2
2
# -*- mode: python; coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
# Copyright © 2008-2016 Teddy Hogeborn
15
# Copyright © 2008-2016 Björn Påhlsson
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
14
# Copyright © 2008-2018 Teddy Hogeborn
15
# Copyright © 2008-2018 Björn Påhlsson
17
# This file is part of Mandos.
19
# Mandos is free software: you can redistribute it and/or modify it
20
# under the terms of the GNU General Public License as published by
19
21
# the Free Software Foundation, either version 3 of the License, or
20
22
# (at your option) any later version.
22
# This program is distributed in the hope that it will be useful,
23
# but WITHOUT ANY WARRANTY; without even the implied warranty of
24
# Mandos is distributed in the hope that it will be useful, but
25
# WITHOUT ANY WARRANTY; without even the implied warranty of
24
26
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
25
27
# GNU General Public License for more details.
27
29
# You should have received a copy of the GNU General Public License
28
# along with this program. If not, see
29
# <http://www.gnu.org/licenses/>.
30
# along with Mandos. If not, see <http://www.gnu.org/licenses/>.
31
32
# Contact the authors at <mandos@recompile.se>.
34
35
from __future__ import (division, absolute_import, print_function,
230
247
'--passphrase-file',
232
249
+ self.gnupgargs,
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
ciphertext, err = proc.communicate(input = data)
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
237
254
if proc.returncode != 0:
238
255
raise PGPError(err)
239
256
return ciphertext
241
258
def decrypt(self, data, password):
242
259
passphrase = self.password_encode(password)
243
260
with tempfile.NamedTemporaryFile(
244
dir = self.tempdir) as passfile:
261
dir=self.tempdir) as passfile:
245
262
passfile.write(passphrase)
247
264
proc = subprocess.Popen([self.gpg, '--decrypt',
248
265
'--passphrase-file',
250
267
+ self.gnupgargs,
251
stdin = subprocess.PIPE,
252
stdout = subprocess.PIPE,
253
stderr = subprocess.PIPE)
254
decrypted_plaintext, err = proc.communicate(input = data)
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
255
272
if proc.returncode != 0:
256
273
raise PGPError(err)
257
274
return decrypted_plaintext
259
277
# Pretend that we have an Avahi module
260
278
class Avahi(object):
261
279
"""This isn't so much a class as it is a module-like namespace.
262
280
It is instantiated once, and simulates having an Avahi module."""
263
IF_UNSPEC = -1 # avahi-common/address.h
264
PROTO_UNSPEC = -1 # avahi-common/address.h
265
PROTO_INET = 0 # avahi-common/address.h
266
PROTO_INET6 = 1 # avahi-common/address.h
281
IF_UNSPEC = -1 # avahi-common/address.h
282
PROTO_UNSPEC = -1 # avahi-common/address.h
283
PROTO_INET = 0 # avahi-common/address.h
284
PROTO_INET6 = 1 # avahi-common/address.h
267
285
DBUS_NAME = "org.freedesktop.Avahi"
268
286
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
269
287
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
270
288
DBUS_PATH_SERVER = "/"
271
290
def string_array_to_txt_array(self, t):
272
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
273
292
for s in t), signature="ay")
274
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
275
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
276
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
277
SERVER_INVALID = 0 # avahi-common/defs.h
278
SERVER_REGISTERING = 1 # avahi-common/defs.h
279
SERVER_RUNNING = 2 # avahi-common/defs.h
280
SERVER_COLLISION = 3 # avahi-common/defs.h
281
SERVER_FAILURE = 4 # avahi-common/defs.h
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
284
304
class AvahiError(Exception):
285
305
def __init__(self, value, *args, **kwargs):
286
306
self.value = value
476
496
class AvahiServiceToSyslog(AvahiService):
477
497
def rename(self, *args, **kwargs):
478
498
"""Add the new name to the syslog messages"""
479
ret = AvahiService.rename(self, *args, **kwargs)
499
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
480
500
syslogger.setFormatter(logging.Formatter(
481
501
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
482
502
.format(self.name)))
485
506
# Pretend that we have a GnuTLS module
486
507
class GnuTLS(object):
487
508
"""This isn't so much a class as it is a module-like namespace.
488
509
It is instantiated once, and simulates having a GnuTLS module."""
490
_library = ctypes.cdll.LoadLibrary(
491
ctypes.util.find_library("gnutls"))
511
library = ctypes.util.find_library("gnutls")
513
library = ctypes.util.find_library("gnutls-deb0")
514
_library = ctypes.cdll.LoadLibrary(library)
492
516
_need_version = b"3.3.0"
517
_tls_rawpk_version = b"3.6.6"
493
519
def __init__(self):
494
# Need to use class name "GnuTLS" here, since this method is
495
# called before the assignment to the "gnutls" global variable
497
if GnuTLS.check_version(self._need_version) is None:
498
raise GnuTLS.Error("Needs GnuTLS {} or later"
499
.format(self._need_version))
520
# Need to use "self" here, since this method is called before
521
# the assignment to the "gnutls" global variable happens.
522
if self.check_version(self._need_version) is None:
523
raise self.Error("Needs GnuTLS {} or later"
524
.format(self._need_version))
501
526
# Unless otherwise indicated, the constants and types below are
502
527
# all from the gnutls/gnutls.h C header file.
506
531
E_INTERRUPTED = -52
511
537
CRD_CERTIFICATE = 1
512
538
E_NO_CERTIFICATE_FOUND = -49
543
KEYID_USE_SHA256 = 1 # gnutls/x509.h
513
544
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
516
547
class session_int(ctypes.Structure):
518
549
session_t = ctypes.POINTER(session_int)
519
551
class certificate_credentials_st(ctypes.Structure):
521
553
certificate_credentials_t = ctypes.POINTER(
522
554
certificate_credentials_st)
523
555
certificate_type_t = ctypes.c_int
524
557
class datum_t(ctypes.Structure):
525
558
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
526
559
('size', ctypes.c_uint)]
527
561
class openpgp_crt_int(ctypes.Structure):
529
563
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
530
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
564
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
531
565
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
532
566
credentials_type_t = ctypes.c_int
533
567
transport_ptr_t = ctypes.c_void_p
534
568
close_request_t = ctypes.c_int
537
571
class Error(Exception):
538
572
# We need to use the class name "GnuTLS" here, since this
539
573
# exception might be raised from within GnuTLS.__init__,
540
574
# which is called before the assignment to the "gnutls"
541
575
# global variable has happened.
542
def __init__(self, message = None, code = None, args=()):
576
def __init__(self, message=None, code=None, args=()):
543
577
# Default usage is by a message string, but if a return
544
578
# code is passed, convert it to a string with
545
579
# gnutls.strerror()
614
654
return _error_code(result)
615
655
result = func(*arguments)
618
658
# Unless otherwise indicated, the function declarations below are
619
659
# all from the gnutls/gnutls.h C header file.
622
662
priority_set_direct = _library.gnutls_priority_set_direct
623
663
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
624
664
ctypes.POINTER(ctypes.c_char_p)]
625
665
priority_set_direct.restype = _error_code
627
667
init = _library.gnutls_init
628
668
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
629
669
init.restype = _error_code
631
671
set_default_priority = _library.gnutls_set_default_priority
632
672
set_default_priority.argtypes = [session_t]
633
673
set_default_priority.restype = _error_code
635
675
record_send = _library.gnutls_record_send
636
676
record_send.argtypes = [session_t, ctypes.c_void_p,
638
678
record_send.restype = ctypes.c_ssize_t
639
679
record_send.errcheck = _retry_on_error
641
681
certificate_allocate_credentials = (
642
682
_library.gnutls_certificate_allocate_credentials)
643
683
certificate_allocate_credentials.argtypes = [
644
684
ctypes.POINTER(certificate_credentials_t)]
645
685
certificate_allocate_credentials.restype = _error_code
647
687
certificate_free_credentials = (
648
688
_library.gnutls_certificate_free_credentials)
649
certificate_free_credentials.argtypes = [certificate_credentials_t]
689
certificate_free_credentials.argtypes = [
690
certificate_credentials_t]
650
691
certificate_free_credentials.restype = None
652
693
handshake_set_private_extensions = (
653
694
_library.gnutls_handshake_set_private_extensions)
654
695
handshake_set_private_extensions.argtypes = [session_t,
656
697
handshake_set_private_extensions.restype = None
658
699
credentials_set = _library.gnutls_credentials_set
659
700
credentials_set.argtypes = [session_t, credentials_type_t,
661
702
credentials_set.restype = _error_code
663
704
strerror = _library.gnutls_strerror
664
705
strerror.argtypes = [ctypes.c_int]
665
706
strerror.restype = ctypes.c_char_p
667
708
certificate_type_get = _library.gnutls_certificate_type_get
668
709
certificate_type_get.argtypes = [session_t]
669
710
certificate_type_get.restype = _error_code
671
712
certificate_get_peers = _library.gnutls_certificate_get_peers
672
713
certificate_get_peers.argtypes = [session_t,
673
714
ctypes.POINTER(ctypes.c_uint)]
674
715
certificate_get_peers.restype = ctypes.POINTER(datum_t)
676
717
global_set_log_level = _library.gnutls_global_set_log_level
677
718
global_set_log_level.argtypes = [ctypes.c_int]
678
719
global_set_log_level.restype = None
680
721
global_set_log_function = _library.gnutls_global_set_log_function
681
722
global_set_log_function.argtypes = [log_func]
682
723
global_set_log_function.restype = None
684
725
deinit = _library.gnutls_deinit
685
726
deinit.argtypes = [session_t]
686
727
deinit.restype = None
688
729
handshake = _library.gnutls_handshake
689
730
handshake.argtypes = [session_t]
690
731
handshake.restype = _error_code
691
732
handshake.errcheck = _retry_on_error
693
734
transport_set_ptr = _library.gnutls_transport_set_ptr
694
735
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
695
736
transport_set_ptr.restype = None
697
738
bye = _library.gnutls_bye
698
739
bye.argtypes = [session_t, close_request_t]
699
740
bye.restype = _error_code
700
741
bye.errcheck = _retry_on_error
702
743
check_version = _library.gnutls_check_version
703
744
check_version.argtypes = [ctypes.c_char_p]
704
745
check_version.restype = ctypes.c_char_p
706
# All the function declarations below are from gnutls/openpgp.h
708
openpgp_crt_init = _library.gnutls_openpgp_crt_init
709
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
710
openpgp_crt_init.restype = _error_code
712
openpgp_crt_import = _library.gnutls_openpgp_crt_import
713
openpgp_crt_import.argtypes = [openpgp_crt_t,
714
ctypes.POINTER(datum_t),
716
openpgp_crt_import.restype = _error_code
718
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
719
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
720
ctypes.POINTER(ctypes.c_uint)]
721
openpgp_crt_verify_self.restype = _error_code
723
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
724
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
725
openpgp_crt_deinit.restype = None
727
openpgp_crt_get_fingerprint = (
728
_library.gnutls_openpgp_crt_get_fingerprint)
729
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
733
openpgp_crt_get_fingerprint.restype = _error_code
747
has_rawpk = bool(check_version(_tls_rawpk_version))
751
class pubkey_st(ctypes.Structure):
753
pubkey_t = ctypes.POINTER(pubkey_st)
755
x509_crt_fmt_t = ctypes.c_int
757
# All the function declarations below are from gnutls/abstract.h
758
pubkey_init = _library.gnutls_pubkey_init
759
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
760
pubkey_init.restype = _error_code
762
pubkey_import = _library.gnutls_pubkey_import
763
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
765
pubkey_import.restype = _error_code
767
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
768
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
769
ctypes.POINTER(ctypes.c_ubyte),
770
ctypes.POINTER(ctypes.c_size_t)]
771
pubkey_get_key_id.restype = _error_code
773
pubkey_deinit = _library.gnutls_pubkey_deinit
774
pubkey_deinit.argtypes = [pubkey_t]
775
pubkey_deinit.restype = None
777
# All the function declarations below are from gnutls/openpgp.h
779
openpgp_crt_init = _library.gnutls_openpgp_crt_init
780
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
781
openpgp_crt_init.restype = _error_code
783
openpgp_crt_import = _library.gnutls_openpgp_crt_import
784
openpgp_crt_import.argtypes = [openpgp_crt_t,
785
ctypes.POINTER(datum_t),
787
openpgp_crt_import.restype = _error_code
789
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
790
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
791
ctypes.POINTER(ctypes.c_uint)]
792
openpgp_crt_verify_self.restype = _error_code
794
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
795
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
796
openpgp_crt_deinit.restype = None
798
openpgp_crt_get_fingerprint = (
799
_library.gnutls_openpgp_crt_get_fingerprint)
800
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
804
openpgp_crt_get_fingerprint.restype = _error_code
806
if check_version("3.6.4"):
807
certificate_type_get2 = _library.gnutls_certificate_type_get2
808
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
809
certificate_type_get2.restype = _error_code
735
811
# Remove non-public functions
736
812
del _error_code, _retry_on_error
737
813
# Create the global "gnutls" object, simulating a module
738
814
gnutls = GnuTLS()
740
817
def call_pipe(connection, # : multiprocessing.Connection
741
818
func, *args, **kwargs):
742
819
"""This function is meant to be called by multiprocessing.Process
744
821
This function runs func(*args, **kwargs), and writes the resulting
745
822
return value on the provided multiprocessing.Connection.
747
824
connection.send(func(*args, **kwargs))
748
825
connection.close()
750
828
class Client(object):
751
829
"""A representation of a client host served by this server.
754
832
approved: bool(); 'None' if not yet approved/disapproved
755
833
approval_delay: datetime.timedelta(); Time to wait for approval
757
835
checker: subprocess.Popen(); a running checker process used
758
836
to see if the client lives.
759
837
'None' if no process is running.
760
checker_callback_tag: a GObject event source tag, or None
838
checker_callback_tag: a GLib event source tag, or None
761
839
checker_command: string; External command which is run to check
762
840
if client lives. %() expansions are done at
763
841
runtime with vars(self) as dict, so that for
764
842
instance %(name)s can be used in the command.
765
checker_initiator_tag: a GObject event source tag, or None
843
checker_initiator_tag: a GLib event source tag, or None
766
844
created: datetime.datetime(); (UTC) object creation
767
845
client_structure: Object describing what attributes a client has
768
846
and is used for storing the client at exit
769
847
current_checker_command: string; current running checker_command
770
disable_initiator_tag: a GObject event source tag, or None
848
disable_initiator_tag: a GLib event source tag, or None
772
850
fingerprint: string (40 or 32 hexadecimal digits); used to
773
uniquely identify the client
851
uniquely identify an OpenPGP client
852
key_id: string (64 hexadecimal digits); used to uniquely identify
853
a client using raw public keys
774
854
host: string; available for use by the checker command
775
855
interval: datetime.timedelta(); How often to start a new checker
776
856
last_approval_request: datetime.datetime(); (UTC) or None
930
1013
logger.info("Disabling client %s", self.name)
931
1014
if getattr(self, "disable_initiator_tag", None) is not None:
932
GObject.source_remove(self.disable_initiator_tag)
1015
GLib.source_remove(self.disable_initiator_tag)
933
1016
self.disable_initiator_tag = None
934
1017
self.expires = None
935
1018
if getattr(self, "checker_initiator_tag", None) is not None:
936
GObject.source_remove(self.checker_initiator_tag)
1019
GLib.source_remove(self.checker_initiator_tag)
937
1020
self.checker_initiator_tag = None
938
1021
self.stop_checker()
939
1022
self.enabled = False
941
1024
self.send_changedstate()
942
# Do not run this again if called by a GObject.timeout_add
1025
# Do not run this again if called by a GLib.timeout_add
945
1028
def __del__(self):
948
1031
def init_checker(self):
949
1032
# Schedule a new checker to be started an 'interval' from now,
950
1033
# and every interval from then on.
951
1034
if self.checker_initiator_tag is not None:
952
GObject.source_remove(self.checker_initiator_tag)
953
self.checker_initiator_tag = GObject.timeout_add(
1035
GLib.source_remove(self.checker_initiator_tag)
1036
self.checker_initiator_tag = GLib.timeout_add(
954
1037
int(self.interval.total_seconds() * 1000),
955
1038
self.start_checker)
956
1039
# Schedule a disable() when 'timeout' has passed
957
1040
if self.disable_initiator_tag is not None:
958
GObject.source_remove(self.disable_initiator_tag)
959
self.disable_initiator_tag = GObject.timeout_add(
1041
GLib.source_remove(self.disable_initiator_tag)
1042
self.disable_initiator_tag = GLib.timeout_add(
960
1043
int(self.timeout.total_seconds() * 1000), self.disable)
961
1044
# Also start a new checker *right now*.
962
1045
self.start_checker()
964
1047
def checker_callback(self, source, condition, connection,
966
1049
"""The checker has completed, so take appropriate actions."""
1049
1132
# The exception is when not debugging but nevertheless
1050
1133
# running in the foreground; use the previously
1051
1134
# created wnull.
1052
popen_args = { "close_fds": True,
1135
popen_args = {"close_fds": True,
1055
1138
if (not self.server_settings["debug"]
1056
1139
and self.server_settings["foreground"]):
1057
1140
popen_args.update({"stdout": wnull,
1059
pipe = multiprocessing.Pipe(duplex = False)
1142
pipe = multiprocessing.Pipe(duplex=False)
1060
1143
self.checker = multiprocessing.Process(
1062
args = (pipe[1], subprocess.call, command),
1063
kwargs = popen_args)
1145
args=(pipe[1], subprocess.call, command),
1064
1147
self.checker.start()
1065
self.checker_callback_tag = GObject.io_add_watch(
1066
pipe[0].fileno(), GObject.IO_IN,
1148
self.checker_callback_tag = GLib.io_add_watch(
1149
pipe[0].fileno(), GLib.IO_IN,
1067
1150
self.checker_callback, pipe[0], command)
1068
# Re-run this periodically if run by GObject.timeout_add
1151
# Re-run this periodically if run by GLib.timeout_add
1071
1154
def stop_checker(self):
1072
1155
"""Force the checker process, if any, to stop."""
1073
1156
if self.checker_callback_tag:
1074
GObject.source_remove(self.checker_callback_tag)
1157
GLib.source_remove(self.checker_callback_tag)
1075
1158
self.checker_callback_tag = None
1076
1159
if getattr(self, "checker", None) is None:
1431
1514
exc_info=error)
1432
1515
return xmlstring
1435
1519
dbus.OBJECT_MANAGER_IFACE
1436
1520
except AttributeError:
1437
1521
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1439
1524
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1440
1525
"""A D-Bus object with an ObjectManager.
1442
1527
Classes inheriting from this exposes the standard
1443
1528
GetManagedObjects call and the InterfacesAdded and
1444
1529
InterfacesRemoved signals on the standard
1445
1530
"org.freedesktop.DBus.ObjectManager" interface.
1447
1532
Note: No signals are sent automatically; they must be sent
1450
1535
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1451
out_signature = "a{oa{sa{sv}}}")
1536
out_signature="a{oa{sa{sv}}}")
1452
1537
def GetManagedObjects(self):
1453
1538
"""This function must be overridden"""
1454
1539
raise NotImplementedError()
1456
1541
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1457
signature = "oa{sa{sv}}")
1542
signature="oa{sa{sv}}")
1458
1543
def InterfacesAdded(self, object_path, interfaces_and_properties):
1461
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1546
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1462
1547
def InterfacesRemoved(self, object_path, interfaces):
1465
1550
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1466
out_signature = "s",
1467
path_keyword = 'object_path',
1468
connection_keyword = 'connection')
1552
path_keyword='object_path',
1553
connection_keyword='connection')
1469
1554
def Introspect(self, object_path, connection):
1470
1555
"""Overloading of standard D-Bus method.
1472
1557
Override return argument name of GetManagedObjects to be
1473
1558
"objpath_interfaces_and_properties"
1765
1853
"ApprovedByDefault")
1766
1854
approval_delay = notifychangeproperty(
1767
1855
dbus.UInt64, "ApprovalDelay",
1768
type_func = lambda td: td.total_seconds() * 1000)
1856
type_func=lambda td: td.total_seconds() * 1000)
1769
1857
approval_duration = notifychangeproperty(
1770
1858
dbus.UInt64, "ApprovalDuration",
1771
type_func = lambda td: td.total_seconds() * 1000)
1859
type_func=lambda td: td.total_seconds() * 1000)
1772
1860
host = notifychangeproperty(dbus.String, "Host")
1773
1861
timeout = notifychangeproperty(
1774
1862
dbus.UInt64, "Timeout",
1775
type_func = lambda td: td.total_seconds() * 1000)
1863
type_func=lambda td: td.total_seconds() * 1000)
1776
1864
extended_timeout = notifychangeproperty(
1777
1865
dbus.UInt64, "ExtendedTimeout",
1778
type_func = lambda td: td.total_seconds() * 1000)
1866
type_func=lambda td: td.total_seconds() * 1000)
1779
1867
interval = notifychangeproperty(
1780
1868
dbus.UInt64, "Interval",
1781
type_func = lambda td: td.total_seconds() * 1000)
1869
type_func=lambda td: td.total_seconds() * 1000)
1782
1870
checker_command = notifychangeproperty(dbus.String, "Checker")
1783
1871
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1784
1872
invalidate_only=True)
1786
1874
del notifychangeproperty
1788
1876
def __del__(self, *args, **kwargs):
1790
1878
self.remove_from_connection()
2155
2250
class ClientHandler(socketserver.BaseRequestHandler, object):
2156
2251
"""A class to handle client connections.
2158
2253
Instantiated once for each connection to handle it.
2159
2254
Note: This will run in its own forked process."""
2161
2256
def handle(self):
2162
2257
with contextlib.closing(self.server.child_pipe) as child_pipe:
2163
2258
logger.info("TCP connection from: %s",
2164
2259
str(self.client_address))
2165
2260
logger.debug("Pipe FD: %d",
2166
2261
self.server.child_pipe.fileno())
2168
2263
session = gnutls.ClientSession(self.request)
2170
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2171
# "+AES-256-CBC", "+SHA1",
2172
# "+COMP-NULL", "+CTYPE-OPENPGP",
2265
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2266
# "+AES-256-CBC", "+SHA1",
2267
# "+COMP-NULL", "+CTYPE-OPENPGP",
2174
2269
# Use a fallback default, since this MUST be set.
2175
2270
priority = self.server.gnutls_priority
2176
2271
if priority is None:
2177
2272
priority = "NORMAL"
2178
gnutls.priority_set_direct(session._c_object, priority,
2273
gnutls.priority_set_direct(session._c_object,
2274
priority.encode("utf-8"),
2181
2277
# Start communication using the Mandos protocol
2182
2278
# Get protocol number
2183
2279
line = self.request.makefile().readline()
2309
2427
cert = cert_list[0]
2310
2428
return ctypes.string_at(cert.data, cert.size)
2431
def key_id(certificate):
2432
"Convert a certificate bytestring to a hexdigit key ID"
2433
# New GnuTLS "datum" with the public key
2434
datum = gnutls.datum_t(
2435
ctypes.cast(ctypes.c_char_p(certificate),
2436
ctypes.POINTER(ctypes.c_ubyte)),
2437
ctypes.c_uint(len(certificate)))
2438
# XXX all these need to be created in the gnutls "module"
2439
# New empty GnuTLS certificate
2440
pubkey = gnutls.pubkey_t()
2441
gnutls.pubkey_init(ctypes.byref(pubkey))
2442
# Import the raw public key into the certificate
2443
gnutls.pubkey_import(pubkey,
2444
ctypes.byref(datum),
2445
gnutls.X509_FMT_DER)
2446
# New buffer for the key ID
2447
buf = ctypes.create_string_buffer(32)
2448
buf_len = ctypes.c_size_t(len(buf))
2449
# Get the key ID from the raw public key into the buffer
2450
gnutls.pubkey_get_key_id(pubkey,
2451
gnutls.KEYID_USE_SHA256,
2452
ctypes.cast(ctypes.byref(buf),
2453
ctypes.POINTER(ctypes.c_ubyte)),
2454
ctypes.byref(buf_len))
2455
# Deinit the certificate
2456
gnutls.pubkey_deinit(pubkey)
2458
# Convert the buffer to a Python bytestring
2459
key_id = ctypes.string_at(buf, buf_len.value)
2460
# Convert the bytestring to hexadecimal notation
2461
hex_key_id = binascii.hexlify(key_id).upper()
2313
2465
def fingerprint(openpgp):
2314
2466
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2348
2501
class MultiprocessingMixIn(object):
2349
2502
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2351
2504
def sub_process_main(self, request, address):
2353
2506
self.finish_request(request, address)
2354
2507
except Exception:
2355
2508
self.handle_error(request, address)
2356
2509
self.close_request(request)
2358
2511
def process_request(self, request, address):
2359
2512
"""Start a new process to process the request."""
2360
proc = multiprocessing.Process(target = self.sub_process_main,
2361
args = (request, address))
2513
proc = multiprocessing.Process(target=self.sub_process_main,
2514
args=(request, address))
2366
2519
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2367
2520
""" adds a pipe to the MixIn """
2369
2522
def process_request(self, request, client_address):
2370
2523
"""Overrides and wraps the original process_request().
2372
2525
This function creates a new pipe in self.pipe
2374
2527
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2376
2529
proc = MultiprocessingMixIn.process_request(self, request,
2377
2530
client_address)
2378
2531
self.child_pipe.close()
2379
2532
self.add_pipe(parent_pipe, proc)
2381
2534
def add_pipe(self, parent_pipe, proc):
2382
2535
"""Dummy function; override as necessary"""
2383
2536
raise NotImplementedError()
2431
2585
# socket_wrapper(), if socketfd was set.
2432
2586
socketserver.TCPServer.__init__(self, server_address,
2433
2587
RequestHandlerClass)
2435
2589
def server_bind(self):
2436
2590
"""This overrides the normal server_bind() function
2437
2591
to bind to an interface if one was specified, and also NOT to
2438
2592
bind to an address or port if they were not specified."""
2593
global SO_BINDTODEVICE
2439
2594
if self.interface is not None:
2440
2595
if SO_BINDTODEVICE is None:
2441
logger.error("SO_BINDTODEVICE does not exist;"
2442
" cannot bind to interface %s",
2446
self.socket.setsockopt(
2447
socket.SOL_SOCKET, SO_BINDTODEVICE,
2448
(self.interface + "\0").encode("utf-8"))
2449
except socket.error as error:
2450
if error.errno == errno.EPERM:
2451
logger.error("No permission to bind to"
2452
" interface %s", self.interface)
2453
elif error.errno == errno.ENOPROTOOPT:
2454
logger.error("SO_BINDTODEVICE not available;"
2455
" cannot bind to interface %s",
2457
elif error.errno == errno.ENODEV:
2458
logger.error("Interface %s does not exist,"
2459
" cannot bind", self.interface)
2596
# Fall back to a hard-coded value which seems to be
2598
logger.warning("SO_BINDTODEVICE not found, trying 25")
2599
SO_BINDTODEVICE = 25
2601
self.socket.setsockopt(
2602
socket.SOL_SOCKET, SO_BINDTODEVICE,
2603
(self.interface + "\0").encode("utf-8"))
2604
except socket.error as error:
2605
if error.errno == errno.EPERM:
2606
logger.error("No permission to bind to"
2607
" interface %s", self.interface)
2608
elif error.errno == errno.ENOPROTOOPT:
2609
logger.error("SO_BINDTODEVICE not available;"
2610
" cannot bind to interface %s",
2612
elif error.errno == errno.ENODEV:
2613
logger.error("Interface %s does not exist,"
2614
" cannot bind", self.interface)
2462
2617
# Only bind(2) the socket if we really need to.
2463
2618
if self.server_address[0] or self.server_address[1]:
2464
2619
if not self.server_address[0]:
2465
2620
if self.address_family == socket.AF_INET6:
2466
any_address = "::" # in6addr_any
2621
any_address = "::" # in6addr_any
2468
any_address = "0.0.0.0" # INADDR_ANY
2623
any_address = "0.0.0.0" # INADDR_ANY
2469
2624
self.server_address = (any_address,
2470
2625
self.server_address[1])
2471
2626
elif not self.server_address[1]:
2505
2660
self.gnutls_priority = gnutls_priority
2506
2661
IPv6_TCPServer.__init__(self, server_address,
2507
2662
RequestHandlerClass,
2508
interface = interface,
2509
use_ipv6 = use_ipv6,
2510
socketfd = socketfd)
2663
interface=interface,
2512
2667
def server_activate(self):
2513
2668
if self.enabled:
2514
2669
return socketserver.TCPServer.server_activate(self)
2516
2671
def enable(self):
2517
2672
self.enabled = True
2519
2674
def add_pipe(self, parent_pipe, proc):
2520
2675
# Call "handle_ipc" for both data and EOF events
2521
GObject.io_add_watch(
2522
2677
parent_pipe.fileno(),
2523
GObject.IO_IN | GObject.IO_HUP,
2678
GLib.IO_IN | GLib.IO_HUP,
2524
2679
functools.partial(self.handle_ipc,
2525
parent_pipe = parent_pipe,
2680
parent_pipe=parent_pipe,
2528
2683
def handle_ipc(self, source, condition,
2529
2684
parent_pipe=None,
2531
2686
client_object=None):
2532
2687
# error, or the other end of multiprocessing.Pipe has closed
2533
if condition & (GObject.IO_ERR | GObject.IO_HUP):
2688
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2534
2689
# Wait for other process to exit
2538
2693
# Read a request from the child
2539
2694
request = parent_pipe.recv()
2540
2695
command = request[0]
2542
2697
if command == 'init':
2544
address = request[2]
2698
key_id = request[1].decode("ascii")
2699
fpr = request[2].decode("ascii")
2700
address = request[3]
2546
2702
for c in self.clients.values():
2547
if c.fingerprint == fpr:
2703
if key_id and c.key_id == key_id:
2706
if fpr and c.fingerprint == fpr:
2551
logger.info("Client not found for fingerprint: %s, ad"
2552
"dress: %s", fpr, address)
2710
logger.info("Client not found for key ID: %s, address"
2711
": %s", key_id or fpr, address)
2553
2712
if self.use_dbus:
2554
2713
# Emit D-Bus signal
2555
mandos_dbus_service.ClientNotFound(fpr,
2714
mandos_dbus_service.ClientNotFound(key_id or fpr,
2557
2716
parent_pipe.send(False)
2560
GObject.io_add_watch(
2561
2720
parent_pipe.fileno(),
2562
GObject.IO_IN | GObject.IO_HUP,
2721
GLib.IO_IN | GLib.IO_HUP,
2563
2722
functools.partial(self.handle_ipc,
2564
parent_pipe = parent_pipe,
2566
client_object = client))
2723
parent_pipe=parent_pipe,
2725
client_object=client))
2567
2726
parent_pipe.send(True)
2568
2727
# remove the old hook in favor of the new above hook on
3022
3190
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3023
3191
service = AvahiServiceToSyslog(
3024
name = server_settings["servicename"],
3025
servicetype = "_mandos._tcp",
3026
protocol = protocol,
3192
name=server_settings["servicename"],
3193
servicetype="_mandos._tcp",
3028
3196
if server_settings["interface"]:
3029
3197
service.interface = if_nametoindex(
3030
3198
server_settings["interface"].encode("utf-8"))
3032
3200
global multiprocessing_manager
3033
3201
multiprocessing_manager = multiprocessing.Manager()
3035
3203
client_class = Client
3037
client_class = functools.partial(ClientDBus, bus = bus)
3205
client_class = functools.partial(ClientDBus, bus=bus)
3039
3207
client_settings = Client.config_parser(client_config)
3040
3208
old_client_settings = {}
3041
3209
clients_data = {}
3043
3211
# This is used to redirect stdout and stderr for checker processes
3045
wnull = open(os.devnull, "w") # A writable /dev/null
3213
wnull = open(os.devnull, "w") # A writable /dev/null
3046
3214
# Only used if server is running in foreground but not in debug
3048
3216
if debug or not foreground:
3051
3219
# Get client data and settings from last running state.
3052
3220
if server_settings["restore"]:
3054
3222
with open(stored_state_path, "rb") as stored_state:
3055
if sys.version_info.major == 2:
3223
if sys.version_info.major == 2:
3056
3224
clients_data, old_client_settings = pickle.load(
3059
3227
bytes_clients_data, bytes_old_client_settings = (
3060
pickle.load(stored_state, encoding = "bytes"))
3061
### Fix bytes to strings
3228
pickle.load(stored_state, encoding="bytes"))
3229
# Fix bytes to strings
3064
clients_data = { (key.decode("utf-8")
3065
if isinstance(key, bytes)
3068
bytes_clients_data.items() }
3232
clients_data = {(key.decode("utf-8")
3233
if isinstance(key, bytes)
3236
bytes_clients_data.items()}
3069
3237
del bytes_clients_data
3070
3238
for key in clients_data:
3071
value = { (k.decode("utf-8")
3072
if isinstance(k, bytes) else k): v
3074
clients_data[key].items() }
3239
value = {(k.decode("utf-8")
3240
if isinstance(k, bytes) else k): v
3242
clients_data[key].items()}
3075
3243
clients_data[key] = value
3076
3244
# .client_structure
3077
3245
value["client_structure"] = [
3078
3246
(s.decode("utf-8")
3079
3247
if isinstance(s, bytes)
3080
3248
else s) for s in
3081
value["client_structure"] ]
3249
value["client_structure"]]
3082
3250
# .name & .host
3083
3251
for k in ("name", "host"):
3084
3252
if isinstance(value[k], bytes):
3085
3253
value[k] = value[k].decode("utf-8")
3086
## old_client_settings
3254
if not value.has_key("key_id"):
3255
value["key_id"] = ""
3256
elif not value.has_key("fingerprint"):
3257
value["fingerprint"] = ""
3258
# old_client_settings
3088
3260
old_client_settings = {
3089
3261
(key.decode("utf-8")
3090
3262
if isinstance(key, bytes)
3091
3263
else key): value
3092
3264
for key, value in
3093
bytes_old_client_settings.items() }
3265
bytes_old_client_settings.items()}
3094
3266
del bytes_old_client_settings
3096
3268
for value in old_client_settings.values():
3202
3374
pidfilename, pid)
3204
3376
del pidfilename
3206
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3207
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3378
for termsig in (signal.SIGHUP, signal.SIGTERM):
3379
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3380
lambda: main_loop.quit() and False)
3211
3384
@alternate_dbus_interfaces(
3212
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3385
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3213
3386
class MandosDBusService(DBusObjectWithObjectManager):
3214
3387
"""A D-Bus proxy object"""
3216
3389
def __init__(self):
3217
3390
dbus.service.Object.__init__(self, bus, "/")
3219
3392
_interface = "se.recompile.Mandos"
3221
3394
@dbus.service.signal(_interface, signature="o")
3222
3395
def ClientAdded(self, objpath):
3226
3399
@dbus.service.signal(_interface, signature="ss")
3227
def ClientNotFound(self, fingerprint, address):
3400
def ClientNotFound(self, key_id, address):
3231
3404
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3233
3406
@dbus.service.signal(_interface, signature="os")
3234
3407
def ClientRemoved(self, objpath, name):
3238
3411
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3240
3413
@dbus.service.method(_interface, out_signature="ao")