196
250
.replace(b"\n", b"\\n")
197
251
.replace(b"\0", b"\\x00"))
200
254
def encrypt(self, data, password):
201
255
passphrase = self.password_encode(password)
202
256
with tempfile.NamedTemporaryFile(
203
257
dir=self.tempdir) as passfile:
204
258
passfile.write(passphrase)
206
proc = subprocess.Popen(['gpg', '--symmetric',
260
proc = subprocess.Popen([self.gpg, '--symmetric',
207
261
'--passphrase-file',
209
263
+ self.gnupgargs,
210
stdin = subprocess.PIPE,
211
stdout = subprocess.PIPE,
212
stderr = subprocess.PIPE)
213
ciphertext, err = proc.communicate(input = data)
264
stdin=subprocess.PIPE,
265
stdout=subprocess.PIPE,
266
stderr=subprocess.PIPE)
267
ciphertext, err = proc.communicate(input=data)
214
268
if proc.returncode != 0:
215
269
raise PGPError(err)
216
270
return ciphertext
218
272
def decrypt(self, data, password):
219
273
passphrase = self.password_encode(password)
220
274
with tempfile.NamedTemporaryFile(
221
dir = self.tempdir) as passfile:
275
dir=self.tempdir) as passfile:
222
276
passfile.write(passphrase)
224
proc = subprocess.Popen(['gpg', '--decrypt',
278
proc = subprocess.Popen([self.gpg, '--decrypt',
225
279
'--passphrase-file',
227
281
+ self.gnupgargs,
228
stdin = subprocess.PIPE,
229
stdout = subprocess.PIPE,
230
stderr = subprocess.PIPE)
231
decrypted_plaintext, err = proc.communicate(input = data)
282
stdin=subprocess.PIPE,
283
stdout=subprocess.PIPE,
284
stderr=subprocess.PIPE)
285
decrypted_plaintext, err = proc.communicate(input=data)
232
286
if proc.returncode != 0:
233
287
raise PGPError(err)
234
288
return decrypted_plaintext
291
# Pretend that we have an Avahi module
293
"""This isn't so much a class as it is a module-like namespace."""
294
IF_UNSPEC = -1 # avahi-common/address.h
295
PROTO_UNSPEC = -1 # avahi-common/address.h
296
PROTO_INET = 0 # avahi-common/address.h
297
PROTO_INET6 = 1 # avahi-common/address.h
298
DBUS_NAME = "org.freedesktop.Avahi"
299
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
300
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
301
DBUS_PATH_SERVER = "/"
304
def string_array_to_txt_array(t):
305
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
306
for s in t), signature="ay")
307
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
308
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
309
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
310
SERVER_INVALID = 0 # avahi-common/defs.h
311
SERVER_REGISTERING = 1 # avahi-common/defs.h
312
SERVER_RUNNING = 2 # avahi-common/defs.h
313
SERVER_COLLISION = 3 # avahi-common/defs.h
314
SERVER_FAILURE = 4 # avahi-common/defs.h
237
317
class AvahiError(Exception):
238
318
def __init__(self, value, *args, **kwargs):
239
319
self.value = value
429
509
class AvahiServiceToSyslog(AvahiService):
430
510
def rename(self, *args, **kwargs):
431
511
"""Add the new name to the syslog messages"""
432
ret = AvahiService.rename(self, *args, **kwargs)
512
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
433
513
syslogger.setFormatter(logging.Formatter(
434
514
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
435
515
.format(self.name)))
519
# Pretend that we have a GnuTLS module
521
"""This isn't so much a class as it is a module-like namespace."""
523
library = ctypes.util.find_library("gnutls")
525
library = ctypes.util.find_library("gnutls-deb0")
526
_library = ctypes.cdll.LoadLibrary(library)
529
# Unless otherwise indicated, the constants and types below are
530
# all from the gnutls/gnutls.h C header file.
541
E_NO_CERTIFICATE_FOUND = -49
546
KEYID_USE_SHA256 = 1 # gnutls/x509.h
547
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
550
class session_int(ctypes.Structure):
552
session_t = ctypes.POINTER(session_int)
554
class certificate_credentials_st(ctypes.Structure):
556
certificate_credentials_t = ctypes.POINTER(
557
certificate_credentials_st)
558
certificate_type_t = ctypes.c_int
560
class datum_t(ctypes.Structure):
561
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
562
('size', ctypes.c_uint)]
564
class openpgp_crt_int(ctypes.Structure):
566
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
567
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
568
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
569
credentials_type_t = ctypes.c_int
570
transport_ptr_t = ctypes.c_void_p
571
close_request_t = ctypes.c_int
574
class Error(Exception):
575
def __init__(self, message=None, code=None, args=()):
576
# Default usage is by a message string, but if a return
577
# code is passed, convert it to a string with
580
if message is None and code is not None:
581
message = gnutls.strerror(code)
582
return super(gnutls.Error, self).__init__(
585
class CertificateSecurityError(Error):
591
self._c_object = gnutls.certificate_credentials_t()
592
gnutls.certificate_allocate_credentials(
593
ctypes.byref(self._c_object))
594
self.type = gnutls.CRD_CERTIFICATE
597
gnutls.certificate_free_credentials(self._c_object)
600
def __init__(self, socket, credentials=None):
601
self._c_object = gnutls.session_t()
602
gnutls_flags = gnutls.CLIENT
603
if gnutls.check_version(b"3.5.6"):
604
gnutls_flags |= gnutls.NO_TICKETS
606
gnutls_flags |= gnutls.ENABLE_RAWPK
607
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
609
gnutls.set_default_priority(self._c_object)
610
gnutls.transport_set_ptr(self._c_object, socket.fileno())
611
gnutls.handshake_set_private_extensions(self._c_object,
614
if credentials is None:
615
credentials = gnutls.Credentials()
616
gnutls.credentials_set(self._c_object, credentials.type,
617
ctypes.cast(credentials._c_object,
619
self.credentials = credentials
622
gnutls.deinit(self._c_object)
625
return gnutls.handshake(self._c_object)
627
def send(self, data):
631
data_len -= gnutls.record_send(self._c_object,
636
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
638
# Error handling functions
639
def _error_code(result):
640
"""A function to raise exceptions on errors, suitable
641
for the 'restype' attribute on ctypes functions"""
644
if result == gnutls.E_NO_CERTIFICATE_FOUND:
645
raise gnutls.CertificateSecurityError(code=result)
646
raise gnutls.Error(code=result)
648
def _retry_on_error(result, func, arguments):
649
"""A function to retry on some errors, suitable
650
for the 'errcheck' attribute on ctypes functions"""
652
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
653
return _error_code(result)
654
result = func(*arguments)
657
# Unless otherwise indicated, the function declarations below are
658
# all from the gnutls/gnutls.h C header file.
661
priority_set_direct = _library.gnutls_priority_set_direct
662
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
663
ctypes.POINTER(ctypes.c_char_p)]
664
priority_set_direct.restype = _error_code
666
init = _library.gnutls_init
667
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
668
init.restype = _error_code
670
set_default_priority = _library.gnutls_set_default_priority
671
set_default_priority.argtypes = [session_t]
672
set_default_priority.restype = _error_code
674
record_send = _library.gnutls_record_send
675
record_send.argtypes = [session_t, ctypes.c_void_p,
677
record_send.restype = ctypes.c_ssize_t
678
record_send.errcheck = _retry_on_error
680
certificate_allocate_credentials = (
681
_library.gnutls_certificate_allocate_credentials)
682
certificate_allocate_credentials.argtypes = [
683
ctypes.POINTER(certificate_credentials_t)]
684
certificate_allocate_credentials.restype = _error_code
686
certificate_free_credentials = (
687
_library.gnutls_certificate_free_credentials)
688
certificate_free_credentials.argtypes = [
689
certificate_credentials_t]
690
certificate_free_credentials.restype = None
692
handshake_set_private_extensions = (
693
_library.gnutls_handshake_set_private_extensions)
694
handshake_set_private_extensions.argtypes = [session_t,
696
handshake_set_private_extensions.restype = None
698
credentials_set = _library.gnutls_credentials_set
699
credentials_set.argtypes = [session_t, credentials_type_t,
701
credentials_set.restype = _error_code
703
strerror = _library.gnutls_strerror
704
strerror.argtypes = [ctypes.c_int]
705
strerror.restype = ctypes.c_char_p
707
certificate_type_get = _library.gnutls_certificate_type_get
708
certificate_type_get.argtypes = [session_t]
709
certificate_type_get.restype = _error_code
711
certificate_get_peers = _library.gnutls_certificate_get_peers
712
certificate_get_peers.argtypes = [session_t,
713
ctypes.POINTER(ctypes.c_uint)]
714
certificate_get_peers.restype = ctypes.POINTER(datum_t)
716
global_set_log_level = _library.gnutls_global_set_log_level
717
global_set_log_level.argtypes = [ctypes.c_int]
718
global_set_log_level.restype = None
720
global_set_log_function = _library.gnutls_global_set_log_function
721
global_set_log_function.argtypes = [log_func]
722
global_set_log_function.restype = None
724
deinit = _library.gnutls_deinit
725
deinit.argtypes = [session_t]
726
deinit.restype = None
728
handshake = _library.gnutls_handshake
729
handshake.argtypes = [session_t]
730
handshake.restype = _error_code
731
handshake.errcheck = _retry_on_error
733
transport_set_ptr = _library.gnutls_transport_set_ptr
734
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
735
transport_set_ptr.restype = None
737
bye = _library.gnutls_bye
738
bye.argtypes = [session_t, close_request_t]
739
bye.restype = _error_code
740
bye.errcheck = _retry_on_error
742
check_version = _library.gnutls_check_version
743
check_version.argtypes = [ctypes.c_char_p]
744
check_version.restype = ctypes.c_char_p
746
_need_version = b"3.3.0"
747
if check_version(_need_version) is None:
748
raise self.Error("Needs GnuTLS {} or later"
749
.format(_need_version))
751
_tls_rawpk_version = b"3.6.6"
752
has_rawpk = bool(check_version(_tls_rawpk_version))
756
class pubkey_st(ctypes.Structure):
758
pubkey_t = ctypes.POINTER(pubkey_st)
760
x509_crt_fmt_t = ctypes.c_int
762
# All the function declarations below are from gnutls/abstract.h
763
pubkey_init = _library.gnutls_pubkey_init
764
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
765
pubkey_init.restype = _error_code
767
pubkey_import = _library.gnutls_pubkey_import
768
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
770
pubkey_import.restype = _error_code
772
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
773
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
774
ctypes.POINTER(ctypes.c_ubyte),
775
ctypes.POINTER(ctypes.c_size_t)]
776
pubkey_get_key_id.restype = _error_code
778
pubkey_deinit = _library.gnutls_pubkey_deinit
779
pubkey_deinit.argtypes = [pubkey_t]
780
pubkey_deinit.restype = None
782
# All the function declarations below are from gnutls/openpgp.h
784
openpgp_crt_init = _library.gnutls_openpgp_crt_init
785
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
786
openpgp_crt_init.restype = _error_code
788
openpgp_crt_import = _library.gnutls_openpgp_crt_import
789
openpgp_crt_import.argtypes = [openpgp_crt_t,
790
ctypes.POINTER(datum_t),
792
openpgp_crt_import.restype = _error_code
794
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
795
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
796
ctypes.POINTER(ctypes.c_uint)]
797
openpgp_crt_verify_self.restype = _error_code
799
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
800
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
801
openpgp_crt_deinit.restype = None
803
openpgp_crt_get_fingerprint = (
804
_library.gnutls_openpgp_crt_get_fingerprint)
805
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
809
openpgp_crt_get_fingerprint.restype = _error_code
811
if check_version(b"3.6.4"):
812
certificate_type_get2 = _library.gnutls_certificate_type_get2
813
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
814
certificate_type_get2.restype = _error_code
816
# Remove non-public functions
817
del _error_code, _retry_on_error
438
820
def call_pipe(connection, # : multiprocessing.Connection
439
821
func, *args, **kwargs):
440
822
"""This function is meant to be called by multiprocessing.Process
442
824
This function runs func(*args, **kwargs), and writes the resulting
443
825
return value on the provided multiprocessing.Connection.
445
827
connection.send(func(*args, **kwargs))
446
828
connection.close()
448
class Client(object):
449
832
"""A representation of a client host served by this server.
452
835
approved: bool(); 'None' if not yet approved/disapproved
453
836
approval_delay: datetime.timedelta(); Time to wait for approval
454
837
approval_duration: datetime.timedelta(); Duration of one approval
455
checker: subprocess.Popen(); a running checker process used
456
to see if the client lives.
457
'None' if no process is running.
458
checker_callback_tag: a gobject event source tag, or None
838
checker: multiprocessing.Process(); a running checker process used
839
to see if the client lives. 'None' if no process is
841
checker_callback_tag: a GLib event source tag, or None
459
842
checker_command: string; External command which is run to check
460
843
if client lives. %() expansions are done at
461
844
runtime with vars(self) as dict, so that for
462
845
instance %(name)s can be used in the command.
463
checker_initiator_tag: a gobject event source tag, or None
846
checker_initiator_tag: a GLib event source tag, or None
464
847
created: datetime.datetime(); (UTC) object creation
465
848
client_structure: Object describing what attributes a client has
466
849
and is used for storing the client at exit
467
850
current_checker_command: string; current running checker_command
468
disable_initiator_tag: a gobject event source tag, or None
851
disable_initiator_tag: a GLib event source tag, or None
470
853
fingerprint: string (40 or 32 hexadecimal digits); used to
471
uniquely identify the client
854
uniquely identify an OpenPGP client
855
key_id: string (64 hexadecimal digits); used to uniquely identify
856
a client using raw public keys
472
857
host: string; available for use by the checker command
473
858
interval: datetime.timedelta(); How often to start a new checker
474
859
last_approval_request: datetime.datetime(); (UTC) or None
895
1287
for cls in self.__class__.__mro__
896
1288
for name, athing in
897
1289
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1291
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1293
path_keyword='object_path',
1294
connection_keyword='connection')
1295
def Introspect(self, object_path, connection):
1296
"""Overloading of standard D-Bus method.
1298
Inserts annotation tags on methods and signals.
1300
xmlstring = dbus.service.Object.Introspect(self, object_path,
1303
document = xml.dom.minidom.parseString(xmlstring)
1305
for if_tag in document.getElementsByTagName("interface"):
1306
# Add annotation tags
1307
for typ in ("method", "signal"):
1308
for tag in if_tag.getElementsByTagName(typ):
1310
for name, prop in (self.
1311
_get_all_dbus_things(typ)):
1312
if (name == tag.getAttribute("name")
1313
and prop._dbus_interface
1314
== if_tag.getAttribute("name")):
1315
annots.update(getattr(
1316
prop, "_dbus_annotations", {}))
1317
for name, value in annots.items():
1318
ann_tag = document.createElement(
1320
ann_tag.setAttribute("name", name)
1321
ann_tag.setAttribute("value", value)
1322
tag.appendChild(ann_tag)
1323
# Add interface annotation tags
1324
for annotation, value in dict(
1325
itertools.chain.from_iterable(
1326
annotations().items()
1327
for name, annotations
1328
in self._get_all_dbus_things("interface")
1329
if name == if_tag.getAttribute("name")
1331
ann_tag = document.createElement("annotation")
1332
ann_tag.setAttribute("name", annotation)
1333
ann_tag.setAttribute("value", value)
1334
if_tag.appendChild(ann_tag)
1335
# Fix argument name for the Introspect method itself
1336
if (if_tag.getAttribute("name")
1337
== dbus.INTROSPECTABLE_IFACE):
1338
for cn in if_tag.getElementsByTagName("method"):
1339
if cn.getAttribute("name") == "Introspect":
1340
for arg in cn.getElementsByTagName("arg"):
1341
if (arg.getAttribute("direction")
1343
arg.setAttribute("name",
1345
xmlstring = document.toxml("utf-8")
1347
except (AttributeError, xml.dom.DOMException,
1348
xml.parsers.expat.ExpatError) as error:
1349
logger.error("Failed to override Introspection method",
1354
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1355
"""A D-Bus object with properties.
1357
Classes inheriting from this can use the dbus_service_property
1358
decorator to expose methods as D-Bus properties. It exposes the
1359
standard Get(), Set(), and GetAll() methods on the D-Bus.
899
1362
def _get_dbus_property(self, interface_name, property_name):
900
1363
"""Returns a bound method if one exists which is a D-Bus
901
1364
property with the specified name and interface.
1059
1519
return xmlstring
1523
dbus.OBJECT_MANAGER_IFACE
1524
except AttributeError:
1525
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1528
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1529
"""A D-Bus object with an ObjectManager.
1531
Classes inheriting from this exposes the standard
1532
GetManagedObjects call and the InterfacesAdded and
1533
InterfacesRemoved signals on the standard
1534
"org.freedesktop.DBus.ObjectManager" interface.
1536
Note: No signals are sent automatically; they must be sent
1539
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1540
out_signature="a{oa{sa{sv}}}")
1541
def GetManagedObjects(self):
1542
"""This function must be overridden"""
1543
raise NotImplementedError()
1545
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1546
signature="oa{sa{sv}}")
1547
def InterfacesAdded(self, object_path, interfaces_and_properties):
1550
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1551
def InterfacesRemoved(self, object_path, interfaces):
1554
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1556
path_keyword='object_path',
1557
connection_keyword='connection')
1558
def Introspect(self, object_path, connection):
1559
"""Overloading of standard D-Bus method.
1561
Override return argument name of GetManagedObjects to be
1562
"objpath_interfaces_and_properties"
1564
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1568
document = xml.dom.minidom.parseString(xmlstring)
1570
for if_tag in document.getElementsByTagName("interface"):
1571
# Fix argument name for the GetManagedObjects method
1572
if (if_tag.getAttribute("name")
1573
== dbus.OBJECT_MANAGER_IFACE):
1574
for cn in if_tag.getElementsByTagName("method"):
1575
if (cn.getAttribute("name")
1576
== "GetManagedObjects"):
1577
for arg in cn.getElementsByTagName("arg"):
1578
if (arg.getAttribute("direction")
1582
"objpath_interfaces"
1584
xmlstring = document.toxml("utf-8")
1586
except (AttributeError, xml.dom.DOMException,
1587
xml.parsers.expat.ExpatError) as error:
1588
logger.error("Failed to override Introspection method",
1062
1593
def datetime_to_dbus(dt, variant_level=0):
1063
1594
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1065
return dbus.String("", variant_level = variant_level)
1596
return dbus.String("", variant_level=variant_level)
1066
1597
return dbus.String(dt.isoformat(), variant_level=variant_level)
1830
2381
delay -= time2 - time
1833
while sent_size < len(client.secret):
1835
sent = session.send(client.secret[sent_size:])
1836
except gnutls.errors.GNUTLSError as error:
1837
logger.warning("gnutls send failed",
1840
logger.debug("Sent: %d, remaining: %d", sent,
1841
len(client.secret) - (sent_size
2384
session.send(client.secret)
2385
except gnutls.Error as error:
2386
logger.warning("gnutls send failed",
1845
2390
logger.info("Sending secret to %s", client.name)
1846
2391
# bump the timeout using extended_timeout
1847
2392
client.bump_timeout(client.extended_timeout)
1848
2393
if self.server.use_dbus:
1849
2394
# Emit D-Bus signal
1850
2395
client.GotSecret()
1853
2398
if approval_required:
1854
2399
client.approvals_pending -= 1
1857
except gnutls.errors.GNUTLSError as error:
2402
except gnutls.Error as error:
1858
2403
logger.warning("GnuTLS bye failed",
1859
2404
exc_info=error)
1862
2407
def peer_certificate(session):
1863
"Return the peer's OpenPGP certificate as a bytestring"
1864
# If not an OpenPGP certificate...
1865
if (gnutls.library.functions.gnutls_certificate_type_get(
1867
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1868
# ...do the normal thing
1869
return session.peer_certificate
2408
"Return the peer's certificate as a bytestring"
2410
cert_type = gnutls.certificate_type_get2(session._c_object,
2412
except AttributeError:
2413
cert_type = gnutls.certificate_type_get(session._c_object)
2414
if gnutls.has_rawpk:
2415
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2417
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2418
# If not a valid certificate type...
2419
if cert_type not in valid_cert_types:
2420
logger.info("Cert type %r not in %r", cert_type,
2422
# ...return invalid data
1870
2424
list_size = ctypes.c_uint(1)
1871
cert_list = (gnutls.library.functions
1872
.gnutls_certificate_get_peers
2425
cert_list = (gnutls.certificate_get_peers
1873
2426
(session._c_object, ctypes.byref(list_size)))
1874
2427
if not bool(cert_list) and list_size.value != 0:
1875
raise gnutls.errors.GNUTLSError("error getting peer"
2428
raise gnutls.Error("error getting peer certificate")
1877
2429
if list_size.value == 0:
1879
2431
cert = cert_list[0]
1880
2432
return ctypes.string_at(cert.data, cert.size)
2435
def key_id(certificate):
2436
"Convert a certificate bytestring to a hexdigit key ID"
2437
# New GnuTLS "datum" with the public key
2438
datum = gnutls.datum_t(
2439
ctypes.cast(ctypes.c_char_p(certificate),
2440
ctypes.POINTER(ctypes.c_ubyte)),
2441
ctypes.c_uint(len(certificate)))
2442
# XXX all these need to be created in the gnutls "module"
2443
# New empty GnuTLS certificate
2444
pubkey = gnutls.pubkey_t()
2445
gnutls.pubkey_init(ctypes.byref(pubkey))
2446
# Import the raw public key into the certificate
2447
gnutls.pubkey_import(pubkey,
2448
ctypes.byref(datum),
2449
gnutls.X509_FMT_DER)
2450
# New buffer for the key ID
2451
buf = ctypes.create_string_buffer(32)
2452
buf_len = ctypes.c_size_t(len(buf))
2453
# Get the key ID from the raw public key into the buffer
2454
gnutls.pubkey_get_key_id(pubkey,
2455
gnutls.KEYID_USE_SHA256,
2456
ctypes.cast(ctypes.byref(buf),
2457
ctypes.POINTER(ctypes.c_ubyte)),
2458
ctypes.byref(buf_len))
2459
# Deinit the certificate
2460
gnutls.pubkey_deinit(pubkey)
2462
# Convert the buffer to a Python bytestring
2463
key_id = ctypes.string_at(buf, buf_len.value)
2464
# Convert the bytestring to hexadecimal notation
2465
hex_key_id = binascii.hexlify(key_id).upper()
1883
2469
def fingerprint(openpgp):
1884
2470
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1885
2471
# New GnuTLS "datum" with the OpenPGP public key
1886
datum = gnutls.library.types.gnutls_datum_t(
2472
datum = gnutls.datum_t(
1887
2473
ctypes.cast(ctypes.c_char_p(openpgp),
1888
2474
ctypes.POINTER(ctypes.c_ubyte)),
1889
2475
ctypes.c_uint(len(openpgp)))
1890
2476
# New empty GnuTLS certificate
1891
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1892
gnutls.library.functions.gnutls_openpgp_crt_init(
2477
crt = gnutls.openpgp_crt_t()
2478
gnutls.openpgp_crt_init(ctypes.byref(crt))
1894
2479
# Import the OpenPGP public key into the certificate
1895
gnutls.library.functions.gnutls_openpgp_crt_import(
1896
crt, ctypes.byref(datum),
1897
gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)
2480
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2481
gnutls.OPENPGP_FMT_RAW)
1898
2482
# Verify the self signature in the key
1899
2483
crtverify = ctypes.c_uint()
1900
gnutls.library.functions.gnutls_openpgp_crt_verify_self(
1901
crt, 0, ctypes.byref(crtverify))
2484
gnutls.openpgp_crt_verify_self(crt, 0,
2485
ctypes.byref(crtverify))
1902
2486
if crtverify.value != 0:
1903
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1904
raise gnutls.errors.CertificateSecurityError(
2487
gnutls.openpgp_crt_deinit(crt)
2488
raise gnutls.CertificateSecurityError(code
1906
2490
# New buffer for the fingerprint
1907
2491
buf = ctypes.create_string_buffer(20)
1908
2492
buf_len = ctypes.c_size_t()
1909
2493
# Get the fingerprint from the certificate into the buffer
1910
gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(
1911
crt, ctypes.byref(buf), ctypes.byref(buf_len))
2494
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2495
ctypes.byref(buf_len))
1912
2496
# Deinit the certificate
1913
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2497
gnutls.openpgp_crt_deinit(crt)
1914
2498
# Convert the buffer to a Python bytestring
1915
2499
fpr = ctypes.string_at(buf, buf_len.value)
1916
2500
# Convert the bytestring to hexadecimal notation
2004
2589
# socket_wrapper(), if socketfd was set.
2005
2590
socketserver.TCPServer.__init__(self, server_address,
2006
2591
RequestHandlerClass)
2008
2593
def server_bind(self):
2009
2594
"""This overrides the normal server_bind() function
2010
2595
to bind to an interface if one was specified, and also NOT to
2011
2596
bind to an address or port if they were not specified."""
2597
global SO_BINDTODEVICE
2012
2598
if self.interface is not None:
2013
2599
if SO_BINDTODEVICE is None:
2014
logger.error("SO_BINDTODEVICE does not exist;"
2015
" cannot bind to interface %s",
2019
self.socket.setsockopt(
2020
socket.SOL_SOCKET, SO_BINDTODEVICE,
2021
(self.interface + "\0").encode("utf-8"))
2022
except socket.error as error:
2023
if error.errno == errno.EPERM:
2024
logger.error("No permission to bind to"
2025
" interface %s", self.interface)
2026
elif error.errno == errno.ENOPROTOOPT:
2027
logger.error("SO_BINDTODEVICE not available;"
2028
" cannot bind to interface %s",
2030
elif error.errno == errno.ENODEV:
2031
logger.error("Interface %s does not exist,"
2032
" cannot bind", self.interface)
2600
# Fall back to a hard-coded value which seems to be
2602
logger.warning("SO_BINDTODEVICE not found, trying 25")
2603
SO_BINDTODEVICE = 25
2605
self.socket.setsockopt(
2606
socket.SOL_SOCKET, SO_BINDTODEVICE,
2607
(self.interface + "\0").encode("utf-8"))
2608
except socket.error as error:
2609
if error.errno == errno.EPERM:
2610
logger.error("No permission to bind to"
2611
" interface %s", self.interface)
2612
elif error.errno == errno.ENOPROTOOPT:
2613
logger.error("SO_BINDTODEVICE not available;"
2614
" cannot bind to interface %s",
2616
elif error.errno == errno.ENODEV:
2617
logger.error("Interface %s does not exist,"
2618
" cannot bind", self.interface)
2035
2621
# Only bind(2) the socket if we really need to.
2036
2622
if self.server_address[0] or self.server_address[1]:
2623
if self.server_address[1]:
2624
self.allow_reuse_address = True
2037
2625
if not self.server_address[0]:
2038
2626
if self.address_family == socket.AF_INET6:
2039
any_address = "::" # in6addr_any
2627
any_address = "::" # in6addr_any
2041
any_address = "0.0.0.0" # INADDR_ANY
2629
any_address = "0.0.0.0" # INADDR_ANY
2042
2630
self.server_address = (any_address,
2043
2631
self.server_address[1])
2044
2632
elif not self.server_address[1]:
2078
2666
self.gnutls_priority = gnutls_priority
2079
2667
IPv6_TCPServer.__init__(self, server_address,
2080
2668
RequestHandlerClass,
2081
interface = interface,
2082
use_ipv6 = use_ipv6,
2083
socketfd = socketfd)
2669
interface=interface,
2085
2673
def server_activate(self):
2086
2674
if self.enabled:
2087
2675
return socketserver.TCPServer.server_activate(self)
2089
2677
def enable(self):
2090
2678
self.enabled = True
2092
2680
def add_pipe(self, parent_pipe, proc):
2093
2681
# Call "handle_ipc" for both data and EOF events
2094
gobject.io_add_watch(
2095
parent_pipe.fileno(),
2096
gobject.IO_IN | gobject.IO_HUP,
2683
parent_pipe.fileno(), GLib.PRIORITY_DEFAULT,
2684
GLib.IO_IN | GLib.IO_HUP,
2097
2685
functools.partial(self.handle_ipc,
2098
parent_pipe = parent_pipe,
2686
parent_pipe=parent_pipe,
2101
2689
def handle_ipc(self, source, condition,
2102
2690
parent_pipe=None,
2104
2692
client_object=None):
2105
2693
# error, or the other end of multiprocessing.Pipe has closed
2106
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2694
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2107
2695
# Wait for other process to exit
2111
2699
# Read a request from the child
2112
2700
request = parent_pipe.recv()
2113
2701
command = request[0]
2115
2703
if command == 'init':
2117
address = request[2]
2119
for c in self.clients.itervalues():
2120
if c.fingerprint == fpr:
2704
key_id = request[1].decode("ascii")
2705
fpr = request[2].decode("ascii")
2706
address = request[3]
2708
for c in self.clients.values():
2709
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2711
if key_id and c.key_id == key_id:
2714
if fpr and c.fingerprint == fpr:
2124
logger.info("Client not found for fingerprint: %s, ad"
2125
"dress: %s", fpr, address)
2718
logger.info("Client not found for key ID: %s, address"
2719
": %s", key_id or fpr, address)
2126
2720
if self.use_dbus:
2127
2721
# Emit D-Bus signal
2128
mandos_dbus_service.ClientNotFound(fpr,
2722
mandos_dbus_service.ClientNotFound(key_id or fpr,
2130
2724
parent_pipe.send(False)
2133
gobject.io_add_watch(
2134
parent_pipe.fileno(),
2135
gobject.IO_IN | gobject.IO_HUP,
2728
parent_pipe.fileno(), GLib.PRIORITY_DEFAULT,
2729
GLib.IO_IN | GLib.IO_HUP,
2136
2730
functools.partial(self.handle_ipc,
2137
parent_pipe = parent_pipe,
2139
client_object = client))
2731
parent_pipe=parent_pipe,
2733
client_object=client))
2140
2734
parent_pipe.send(True)
2141
2735
# remove the old hook in favor of the new above hook on
2589
3193
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2590
3194
service = AvahiServiceToSyslog(
2591
name = server_settings["servicename"],
2592
servicetype = "_mandos._tcp",
2593
protocol = protocol,
3195
name=server_settings["servicename"],
3196
servicetype="_mandos._tcp",
2595
3199
if server_settings["interface"]:
2596
3200
service.interface = if_nametoindex(
2597
3201
server_settings["interface"].encode("utf-8"))
2599
3203
global multiprocessing_manager
2600
3204
multiprocessing_manager = multiprocessing.Manager()
2602
3206
client_class = Client
2604
client_class = functools.partial(ClientDBus, bus = bus)
3208
client_class = functools.partial(ClientDBus, bus=bus)
2606
3210
client_settings = Client.config_parser(client_config)
2607
3211
old_client_settings = {}
2608
3212
clients_data = {}
2610
3214
# This is used to redirect stdout and stderr for checker processes
2612
wnull = open(os.devnull, "w") # A writable /dev/null
3216
wnull = open(os.devnull, "w") # A writable /dev/null
2613
3217
# Only used if server is running in foreground but not in debug
2615
3219
if debug or not foreground:
2618
3222
# Get client data and settings from last running state.
2619
3223
if server_settings["restore"]:
2621
3225
with open(stored_state_path, "rb") as stored_state:
2622
clients_data, old_client_settings = pickle.load(
3226
if sys.version_info.major == 2:
3227
clients_data, old_client_settings = pickle.load(
3230
bytes_clients_data, bytes_old_client_settings = (
3231
pickle.load(stored_state, encoding="bytes"))
3232
# Fix bytes to strings
3235
clients_data = {(key.decode("utf-8")
3236
if isinstance(key, bytes)
3239
bytes_clients_data.items()}
3240
del bytes_clients_data
3241
for key in clients_data:
3242
value = {(k.decode("utf-8")
3243
if isinstance(k, bytes) else k): v
3245
clients_data[key].items()}
3246
clients_data[key] = value
3248
value["client_structure"] = [
3250
if isinstance(s, bytes)
3252
value["client_structure"]]
3254
for k in ("name", "host"):
3255
if isinstance(value[k], bytes):
3256
value[k] = value[k].decode("utf-8")
3257
if "key_id" not in value:
3258
value["key_id"] = ""
3259
elif "fingerprint" not in value:
3260
value["fingerprint"] = ""
3261
# old_client_settings
3263
old_client_settings = {
3264
(key.decode("utf-8")
3265
if isinstance(key, bytes)
3268
bytes_old_client_settings.items()}
3269
del bytes_old_client_settings
3271
for value in old_client_settings.values():
3272
if isinstance(value["host"], bytes):
3273
value["host"] = (value["host"]
2624
3275
os.remove(stored_state_path)
2625
3276
except IOError as e:
2626
3277
if e.errno == errno.ENOENT:
2726
3377
pidfilename, pid)
2728
3379
del pidfilename
2730
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2731
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3381
for termsig in (signal.SIGHUP, signal.SIGTERM):
3382
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3383
lambda: main_loop.quit() and False)
2735
3387
@alternate_dbus_interfaces(
2736
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
2737
class MandosDBusService(DBusObjectWithProperties):
3388
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3389
class MandosDBusService(DBusObjectWithObjectManager):
2738
3390
"""A D-Bus proxy object"""
2740
3392
def __init__(self):
2741
3393
dbus.service.Object.__init__(self, bus, "/")
2743
3395
_interface = "se.recompile.Mandos"
2745
@dbus_interface_annotations(_interface)
2748
"org.freedesktop.DBus.Property.EmitsChangedSignal":
2751
3397
@dbus.service.signal(_interface, signature="o")
2752
3398
def ClientAdded(self, objpath):
2756
3402
@dbus.service.signal(_interface, signature="ss")
2757
def ClientNotFound(self, fingerprint, address):
3403
def ClientNotFound(self, key_id, address):
3407
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2761
3409
@dbus.service.signal(_interface, signature="os")
2762
3410
def ClientRemoved(self, objpath, name):
3414
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2766
3416
@dbus.service.method(_interface, out_signature="ao")
2767
3417
def GetAllClients(self):
2769
3419
return dbus.Array(c.dbus_object_path for c in
2770
tcp_server.clients.itervalues())
3420
tcp_server.clients.values())
3422
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2772
3424
@dbus.service.method(_interface,
2773
3425
out_signature="a{oa{sv}}")
2774
3426
def GetAllClientsWithProperties(self):
2776
3428
return dbus.Dictionary(
2777
{ c.dbus_object_path: c.GetAll("")
2778
for c in tcp_server.clients.itervalues() },
3429
{c.dbus_object_path: c.GetAll(
3430
"se.recompile.Mandos.Client")
3431
for c in tcp_server.clients.values()},
2779
3432
signature="oa{sv}")
2781
3434
@dbus.service.method(_interface, in_signature="o")
2782
3435
def RemoveClient(self, object_path):
2784
for c in tcp_server.clients.itervalues():
3437
for c in tcp_server.clients.values():
2785
3438
if c.dbus_object_path == object_path:
2786
3439
del tcp_server.clients[c.name]
2787
3440
c.remove_from_connection()
2788
# Don't signal anything except ClientRemoved
3441
# Don't signal the disabling
2789
3442
c.disable(quiet=True)
2791
self.ClientRemoved(object_path, c.name)
3443
# Emit D-Bus signal for removal
3444
self.client_removed_signal(c)
2793
3446
raise KeyError(object_path)
3450
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3451
out_signature="a{oa{sa{sv}}}")
3452
def GetManagedObjects(self):
3454
return dbus.Dictionary(
3455
{client.dbus_object_path:
3457
{interface: client.GetAll(interface)
3459
client._get_all_interface_names()})
3460
for client in tcp_server.clients.values()})
3462
def client_added_signal(self, client):
3463
"""Send the new standard signal and the old signal"""
3465
# New standard signal
3466
self.InterfacesAdded(
3467
client.dbus_object_path,
3469
{interface: client.GetAll(interface)
3471
client._get_all_interface_names()}))
3473
self.ClientAdded(client.dbus_object_path)
3475
def client_removed_signal(self, client):
3476
"""Send the new standard signal and the old signal"""
3478
# New standard signal
3479
self.InterfacesRemoved(
3480
client.dbus_object_path,
3481
client._get_all_interface_names())
3483
self.ClientRemoved(client.dbus_object_path,
2797
3486
mandos_dbus_service = MandosDBusService()
3488
# Save modules to variables to exempt the modules from being
3489
# unloaded before the function registered with atexit() is run.
3490
mp = multiprocessing
2800
3494
"Cleanup function; run on exit"
2802
3496
service.cleanup()
2804
multiprocessing.active_children()
3498
mp.active_children()
2806
3500
if not (tcp_server.clients or client_settings):
2809
3503
# Store client before exiting. Secrets are encrypted with key
2810
3504
# based on what config file has. If config file is
2811
3505
# removed/edited, old secret will thus be unrecovable.
2813
3507
with PGPEngine() as pgp:
2814
for client in tcp_server.clients.itervalues():
3508
for client in tcp_server.clients.values():
2815
3509
key = client_settings[client.name]["secret"]
2816
3510
client.encrypted_secret = pgp.encrypt(client.secret,
2818
3512
client_dict = {}
2820
3514
# A list of attributes that can not be pickled
2822
exclude = { "bus", "changedstate", "secret",
2823
"checker", "server_settings" }
3516
exclude = {"bus", "changedstate", "secret",
3517
"checker", "server_settings"}
2824
3518
for name, typ in inspect.getmembers(dbus.service
2826
3520
exclude.add(name)
2828
3522
client_dict["encrypted_secret"] = (client
2829
3523
.encrypted_secret)
2830
3524
for attr in client.client_structure:
2831
3525
if attr not in exclude:
2832
3526
client_dict[attr] = getattr(client, attr)
2834
3528
clients[client.name] = client_dict
2835
3529
del client_settings[client.name]["secret"]
2838
3532
with tempfile.NamedTemporaryFile(