session_t()
600
gnutls_flags = gnutls.CLIENT
601
if gnutls.check_version(b"3.5.6"):
602
gnutls_flags |= gnutls.NO_TICKETS
604
gnutls_flags |= gnutls.ENABLE_RAWPK
605
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
568
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
607
569
gnutls.set_default_priority(self._c_object)
608
570
gnutls.transport_set_ptr(self._c_object, socket.fileno())
609
571
gnutls.handshake_set_private_extensions(self._c_object,
651
613
return _error_code(result)
652
614
result = func(*arguments)
655
617
# Unless otherwise indicated, the function declarations below are
656
618
# all from the gnutls/gnutls.h C header file.
659
621
priority_set_direct = _library.gnutls_priority_set_direct
660
622
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
661
623
ctypes.POINTER(ctypes.c_char_p)]
662
624
priority_set_direct.restype = _error_code
664
626
init = _library.gnutls_init
665
627
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
666
628
init.restype = _error_code
668
630
set_default_priority = _library.gnutls_set_default_priority
669
631
set_default_priority.argtypes = [session_t]
670
632
set_default_priority.restype = _error_code
672
634
record_send = _library.gnutls_record_send
673
635
record_send.argtypes = [session_t, ctypes.c_void_p,
675
637
record_send.restype = ctypes.c_ssize_t
676
638
record_send.errcheck = _retry_on_error
678
640
certificate_allocate_credentials = (
679
641
_library.gnutls_certificate_allocate_credentials)
680
642
certificate_allocate_credentials.argtypes = [
681
643
ctypes.POINTER(certificate_credentials_t)]
682
644
certificate_allocate_credentials.restype = _error_code
684
646
certificate_free_credentials = (
685
647
_library.gnutls_certificate_free_credentials)
686
certificate_free_credentials.argtypes = [
687
certificate_credentials_t]
648
certificate_free_credentials.argtypes = [certificate_credentials_t]
688
649
certificate_free_credentials.restype = None
690
651
handshake_set_private_extensions = (
691
652
_library.gnutls_handshake_set_private_extensions)
692
653
handshake_set_private_extensions.argtypes = [session_t,
694
655
handshake_set_private_extensions.restype = None
696
657
credentials_set = _library.gnutls_credentials_set
697
658
credentials_set.argtypes = [session_t, credentials_type_t,
699
660
credentials_set.restype = _error_code
701
662
strerror = _library.gnutls_strerror
702
663
strerror.argtypes = [ctypes.c_int]
703
664
strerror.restype = ctypes.c_char_p
705
666
certificate_type_get = _library.gnutls_certificate_type_get
706
667
certificate_type_get.argtypes = [session_t]
707
668
certificate_type_get.restype = _error_code
709
670
certificate_get_peers = _library.gnutls_certificate_get_peers
710
671
certificate_get_peers.argtypes = [session_t,
711
672
ctypes.POINTER(ctypes.c_uint)]
712
673
certificate_get_peers.restype = ctypes.POINTER(datum_t)
714
675
global_set_log_level = _library.gnutls_global_set_log_level
715
676
global_set_log_level.argtypes = [ctypes.c_int]
716
677
global_set_log_level.restype = None
718
679
global_set_log_function = _library.gnutls_global_set_log_function
719
680
global_set_log_function.argtypes = [log_func]
720
681
global_set_log_function.restype = None
722
683
deinit = _library.gnutls_deinit
723
684
deinit.argtypes = [session_t]
724
685
deinit.restype = None
726
687
handshake = _library.gnutls_handshake
727
688
handshake.argtypes = [session_t]
728
689
handshake.restype = _error_code
729
690
handshake.errcheck = _retry_on_error
731
692
transport_set_ptr = _library.gnutls_transport_set_ptr
732
693
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
733
694
transport_set_ptr.restype = None
735
696
bye = _library.gnutls_bye
736
697
bye.argtypes = [session_t, close_request_t]
737
698
bye.restype = _error_code
738
699
bye.errcheck = _retry_on_error
740
701
check_version = _library.gnutls_check_version
741
702
check_version.argtypes = [ctypes.c_char_p]
742
703
check_version.restype = ctypes.c_char_p
744
_need_version = b"3.3.0"
745
if check_version(_need_version) is None:
746
raise self.Error("Needs GnuTLS {} or later"
747
.format(_need_version))
749
_tls_rawpk_version = b"3.6.6"
750
has_rawpk = bool(check_version(_tls_rawpk_version))
754
class pubkey_st(ctypes.Structure):
756
pubkey_t = ctypes.POINTER(pubkey_st)
758
x509_crt_fmt_t = ctypes.c_int
760
# All the function declarations below are from gnutls/abstract.h
761
pubkey_init = _library.gnutls_pubkey_init
762
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
763
pubkey_init.restype = _error_code
765
pubkey_import = _library.gnutls_pubkey_import
766
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
768
pubkey_import.restype = _error_code
770
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
771
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
772
ctypes.POINTER(ctypes.c_ubyte),
773
ctypes.POINTER(ctypes.c_size_t)]
774
pubkey_get_key_id.restype = _error_code
776
pubkey_deinit = _library.gnutls_pubkey_deinit
777
pubkey_deinit.argtypes = [pubkey_t]
778
pubkey_deinit.restype = None
780
# All the function declarations below are from gnutls/openpgp.h
782
openpgp_crt_init = _library.gnutls_openpgp_crt_init
783
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
784
openpgp_crt_init.restype = _error_code
786
openpgp_crt_import = _library.gnutls_openpgp_crt_import
787
openpgp_crt_import.argtypes = [openpgp_crt_t,
788
ctypes.POINTER(datum_t),
790
openpgp_crt_import.restype = _error_code
792
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
793
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
794
ctypes.POINTER(ctypes.c_uint)]
795
openpgp_crt_verify_self.restype = _error_code
797
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
798
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
799
openpgp_crt_deinit.restype = None
801
openpgp_crt_get_fingerprint = (
802
_library.gnutls_openpgp_crt_get_fingerprint)
803
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
807
openpgp_crt_get_fingerprint.restype = _error_code
809
if check_version(b"3.6.4"):
810
certificate_type_get2 = _library.gnutls_certificate_type_get2
811
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
812
certificate_type_get2.restype = _error_code
705
# All the function declarations below are from gnutls/openpgp.h
707
openpgp_crt_init = _library.gnutls_openpgp_crt_init
708
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
709
openpgp_crt_init.restype = _error_code
711
openpgp_crt_import = _library.gnutls_openpgp_crt_import
712
openpgp_crt_import.argtypes = [openpgp_crt_t,
713
ctypes.POINTER(datum_t),
715
openpgp_crt_import.restype = _error_code
717
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
718
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
719
ctypes.POINTER(ctypes.c_uint)]
720
openpgp_crt_verify_self.restype = _error_code
722
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
723
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
724
openpgp_crt_deinit.restype = None
726
openpgp_crt_get_fingerprint = (
727
_library.gnutls_openpgp_crt_get_fingerprint)
728
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
732
openpgp_crt_get_fingerprint.restype = _error_code
814
734
# Remove non-public functions
815
735
del _error_code, _retry_on_error
736
# Create the global "gnutls" object, simulating a module
818
739
def call_pipe(connection, # : multiprocessing.Connection
819
740
func, *args, **kwargs):
820
741
"""This function is meant to be called by multiprocessing.Process
822
743
This function runs func(*args, **kwargs), and writes the resulting
823
744
return value on the provided multiprocessing.Connection.
825
746
connection.send(func(*args, **kwargs))
826
747
connection.close()
749
class Client(object):
830
750
"""A representation of a client host served by this server.
833
753
approved: bool(); 'None' if not yet approved/disapproved
834
754
approval_delay: datetime.timedelta(); Time to wait for approval
835
755
approval_duration: datetime.timedelta(); Duration of one approval
836
checker: multiprocessing.Process(); a running checker process used
837
to see if the client lives. 'None' if no process is
756
checker: subprocess.Popen(); a running checker process used
757
to see if the client lives.
758
'None' if no process is running.
839
759
checker_callback_tag: a GLib event source tag, or None
840
760
checker_command: string; External command which is run to check
841
761
if client lives. %() expansions are done at
1517
1430
exc_info=error)
1518
1431
return xmlstring
1522
1434
dbus.OBJECT_MANAGER_IFACE
1523
1435
except AttributeError:
1524
1436
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1527
1438
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1528
1439
"""A D-Bus object with an ObjectManager.
1530
1441
Classes inheriting from this exposes the standard
1531
1442
GetManagedObjects call and the InterfacesAdded and
1532
1443
InterfacesRemoved signals on the standard
1533
1444
"org.freedesktop.DBus.ObjectManager" interface.
1535
1446
Note: No signals are sent automatically; they must be sent
1538
1449
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1539
out_signature="a{oa{sa{sv}}}")
1450
out_signature = "a{oa{sa{sv}}}")
1540
1451
def GetManagedObjects(self):
1541
1452
"""This function must be overridden"""
1542
1453
raise NotImplementedError()
1544
1455
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1545
signature="oa{sa{sv}}")
1456
signature = "oa{sa{sv}}")
1546
1457
def InterfacesAdded(self, object_path, interfaces_and_properties):
1549
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1460
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1550
1461
def InterfacesRemoved(self, object_path, interfaces):
1553
1464
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1555
path_keyword='object_path',
1556
connection_keyword='connection')
1465
out_signature = "s",
1466
path_keyword = 'object_path',
1467
connection_keyword = 'connection')
1557
1468
def Introspect(self, object_path, connection):
1558
1469
"""Overloading of standard D-Bus method.
1560
1471
Override return argument name of GetManagedObjects to be
1561
1472
"objpath_interfaces_and_properties"
2504
class MultiprocessingMixIn:
2348
class MultiprocessingMixIn(object):
2505
2349
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2507
2351
def sub_process_main(self, request, address):
2509
2353
self.finish_request(request, address)
2510
2354
except Exception:
2511
2355
self.handle_error(request, address)
2512
2356
self.close_request(request)
2514
2358
def process_request(self, request, address):
2515
2359
"""Start a new process to process the request."""
2516
proc = multiprocessing.Process(target=self.sub_process_main,
2517
args=(request, address))
2360
proc = multiprocessing.Process(target = self.sub_process_main,
2361
args = (request, address))
2522
class MultiprocessingMixInWithPipe(MultiprocessingMixIn):
2366
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2523
2367
""" adds a pipe to the MixIn """
2525
2369
def process_request(self, request, client_address):
2526
2370
"""Overrides and wraps the original process_request().
2528
2372
This function creates a new pipe in self.pipe
2530
2374
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2532
2376
proc = MultiprocessingMixIn.process_request(self, request,
2533
2377
client_address)
2534
2378
self.child_pipe.close()
2535
2379
self.add_pipe(parent_pipe, proc)
2537
2381
def add_pipe(self, parent_pipe, proc):
2538
2382
"""Dummy function; override as necessary"""
2539
2383
raise NotImplementedError()
2542
2386
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2543
socketserver.TCPServer):
2387
socketserver.TCPServer, object):
2544
2388
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2547
2391
enabled: Boolean; whether this server is activated yet
2548
2392
interface: None or a network interface name (string)
2549
2393
use_ipv6: Boolean; to use IPv6 or not
2552
2396
def __init__(self, server_address, RequestHandlerClass,
2553
2397
interface=None,
2588
2431
# socket_wrapper(), if socketfd was set.
2589
2432
socketserver.TCPServer.__init__(self, server_address,
2590
2433
RequestHandlerClass)
2592
2435
def server_bind(self):
2593
2436
"""This overrides the normal server_bind() function
2594
2437
to bind to an interface if one was specified, and also NOT to
2595
2438
bind to an address or port if they were not specified."""
2596
global SO_BINDTODEVICE
2597
2439
if self.interface is not None:
2598
2440
if SO_BINDTODEVICE is None:
2599
# Fall back to a hard-coded value which seems to be
2601
logger.warning("SO_BINDTODEVICE not found, trying 25")
2602
SO_BINDTODEVICE = 25
2604
self.socket.setsockopt(
2605
socket.SOL_SOCKET, SO_BINDTODEVICE,
2606
(self.interface + "\0").encode("utf-8"))
2607
except socket.error as error:
2608
if error.errno == errno.EPERM:
2609
logger.error("No permission to bind to"
2610
" interface %s", self.interface)
2611
elif error.errno == errno.ENOPROTOOPT:
2612
logger.error("SO_BINDTODEVICE not available;"
2613
" cannot bind to interface %s",
2615
elif error.errno == errno.ENODEV:
2616
logger.error("Interface %s does not exist,"
2617
" cannot bind", self.interface)
2441
logger.error("SO_BINDTODEVICE does not exist;"
2442
" cannot bind to interface %s",
2446
self.socket.setsockopt(
2447
socket.SOL_SOCKET, SO_BINDTODEVICE,
2448
(self.interface + "\0").encode("utf-8"))
2449
except socket.error as error:
2450
if error.errno == errno.EPERM:
2451
logger.error("No permission to bind to"
2452
" interface %s", self.interface)
2453
elif error.errno == errno.ENOPROTOOPT:
2454
logger.error("SO_BINDTODEVICE not available;"
2455
" cannot bind to interface %s",
2457
elif error.errno == errno.ENODEV:
2458
logger.error("Interface %s does not exist,"
2459
" cannot bind", self.interface)
2620
2462
# Only bind(2) the socket if we really need to.
2621
2463
if self.server_address[0] or self.server_address[1]:
2622
if self.server_address[1]:
2623
self.allow_reuse_address = True
2624
2464
if not self.server_address[0]:
2625
2465
if self.address_family == socket.AF_INET6:
2626
any_address = "::" # in6addr_any
2466
any_address = "::" # in6addr_any
2628
any_address = "0.0.0.0" # INADDR_ANY
2468
any_address = "0.0.0.0" # INADDR_ANY
2629
2469
self.server_address = (any_address,
2630
2470
self.server_address[1])
2631
2471
elif not self.server_address[1]:
2665
2505
self.gnutls_priority = gnutls_priority
2666
2506
IPv6_TCPServer.__init__(self, server_address,
2667
2507
RequestHandlerClass,
2668
interface=interface,
2508
interface = interface,
2509
use_ipv6 = use_ipv6,
2510
socketfd = socketfd)
2672
2512
def server_activate(self):
2673
2513
if self.enabled:
2674
2514
return socketserver.TCPServer.server_activate(self)
2676
2516
def enable(self):
2677
2517
self.enabled = True
2679
2519
def add_pipe(self, parent_pipe, proc):
2680
2520
# Call "handle_ipc" for both data and EOF events
2681
2521
GLib.io_add_watch(
2682
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2683
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2522
parent_pipe.fileno(),
2523
GLib.IO_IN | GLib.IO_HUP,
2684
2524
functools.partial(self.handle_ipc,
2685
parent_pipe=parent_pipe,
2525
parent_pipe = parent_pipe,
2688
2528
def handle_ipc(self, source, condition,
2689
2529
parent_pipe=None,
2691
2531
client_object=None):
2692
2532
# error, or the other end of multiprocessing.Pipe has closed
2693
2533
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2694
2534
# Wait for other process to exit
2698
2538
# Read a request from the child
2699
2539
request = parent_pipe.recv()
2700
2540
command = request[0]
2702
2542
if command == 'init':
2703
key_id = request[1].decode("ascii")
2704
fpr = request[2].decode("ascii")
2705
address = request[3]
2544
address = request[2]
2707
2546
for c in self.clients.values():
2708
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2710
if key_id and c.key_id == key_id:
2713
if fpr and c.fingerprint == fpr:
2547
if c.fingerprint == fpr:
2717
logger.info("Client not found for key ID: %s, address"
2718
": %s", key_id or fpr, address)
2551
logger.info("Client not found for fingerprint: %s, ad"
2552
"dress: %s", fpr, address)
2719
2553
if self.use_dbus:
2720
2554
# Emit D-Bus signal
2721
mandos_dbus_service.ClientNotFound(key_id or fpr,
2555
mandos_dbus_service.ClientNotFound(fpr,
2723
2557
parent_pipe.send(False)
2726
2560
GLib.io_add_watch(
2727
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2728
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2561
parent_pipe.fileno(),
2562
GLib.IO_IN | GLib.IO_HUP,
2729
2563
functools.partial(self.handle_ipc,
2730
parent_pipe=parent_pipe,
2732
client_object=client))
2564
parent_pipe = parent_pipe,
2566
client_object = client))
2733
2567
parent_pipe.send(True)
2734
2568
# remove the old hook in favor of the new above hook on
2752
2586
parent_pipe.send((
2753
2587
'data', client_object.__getattribute__(attrname)))
2755
2589
if command == 'setattr':
2756
2590
attrname = request[1]
2757
2591
value = request[2]
2758
2592
setattr(client_object, attrname, value)
2763
2597
def rfc3339_duration_to_delta(duration):
2764
2598
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2766
>>> rfc3339_duration_to_delta("P7D") == datetime.timedelta(7)
2768
>>> rfc3339_duration_to_delta("PT60S") == datetime.timedelta(0, 60)
2770
>>> rfc3339_duration_to_delta("PT60M") == datetime.timedelta(0, 3600)
2772
>>> rfc3339_duration_to_delta("PT24H") == datetime.timedelta(1)
2774
>>> rfc3339_duration_to_delta("P1W") == datetime.timedelta(7)
2776
>>> rfc3339_duration_to_delta("PT5M30S") == datetime.timedelta(0, 330)
2778
>>> rfc3339_duration_to_delta("P1DT3M20S") == datetime.timedelta(1, 200)
2600
>>> rfc3339_duration_to_delta("P7D")
2601
datetime.timedelta(7)
2602
>>> rfc3339_duration_to_delta("PT60S")
2603
datetime.timedelta(0, 60)
2604
>>> rfc3339_duration_to_delta("PT60M")
2605
datetime.timedelta(0, 3600)
2606
>>> rfc3339_duration_to_delta("PT24H")
2607
datetime.timedelta(1)
2608
>>> rfc3339_duration_to_delta("P1W")
2609
datetime.timedelta(7)
2610
>>> rfc3339_duration_to_delta("PT5M30S")
2611
datetime.timedelta(0, 330)
2612
>>> rfc3339_duration_to_delta("P1DT3M20S")
2613
datetime.timedelta(1, 200)
2782
2616
# Parsing an RFC 3339 duration with regular expressions is not
2783
2617
# possible - there would have to be multiple places for the same
2784
2618
# values, like seconds. The current code, while more esoteric, is
2785
2619
# cleaner without depending on a parsing library. If Python had a
2786
2620
# built-in library for parsing we would use it, but we'd like to
2787
2621
# avoid excessive use of external libraries.
2789
2623
# New type for defining tokens, syntax, and semantics all-in-one
2790
2624
Token = collections.namedtuple("Token", (
2791
2625
"regexp", # To match token; if "value" is not None, must have
2978
2809
parser.add_argument("--no-zeroconf", action="store_false",
2979
2810
dest="zeroconf", help="Do not use Zeroconf",
2982
2813
options = parser.parse_args()
2817
fail_count, test_count = doctest.testmod()
2818
sys.exit(os.EX_OK if fail_count == 0 else 1)
2984
2820
# Default values for config file for server-global settings
2985
if gnutls.has_rawpk:
2986
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2987
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2989
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2990
":+SIGN-DSA-SHA256")
2991
server_defaults = {"interface": "",
2995
"priority": priority,
2996
"servicename": "Mandos",
3002
"statedir": "/var/lib/mandos",
3003
"foreground": "False",
2821
server_defaults = { "interface": "",
2826
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2827
":+SIGN-DSA-SHA256",
2828
"servicename": "Mandos",
2834
"statedir": "/var/lib/mandos",
2835
"foreground": "False",
3008
2839
# Parse config file for server-global settings
3009
server_config = configparser.ConfigParser(server_defaults)
2840
server_config = configparser.SafeConfigParser(server_defaults)
3010
2841
del server_defaults
3011
2842
server_config.read(os.path.join(options.configdir, "mandos.conf"))
3012
# Convert the ConfigParser object to a dict
2843
# Convert the SafeConfigParser object to a dict
3013
2844
server_settings = server_config.defaults()
3014
2845
# Use the appropriate methods on the non-string config options
3015
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3016
"foreground", "zeroconf"):
2846
for option in ("debug", "use_dbus", "use_ipv6", "foreground"):
3017
2847
server_settings[option] = server_config.getboolean("DEFAULT",
3019
2849
if server_settings["port"]:
3192
3022
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3193
3023
service = AvahiServiceToSyslog(
3194
name=server_settings["servicename"],
3195
servicetype="_mandos._tcp",
3024
name = server_settings["servicename"],
3025
servicetype = "_mandos._tcp",
3026
protocol = protocol,
3198
3028
if server_settings["interface"]:
3199
3029
service.interface = if_nametoindex(
3200
3030
server_settings["interface"].encode("utf-8"))
3202
3032
global multiprocessing_manager
3203
3033
multiprocessing_manager = multiprocessing.Manager()
3205
3035
client_class = Client
3207
client_class = functools.partial(ClientDBus, bus=bus)
3037
client_class = functools.partial(ClientDBus, bus = bus)
3209
3039
client_settings = Client.config_parser(client_config)
3210
3040
old_client_settings = {}
3211
3041
clients_data = {}
3213
3043
# This is used to redirect stdout and stderr for checker processes
3215
wnull = open(os.devnull, "w") # A writable /dev/null
3045
wnull = open(os.devnull, "w") # A writable /dev/null
3216
3046
# Only used if server is running in foreground but not in debug
3218
3048
if debug or not foreground:
3221
3051
# Get client data and settings from last running state.
3222
3052
if server_settings["restore"]:
3224
3054
with open(stored_state_path, "rb") as stored_state:
3225
if sys.version_info.major == 2:
3055
if sys.version_info.major == 2:
3226
3056
clients_data, old_client_settings = pickle.load(
3229
3059
bytes_clients_data, bytes_old_client_settings = (
3230
pickle.load(stored_state, encoding="bytes"))
3231
# Fix bytes to strings
3060
pickle.load(stored_state, encoding = "bytes"))
3061
### Fix bytes to strings
3234
clients_data = {(key.decode("utf-8")
3235
if isinstance(key, bytes)
3238
bytes_clients_data.items()}
3064
clients_data = { (key.decode("utf-8")
3065
if isinstance(key, bytes)
3068
bytes_clients_data.items() }
3239
3069
del bytes_clients_data
3240
3070
for key in clients_data:
3241
value = {(k.decode("utf-8")
3242
if isinstance(k, bytes) else k): v
3244
clients_data[key].items()}
3071
value = { (k.decode("utf-8")
3072
if isinstance(k, bytes) else k): v
3074
clients_data[key].items() }
3245
3075
clients_data[key] = value
3246
3076
# .client_structure
3247
3077
value["client_structure"] = [
3248
3078
(s.decode("utf-8")
3249
3079
if isinstance(s, bytes)
3250
3080
else s) for s in
3251
value["client_structure"]]
3252
# .name, .host, and .checker_command
3253
for k in ("name", "host", "checker_command"):
3081
value["client_structure"] ]
3083
for k in ("name", "host"):
3254
3084
if isinstance(value[k], bytes):
3255
3085
value[k] = value[k].decode("utf-8")
3256
if "key_id" not in value:
3257
value["key_id"] = ""
3258
elif "fingerprint" not in value:
3259
value["fingerprint"] = ""
3260
# old_client_settings
3086
## old_client_settings
3262
3088
old_client_settings = {
3263
3089
(key.decode("utf-8")
3264
3090
if isinstance(key, bytes)
3265
3091
else key): value
3266
3092
for key, value in
3267
bytes_old_client_settings.items()}
3093
bytes_old_client_settings.items() }
3268
3094
del bytes_old_client_settings
3269
# .host and .checker_command
3270
3096
for value in old_client_settings.values():
3271
for attribute in ("host", "checker_command"):
3272
if isinstance(value[attribute], bytes):
3273
value[attribute] = (value[attribute]
3097
if isinstance(value["host"], bytes):
3098
value["host"] = (value["host"]
3275
3100
os.remove(stored_state_path)
3276
3101
except IOError as e:
3277
3102
if e.errno == errno.ENOENT: