2
2
# -*- mode: python; coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
# Copyright © 2008-2015 Teddy Hogeborn
15
# Copyright © 2008-2015 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2017 Teddy Hogeborn
15
# Copyright © 2008-2017 Björn Påhlsson
17
# This file is part of Mandos.
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
32
# Contact the authors at <mandos@recompile.se>.
34
35
from __future__ import (division, absolute_import, print_function,
37
from future_builtins import *
39
from future_builtins import *
40
44
import SocketServer as socketserver
196
236
.replace(b"\n", b"\\n")
197
237
.replace(b"\0", b"\\x00"))
200
240
def encrypt(self, data, password):
201
241
passphrase = self.password_encode(password)
202
242
with tempfile.NamedTemporaryFile(
203
243
dir=self.tempdir) as passfile:
204
244
passfile.write(passphrase)
206
proc = subprocess.Popen(['gpg', '--symmetric',
246
proc = subprocess.Popen([self.gpg, '--symmetric',
207
247
'--passphrase-file',
209
249
+ self.gnupgargs,
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
214
254
if proc.returncode != 0:
215
255
raise PGPError(err)
216
256
return ciphertext
218
258
def decrypt(self, data, password):
219
259
passphrase = self.password_encode(password)
220
260
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
261
dir=self.tempdir) as passfile:
222
262
passfile.write(passphrase)
224
proc = subprocess.Popen(['gpg', '--decrypt',
264
proc = subprocess.Popen([self.gpg, '--decrypt',
225
265
'--passphrase-file',
227
267
+ self.gnupgargs,
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
232
272
if proc.returncode != 0:
233
273
raise PGPError(err)
234
274
return decrypted_plaintext
277
# Pretend that we have an Avahi module
279
"""This isn't so much a class as it is a module-like namespace.
280
It is instantiated once, and simulates having an Avahi module."""
281
IF_UNSPEC = -1 # avahi-common/address.h
282
PROTO_UNSPEC = -1 # avahi-common/address.h
283
PROTO_INET = 0 # avahi-common/address.h
284
PROTO_INET6 = 1 # avahi-common/address.h
285
DBUS_NAME = "org.freedesktop.Avahi"
286
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
287
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
288
DBUS_PATH_SERVER = "/"
290
def string_array_to_txt_array(self, t):
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
237
304
class AvahiError(Exception):
238
305
def __init__(self, value, *args, **kwargs):
239
306
self.value = value
429
496
class AvahiServiceToSyslog(AvahiService):
430
497
def rename(self, *args, **kwargs):
431
498
"""Add the new name to the syslog messages"""
432
ret = AvahiService.rename(self, *args, **kwargs)
499
ret = super(AvahiServiceToSyslog, self).rename(self, *args,
433
501
syslogger.setFormatter(logging.Formatter(
434
502
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
435
503
.format(self.name)))
507
# Pretend that we have a GnuTLS module
508
class GnuTLS(object):
509
"""This isn't so much a class as it is a module-like namespace.
510
It is instantiated once, and simulates having a GnuTLS module."""
512
library = ctypes.util.find_library("gnutls")
514
library = ctypes.util.find_library("gnutls-deb0")
515
_library = ctypes.cdll.LoadLibrary(library)
517
_need_version = b"3.3.0"
520
# Need to use "self" here, since this method is called before
521
# the assignment to the "gnutls" global variable happens.
522
if self.check_version(self._need_version) is None:
523
raise self.Error("Needs GnuTLS {} or later"
524
.format(self._need_version))
526
# Unless otherwise indicated, the constants and types below are
527
# all from the gnutls/gnutls.h C header file.
537
E_NO_CERTIFICATE_FOUND = -49
538
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
541
class session_int(ctypes.Structure):
543
session_t = ctypes.POINTER(session_int)
545
class certificate_credentials_st(ctypes.Structure):
547
certificate_credentials_t = ctypes.POINTER(
548
certificate_credentials_st)
549
certificate_type_t = ctypes.c_int
551
class datum_t(ctypes.Structure):
552
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
553
('size', ctypes.c_uint)]
555
class openpgp_crt_int(ctypes.Structure):
557
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
558
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
559
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
560
credentials_type_t = ctypes.c_int
561
transport_ptr_t = ctypes.c_void_p
562
close_request_t = ctypes.c_int
565
class Error(Exception):
566
# We need to use the class name "GnuTLS" here, since this
567
# exception might be raised from within GnuTLS.__init__,
568
# which is called before the assignment to the "gnutls"
569
# global variable has happened.
570
def __init__(self, message=None, code=None, args=()):
571
# Default usage is by a message string, but if a return
572
# code is passed, convert it to a string with
575
if message is None and code is not None:
576
message = GnuTLS.strerror(code)
577
return super(GnuTLS.Error, self).__init__(
580
class CertificateSecurityError(Error):
584
class Credentials(object):
586
self._c_object = gnutls.certificate_credentials_t()
587
gnutls.certificate_allocate_credentials(
588
ctypes.byref(self._c_object))
589
self.type = gnutls.CRD_CERTIFICATE
592
gnutls.certificate_free_credentials(self._c_object)
594
class ClientSession(object):
595
def __init__(self, socket, credentials=None):
596
self._c_object = gnutls.session_t()
597
gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)
598
gnutls.set_default_priority(self._c_object)
599
gnutls.transport_set_ptr(self._c_object, socket.fileno())
600
gnutls.handshake_set_private_extensions(self._c_object,
603
if credentials is None:
604
credentials = gnutls.Credentials()
605
gnutls.credentials_set(self._c_object, credentials.type,
606
ctypes.cast(credentials._c_object,
608
self.credentials = credentials
611
gnutls.deinit(self._c_object)
614
return gnutls.handshake(self._c_object)
616
def send(self, data):
620
data_len -= gnutls.record_send(self._c_object,
625
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
627
# Error handling functions
628
def _error_code(result):
629
"""A function to raise exceptions on errors, suitable
630
for the 'restype' attribute on ctypes functions"""
633
if result == gnutls.E_NO_CERTIFICATE_FOUND:
634
raise gnutls.CertificateSecurityError(code=result)
635
raise gnutls.Error(code=result)
637
def _retry_on_error(result, func, arguments):
638
"""A function to retry on some errors, suitable
639
for the 'errcheck' attribute on ctypes functions"""
641
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
642
return _error_code(result)
643
result = func(*arguments)
646
# Unless otherwise indicated, the function declarations below are
647
# all from the gnutls/gnutls.h C header file.
650
priority_set_direct = _library.gnutls_priority_set_direct
651
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
652
ctypes.POINTER(ctypes.c_char_p)]
653
priority_set_direct.restype = _error_code
655
init = _library.gnutls_init
656
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
657
init.restype = _error_code
659
set_default_priority = _library.gnutls_set_default_priority
660
set_default_priority.argtypes = [session_t]
661
set_default_priority.restype = _error_code
663
record_send = _library.gnutls_record_send
664
record_send.argtypes = [session_t, ctypes.c_void_p,
666
record_send.restype = ctypes.c_ssize_t
667
record_send.errcheck = _retry_on_error
669
certificate_allocate_credentials = (
670
_library.gnutls_certificate_allocate_credentials)
671
certificate_allocate_credentials.argtypes = [
672
ctypes.POINTER(certificate_credentials_t)]
673
certificate_allocate_credentials.restype = _error_code
675
certificate_free_credentials = (
676
_library.gnutls_certificate_free_credentials)
677
certificate_free_credentials.argtypes = [
678
certificate_credentials_t]
679
certificate_free_credentials.restype = None
681
handshake_set_private_extensions = (
682
_library.gnutls_handshake_set_private_extensions)
683
handshake_set_private_extensions.argtypes = [session_t,
685
handshake_set_private_extensions.restype = None
687
credentials_set = _library.gnutls_credentials_set
688
credentials_set.argtypes = [session_t, credentials_type_t,
690
credentials_set.restype = _error_code
692
strerror = _library.gnutls_strerror
693
strerror.argtypes = [ctypes.c_int]
694
strerror.restype = ctypes.c_char_p
696
certificate_type_get = _library.gnutls_certificate_type_get
697
certificate_type_get.argtypes = [session_t]
698
certificate_type_get.restype = _error_code
700
certificate_get_peers = _library.gnutls_certificate_get_peers
701
certificate_get_peers.argtypes = [session_t,
702
ctypes.POINTER(ctypes.c_uint)]
703
certificate_get_peers.restype = ctypes.POINTER(datum_t)
705
global_set_log_level = _library.gnutls_global_set_log_level
706
global_set_log_level.argtypes = [ctypes.c_int]
707
global_set_log_level.restype = None
709
global_set_log_function = _library.gnutls_global_set_log_function
710
global_set_log_function.argtypes = [log_func]
711
global_set_log_function.restype = None
713
deinit = _library.gnutls_deinit
714
deinit.argtypes = [session_t]
715
deinit.restype = None
717
handshake = _library.gnutls_handshake
718
handshake.argtypes = [session_t]
719
handshake.restype = _error_code
720
handshake.errcheck = _retry_on_error
722
transport_set_ptr = _library.gnutls_transport_set_ptr
723
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
724
transport_set_ptr.restype = None
726
bye = _library.gnutls_bye
727
bye.argtypes = [session_t, close_request_t]
728
bye.restype = _error_code
729
bye.errcheck = _retry_on_error
731
check_version = _library.gnutls_check_version
732
check_version.argtypes = [ctypes.c_char_p]
733
check_version.restype = ctypes.c_char_p
735
# All the function declarations below are from gnutls/openpgp.h
737
openpgp_crt_init = _library.gnutls_openpgp_crt_init
738
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
739
openpgp_crt_init.restype = _error_code
741
openpgp_crt_import = _library.gnutls_openpgp_crt_import
742
openpgp_crt_import.argtypes = [openpgp_crt_t,
743
ctypes.POINTER(datum_t),
745
openpgp_crt_import.restype = _error_code
747
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
748
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
749
ctypes.POINTER(ctypes.c_uint)]
750
openpgp_crt_verify_self.restype = _error_code
752
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
753
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
754
openpgp_crt_deinit.restype = None
756
openpgp_crt_get_fingerprint = (
757
_library.gnutls_openpgp_crt_get_fingerprint)
758
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
762
openpgp_crt_get_fingerprint.restype = _error_code
764
# Remove non-public functions
765
del _error_code, _retry_on_error
766
# Create the global "gnutls" object, simulating a module
438
770
def call_pipe(connection, # : multiprocessing.Connection
439
771
func, *args, **kwargs):
440
772
"""This function is meant to be called by multiprocessing.Process
442
774
This function runs func(*args, **kwargs), and writes the resulting
443
775
return value on the provided multiprocessing.Connection.
445
777
connection.send(func(*args, **kwargs))
446
778
connection.close()
448
781
class Client(object):
449
782
"""A representation of a client host served by this server.
452
785
approved: bool(); 'None' if not yet approved/disapproved
453
786
approval_delay: datetime.timedelta(); Time to wait for approval
895
1231
for cls in self.__class__.__mro__
896
1232
for name, athing in
897
1233
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1235
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1237
path_keyword='object_path',
1238
connection_keyword='connection')
1239
def Introspect(self, object_path, connection):
1240
"""Overloading of standard D-Bus method.
1242
Inserts annotation tags on methods and signals.
1244
xmlstring = dbus.service.Object.Introspect(self, object_path,
1247
document = xml.dom.minidom.parseString(xmlstring)
1249
for if_tag in document.getElementsByTagName("interface"):
1250
# Add annotation tags
1251
for typ in ("method", "signal"):
1252
for tag in if_tag.getElementsByTagName(typ):
1254
for name, prop in (self.
1255
_get_all_dbus_things(typ)):
1256
if (name == tag.getAttribute("name")
1257
and prop._dbus_interface
1258
== if_tag.getAttribute("name")):
1259
annots.update(getattr(
1260
prop, "_dbus_annotations", {}))
1261
for name, value in annots.items():
1262
ann_tag = document.createElement(
1264
ann_tag.setAttribute("name", name)
1265
ann_tag.setAttribute("value", value)
1266
tag.appendChild(ann_tag)
1267
# Add interface annotation tags
1268
for annotation, value in dict(
1269
itertools.chain.from_iterable(
1270
annotations().items()
1271
for name, annotations
1272
in self._get_all_dbus_things("interface")
1273
if name == if_tag.getAttribute("name")
1275
ann_tag = document.createElement("annotation")
1276
ann_tag.setAttribute("name", annotation)
1277
ann_tag.setAttribute("value", value)
1278
if_tag.appendChild(ann_tag)
1279
# Fix argument name for the Introspect method itself
1280
if (if_tag.getAttribute("name")
1281
== dbus.INTROSPECTABLE_IFACE):
1282
for cn in if_tag.getElementsByTagName("method"):
1283
if cn.getAttribute("name") == "Introspect":
1284
for arg in cn.getElementsByTagName("arg"):
1285
if (arg.getAttribute("direction")
1287
arg.setAttribute("name",
1289
xmlstring = document.toxml("utf-8")
1291
except (AttributeError, xml.dom.DOMException,
1292
xml.parsers.expat.ExpatError) as error:
1293
logger.error("Failed to override Introspection method",
1298
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1299
"""A D-Bus object with properties.
1301
Classes inheriting from this can use the dbus_service_property
1302
decorator to expose methods as D-Bus properties. It exposes the
1303
standard Get(), Set(), and GetAll() methods on the D-Bus.
899
1306
def _get_dbus_property(self, interface_name, property_name):
900
1307
"""Returns a bound method if one exists which is a D-Bus
901
1308
property with the specified name and interface.
1006
1423
if prop._dbus_interface
1007
1424
== if_tag.getAttribute("name")):
1008
1425
if_tag.appendChild(tag)
1009
# Add annotation tags
1010
for typ in ("method", "signal", "property"):
1011
for tag in if_tag.getElementsByTagName(typ):
1013
for name, prop in (self.
1014
_get_all_dbus_things(typ)):
1015
if (name == tag.getAttribute("name")
1016
and prop._dbus_interface
1017
== if_tag.getAttribute("name")):
1018
annots.update(getattr(
1019
prop, "_dbus_annotations", {}))
1020
for name, value in annots.items():
1021
ann_tag = document.createElement(
1023
ann_tag.setAttribute("name", name)
1024
ann_tag.setAttribute("value", value)
1025
tag.appendChild(ann_tag)
1026
# Add interface annotation tags
1027
for annotation, value in dict(
1028
itertools.chain.from_iterable(
1029
annotations().items()
1030
for name, annotations
1031
in self._get_all_dbus_things("interface")
1032
if name == if_tag.getAttribute("name")
1034
ann_tag = document.createElement("annotation")
1035
ann_tag.setAttribute("name", annotation)
1036
ann_tag.setAttribute("value", value)
1037
if_tag.appendChild(ann_tag)
1426
# Add annotation tags for properties
1427
for tag in if_tag.getElementsByTagName("property"):
1429
for name, prop in self._get_all_dbus_things(
1431
if (name == tag.getAttribute("name")
1432
and prop._dbus_interface
1433
== if_tag.getAttribute("name")):
1434
annots.update(getattr(
1435
prop, "_dbus_annotations", {}))
1436
for name, value in annots.items():
1437
ann_tag = document.createElement(
1439
ann_tag.setAttribute("name", name)
1440
ann_tag.setAttribute("value", value)
1441
tag.appendChild(ann_tag)
1038
1442
# Add the names to the return values for the
1039
1443
# "org.freedesktop.DBus.Properties" methods
1040
1444
if (if_tag.getAttribute("name")
1059
1463
return xmlstring
1467
dbus.OBJECT_MANAGER_IFACE
1468
except AttributeError:
1469
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1472
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1473
"""A D-Bus object with an ObjectManager.
1475
Classes inheriting from this exposes the standard
1476
GetManagedObjects call and the InterfacesAdded and
1477
InterfacesRemoved signals on the standard
1478
"org.freedesktop.DBus.ObjectManager" interface.
1480
Note: No signals are sent automatically; they must be sent
1483
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1484
out_signature="a{oa{sa{sv}}}")
1485
def GetManagedObjects(self):
1486
"""This function must be overridden"""
1487
raise NotImplementedError()
1489
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1490
signature="oa{sa{sv}}")
1491
def InterfacesAdded(self, object_path, interfaces_and_properties):
1494
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1495
def InterfacesRemoved(self, object_path, interfaces):
1498
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1500
path_keyword='object_path',
1501
connection_keyword='connection')
1502
def Introspect(self, object_path, connection):
1503
"""Overloading of standard D-Bus method.
1505
Override return argument name of GetManagedObjects to be
1506
"objpath_interfaces_and_properties"
1508
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1512
document = xml.dom.minidom.parseString(xmlstring)
1514
for if_tag in document.getElementsByTagName("interface"):
1515
# Fix argument name for the GetManagedObjects method
1516
if (if_tag.getAttribute("name")
1517
== dbus.OBJECT_MANAGER_IFACE):
1518
for cn in if_tag.getElementsByTagName("method"):
1519
if (cn.getAttribute("name")
1520
== "GetManagedObjects"):
1521
for arg in cn.getElementsByTagName("arg"):
1522
if (arg.getAttribute("direction")
1526
"objpath_interfaces"
1528
xmlstring = document.toxml("utf-8")
1530
except (AttributeError, xml.dom.DOMException,
1531
xml.parsers.expat.ExpatError) as error:
1532
logger.error("Failed to override Introspection method",
1062
1537
def datetime_to_dbus(dt, variant_level=0):
1063
1538
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1065
return dbus.String("", variant_level = variant_level)
1540
return dbus.String("", variant_level=variant_level)
1066
1541
return dbus.String(dt.isoformat(), variant_level=variant_level)
1720
2191
class ClientHandler(socketserver.BaseRequestHandler, object):
1721
2192
"""A class to handle client connections.
1723
2194
Instantiated once for each connection to handle it.
1724
2195
Note: This will run in its own forked process."""
1726
2197
def handle(self):
1727
2198
with contextlib.closing(self.server.child_pipe) as child_pipe:
1728
2199
logger.info("TCP connection from: %s",
1729
2200
str(self.client_address))
1730
2201
logger.debug("Pipe FD: %d",
1731
2202
self.server.child_pipe.fileno())
1733
session = gnutls.connection.ClientSession(
1734
self.request, gnutls.connection .X509Credentials())
1736
# Note: gnutls.connection.X509Credentials is really a
1737
# generic GnuTLS certificate credentials object so long as
1738
# no X.509 keys are added to it. Therefore, we can use it
1739
# here despite using OpenPGP certificates.
1741
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1742
# "+AES-256-CBC", "+SHA1",
1743
# "+COMP-NULL", "+CTYPE-OPENPGP",
2204
session = gnutls.ClientSession(self.request)
2206
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2207
# "+AES-256-CBC", "+SHA1",
2208
# "+COMP-NULL", "+CTYPE-OPENPGP",
1745
2210
# Use a fallback default, since this MUST be set.
1746
2211
priority = self.server.gnutls_priority
1747
2212
if priority is None:
1748
2213
priority = "NORMAL"
1749
gnutls.library.functions.gnutls_priority_set_direct(
1750
session._c_object, priority, None)
2214
gnutls.priority_set_direct(session._c_object,
2215
priority.encode("utf-8"),
1752
2218
# Start communication using the Mandos protocol
1753
2219
# Get protocol number
1754
2220
line = self.request.makefile().readline()
1841
2306
delay -= time2 - time
1844
while sent_size < len(client.secret):
1846
sent = session.send(client.secret[sent_size:])
1847
except gnutls.errors.GNUTLSError as error:
1848
logger.warning("gnutls send failed",
1851
logger.debug("Sent: %d, remaining: %d", sent,
1852
len(client.secret) - (sent_size
2309
session.send(client.secret)
2310
except gnutls.Error as error:
2311
logger.warning("gnutls send failed",
1856
2315
logger.info("Sending secret to %s", client.name)
1857
2316
# bump the timeout using extended_timeout
1858
2317
client.bump_timeout(client.extended_timeout)
1859
2318
if self.server.use_dbus:
1860
2319
# Emit D-Bus signal
1861
2320
client.GotSecret()
1864
2323
if approval_required:
1865
2324
client.approvals_pending -= 1
1868
except gnutls.errors.GNUTLSError as error:
2327
except gnutls.Error as error:
1869
2328
logger.warning("GnuTLS bye failed",
1870
2329
exc_info=error)
1873
2332
def peer_certificate(session):
1874
2333
"Return the peer's OpenPGP certificate as a bytestring"
1875
2334
# If not an OpenPGP certificate...
1876
if (gnutls.library.functions.gnutls_certificate_type_get(
1878
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1879
# ...do the normal thing
1880
return session.peer_certificate
2335
if (gnutls.certificate_type_get(session._c_object)
2336
!= gnutls.CRT_OPENPGP):
2337
# ...return invalid data
1881
2339
list_size = ctypes.c_uint(1)
1882
cert_list = (gnutls.library.functions
1883
.gnutls_certificate_get_peers
2340
cert_list = (gnutls.certificate_get_peers
1884
2341
(session._c_object, ctypes.byref(list_size)))
1885
2342
if not bool(cert_list) and list_size.value != 0:
1886
raise gnutls.errors.GNUTLSError("error getting peer"
2343
raise gnutls.Error("error getting peer certificate")
1888
2344
if list_size.value == 0:
1890
2346
cert = cert_list[0]
1891
2347
return ctypes.string_at(cert.data, cert.size)
1894
2350
def fingerprint(openpgp):
1895
2351
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1896
2352
# New GnuTLS "datum" with the OpenPGP public key
1897
datum = gnutls.library.types.gnutls_datum_t(
2353
datum = gnutls.datum_t(
1898
2354
ctypes.cast(ctypes.c_char_p(openpgp),
1899
2355
ctypes.POINTER(ctypes.c_ubyte)),
1900
2356
ctypes.c_uint(len(openpgp)))
1901
2357
# New empty GnuTLS certificate
1902
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1903
gnutls.library.functions.gnutls_openpgp_crt_init(
2358
crt = gnutls.openpgp_crt_t()
2359
gnutls.openpgp_crt_init(ctypes.byref(crt))
1905
2360
# Import the OpenPGP public key into the certificate
1906
gnutls.library.functions.gnutls_openpgp_crt_import(
1907
crt, ctypes.byref(datum),
1908
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2361
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2362
gnutls.OPENPGP_FMT_RAW)
1909
2363
# Verify the self signature in the key
1910
2364
crtverify = ctypes.c_uint()
1911
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1912
crt, 0, ctypes.byref(crtverify))
2365
gnutls.openpgp_crt_verify_self(crt, 0,
2366
ctypes.byref(crtverify))
1913
2367
if crtverify.value != 0:
1914
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1915
raise gnutls.errors.CertificateSecurityError(
2368
gnutls.openpgp_crt_deinit(crt)
2369
raise gnutls.CertificateSecurityError("Verify failed")
1917
2370
# New buffer for the fingerprint
1918
2371
buf = ctypes.create_string_buffer(20)
1919
2372
buf_len = ctypes.c_size_t()
1920
2373
# Get the fingerprint from the certificate into the buffer
1921
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1922
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2374
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2375
ctypes.byref(buf_len))
1923
2376
# Deinit the certificate
1924
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2377
gnutls.openpgp_crt_deinit(crt)
1925
2378
# Convert the buffer to a Python bytestring
1926
2379
fpr = ctypes.string_at(buf, buf_len.value)
1927
2380
# Convert the bytestring to hexadecimal notation
2015
2469
# socket_wrapper(), if socketfd was set.
2016
2470
socketserver.TCPServer.__init__(self, server_address,
2017
2471
RequestHandlerClass)
2019
2473
def server_bind(self):
2020
2474
"""This overrides the normal server_bind() function
2021
2475
to bind to an interface if one was specified, and also NOT to
2022
2476
bind to an address or port if they were not specified."""
2477
global SO_BINDTODEVICE
2023
2478
if self.interface is not None:
2024
2479
if SO_BINDTODEVICE is None:
2025
logger.error("SO_BINDTODEVICE does not exist;"
2026
" cannot bind to interface %s",
2030
self.socket.setsockopt(
2031
socket.SOL_SOCKET, SO_BINDTODEVICE,
2032
(self.interface + "\0").encode("utf-8"))
2033
except socket.error as error:
2034
if error.errno == errno.EPERM:
2035
logger.error("No permission to bind to"
2036
" interface %s", self.interface)
2037
elif error.errno == errno.ENOPROTOOPT:
2038
logger.error("SO_BINDTODEVICE not available;"
2039
" cannot bind to interface %s",
2041
elif error.errno == errno.ENODEV:
2042
logger.error("Interface %s does not exist,"
2043
" cannot bind", self.interface)
2480
# Fall back to a hard-coded value which seems to be
2482
logger.warning("SO_BINDTODEVICE not found, trying 25")
2483
SO_BINDTODEVICE = 25
2485
self.socket.setsockopt(
2486
socket.SOL_SOCKET, SO_BINDTODEVICE,
2487
(self.interface + "\0").encode("utf-8"))
2488
except socket.error as error:
2489
if error.errno == errno.EPERM:
2490
logger.error("No permission to bind to"
2491
" interface %s", self.interface)
2492
elif error.errno == errno.ENOPROTOOPT:
2493
logger.error("SO_BINDTODEVICE not available;"
2494
" cannot bind to interface %s",
2496
elif error.errno == errno.ENODEV:
2497
logger.error("Interface %s does not exist,"
2498
" cannot bind", self.interface)
2046
2501
# Only bind(2) the socket if we really need to.
2047
2502
if self.server_address[0] or self.server_address[1]:
2048
2503
if not self.server_address[0]:
2049
2504
if self.address_family == socket.AF_INET6:
2050
any_address = "::" # in6addr_any
2505
any_address = "::" # in6addr_any
2052
any_address = "0.0.0.0" # INADDR_ANY
2507
any_address = "0.0.0.0" # INADDR_ANY
2053
2508
self.server_address = (any_address,
2054
2509
self.server_address[1])
2055
2510
elif not self.server_address[1]:
2600
3065
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2601
3066
service = AvahiServiceToSyslog(
2602
name = server_settings["servicename"],
2603
servicetype = "_mandos._tcp",
2604
protocol = protocol,
3067
name=server_settings["servicename"],
3068
servicetype="_mandos._tcp",
2606
3071
if server_settings["interface"]:
2607
3072
service.interface = if_nametoindex(
2608
3073
server_settings["interface"].encode("utf-8"))
2610
3075
global multiprocessing_manager
2611
3076
multiprocessing_manager = multiprocessing.Manager()
2613
3078
client_class = Client
2615
client_class = functools.partial(ClientDBus, bus = bus)
3080
client_class = functools.partial(ClientDBus, bus=bus)
2617
3082
client_settings = Client.config_parser(client_config)
2618
3083
old_client_settings = {}
2619
3084
clients_data = {}
2621
3086
# This is used to redirect stdout and stderr for checker processes
2623
wnull = open(os.devnull, "w") # A writable /dev/null
3088
wnull = open(os.devnull, "w") # A writable /dev/null
2624
3089
# Only used if server is running in foreground but not in debug
2626
3091
if debug or not foreground:
2629
3094
# Get client data and settings from last running state.
2630
3095
if server_settings["restore"]:
2632
3097
with open(stored_state_path, "rb") as stored_state:
2633
clients_data, old_client_settings = pickle.load(
3098
if sys.version_info.major == 2:
3099
clients_data, old_client_settings = pickle.load(
3102
bytes_clients_data, bytes_old_client_settings = (
3103
pickle.load(stored_state, encoding="bytes"))
3104
# Fix bytes to strings
3107
clients_data = {(key.decode("utf-8")
3108
if isinstance(key, bytes)
3111
bytes_clients_data.items()}
3112
del bytes_clients_data
3113
for key in clients_data:
3114
value = {(k.decode("utf-8")
3115
if isinstance(k, bytes) else k): v
3117
clients_data[key].items()}
3118
clients_data[key] = value
3120
value["client_structure"] = [
3122
if isinstance(s, bytes)
3124
value["client_structure"]]
3126
for k in ("name", "host"):
3127
if isinstance(value[k], bytes):
3128
value[k] = value[k].decode("utf-8")
3129
# old_client_settings
3131
old_client_settings = {
3132
(key.decode("utf-8")
3133
if isinstance(key, bytes)
3136
bytes_old_client_settings.items()}
3137
del bytes_old_client_settings
3139
for value in old_client_settings.values():
3140
if isinstance(value["host"], bytes):
3141
value["host"] = (value["host"]
2635
3143
os.remove(stored_state_path)
2636
3144
except IOError as e:
2637
3145
if e.errno == errno.ENOENT:
2737
3245
pidfilename, pid)
2739
3247
del pidfilename
2741
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2742
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3249
for termsig in (signal.SIGHUP, signal.SIGTERM):
3250
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3251
lambda: main_loop.quit() and False)
2746
3255
@alternate_dbus_interfaces(
2747
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2748
class MandosDBusService(DBusObjectWithProperties):
3256
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3257
class MandosDBusService(DBusObjectWithObjectManager):
2749
3258
"""A D-Bus proxy object"""
2751
3260
def __init__(self):
2752
3261
dbus.service.Object.__init__(self, bus, "/")
2754
3263
_interface = "se.recompile.Mandos"
2756
@dbus_interface_annotations(_interface)
2759
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2762
3265
@dbus.service.signal(_interface, signature="o")
2763
3266
def ClientAdded(self, objpath):
2767
3270
@dbus.service.signal(_interface, signature="ss")
2768
3271
def ClientNotFound(self, fingerprint, address):
3275
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2772
3277
@dbus.service.signal(_interface, signature="os")
2773
3278
def ClientRemoved(self, objpath, name):
3282
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2777
3284
@dbus.service.method(_interface, out_signature="ao")
2778
3285
def GetAllClients(self):
2780
3287
return dbus.Array(c.dbus_object_path for c in
2781
tcp_server.clients.itervalues())
3288
tcp_server.clients.values())
3290
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2783
3292
@dbus.service.method(_interface,
2784
3293
out_signature="a{oa{sv}}")
2785
3294
def GetAllClientsWithProperties(self):
2787
3296
return dbus.Dictionary(
2788
{ c.dbus_object_path: c.GetAll("")
2789
for c in tcp_server.clients.itervalues() },
3297
{c.dbus_object_path: c.GetAll(
3298
"se.recompile.Mandos.Client")
3299
for c in tcp_server.clients.values()},
2790
3300
signature="oa{sv}")
2792
3302
@dbus.service.method(_interface, in_signature="o")
2793
3303
def RemoveClient(self, object_path):
2795
for c in tcp_server.clients.itervalues():
3305
for c in tcp_server.clients.values():
2796
3306
if c.dbus_object_path == object_path:
2797
3307
del tcp_server.clients[c.name]
2798
3308
c.remove_from_connection()
2799
# Don't signal anything except ClientRemoved
3309
# Don't signal the disabling
2800
3310
c.disable(quiet=True)
2802
self.ClientRemoved(object_path, c.name)
3311
# Emit D-Bus signal for removal
3312
self.client_removed_signal(c)
2804
3314
raise KeyError(object_path)
3318
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3319
out_signature="a{oa{sa{sv}}}")
3320
def GetManagedObjects(self):
3322
return dbus.Dictionary(
3323
{client.dbus_object_path:
3325
{interface: client.GetAll(interface)
3327
client._get_all_interface_names()})
3328
for client in tcp_server.clients.values()})
3330
def client_added_signal(self, client):
3331
"""Send the new standard signal and the old signal"""
3333
# New standard signal
3334
self.InterfacesAdded(
3335
client.dbus_object_path,
3337
{interface: client.GetAll(interface)
3339
client._get_all_interface_names()}))
3341
self.ClientAdded(client.dbus_object_path)
3343
def client_removed_signal(self, client):
3344
"""Send the new standard signal and the old signal"""
3346
# New standard signal
3347
self.InterfacesRemoved(
3348
client.dbus_object_path,
3349
client._get_all_interface_names())
3351
self.ClientRemoved(client.dbus_object_path,
2808
3354
mandos_dbus_service = MandosDBusService()
3356
# Save modules to variables to exempt the modules from being
3357
# unloaded before the function registered with atexit() is run.
3358
mp = multiprocessing
2811
3362
"Cleanup function; run on exit"
2813
3364
service.cleanup()
2815
multiprocessing.active_children()
3366
mp.active_children()
2817
3368
if not (tcp_server.clients or client_settings):
2820
3371
# Store client before exiting. Secrets are encrypted with key
2821
3372
# based on what config file has. If config file is
2822
3373
# removed/edited, old secret will thus be unrecovable.
2824
3375
with PGPEngine() as pgp:
2825
for client in tcp_server.clients.itervalues():
3376
for client in tcp_server.clients.values():
2826
3377
key = client_settings[client.name]["secret"]
2827
3378
client.encrypted_secret = pgp.encrypt(client.secret,
2829
3380
client_dict = {}
2831
3382
# A list of attributes that can not be pickled
2833
exclude = { "bus", "changedstate", "secret",
2834
"checker", "server_settings" }
3384
exclude = {"bus", "changedstate", "secret",
3385
"checker", "server_settings"}
2835
3386
for name, typ in inspect.getmembers(dbus.service
2837
3388
exclude.add(name)
2839
3390
client_dict["encrypted_secret"] = (client
2840
3391
.encrypted_secret)
2841
3392
for attr in client.client_structure:
2842
3393
if attr not in exclude:
2843
3394
client_dict[attr] = getattr(client, attr)
2845
3396
clients[client.name] = client_dict
2846
3397
del client_settings[client.name]["secret"]
2849
3400
with tempfile.NamedTemporaryFile(