196
235
.replace(b"\n", b"\\n")
197
236
.replace(b"\0", b"\\x00"))
200
239
def encrypt(self, data, password):
201
240
passphrase = self.password_encode(password)
202
241
with tempfile.NamedTemporaryFile(
203
242
dir=self.tempdir) as passfile:
204
243
passfile.write(passphrase)
206
proc = subprocess.Popen(['gpg', '--symmetric',
245
proc = subprocess.Popen([self.gpg, '--symmetric',
207
246
'--passphrase-file',
209
248
+ self.gnupgargs,
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
249
stdin=subprocess.PIPE,
250
stdout=subprocess.PIPE,
251
stderr=subprocess.PIPE)
252
ciphertext, err = proc.communicate(input=data)
214
253
if proc.returncode != 0:
215
254
raise PGPError(err)
216
255
return ciphertext
218
257
def decrypt(self, data, password):
219
258
passphrase = self.password_encode(password)
220
259
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
260
dir=self.tempdir) as passfile:
222
261
passfile.write(passphrase)
224
proc = subprocess.Popen(['gpg', '--decrypt',
263
proc = subprocess.Popen([self.gpg, '--decrypt',
225
264
'--passphrase-file',
227
266
+ self.gnupgargs,
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
267
stdin=subprocess.PIPE,
268
stdout=subprocess.PIPE,
269
stderr=subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input=data)
232
271
if proc.returncode != 0:
233
272
raise PGPError(err)
234
273
return decrypted_plaintext
276
# Pretend that we have an Avahi module
278
"""This isn't so much a class as it is a module-like namespace.
279
It is instantiated once, and simulates having an Avahi module."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
289
def string_array_to_txt_array(self, t):
290
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
291
for s in t), signature="ay")
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
293
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
294
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
295
SERVER_INVALID = 0 # avahi-common/defs.h
296
SERVER_REGISTERING = 1 # avahi-common/defs.h
297
SERVER_RUNNING = 2 # avahi-common/defs.h
298
SERVER_COLLISION = 3 # avahi-common/defs.h
299
SERVER_FAILURE = 4 # avahi-common/defs.h
237
303
class AvahiError(Exception):
238
304
def __init__(self, value, *args, **kwargs):
239
305
self.value = value
435
501
.format(self.name)))
505
# Pretend that we have a GnuTLS module
506
class GnuTLS(object):
507
"""This isn't so much a class as it is a module-like namespace.
508
It is instantiated once, and simulates having a GnuTLS module."""
510
library = ctypes.util.find_library("gnutls")
512
library = ctypes.util.find_library("gnutls-deb0")
513
_library = ctypes.cdll.LoadLibrary(library)
515
_need_version = b"3.3.0"
518
# Need to use "self" here, since this method is called before
519
# the assignment to the "gnutls" global variable happens.
520
if self.check_version(self._need_version) is None:
521
raise self.Error("Needs GnuTLS {} or later"
522
.format(self._need_version))
524
# Unless otherwise indicated, the constants and types below are
525
# all from the gnutls/gnutls.h C header file.
535
E_NO_CERTIFICATE_FOUND = -49
536
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
539
class session_int(ctypes.Structure):
541
session_t = ctypes.POINTER(session_int)
543
class certificate_credentials_st(ctypes.Structure):
545
certificate_credentials_t = ctypes.POINTER(
546
certificate_credentials_st)
547
certificate_type_t = ctypes.c_int
549
class datum_t(ctypes.Structure):
550
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
551
('size', ctypes.c_uint)]
553
class openpgp_crt_int(ctypes.Structure):
555
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
556
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
557
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
558
credentials_type_t = ctypes.c_int
559
transport_ptr_t = ctypes.c_void_p
560
close_request_t = ctypes.c_int
563
class Error(Exception):
564
# We need to use the class name "GnuTLS" here, since this
565
# exception might be raised from within GnuTLS.__init__,
566
# which is called before the assignment to the "gnutls"
567
# global variable has happened.
568
def __init__(self, message=None, code=None, args=()):
569
# Default usage is by a message string, but if a return
570
# code is passed, convert it to a string with
573
if message is None and code is not None:
574
message = GnuTLS.strerror(code)
575
return super(GnuTLS.Error, self).__init__(
578
class CertificateSecurityError(Error):
582
class Credentials(object):
584
self._c_object = gnutls.certificate_credentials_t()
585
gnutls.certificate_allocate_credentials(
586
ctypes.byref(self._c_object))
587
self.type = gnutls.CRD_CERTIFICATE
590
gnutls.certificate_free_credentials(self._c_object)
592
class ClientSession(object):
593
def __init__(self, socket, credentials=None):
594
self._c_object = gnutls.session_t()
595
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
596
gnutls.set_default_priority(self._c_object)
597
gnutls.transport_set_ptr(self._c_object, socket.fileno())
598
gnutls.handshake_set_private_extensions(self._c_object,
601
if credentials is None:
602
credentials = gnutls.Credentials()
603
gnutls.credentials_set(self._c_object, credentials.type,
604
ctypes.cast(credentials._c_object,
606
self.credentials = credentials
609
gnutls.deinit(self._c_object)
612
return gnutls.handshake(self._c_object)
614
def send(self, data):
618
data_len -= gnutls.record_send(self._c_object,
623
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
625
# Error handling functions
626
def _error_code(result):
627
"""A function to raise exceptions on errors, suitable
628
for the 'restype' attribute on ctypes functions"""
631
if result == gnutls.E_NO_CERTIFICATE_FOUND:
632
raise gnutls.CertificateSecurityError(code=result)
633
raise gnutls.Error(code=result)
635
def _retry_on_error(result, func, arguments):
636
"""A function to retry on some errors, suitable
637
for the 'errcheck' attribute on ctypes functions"""
639
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
640
return _error_code(result)
641
result = func(*arguments)
644
# Unless otherwise indicated, the function declarations below are
645
# all from the gnutls/gnutls.h C header file.
648
priority_set_direct = _library.gnutls_priority_set_direct
649
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
650
ctypes.POINTER(ctypes.c_char_p)]
651
priority_set_direct.restype = _error_code
653
init = _library.gnutls_init
654
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
655
init.restype = _error_code
657
set_default_priority = _library.gnutls_set_default_priority
658
set_default_priority.argtypes = [session_t]
659
set_default_priority.restype = _error_code
661
record_send = _library.gnutls_record_send
662
record_send.argtypes = [session_t, ctypes.c_void_p,
664
record_send.restype = ctypes.c_ssize_t
665
record_send.errcheck = _retry_on_error
667
certificate_allocate_credentials = (
668
_library.gnutls_certificate_allocate_credentials)
669
certificate_allocate_credentials.argtypes = [
670
ctypes.POINTER(certificate_credentials_t)]
671
certificate_allocate_credentials.restype = _error_code
673
certificate_free_credentials = (
674
_library.gnutls_certificate_free_credentials)
675
certificate_free_credentials.argtypes = [
676
certificate_credentials_t]
677
certificate_free_credentials.restype = None
679
handshake_set_private_extensions = (
680
_library.gnutls_handshake_set_private_extensions)
681
handshake_set_private_extensions.argtypes = [session_t,
683
handshake_set_private_extensions.restype = None
685
credentials_set = _library.gnutls_credentials_set
686
credentials_set.argtypes = [session_t, credentials_type_t,
688
credentials_set.restype = _error_code
690
strerror = _library.gnutls_strerror
691
strerror.argtypes = [ctypes.c_int]
692
strerror.restype = ctypes.c_char_p
694
certificate_type_get = _library.gnutls_certificate_type_get
695
certificate_type_get.argtypes = [session_t]
696
certificate_type_get.restype = _error_code
698
certificate_get_peers = _library.gnutls_certificate_get_peers
699
certificate_get_peers.argtypes = [session_t,
700
ctypes.POINTER(ctypes.c_uint)]
701
certificate_get_peers.restype = ctypes.POINTER(datum_t)
703
global_set_log_level = _library.gnutls_global_set_log_level
704
global_set_log_level.argtypes = [ctypes.c_int]
705
global_set_log_level.restype = None
707
global_set_log_function = _library.gnutls_global_set_log_function
708
global_set_log_function.argtypes = [log_func]
709
global_set_log_function.restype = None
711
deinit = _library.gnutls_deinit
712
deinit.argtypes = [session_t]
713
deinit.restype = None
715
handshake = _library.gnutls_handshake
716
handshake.argtypes = [session_t]
717
handshake.restype = _error_code
718
handshake.errcheck = _retry_on_error
720
transport_set_ptr = _library.gnutls_transport_set_ptr
721
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
722
transport_set_ptr.restype = None
724
bye = _library.gnutls_bye
725
bye.argtypes = [session_t, close_request_t]
726
bye.restype = _error_code
727
bye.errcheck = _retry_on_error
729
check_version = _library.gnutls_check_version
730
check_version.argtypes = [ctypes.c_char_p]
731
check_version.restype = ctypes.c_char_p
733
# All the function declarations below are from gnutls/openpgp.h
735
openpgp_crt_init = _library.gnutls_openpgp_crt_init
736
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
737
openpgp_crt_init.restype = _error_code
739
openpgp_crt_import = _library.gnutls_openpgp_crt_import
740
openpgp_crt_import.argtypes = [openpgp_crt_t,
741
ctypes.POINTER(datum_t),
743
openpgp_crt_import.restype = _error_code
745
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
746
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
747
ctypes.POINTER(ctypes.c_uint)]
748
openpgp_crt_verify_self.restype = _error_code
750
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
751
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
752
openpgp_crt_deinit.restype = None
754
openpgp_crt_get_fingerprint = (
755
_library.gnutls_openpgp_crt_get_fingerprint)
756
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
760
openpgp_crt_get_fingerprint.restype = _error_code
762
# Remove non-public functions
763
del _error_code, _retry_on_error
764
# Create the global "gnutls" object, simulating a module
438
768
def call_pipe(connection, # : multiprocessing.Connection
439
769
func, *args, **kwargs):
440
770
"""This function is meant to be called by multiprocessing.Process
442
772
This function runs func(*args, **kwargs), and writes the resulting
443
773
return value on the provided multiprocessing.Connection.
445
775
connection.send(func(*args, **kwargs))
446
776
connection.close()
448
779
class Client(object):
449
780
"""A representation of a client host served by this server.
452
783
approved: bool(); 'None' if not yet approved/disapproved
453
784
approval_delay: datetime.timedelta(); Time to wait for approval
626
959
logger.info("Disabling client %s", self.name)
627
960
if getattr(self, "disable_initiator_tag", None) is not None:
628
gobject.source_remove(self.disable_initiator_tag)
961
GLib.source_remove(self.disable_initiator_tag)
629
962
self.disable_initiator_tag = None
630
963
self.expires = None
631
964
if getattr(self, "checker_initiator_tag", None) is not None:
632
gobject.source_remove(self.checker_initiator_tag)
965
GLib.source_remove(self.checker_initiator_tag)
633
966
self.checker_initiator_tag = None
634
967
self.stop_checker()
635
968
self.enabled = False
637
970
self.send_changedstate()
638
# Do not run this again if called by a gobject.timeout_add
971
# Do not run this again if called by a GLib.timeout_add
641
974
def __del__(self):
644
977
def init_checker(self):
645
978
# Schedule a new checker to be started an 'interval' from now,
646
979
# and every interval from then on.
647
980
if self.checker_initiator_tag is not None:
648
gobject.source_remove(self.checker_initiator_tag)
649
self.checker_initiator_tag = gobject.timeout_add(
981
GLib.source_remove(self.checker_initiator_tag)
982
self.checker_initiator_tag = GLib.timeout_add(
650
983
int(self.interval.total_seconds() * 1000),
651
984
self.start_checker)
652
985
# Schedule a disable() when 'timeout' has passed
653
986
if self.disable_initiator_tag is not None:
654
gobject.source_remove(self.disable_initiator_tag)
655
self.disable_initiator_tag = gobject.timeout_add(
987
GLib.source_remove(self.disable_initiator_tag)
988
self.disable_initiator_tag = GLib.timeout_add(
656
989
int(self.timeout.total_seconds() * 1000), self.disable)
657
990
# Also start a new checker *right now*.
658
991
self.start_checker()
660
993
def checker_callback(self, source, condition, connection,
662
995
"""The checker has completed, so take appropriate actions."""
895
1229
for cls in self.__class__.__mro__
896
1230
for name, athing in
897
1231
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1233
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1235
path_keyword='object_path',
1236
connection_keyword='connection')
1237
def Introspect(self, object_path, connection):
1238
"""Overloading of standard D-Bus method.
1240
Inserts annotation tags on methods and signals.
1242
xmlstring = dbus.service.Object.Introspect(self, object_path,
1245
document = xml.dom.minidom.parseString(xmlstring)
1247
for if_tag in document.getElementsByTagName("interface"):
1248
# Add annotation tags
1249
for typ in ("method", "signal"):
1250
for tag in if_tag.getElementsByTagName(typ):
1252
for name, prop in (self.
1253
_get_all_dbus_things(typ)):
1254
if (name == tag.getAttribute("name")
1255
and prop._dbus_interface
1256
== if_tag.getAttribute("name")):
1257
annots.update(getattr(
1258
prop, "_dbus_annotations", {}))
1259
for name, value in annots.items():
1260
ann_tag = document.createElement(
1262
ann_tag.setAttribute("name", name)
1263
ann_tag.setAttribute("value", value)
1264
tag.appendChild(ann_tag)
1265
# Add interface annotation tags
1266
for annotation, value in dict(
1267
itertools.chain.from_iterable(
1268
annotations().items()
1269
for name, annotations
1270
in self._get_all_dbus_things("interface")
1271
if name == if_tag.getAttribute("name")
1273
ann_tag = document.createElement("annotation")
1274
ann_tag.setAttribute("name", annotation)
1275
ann_tag.setAttribute("value", value)
1276
if_tag.appendChild(ann_tag)
1277
# Fix argument name for the Introspect method itself
1278
if (if_tag.getAttribute("name")
1279
== dbus.INTROSPECTABLE_IFACE):
1280
for cn in if_tag.getElementsByTagName("method"):
1281
if cn.getAttribute("name") == "Introspect":
1282
for arg in cn.getElementsByTagName("arg"):
1283
if (arg.getAttribute("direction")
1285
arg.setAttribute("name",
1287
xmlstring = document.toxml("utf-8")
1289
except (AttributeError, xml.dom.DOMException,
1290
xml.parsers.expat.ExpatError) as error:
1291
logger.error("Failed to override Introspection method",
1296
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1297
"""A D-Bus object with properties.
1299
Classes inheriting from this can use the dbus_service_property
1300
decorator to expose methods as D-Bus properties. It exposes the
1301
standard Get(), Set(), and GetAll() methods on the D-Bus.
899
1304
def _get_dbus_property(self, interface_name, property_name):
900
1305
"""Returns a bound method if one exists which is a D-Bus
901
1306
property with the specified name and interface.
1006
1421
if prop._dbus_interface
1007
1422
== if_tag.getAttribute("name")):
1008
1423
if_tag.appendChild(tag)
1009
# Add annotation tags
1010
for typ in ("method", "signal", "property"):
1011
for tag in if_tag.getElementsByTagName(typ):
1013
for name, prop in (self.
1014
_get_all_dbus_things(typ)):
1015
if (name == tag.getAttribute("name")
1016
and prop._dbus_interface
1017
== if_tag.getAttribute("name")):
1018
annots.update(getattr(
1019
prop, "_dbus_annotations", {}))
1020
for name, value in annots.items():
1021
ann_tag = document.createElement(
1023
ann_tag.setAttribute("name", name)
1024
ann_tag.setAttribute("value", value)
1025
tag.appendChild(ann_tag)
1026
# Add interface annotation tags
1027
for annotation, value in dict(
1028
itertools.chain.from_iterable(
1029
annotations().items()
1030
for name, annotations
1031
in self._get_all_dbus_things("interface")
1032
if name == if_tag.getAttribute("name")
1034
ann_tag = document.createElement("annotation")
1035
ann_tag.setAttribute("name", annotation)
1036
ann_tag.setAttribute("value", value)
1037
if_tag.appendChild(ann_tag)
1424
# Add annotation tags for properties
1425
for tag in if_tag.getElementsByTagName("property"):
1427
for name, prop in self._get_all_dbus_things(
1429
if (name == tag.getAttribute("name")
1430
and prop._dbus_interface
1431
== if_tag.getAttribute("name")):
1432
annots.update(getattr(
1433
prop, "_dbus_annotations", {}))
1434
for name, value in annots.items():
1435
ann_tag = document.createElement(
1437
ann_tag.setAttribute("name", name)
1438
ann_tag.setAttribute("value", value)
1439
tag.appendChild(ann_tag)
1038
1440
# Add the names to the return values for the
1039
1441
# "org.freedesktop.DBus.Properties" methods
1040
1442
if (if_tag.getAttribute("name")
1059
1461
return xmlstring
1465
dbus.OBJECT_MANAGER_IFACE
1466
except AttributeError:
1467
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1470
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1471
"""A D-Bus object with an ObjectManager.
1473
Classes inheriting from this exposes the standard
1474
GetManagedObjects call and the InterfacesAdded and
1475
InterfacesRemoved signals on the standard
1476
"org.freedesktop.DBus.ObjectManager" interface.
1478
Note: No signals are sent automatically; they must be sent
1481
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1482
out_signature="a{oa{sa{sv}}}")
1483
def GetManagedObjects(self):
1484
"""This function must be overridden"""
1485
raise NotImplementedError()
1487
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1488
signature="oa{sa{sv}}")
1489
def InterfacesAdded(self, object_path, interfaces_and_properties):
1492
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1493
def InterfacesRemoved(self, object_path, interfaces):
1496
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1498
path_keyword='object_path',
1499
connection_keyword='connection')
1500
def Introspect(self, object_path, connection):
1501
"""Overloading of standard D-Bus method.
1503
Override return argument name of GetManagedObjects to be
1504
"objpath_interfaces_and_properties"
1506
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1510
document = xml.dom.minidom.parseString(xmlstring)
1512
for if_tag in document.getElementsByTagName("interface"):
1513
# Fix argument name for the GetManagedObjects method
1514
if (if_tag.getAttribute("name")
1515
== dbus.OBJECT_MANAGER_IFACE):
1516
for cn in if_tag.getElementsByTagName("method"):
1517
if (cn.getAttribute("name")
1518
== "GetManagedObjects"):
1519
for arg in cn.getElementsByTagName("arg"):
1520
if (arg.getAttribute("direction")
1524
"objpath_interfaces"
1526
xmlstring = document.toxml("utf-8")
1528
except (AttributeError, xml.dom.DOMException,
1529
xml.parsers.expat.ExpatError) as error:
1530
logger.error("Failed to override Introspection method",
1062
1535
def datetime_to_dbus(dt, variant_level=0):
1063
1536
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1065
return dbus.String("", variant_level = variant_level)
1538
return dbus.String("", variant_level=variant_level)
1066
1539
return dbus.String(dt.isoformat(), variant_level=variant_level)
1724
2189
class ClientHandler(socketserver.BaseRequestHandler, object):
1725
2190
"""A class to handle client connections.
1727
2192
Instantiated once for each connection to handle it.
1728
2193
Note: This will run in its own forked process."""
1730
2195
def handle(self):
1731
2196
with contextlib.closing(self.server.child_pipe) as child_pipe:
1732
2197
logger.info("TCP connection from: %s",
1733
2198
str(self.client_address))
1734
2199
logger.debug("Pipe FD: %d",
1735
2200
self.server.child_pipe.fileno())
1737
session = gnutls.connection.ClientSession(
1738
self.request, gnutls.connection .X509Credentials())
1740
# Note: gnutls.connection.X509Credentials is really a
1741
# generic GnuTLS certificate credentials object so long as
1742
# no X.509 keys are added to it. Therefore, we can use it
1743
# here despite using OpenPGP certificates.
1745
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1746
# "+AES-256-CBC", "+SHA1",
1747
# "+COMP-NULL", "+CTYPE-OPENPGP",
2202
session = gnutls.ClientSession(self.request)
2204
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2205
# "+AES-256-CBC", "+SHA1",
2206
# "+COMP-NULL", "+CTYPE-OPENPGP",
1749
2208
# Use a fallback default, since this MUST be set.
1750
2209
priority = self.server.gnutls_priority
1751
2210
if priority is None:
1752
2211
priority = "NORMAL"
1753
gnutls.library.functions.gnutls_priority_set_direct(
1754
session._c_object, priority, None)
2212
gnutls.priority_set_direct(session._c_object,
2213
priority.encode("utf-8"),
1756
2216
# Start communication using the Mandos protocol
1757
2217
# Get protocol number
1758
2218
line = self.request.makefile().readline()
1845
2304
delay -= time2 - time
1848
while sent_size < len(client.secret):
1850
sent = session.send(client.secret[sent_size:])
1851
except gnutls.errors.GNUTLSError as error:
1852
logger.warning("gnutls send failed",
1855
logger.debug("Sent: %d, remaining: %d", sent,
1856
len(client.secret) - (sent_size
2307
session.send(client.secret)
2308
except gnutls.Error as error:
2309
logger.warning("gnutls send failed",
1860
2313
logger.info("Sending secret to %s", client.name)
1861
2314
# bump the timeout using extended_timeout
1862
2315
client.bump_timeout(client.extended_timeout)
1863
2316
if self.server.use_dbus:
1864
2317
# Emit D-Bus signal
1865
2318
client.GotSecret()
1868
2321
if approval_required:
1869
2322
client.approvals_pending -= 1
1872
except gnutls.errors.GNUTLSError as error:
2325
except gnutls.Error as error:
1873
2326
logger.warning("GnuTLS bye failed",
1874
2327
exc_info=error)
1877
2330
def peer_certificate(session):
1878
2331
"Return the peer's OpenPGP certificate as a bytestring"
1879
2332
# If not an OpenPGP certificate...
1880
if (gnutls.library.functions.gnutls_certificate_type_get(
1882
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1883
# ...do the normal thing
1884
return session.peer_certificate
2333
if (gnutls.certificate_type_get(session._c_object)
2334
!= gnutls.CRT_OPENPGP):
2335
# ...return invalid data
1885
2337
list_size = ctypes.c_uint(1)
1886
cert_list = (gnutls.library.functions
1887
.gnutls_certificate_get_peers
2338
cert_list = (gnutls.certificate_get_peers
1888
2339
(session._c_object, ctypes.byref(list_size)))
1889
2340
if not bool(cert_list) and list_size.value != 0:
1890
raise gnutls.errors.GNUTLSError("error getting peer"
2341
raise gnutls.Error("error getting peer certificate")
1892
2342
if list_size.value == 0:
1894
2344
cert = cert_list[0]
1895
2345
return ctypes.string_at(cert.data, cert.size)
1898
2348
def fingerprint(openpgp):
1899
2349
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1900
2350
# New GnuTLS "datum" with the OpenPGP public key
1901
datum = gnutls.library.types.gnutls_datum_t(
2351
datum = gnutls.datum_t(
1902
2352
ctypes.cast(ctypes.c_char_p(openpgp),
1903
2353
ctypes.POINTER(ctypes.c_ubyte)),
1904
2354
ctypes.c_uint(len(openpgp)))
1905
2355
# New empty GnuTLS certificate
1906
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1907
gnutls.library.functions.gnutls_openpgp_crt_init(
2356
crt = gnutls.openpgp_crt_t()
2357
gnutls.openpgp_crt_init(ctypes.byref(crt))
1909
2358
# Import the OpenPGP public key into the certificate
1910
gnutls.library.functions.gnutls_openpgp_crt_import(
1911
crt, ctypes.byref(datum),
1912
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2359
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2360
gnutls.OPENPGP_FMT_RAW)
1913
2361
# Verify the self signature in the key
1914
2362
crtverify = ctypes.c_uint()
1915
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1916
crt, 0, ctypes.byref(crtverify))
2363
gnutls.openpgp_crt_verify_self(crt, 0,
2364
ctypes.byref(crtverify))
1917
2365
if crtverify.value != 0:
1918
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1919
raise gnutls.errors.CertificateSecurityError(
2366
gnutls.openpgp_crt_deinit(crt)
2367
raise gnutls.CertificateSecurityError("Verify failed")
1921
2368
# New buffer for the fingerprint
1922
2369
buf = ctypes.create_string_buffer(20)
1923
2370
buf_len = ctypes.c_size_t()
1924
2371
# Get the fingerprint from the certificate into the buffer
1925
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1926
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2372
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2373
ctypes.byref(buf_len))
1927
2374
# Deinit the certificate
1928
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2375
gnutls.openpgp_crt_deinit(crt)
1929
2376
# Convert the buffer to a Python bytestring
1930
2377
fpr = ctypes.string_at(buf, buf_len.value)
1931
2378
# Convert the bytestring to hexadecimal notation
2019
2467
# socket_wrapper(), if socketfd was set.
2020
2468
socketserver.TCPServer.__init__(self, server_address,
2021
2469
RequestHandlerClass)
2023
2471
def server_bind(self):
2024
2472
"""This overrides the normal server_bind() function
2025
2473
to bind to an interface if one was specified, and also NOT to
2026
2474
bind to an address or port if they were not specified."""
2475
global SO_BINDTODEVICE
2027
2476
if self.interface is not None:
2028
2477
if SO_BINDTODEVICE is None:
2029
logger.error("SO_BINDTODEVICE does not exist;"
2030
" cannot bind to interface %s",
2034
self.socket.setsockopt(
2035
socket.SOL_SOCKET, SO_BINDTODEVICE,
2036
(self.interface + "\0").encode("utf-8"))
2037
except socket.error as error:
2038
if error.errno == errno.EPERM:
2039
logger.error("No permission to bind to"
2040
" interface %s", self.interface)
2041
elif error.errno == errno.ENOPROTOOPT:
2042
logger.error("SO_BINDTODEVICE not available;"
2043
" cannot bind to interface %s",
2045
elif error.errno == errno.ENODEV:
2046
logger.error("Interface %s does not exist,"
2047
" cannot bind", self.interface)
2478
# Fall back to a hard-coded value which seems to be
2480
logger.warning("SO_BINDTODEVICE not found, trying 25")
2481
SO_BINDTODEVICE = 25
2483
self.socket.setsockopt(
2484
socket.SOL_SOCKET, SO_BINDTODEVICE,
2485
(self.interface + "\0").encode("utf-8"))
2486
except socket.error as error:
2487
if error.errno == errno.EPERM:
2488
logger.error("No permission to bind to"
2489
" interface %s", self.interface)
2490
elif error.errno == errno.ENOPROTOOPT:
2491
logger.error("SO_BINDTODEVICE not available;"
2492
" cannot bind to interface %s",
2494
elif error.errno == errno.ENODEV:
2495
logger.error("Interface %s does not exist,"
2496
" cannot bind", self.interface)
2050
2499
# Only bind(2) the socket if we really need to.
2051
2500
if self.server_address[0] or self.server_address[1]:
2052
2501
if not self.server_address[0]:
2053
2502
if self.address_family == socket.AF_INET6:
2054
any_address = "::" # in6addr_any
2503
any_address = "::" # in6addr_any
2056
any_address = "0.0.0.0" # INADDR_ANY
2505
any_address = "0.0.0.0" # INADDR_ANY
2057
2506
self.server_address = (any_address,
2058
2507
self.server_address[1])
2059
2508
elif not self.server_address[1]:
2604
3063
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2605
3064
service = AvahiServiceToSyslog(
2606
name = server_settings["servicename"],
2607
servicetype = "_mandos._tcp",
2608
protocol = protocol,
3065
name=server_settings["servicename"],
3066
servicetype="_mandos._tcp",
2610
3069
if server_settings["interface"]:
2611
3070
service.interface = if_nametoindex(
2612
3071
server_settings["interface"].encode("utf-8"))
2614
3073
global multiprocessing_manager
2615
3074
multiprocessing_manager = multiprocessing.Manager()
2617
3076
client_class = Client
2619
client_class = functools.partial(ClientDBus, bus = bus)
3078
client_class = functools.partial(ClientDBus, bus=bus)
2621
3080
client_settings = Client.config_parser(client_config)
2622
3081
old_client_settings = {}
2623
3082
clients_data = {}
2625
3084
# This is used to redirect stdout and stderr for checker processes
2627
wnull = open(os.devnull, "w") # A writable /dev/null
3086
wnull = open(os.devnull, "w") # A writable /dev/null
2628
3087
# Only used if server is running in foreground but not in debug
2630
3089
if debug or not foreground:
2633
3092
# Get client data and settings from last running state.
2634
3093
if server_settings["restore"]:
2636
3095
with open(stored_state_path, "rb") as stored_state:
2637
clients_data, old_client_settings = pickle.load(
3096
if sys.version_info.major == 2:
3097
clients_data, old_client_settings = pickle.load(
3100
bytes_clients_data, bytes_old_client_settings = (
3101
pickle.load(stored_state, encoding="bytes"))
3102
# Fix bytes to strings
3105
clients_data = {(key.decode("utf-8")
3106
if isinstance(key, bytes)
3109
bytes_clients_data.items()}
3110
del bytes_clients_data
3111
for key in clients_data:
3112
value = {(k.decode("utf-8")
3113
if isinstance(k, bytes) else k): v
3115
clients_data[key].items()}
3116
clients_data[key] = value
3118
value["client_structure"] = [
3120
if isinstance(s, bytes)
3122
value["client_structure"]]
3124
for k in ("name", "host"):
3125
if isinstance(value[k], bytes):
3126
value[k] = value[k].decode("utf-8")
3127
# old_client_settings
3129
old_client_settings = {
3130
(key.decode("utf-8")
3131
if isinstance(key, bytes)
3134
bytes_old_client_settings.items()}
3135
del bytes_old_client_settings
3137
for value in old_client_settings.values():
3138
if isinstance(value["host"], bytes):
3139
value["host"] = (value["host"]
2639
3141
os.remove(stored_state_path)
2640
3142
except IOError as e:
2641
3143
if e.errno == errno.ENOENT:
2741
3243
pidfilename, pid)
2743
3245
del pidfilename
2745
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2746
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3247
for termsig in (signal.SIGHUP, signal.SIGTERM):
3248
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3249
lambda: main_loop.quit() and False)
2750
3253
@alternate_dbus_interfaces(
2751
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2752
class MandosDBusService(DBusObjectWithProperties):
3254
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3255
class MandosDBusService(DBusObjectWithObjectManager):
2753
3256
"""A D-Bus proxy object"""
2755
3258
def __init__(self):
2756
3259
dbus.service.Object.__init__(self, bus, "/")
2758
3261
_interface = "se.recompile.Mandos"
2760
@dbus_interface_annotations(_interface)
2763
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2766
3263
@dbus.service.signal(_interface, signature="o")
2767
3264
def ClientAdded(self, objpath):
2771
3268
@dbus.service.signal(_interface, signature="ss")
2772
3269
def ClientNotFound(self, fingerprint, address):
3273
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2776
3275
@dbus.service.signal(_interface, signature="os")
2777
3276
def ClientRemoved(self, objpath, name):
3280
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2781
3282
@dbus.service.method(_interface, out_signature="ao")
2782
3283
def GetAllClients(self):
2784
3285
return dbus.Array(c.dbus_object_path for c in
2785
tcp_server.clients.itervalues())
3286
tcp_server.clients.values())
3288
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2787
3290
@dbus.service.method(_interface,
2788
3291
out_signature="a{oa{sv}}")
2789
3292
def GetAllClientsWithProperties(self):
2791
3294
return dbus.Dictionary(
2792
{ c.dbus_object_path: c.GetAll("")
2793
for c in tcp_server.clients.itervalues() },
3295
{c.dbus_object_path: c.GetAll(
3296
"se.recompile.Mandos.Client")
3297
for c in tcp_server.clients.values()},
2794
3298
signature="oa{sv}")
2796
3300
@dbus.service.method(_interface, in_signature="o")
2797
3301
def RemoveClient(self, object_path):
2799
for c in tcp_server.clients.itervalues():
3303
for c in tcp_server.clients.values():
2800
3304
if c.dbus_object_path == object_path:
2801
3305
del tcp_server.clients[c.name]
2802
3306
c.remove_from_connection()
2803
# Don't signal anything except ClientRemoved
3307
# Don't signal the disabling
2804
3308
c.disable(quiet=True)
2806
self.ClientRemoved(object_path, c.name)
3309
# Emit D-Bus signal for removal
3310
self.client_removed_signal(c)
2808
3312
raise KeyError(object_path)
3316
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3317
out_signature="a{oa{sa{sv}}}")
3318
def GetManagedObjects(self):
3320
return dbus.Dictionary(
3321
{client.dbus_object_path:
3323
{interface: client.GetAll(interface)
3325
client._get_all_interface_names()})
3326
for client in tcp_server.clients.values()})
3328
def client_added_signal(self, client):
3329
"""Send the new standard signal and the old signal"""
3331
# New standard signal
3332
self.InterfacesAdded(
3333
client.dbus_object_path,
3335
{interface: client.GetAll(interface)
3337
client._get_all_interface_names()}))
3339
self.ClientAdded(client.dbus_object_path)
3341
def client_removed_signal(self, client):
3342
"""Send the new standard signal and the old signal"""
3344
# New standard signal
3345
self.InterfacesRemoved(
3346
client.dbus_object_path,
3347
client._get_all_interface_names())
3349
self.ClientRemoved(client.dbus_object_path,
2812
3352
mandos_dbus_service = MandosDBusService()
3354
# Save modules to variables to exempt the modules from being
3355
# unloaded before the function registered with atexit() is run.
3356
mp = multiprocessing
2815
3360
"Cleanup function; run on exit"
2817
3362
service.cleanup()
2819
multiprocessing.active_children()
3364
mp.active_children()
2821
3366
if not (tcp_server.clients or client_settings):
2824
3369
# Store client before exiting. Secrets are encrypted with key
2825
3370
# based on what config file has. If config file is
2826
3371
# removed/edited, old secret will thus be unrecovable.
2828
3373
with PGPEngine() as pgp:
2829
for client in tcp_server.clients.itervalues():
3374
for client in tcp_server.clients.values():
2830
3375
key = client_settings[client.name]["secret"]
2831
3376
client.encrypted_secret = pgp.encrypt(client.secret,
2833
3378
client_dict = {}
2835
3380
# A list of attributes that can not be pickled
2837
exclude = { "bus", "changedstate", "secret",
2838
"checker", "server_settings" }
3382
exclude = {"bus", "changedstate", "secret",
3383
"checker", "server_settings"}
2839
3384
for name, typ in inspect.getmembers(dbus.service
2841
3386
exclude.add(name)
2843
3388
client_dict["encrypted_secret"] = (client
2844
3389
.encrypted_secret)
2845
3390
for attr in client.client_structure:
2846
3391
if attr not in exclude:
2847
3392
client_dict[attr] = getattr(client, attr)
2849
3394
clients[client.name] = client_dict
2850
3395
del client_settings[client.name]["secret"]
2853
3398
with tempfile.NamedTemporaryFile(