265
235
.replace(b"\n", b"\\n")
266
236
.replace(b"\0", b"\\x00"))
269
239
def encrypt(self, data, password):
270
240
passphrase = self.password_encode(password)
271
241
with tempfile.NamedTemporaryFile(
272
242
dir=self.tempdir) as passfile:
273
243
passfile.write(passphrase)
275
proc = subprocess.Popen([self.gpg, "--symmetric",
245
proc = subprocess.Popen([self.gpg, '--symmetric',
278
248
+ self.gnupgargs,
279
stdin=subprocess.PIPE,
280
stdout=subprocess.PIPE,
281
stderr=subprocess.PIPE)
282
ciphertext, err = proc.communicate(input=data)
249
stdin = subprocess.PIPE,
250
stdout = subprocess.PIPE,
251
stderr = subprocess.PIPE)
252
ciphertext, err = proc.communicate(input = data)
283
253
if proc.returncode != 0:
284
254
raise PGPError(err)
285
255
return ciphertext
287
257
def decrypt(self, data, password):
288
258
passphrase = self.password_encode(password)
289
259
with tempfile.NamedTemporaryFile(
290
dir=self.tempdir) as passfile:
260
dir = self.tempdir) as passfile:
291
261
passfile.write(passphrase)
293
proc = subprocess.Popen([self.gpg, "--decrypt",
263
proc = subprocess.Popen([self.gpg, '--decrypt',
296
266
+ self.gnupgargs,
297
stdin=subprocess.PIPE,
298
stdout=subprocess.PIPE,
299
stderr=subprocess.PIPE)
300
decrypted_plaintext, err = proc.communicate(input=data)
267
stdin = subprocess.PIPE,
268
stdout = subprocess.PIPE,
269
stderr = subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input = data)
301
271
if proc.returncode != 0:
302
272
raise PGPError(err)
303
273
return decrypted_plaintext
306
275
# Pretend that we have an Avahi module
308
"""This isn't so much a class as it is a module-like namespace."""
309
IF_UNSPEC = -1 # avahi-common/address.h
310
PROTO_UNSPEC = -1 # avahi-common/address.h
311
PROTO_INET = 0 # avahi-common/address.h
312
PROTO_INET6 = 1 # avahi-common/address.h
277
"""This isn't so much a class as it is a module-like namespace.
278
It is instantiated once, and simulates having an Avahi module."""
279
IF_UNSPEC = -1 # avahi-common/address.h
280
PROTO_UNSPEC = -1 # avahi-common/address.h
281
PROTO_INET = 0 # avahi-common/address.h
282
PROTO_INET6 = 1 # avahi-common/address.h
313
283
DBUS_NAME = "org.freedesktop.Avahi"
314
284
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
315
285
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
286
DBUS_PATH_SERVER = "/"
319
def string_array_to_txt_array(t):
287
def string_array_to_txt_array(self, t):
320
288
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
289
for s in t), signature="ay")
322
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
323
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
324
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
325
SERVER_INVALID = 0 # avahi-common/defs.h
326
SERVER_REGISTERING = 1 # avahi-common/defs.h
327
SERVER_RUNNING = 2 # avahi-common/defs.h
328
SERVER_COLLISION = 3 # avahi-common/defs.h
329
SERVER_FAILURE = 4 # avahi-common/defs.h
290
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
291
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
292
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
293
SERVER_INVALID = 0 # avahi-common/defs.h
294
SERVER_REGISTERING = 1 # avahi-common/defs.h
295
SERVER_RUNNING = 2 # avahi-common/defs.h
296
SERVER_COLLISION = 3 # avahi-common/defs.h
297
SERVER_FAILURE = 4 # avahi-common/defs.h
332
300
class AvahiError(Exception):
333
301
def __init__(self, value, *args, **kwargs):
524
492
class AvahiServiceToSyslog(AvahiService):
525
493
def rename(self, *args, **kwargs):
526
494
"""Add the new name to the syslog messages"""
527
ret = super(AvahiServiceToSyslog, self).rename(*args,
495
ret = AvahiService.rename(self, *args, **kwargs)
529
496
syslogger.setFormatter(logging.Formatter(
530
"Mandos ({}) [%(process)d]: %(levelname)s: %(message)s"
497
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
531
498
.format(self.name)))
535
501
# Pretend that we have a GnuTLS module
537
"""This isn't so much a class as it is a module-like namespace."""
539
library = ctypes.util.find_library("gnutls")
541
library = ctypes.util.find_library("gnutls-deb0")
542
_library = ctypes.cdll.LoadLibrary(library)
502
class GnuTLS(object):
503
"""This isn't so much a class as it is a module-like namespace.
504
It is instantiated once, and simulates having a GnuTLS module."""
506
_library = ctypes.cdll.LoadLibrary(
507
ctypes.util.find_library("gnutls"))
508
_need_version = b"3.3.0"
510
# Need to use class name "GnuTLS" here, since this method is
511
# called before the assignment to the "gnutls" global variable
513
if GnuTLS.check_version(self._need_version) is None:
514
raise GnuTLS.Error("Needs GnuTLS {} or later"
515
.format(self._need_version))
545
517
# Unless otherwise indicated, the constants and types below are
546
518
# all from the gnutls/gnutls.h C header file.
550
522
E_INTERRUPTED = -52
556
527
CRD_CERTIFICATE = 1
557
528
E_NO_CERTIFICATE_FOUND = -49
562
KEYID_USE_SHA256 = 1 # gnutls/x509.h
563
529
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
566
class _session_int(ctypes.Structure):
532
class session_int(ctypes.Structure):
568
session_t = ctypes.POINTER(_session_int)
534
session_t = ctypes.POINTER(session_int)
570
535
class certificate_credentials_st(ctypes.Structure):
572
537
certificate_credentials_t = ctypes.POINTER(
573
538
certificate_credentials_st)
574
539
certificate_type_t = ctypes.c_int
576
540
class datum_t(ctypes.Structure):
577
_fields_ = [("data", ctypes.POINTER(ctypes.c_ubyte)),
578
("size", ctypes.c_uint)]
580
class _openpgp_crt_int(ctypes.Structure):
541
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
542
('size', ctypes.c_uint)]
543
class openpgp_crt_int(ctypes.Structure):
582
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
583
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
545
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
546
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
584
547
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
585
548
credentials_type_t = ctypes.c_int
586
549
transport_ptr_t = ctypes.c_void_p
587
550
close_request_t = ctypes.c_int
590
553
class Error(Exception):
591
def __init__(self, message=None, code=None, args=()):
554
# We need to use the class name "GnuTLS" here, since this
555
# exception might be raised from within GnuTLS.__init__,
556
# which is called before the assignment to the "gnutls"
557
# global variable has happened.
558
def __init__(self, message = None, code = None, args=()):
592
559
# Default usage is by a message string, but if a return
593
560
# code is passed, convert it to a string with
594
561
# gnutls.strerror()
596
563
if message is None and code is not None:
597
message = gnutls.strerror(code).decode(
598
"utf-8", errors="replace")
599
return super(gnutls.Error, self).__init__(
564
message = GnuTLS.strerror(code)
565
return super(GnuTLS.Error, self).__init__(
602
568
class CertificateSecurityError(Error):
606
def __init__(self, cls):
609
def from_param(self, obj):
610
if not isinstance(obj, self.cls):
611
raise TypeError("Not of type {}: {!r}"
612
.format(self.cls.__name__, obj))
613
return ctypes.byref(obj.from_param(obj))
615
class CastToVoidPointer:
616
def __init__(self, cls):
619
def from_param(self, obj):
620
if not isinstance(obj, self.cls):
621
raise TypeError("Not of type {}: {!r}"
622
.format(self.cls.__name__, obj))
623
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
625
class With_from_param:
627
def from_param(cls, obj):
628
return obj._as_parameter_
631
class Credentials(With_from_param):
572
class Credentials(object):
632
573
def __init__(self):
633
self._as_parameter_ = gnutls.certificate_credentials_t()
634
gnutls.certificate_allocate_credentials(self)
574
self._c_object = gnutls.certificate_credentials_t()
575
gnutls.certificate_allocate_credentials(
576
ctypes.byref(self._c_object))
635
577
self.type = gnutls.CRD_CERTIFICATE
637
579
def __del__(self):
638
gnutls.certificate_free_credentials(self)
640
class ClientSession(With_from_param):
641
def __init__(self, socket, credentials=None):
642
self._as_parameter_ = gnutls.session_t()
643
gnutls_flags = gnutls.CLIENT
644
if gnutls.check_version(b"3.5.6"):
645
gnutls_flags |= gnutls.NO_TICKETS
647
gnutls_flags |= gnutls.ENABLE_RAWPK
648
gnutls.init(self, gnutls_flags)
650
gnutls.set_default_priority(self)
651
gnutls.transport_set_ptr(self, socket.fileno())
652
gnutls.handshake_set_private_extensions(self, True)
580
gnutls.certificate_free_credentials(self._c_object)
582
class ClientSession(object):
583
def __init__(self, socket, credentials = None):
584
self._c_object = gnutls.session_t()
585
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
586
gnutls.set_default_priority(self._c_object)
587
gnutls.transport_set_ptr(self._c_object, socket.fileno())
588
gnutls.handshake_set_private_extensions(self._c_object,
653
590
self.socket = socket
654
591
if credentials is None:
655
592
credentials = gnutls.Credentials()
656
gnutls.credentials_set(self, credentials.type,
593
gnutls.credentials_set(self._c_object, credentials.type,
594
ctypes.cast(credentials._c_object,
658
596
self.credentials = credentials
660
598
def __del__(self):
599
gnutls.deinit(self._c_object)
663
601
def handshake(self):
664
return gnutls.handshake(self)
602
return gnutls.handshake(self._c_object)
666
604
def send(self, data):
667
605
data = bytes(data)
668
606
data_len = len(data)
669
607
while data_len > 0:
670
data_len -= gnutls.record_send(self, data[-data_len:],
608
data_len -= gnutls.record_send(self._c_object,
674
return gnutls.bye(self, gnutls.SHUT_RDWR)
613
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
676
615
# Error handling functions
677
616
def _error_code(result):
678
617
"""A function to raise exceptions on errors, suitable
679
for the "restype" attribute on ctypes functions"""
680
if result >= gnutls.E_SUCCESS:
618
for the 'restype' attribute on ctypes functions"""
682
621
if result == gnutls.E_NO_CERTIFICATE_FOUND:
683
raise gnutls.CertificateSecurityError(code=result)
684
raise gnutls.Error(code=result)
686
def _retry_on_error(result, func, arguments,
687
_error_code=_error_code):
622
raise gnutls.CertificateSecurityError(code = result)
623
raise gnutls.Error(code = result)
625
def _retry_on_error(result, func, arguments):
688
626
"""A function to retry on some errors, suitable
689
for the "errcheck" attribute on ctypes functions"""
690
while result < gnutls.E_SUCCESS:
627
for the 'errcheck' attribute on ctypes functions"""
691
629
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
692
630
return _error_code(result)
693
631
result = func(*arguments)
696
634
# Unless otherwise indicated, the function declarations below are
697
635
# all from the gnutls/gnutls.h C header file.
700
638
priority_set_direct = _library.gnutls_priority_set_direct
701
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
639
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
702
640
ctypes.POINTER(ctypes.c_char_p)]
703
641
priority_set_direct.restype = _error_code
705
643
init = _library.gnutls_init
706
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
644
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
707
645
init.restype = _error_code
709
647
set_default_priority = _library.gnutls_set_default_priority
710
set_default_priority.argtypes = [ClientSession]
648
set_default_priority.argtypes = [session_t]
711
649
set_default_priority.restype = _error_code
713
651
record_send = _library.gnutls_record_send
714
record_send.argtypes = [ClientSession, ctypes.c_void_p,
652
record_send.argtypes = [session_t, ctypes.c_void_p,
716
654
record_send.restype = ctypes.c_ssize_t
717
655
record_send.errcheck = _retry_on_error
719
657
certificate_allocate_credentials = (
720
658
_library.gnutls_certificate_allocate_credentials)
721
659
certificate_allocate_credentials.argtypes = [
722
PointerTo(Credentials)]
660
ctypes.POINTER(certificate_credentials_t)]
723
661
certificate_allocate_credentials.restype = _error_code
725
663
certificate_free_credentials = (
726
664
_library.gnutls_certificate_free_credentials)
727
certificate_free_credentials.argtypes = [Credentials]
665
certificate_free_credentials.argtypes = [certificate_credentials_t]
728
666
certificate_free_credentials.restype = None
730
668
handshake_set_private_extensions = (
731
669
_library.gnutls_handshake_set_private_extensions)
732
handshake_set_private_extensions.argtypes = [ClientSession,
670
handshake_set_private_extensions.argtypes = [session_t,
734
672
handshake_set_private_extensions.restype = None
736
674
credentials_set = _library.gnutls_credentials_set
737
credentials_set.argtypes = [ClientSession, credentials_type_t,
738
CastToVoidPointer(Credentials)]
675
credentials_set.argtypes = [session_t, credentials_type_t,
739
677
credentials_set.restype = _error_code
741
679
strerror = _library.gnutls_strerror
742
680
strerror.argtypes = [ctypes.c_int]
743
681
strerror.restype = ctypes.c_char_p
745
683
certificate_type_get = _library.gnutls_certificate_type_get
746
certificate_type_get.argtypes = [ClientSession]
684
certificate_type_get.argtypes = [session_t]
747
685
certificate_type_get.restype = _error_code
749
687
certificate_get_peers = _library.gnutls_certificate_get_peers
750
certificate_get_peers.argtypes = [ClientSession,
688
certificate_get_peers.argtypes = [session_t,
751
689
ctypes.POINTER(ctypes.c_uint)]
752
690
certificate_get_peers.restype = ctypes.POINTER(datum_t)
754
692
global_set_log_level = _library.gnutls_global_set_log_level
755
693
global_set_log_level.argtypes = [ctypes.c_int]
756
694
global_set_log_level.restype = None
758
696
global_set_log_function = _library.gnutls_global_set_log_function
759
697
global_set_log_function.argtypes = [log_func]
760
698
global_set_log_function.restype = None
762
700
deinit = _library.gnutls_deinit
763
deinit.argtypes = [ClientSession]
701
deinit.argtypes = [session_t]
764
702
deinit.restype = None
766
704
handshake = _library.gnutls_handshake
767
handshake.argtypes = [ClientSession]
768
handshake.restype = ctypes.c_int
705
handshake.argtypes = [session_t]
706
handshake.restype = _error_code
769
707
handshake.errcheck = _retry_on_error
771
709
transport_set_ptr = _library.gnutls_transport_set_ptr
772
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
710
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
773
711
transport_set_ptr.restype = None
775
713
bye = _library.gnutls_bye
776
bye.argtypes = [ClientSession, close_request_t]
777
bye.restype = ctypes.c_int
714
bye.argtypes = [session_t, close_request_t]
715
bye.restype = _error_code
778
716
bye.errcheck = _retry_on_error
780
718
check_version = _library.gnutls_check_version
781
719
check_version.argtypes = [ctypes.c_char_p]
782
720
check_version.restype = ctypes.c_char_p
784
_need_version = b"3.3.0"
785
if check_version(_need_version) is None:
786
raise self.Error("Needs GnuTLS {} or later"
787
.format(_need_version))
789
_tls_rawpk_version = b"3.6.6"
790
has_rawpk = bool(check_version(_tls_rawpk_version))
794
class pubkey_st(ctypes.Structure):
796
pubkey_t = ctypes.POINTER(pubkey_st)
798
x509_crt_fmt_t = ctypes.c_int
800
# All the function declarations below are from
802
pubkey_init = _library.gnutls_pubkey_init
803
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
804
pubkey_init.restype = _error_code
806
pubkey_import = _library.gnutls_pubkey_import
807
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
809
pubkey_import.restype = _error_code
811
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
812
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
813
ctypes.POINTER(ctypes.c_ubyte),
814
ctypes.POINTER(ctypes.c_size_t)]
815
pubkey_get_key_id.restype = _error_code
817
pubkey_deinit = _library.gnutls_pubkey_deinit
818
pubkey_deinit.argtypes = [pubkey_t]
819
pubkey_deinit.restype = None
821
# All the function declarations below are from
824
openpgp_crt_init = _library.gnutls_openpgp_crt_init
825
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
826
openpgp_crt_init.restype = _error_code
828
openpgp_crt_import = _library.gnutls_openpgp_crt_import
829
openpgp_crt_import.argtypes = [openpgp_crt_t,
830
ctypes.POINTER(datum_t),
832
openpgp_crt_import.restype = _error_code
834
openpgp_crt_verify_self = \
835
_library.gnutls_openpgp_crt_verify_self
836
openpgp_crt_verify_self.argtypes = [
839
ctypes.POINTER(ctypes.c_uint),
841
openpgp_crt_verify_self.restype = _error_code
843
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
844
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
845
openpgp_crt_deinit.restype = None
847
openpgp_crt_get_fingerprint = (
848
_library.gnutls_openpgp_crt_get_fingerprint)
849
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
853
openpgp_crt_get_fingerprint.restype = _error_code
855
if check_version(b"3.6.4"):
856
certificate_type_get2 = _library.gnutls_certificate_type_get2
857
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
858
certificate_type_get2.restype = _error_code
722
# All the function declarations below are from gnutls/openpgp.h
724
openpgp_crt_init = _library.gnutls_openpgp_crt_init
725
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
726
openpgp_crt_init.restype = _error_code
728
openpgp_crt_import = _library.gnutls_openpgp_crt_import
729
openpgp_crt_import.argtypes = [openpgp_crt_t,
730
ctypes.POINTER(datum_t),
732
openpgp_crt_import.restype = _error_code
734
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
735
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
736
ctypes.POINTER(ctypes.c_uint)]
737
openpgp_crt_verify_self.restype = _error_code
739
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
740
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
741
openpgp_crt_deinit.restype = None
743
openpgp_crt_get_fingerprint = (
744
_library.gnutls_openpgp_crt_get_fingerprint)
745
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
749
openpgp_crt_get_fingerprint.restype = _error_code
860
751
# Remove non-public functions
861
752
del _error_code, _retry_on_error
753
# Create the global "gnutls" object, simulating a module
864
756
def call_pipe(connection, # : multiprocessing.Connection
865
757
func, *args, **kwargs):
866
758
"""This function is meant to be called by multiprocessing.Process
868
760
This function runs func(*args, **kwargs), and writes the resulting
869
761
return value on the provided multiprocessing.Connection.
871
763
connection.send(func(*args, **kwargs))
872
764
connection.close()
766
class Client(object):
876
767
"""A representation of a client host served by this server.
879
approved: bool(); None if not yet approved/disapproved
770
approved: bool(); 'None' if not yet approved/disapproved
880
771
approval_delay: datetime.timedelta(); Time to wait for approval
881
772
approval_duration: datetime.timedelta(); Duration of one approval
882
checker: multiprocessing.Process(); a running checker process used
883
to see if the client lives. None if no process is
773
checker: subprocess.Popen(); a running checker process used
774
to see if the client lives.
775
'None' if no process is running.
885
776
checker_callback_tag: a GLib event source tag, or None
886
777
checker_command: string; External command which is run to check
887
778
if client lives. %() expansions are done at
2265
2136
byte_arrays=True)
2266
2137
def Secret_dbus_property(self, value):
2267
2138
self.secret = bytes(value)
2273
def __init__(self, child_pipe, key_id, fpr, address):
2143
class ProxyClient(object):
2144
def __init__(self, child_pipe, fpr, address):
2274
2145
self._pipe = child_pipe
2275
self._pipe.send(("init", key_id, fpr, address))
2146
self._pipe.send(('init', fpr, address))
2276
2147
if not self._pipe.recv():
2277
raise KeyError(key_id or fpr)
2279
2150
def __getattribute__(self, name):
2281
2152
return super(ProxyClient, self).__getattribute__(name)
2282
self._pipe.send(("getattr", name))
2153
self._pipe.send(('getattr', name))
2283
2154
data = self._pipe.recv()
2284
if data[0] == "data":
2155
if data[0] == 'data':
2286
if data[0] == "function":
2157
if data[0] == 'function':
2288
2159
def func(*args, **kwargs):
2289
self._pipe.send(("funcall", name, args, kwargs))
2160
self._pipe.send(('funcall', name, args, kwargs))
2290
2161
return self._pipe.recv()[1]
2294
2165
def __setattr__(self, name, value):
2296
2167
return super(ProxyClient, self).__setattr__(name, value)
2297
self._pipe.send(("setattr", name, value))
2168
self._pipe.send(('setattr', name, value))
2300
2171
class ClientHandler(socketserver.BaseRequestHandler, object):
2301
2172
"""A class to handle client connections.
2303
2174
Instantiated once for each connection to handle it.
2304
2175
Note: This will run in its own forked process."""
2306
2177
def handle(self):
2307
2178
with contextlib.closing(self.server.child_pipe) as child_pipe:
2308
2179
logger.info("TCP connection from: %s",
2309
2180
str(self.client_address))
2310
2181
logger.debug("Pipe FD: %d",
2311
2182
self.server.child_pipe.fileno())
2313
2184
session = gnutls.ClientSession(self.request)
2315
# priority = ":".join(("NONE", "+VERS-TLS1.1",
2316
# "+AES-256-CBC", "+SHA1",
2317
# "+COMP-NULL", "+CTYPE-OPENPGP",
2186
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2187
# "+AES-256-CBC", "+SHA1",
2188
# "+COMP-NULL", "+CTYPE-OPENPGP",
2319
2190
# Use a fallback default, since this MUST be set.
2320
2191
priority = self.server.gnutls_priority
2321
2192
if priority is None:
2322
2193
priority = "NORMAL"
2323
gnutls.priority_set_direct(session,
2324
priority.encode("utf-8"), None)
2194
gnutls.priority_set_direct(session._c_object,
2195
priority.encode("utf-8"),
2326
2198
# Start communication using the Mandos protocol
2327
2199
# Get protocol number
2328
2200
line = self.request.makefile().readline()
2714
2523
self.gnutls_priority = gnutls_priority
2715
2524
IPv6_TCPServer.__init__(self, server_address,
2716
2525
RequestHandlerClass,
2717
interface=interface,
2526
interface = interface,
2527
use_ipv6 = use_ipv6,
2528
socketfd = socketfd)
2721
2530
def server_activate(self):
2722
2531
if self.enabled:
2723
2532
return socketserver.TCPServer.server_activate(self)
2725
2534
def enable(self):
2726
2535
self.enabled = True
2728
2537
def add_pipe(self, parent_pipe, proc):
2729
2538
# Call "handle_ipc" for both data and EOF events
2730
2539
GLib.io_add_watch(
2731
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2732
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2540
parent_pipe.fileno(),
2541
GLib.IO_IN | GLib.IO_HUP,
2733
2542
functools.partial(self.handle_ipc,
2734
parent_pipe=parent_pipe,
2543
parent_pipe = parent_pipe,
2737
2546
def handle_ipc(self, source, condition,
2738
2547
parent_pipe=None,
2740
2549
client_object=None):
2741
2550
# error, or the other end of multiprocessing.Pipe has closed
2742
2551
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2743
2552
# Wait for other process to exit
2747
2556
# Read a request from the child
2748
2557
request = parent_pipe.recv()
2749
2558
command = request[0]
2751
if command == "init":
2752
key_id = request[1].decode("ascii")
2753
fpr = request[2].decode("ascii")
2754
address = request[3]
2560
if command == 'init':
2562
address = request[2]
2756
2564
for c in self.clients.values():
2757
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2758
"27AE41E4649B934CA495991B7852B855"):
2760
if key_id and c.key_id == key_id:
2763
if fpr and c.fingerprint == fpr:
2565
if c.fingerprint == fpr:
2767
logger.info("Client not found for key ID: %s, address"
2768
": %s", key_id or fpr, address)
2569
logger.info("Client not found for fingerprint: %s, ad"
2570
"dress: %s", fpr, address)
2769
2571
if self.use_dbus:
2770
2572
# Emit D-Bus signal
2771
mandos_dbus_service.ClientNotFound(key_id or fpr,
2573
mandos_dbus_service.ClientNotFound(fpr,
2773
2575
parent_pipe.send(False)
2776
2578
GLib.io_add_watch(
2777
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2778
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2579
parent_pipe.fileno(),
2580
GLib.IO_IN | GLib.IO_HUP,
2779
2581
functools.partial(self.handle_ipc,
2780
parent_pipe=parent_pipe,
2782
client_object=client))
2582
parent_pipe = parent_pipe,
2584
client_object = client))
2783
2585
parent_pipe.send(True)
2784
2586
# remove the old hook in favor of the new above hook on
2787
if command == "funcall":
2589
if command == 'funcall':
2788
2590
funcname = request[1]
2789
2591
args = request[2]
2790
2592
kwargs = request[3]
2792
parent_pipe.send(("data", getattr(client_object,
2594
parent_pipe.send(('data', getattr(client_object,
2793
2595
funcname)(*args,
2796
if command == "getattr":
2598
if command == 'getattr':
2797
2599
attrname = request[1]
2798
2600
if isinstance(client_object.__getattribute__(attrname),
2799
collections.abc.Callable):
2800
parent_pipe.send(("function", ))
2601
collections.Callable):
2602
parent_pipe.send(('function', ))
2802
2604
parent_pipe.send((
2803
"data", client_object.__getattribute__(attrname)))
2805
if command == "setattr":
2605
'data', client_object.__getattribute__(attrname)))
2607
if command == 'setattr':
2806
2608
attrname = request[1]
2807
2609
value = request[2]
2808
2610
setattr(client_object, attrname, value)
2813
2615
def rfc3339_duration_to_delta(duration):
2814
2616
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2816
>>> timedelta = datetime.timedelta
2817
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2819
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2821
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2823
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2825
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2827
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2829
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2618
>>> rfc3339_duration_to_delta("P7D")
2619
datetime.timedelta(7)
2620
>>> rfc3339_duration_to_delta("PT60S")
2621
datetime.timedelta(0, 60)
2622
>>> rfc3339_duration_to_delta("PT60M")
2623
datetime.timedelta(0, 3600)
2624
>>> rfc3339_duration_to_delta("PT24H")
2625
datetime.timedelta(1)
2626
>>> rfc3339_duration_to_delta("P1W")
2627
datetime.timedelta(7)
2628
>>> rfc3339_duration_to_delta("PT5M30S")
2629
datetime.timedelta(0, 330)
2630
>>> rfc3339_duration_to_delta("P1DT3M20S")
2631
datetime.timedelta(1, 200)
2834
2634
# Parsing an RFC 3339 duration with regular expressions is not
2835
2635
# possible - there would have to be multiple places for the same
2836
2636
# values, like seconds. The current code, while more esoteric, is
2837
2637
# cleaner without depending on a parsing library. If Python had a
2838
2638
# built-in library for parsing we would use it, but we'd like to
2839
2639
# avoid excessive use of external libraries.
2841
2641
# New type for defining tokens, syntax, and semantics all-in-one
2842
2642
Token = collections.namedtuple("Token", (
2843
2643
"regexp", # To match token; if "value" is not None, must have
3246
3040
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3247
3041
service = AvahiServiceToSyslog(
3248
name=server_settings["servicename"],
3249
servicetype="_mandos._tcp",
3042
name = server_settings["servicename"],
3043
servicetype = "_mandos._tcp",
3044
protocol = protocol,
3252
3046
if server_settings["interface"]:
3253
3047
service.interface = if_nametoindex(
3254
3048
server_settings["interface"].encode("utf-8"))
3256
3050
global multiprocessing_manager
3257
3051
multiprocessing_manager = multiprocessing.Manager()
3259
3053
client_class = Client
3261
client_class = functools.partial(ClientDBus, bus=bus)
3055
client_class = functools.partial(ClientDBus, bus = bus)
3263
3057
client_settings = Client.config_parser(client_config)
3264
3058
old_client_settings = {}
3265
3059
clients_data = {}
3267
3061
# This is used to redirect stdout and stderr for checker processes
3269
wnull = open(os.devnull, "w") # A writable /dev/null
3063
wnull = open(os.devnull, "w") # A writable /dev/null
3270
3064
# Only used if server is running in foreground but not in debug
3272
3066
if debug or not foreground:
3275
3069
# Get client data and settings from last running state.
3276
3070
if server_settings["restore"]:
3278
3072
with open(stored_state_path, "rb") as stored_state:
3279
if sys.version_info.major == 2:
3073
if sys.version_info.major == 2:
3280
3074
clients_data, old_client_settings = pickle.load(
3283
3077
bytes_clients_data, bytes_old_client_settings = (
3284
pickle.load(stored_state, encoding="bytes"))
3285
# Fix bytes to strings
3078
pickle.load(stored_state, encoding = "bytes"))
3079
### Fix bytes to strings
3288
clients_data = {(key.decode("utf-8")
3289
if isinstance(key, bytes)
3292
bytes_clients_data.items()}
3082
clients_data = { (key.decode("utf-8")
3083
if isinstance(key, bytes)
3086
bytes_clients_data.items() }
3293
3087
del bytes_clients_data
3294
3088
for key in clients_data:
3295
value = {(k.decode("utf-8")
3296
if isinstance(k, bytes) else k): v
3298
clients_data[key].items()}
3089
value = { (k.decode("utf-8")
3090
if isinstance(k, bytes) else k): v
3092
clients_data[key].items() }
3299
3093
clients_data[key] = value
3300
3094
# .client_structure
3301
3095
value["client_structure"] = [
3302
3096
(s.decode("utf-8")
3303
3097
if isinstance(s, bytes)
3304
3098
else s) for s in
3305
value["client_structure"]]
3306
# .name, .host, and .checker_command
3307
for k in ("name", "host", "checker_command"):
3099
value["client_structure"] ]
3101
for k in ("name", "host"):
3308
3102
if isinstance(value[k], bytes):
3309
3103
value[k] = value[k].decode("utf-8")
3310
if "key_id" not in value:
3311
value["key_id"] = ""
3312
elif "fingerprint" not in value:
3313
value["fingerprint"] = ""
3314
# old_client_settings
3104
## old_client_settings
3316
3106
old_client_settings = {
3317
3107
(key.decode("utf-8")
3318
3108
if isinstance(key, bytes)
3319
3109
else key): value
3320
3110
for key, value in
3321
bytes_old_client_settings.items()}
3111
bytes_old_client_settings.items() }
3322
3112
del bytes_old_client_settings
3323
# .host and .checker_command
3324
3114
for value in old_client_settings.values():
3325
for attribute in ("host", "checker_command"):
3326
if isinstance(value[attribute], bytes):
3327
value[attribute] = (value[attribute]
3115
if isinstance(value["host"], bytes):
3116
value["host"] = (value["host"]
3329
3118
os.remove(stored_state_path)
3330
3119
except IOError as e:
3331
3120
if e.errno == errno.ENOENT: