70
import cPickle as pickle
63
import cPickle as pickle
73
64
import multiprocessing
82
70
import dbus.service
83
from gi.repository import GLib
84
73
from dbus.mainloop.glib import DBusGMainLoop
87
76
import xml.dom.minidom
90
# Try to find the value of SO_BINDTODEVICE:
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
93
# newer, and it is also the most natural place for it:
94
81
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
95
82
except AttributeError:
97
# This is where SO_BINDTODEVICE was up to and including Python
99
84
from IN import SO_BINDTODEVICE
100
85
except ImportError:
101
# In Python 2.7 it seems to have been removed entirely.
102
# Try running the C preprocessor:
104
cc = subprocess.Popen(["cc", "--language=c", "-E",
106
stdin=subprocess.PIPE,
107
stdout=subprocess.PIPE)
108
stdout = cc.communicate(
109
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
110
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
111
except (OSError, ValueError, IndexError):
113
SO_BINDTODEVICE = None
115
if sys.version_info.major == 2:
86
SO_BINDTODEVICE = None
119
89
stored_state_file = "clients.pickle"
121
91
logger = logging.getLogger()
92
syslogger = (logging.handlers.SysLogHandler
93
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
94
address = str("/dev/log")))
125
if_nametoindex = ctypes.cdll.LoadLibrary(
126
ctypes.util.find_library("c")).if_nametoindex
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
127
100
except (OSError, AttributeError):
129
101
def if_nametoindex(interface):
130
102
"Get an interface index the hard way, i.e. using fcntl()"
131
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
132
104
with contextlib.closing(socket.socket()) as s:
133
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
134
struct.pack(b"16s16x", interface))
135
interface_index = struct.unpack("I", ifreq[16:20])[0]
106
struct.pack(str("16s16x"),
108
interface_index = struct.unpack(str("I"),
136
110
return interface_index
139
def copy_function(func):
140
"""Make a copy of a function"""
141
if sys.version_info.major == 2:
142
return types.FunctionType(func.func_code,
148
return types.FunctionType(func.__code__,
155
def initlogger(debug, level=logging.WARNING):
113
def initlogger(level=logging.WARNING):
156
114
"""init logger and add loglevel"""
159
syslogger = (logging.handlers.SysLogHandler(
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
162
116
syslogger.setFormatter(logging.Formatter
163
117
('Mandos [%(process)d]: %(levelname)s:'
165
119
logger.addHandler(syslogger)
168
console = logging.StreamHandler()
169
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
173
logger.addHandler(console)
121
console = logging.StreamHandler()
122
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
126
logger.addHandler(console)
174
127
logger.setLevel(level)
226
166
os.rmdir(self.tempdir)
227
167
self.tempdir = None
229
169
def password_encode(self, password):
230
170
# Passphrase can not be empty and can not contain newlines or
231
171
# NUL bytes. So we prefix it and hex encode it.
232
encoded = b"mandos" + binascii.hexlify(password)
233
if len(encoded) > 2048:
234
# GnuPG can't handle long passwords, so encode differently
235
encoded = (b"mandos" + password.replace(b"\\", b"\\\\")
236
.replace(b"\n", b"\\n")
237
.replace(b"\0", b"\\x00"))
172
return b"mandos" + binascii.hexlify(password)
240
174
def encrypt(self, data, password):
241
passphrase = self.password_encode(password)
242
with tempfile.NamedTemporaryFile(
243
dir=self.tempdir) as passfile:
244
passfile.write(passphrase)
246
proc = subprocess.Popen([self.gpg, '--symmetric',
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
254
if proc.returncode != 0:
175
self.gnupg.passphrase = self.password_encode(password)
176
with open(os.devnull) as devnull:
178
proc = self.gnupg.run(['--symmetric'],
179
create_fhs=['stdin', 'stdout'],
180
attach_fhs={'stderr': devnull})
181
with contextlib.closing(proc.handles['stdin']) as f:
183
with contextlib.closing(proc.handles['stdout']) as f:
184
ciphertext = f.read()
188
self.gnupg.passphrase = None
256
189
return ciphertext
258
191
def decrypt(self, data, password):
259
passphrase = self.password_encode(password)
260
with tempfile.NamedTemporaryFile(
261
dir=self.tempdir) as passfile:
262
passfile.write(passphrase)
264
proc = subprocess.Popen([self.gpg, '--decrypt',
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
272
if proc.returncode != 0:
192
self.gnupg.passphrase = self.password_encode(password)
193
with open(os.devnull) as devnull:
195
proc = self.gnupg.run(['--decrypt'],
196
create_fhs=['stdin', 'stdout'],
197
attach_fhs={'stderr': devnull})
198
with contextlib.closing(proc.handles['stdin'] ) as f:
200
with contextlib.closing(proc.handles['stdout']) as f:
201
decrypted_plaintext = f.read()
205
self.gnupg.passphrase = None
274
206
return decrypted_plaintext
277
# Pretend that we have an Avahi module
279
"""This isn't so much a class as it is a module-like namespace.
280
It is instantiated once, and simulates having an Avahi module."""
281
IF_UNSPEC = -1 # avahi-common/address.h
282
PROTO_UNSPEC = -1 # avahi-common/address.h
283
PROTO_INET = 0 # avahi-common/address.h
284
PROTO_INET6 = 1 # avahi-common/address.h
285
DBUS_NAME = "org.freedesktop.Avahi"
286
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
287
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
288
DBUS_PATH_SERVER = "/"
290
def string_array_to_txt_array(self, t):
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
304
210
class AvahiError(Exception):
305
211
def __init__(self, value, *args, **kwargs):
306
212
self.value = value
307
return super(AvahiError, self).__init__(value, *args,
213
super(AvahiError, self).__init__(value, *args, **kwargs)
214
def __unicode__(self):
215
return unicode(repr(self.value))
311
217
class AvahiServiceError(AvahiError):
315
220
class AvahiGroupError(AvahiError):
319
224
class AvahiService(object):
320
225
"""An Avahi (Zeroconf) service.
323
228
interface: integer; avahi.IF_UNSPEC or an interface index.
324
229
Used to optionally bind to the specified interface.
325
230
name: string; Example: 'Mandos'
326
231
type: string; Example: '_mandos._tcp'.
327
See <https://www.iana.org/assignments/service-names-port-numbers>
232
See <http://www.dns-sd.org/ServiceTypes.html>
328
233
port: integer; what port to announce
329
234
TXT: list of strings; TXT record for the service
330
235
domain: string; Domain to publish on, default to .local if empty.
489
364
follow_name_owner_changes=True),
490
365
avahi.DBUS_INTERFACE_SERVER)
491
366
self.server.connect_to_signal("StateChanged",
492
self.server_state_changed)
367
self.server_state_changed)
493
368
self.server_state_changed(self.server.GetState())
496
370
class AvahiServiceToSyslog(AvahiService):
497
def rename(self, *args, **kwargs):
498
372
"""Add the new name to the syslog messages"""
499
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
500
syslogger.setFormatter(logging.Formatter(
501
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
373
ret = AvahiService.rename(self)
374
syslogger.setFormatter(logging.Formatter
375
('Mandos (%s) [%%(process)d]:'
376
' %%(levelname)s: %%(message)s'
506
# Pretend that we have a GnuTLS module
507
class GnuTLS(object):
508
"""This isn't so much a class as it is a module-like namespace.
509
It is instantiated once, and simulates having a GnuTLS module."""
511
library = ctypes.util.find_library("gnutls")
513
library = ctypes.util.find_library("gnutls-deb0")
514
_library = ctypes.cdll.LoadLibrary(library)
516
_need_version = b"3.3.0"
517
_tls_rawpk_version = b"3.6.6"
520
# Need to use "self" here, since this method is called before
521
# the assignment to the "gnutls" global variable happens.
522
if self.check_version(self._need_version) is None:
523
raise self.Error("Needs GnuTLS {} or later"
524
.format(self._need_version))
526
# Unless otherwise indicated, the constants and types below are
527
# all from the gnutls/gnutls.h C header file.
538
E_NO_CERTIFICATE_FOUND = -49
543
KEYID_USE_SHA256 = 1 # gnutls/x509.h
544
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
547
class session_int(ctypes.Structure):
549
session_t = ctypes.POINTER(session_int)
551
class certificate_credentials_st(ctypes.Structure):
553
certificate_credentials_t = ctypes.POINTER(
554
certificate_credentials_st)
555
certificate_type_t = ctypes.c_int
557
class datum_t(ctypes.Structure):
558
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
559
('size', ctypes.c_uint)]
561
class openpgp_crt_int(ctypes.Structure):
563
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
564
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
565
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
566
credentials_type_t = ctypes.c_int
567
transport_ptr_t = ctypes.c_void_p
568
close_request_t = ctypes.c_int
571
class Error(Exception):
572
# We need to use the class name "GnuTLS" here, since this
573
# exception might be raised from within GnuTLS.__init__,
574
# which is called before the assignment to the "gnutls"
575
# global variable has happened.
576
def __init__(self, message=None, code=None, args=()):
577
# Default usage is by a message string, but if a return
578
# code is passed, convert it to a string with
581
if message is None and code is not None:
582
message = GnuTLS.strerror(code)
583
return super(GnuTLS.Error, self).__init__(
586
class CertificateSecurityError(Error):
590
class Credentials(object):
592
self._c_object = gnutls.certificate_credentials_t()
593
gnutls.certificate_allocate_credentials(
594
ctypes.byref(self._c_object))
595
self.type = gnutls.CRD_CERTIFICATE
598
gnutls.certificate_free_credentials(self._c_object)
600
class ClientSession(object):
601
def __init__(self, socket, credentials=None):
602
self._c_object = gnutls.session_t()
603
gnutls_flags = gnutls.CLIENT
604
if gnutls.check_version("3.5.6"):
605
gnutls_flags |= gnutls.NO_TICKETS
607
gnutls_flags |= gnutls.ENABLE_RAWPK
608
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
610
gnutls.set_default_priority(self._c_object)
611
gnutls.transport_set_ptr(self._c_object, socket.fileno())
612
gnutls.handshake_set_private_extensions(self._c_object,
615
if credentials is None:
616
credentials = gnutls.Credentials()
617
gnutls.credentials_set(self._c_object, credentials.type,
618
ctypes.cast(credentials._c_object,
620
self.credentials = credentials
623
gnutls.deinit(self._c_object)
626
return gnutls.handshake(self._c_object)
628
def send(self, data):
632
data_len -= gnutls.record_send(self._c_object,
637
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
639
# Error handling functions
640
def _error_code(result):
641
"""A function to raise exceptions on errors, suitable
642
for the 'restype' attribute on ctypes functions"""
645
if result == gnutls.E_NO_CERTIFICATE_FOUND:
646
raise gnutls.CertificateSecurityError(code=result)
647
raise gnutls.Error(code=result)
649
def _retry_on_error(result, func, arguments):
650
"""A function to retry on some errors, suitable
651
for the 'errcheck' attribute on ctypes functions"""
653
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
654
return _error_code(result)
655
result = func(*arguments)
658
# Unless otherwise indicated, the function declarations below are
659
# all from the gnutls/gnutls.h C header file.
662
priority_set_direct = _library.gnutls_priority_set_direct
663
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
664
ctypes.POINTER(ctypes.c_char_p)]
665
priority_set_direct.restype = _error_code
667
init = _library.gnutls_init
668
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
669
init.restype = _error_code
671
set_default_priority = _library.gnutls_set_default_priority
672
set_default_priority.argtypes = [session_t]
673
set_default_priority.restype = _error_code
675
record_send = _library.gnutls_record_send
676
record_send.argtypes = [session_t, ctypes.c_void_p,
678
record_send.restype = ctypes.c_ssize_t
679
record_send.errcheck = _retry_on_error
681
certificate_allocate_credentials = (
682
_library.gnutls_certificate_allocate_credentials)
683
certificate_allocate_credentials.argtypes = [
684
ctypes.POINTER(certificate_credentials_t)]
685
certificate_allocate_credentials.restype = _error_code
687
certificate_free_credentials = (
688
_library.gnutls_certificate_free_credentials)
689
certificate_free_credentials.argtypes = [
690
certificate_credentials_t]
691
certificate_free_credentials.restype = None
693
handshake_set_private_extensions = (
694
_library.gnutls_handshake_set_private_extensions)
695
handshake_set_private_extensions.argtypes = [session_t,
697
handshake_set_private_extensions.restype = None
699
credentials_set = _library.gnutls_credentials_set
700
credentials_set.argtypes = [session_t, credentials_type_t,
702
credentials_set.restype = _error_code
704
strerror = _library.gnutls_strerror
705
strerror.argtypes = [ctypes.c_int]
706
strerror.restype = ctypes.c_char_p
708
certificate_type_get = _library.gnutls_certificate_type_get
709
certificate_type_get.argtypes = [session_t]
710
certificate_type_get.restype = _error_code
712
certificate_get_peers = _library.gnutls_certificate_get_peers
713
certificate_get_peers.argtypes = [session_t,
714
ctypes.POINTER(ctypes.c_uint)]
715
certificate_get_peers.restype = ctypes.POINTER(datum_t)
717
global_set_log_level = _library.gnutls_global_set_log_level
718
global_set_log_level.argtypes = [ctypes.c_int]
719
global_set_log_level.restype = None
721
global_set_log_function = _library.gnutls_global_set_log_function
722
global_set_log_function.argtypes = [log_func]
723
global_set_log_function.restype = None
725
deinit = _library.gnutls_deinit
726
deinit.argtypes = [session_t]
727
deinit.restype = None
729
handshake = _library.gnutls_handshake
730
handshake.argtypes = [session_t]
731
handshake.restype = _error_code
732
handshake.errcheck = _retry_on_error
734
transport_set_ptr = _library.gnutls_transport_set_ptr
735
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
736
transport_set_ptr.restype = None
738
bye = _library.gnutls_bye
739
bye.argtypes = [session_t, close_request_t]
740
bye.restype = _error_code
741
bye.errcheck = _retry_on_error
743
check_version = _library.gnutls_check_version
744
check_version.argtypes = [ctypes.c_char_p]
745
check_version.restype = ctypes.c_char_p
747
has_rawpk = bool(check_version(_tls_rawpk_version))
751
class pubkey_st(ctypes.Structure):
753
pubkey_t = ctypes.POINTER(pubkey_st)
755
x509_crt_fmt_t = ctypes.c_int
757
# All the function declarations below are from gnutls/abstract.h
758
pubkey_init = _library.gnutls_pubkey_init
759
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
760
pubkey_init.restype = _error_code
762
pubkey_import = _library.gnutls_pubkey_import
763
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
765
pubkey_import.restype = _error_code
767
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
768
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
769
ctypes.POINTER(ctypes.c_ubyte),
770
ctypes.POINTER(ctypes.c_size_t)]
771
pubkey_get_key_id.restype = _error_code
773
pubkey_deinit = _library.gnutls_pubkey_deinit
774
pubkey_deinit.argtypes = [pubkey_t]
775
pubkey_deinit.restype = None
777
# All the function declarations below are from gnutls/openpgp.h
779
openpgp_crt_init = _library.gnutls_openpgp_crt_init
780
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
781
openpgp_crt_init.restype = _error_code
783
openpgp_crt_import = _library.gnutls_openpgp_crt_import
784
openpgp_crt_import.argtypes = [openpgp_crt_t,
785
ctypes.POINTER(datum_t),
787
openpgp_crt_import.restype = _error_code
789
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
790
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
791
ctypes.POINTER(ctypes.c_uint)]
792
openpgp_crt_verify_self.restype = _error_code
794
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
795
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
796
openpgp_crt_deinit.restype = None
798
openpgp_crt_get_fingerprint = (
799
_library.gnutls_openpgp_crt_get_fingerprint)
800
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
804
openpgp_crt_get_fingerprint.restype = _error_code
806
if check_version("3.6.4"):
807
certificate_type_get2 = _library.gnutls_certificate_type_get2
808
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
809
certificate_type_get2.restype = _error_code
811
# Remove non-public functions
812
del _error_code, _retry_on_error
813
# Create the global "gnutls" object, simulating a module
817
def call_pipe(connection, # : multiprocessing.Connection
818
func, *args, **kwargs):
819
"""This function is meant to be called by multiprocessing.Process
821
This function runs func(*args, **kwargs), and writes the resulting
822
return value on the provided multiprocessing.Connection.
824
connection.send(func(*args, **kwargs))
380
def timedelta_to_milliseconds(td):
381
"Convert a datetime.timedelta() to milliseconds"
382
return ((td.days * 24 * 60 * 60 * 1000)
383
+ (td.seconds * 1000)
384
+ (td.microseconds // 1000))
828
386
class Client(object):
829
387
"""A representation of a client host served by this server.
832
390
approved: bool(); 'None' if not yet approved/disapproved
833
391
approval_delay: datetime.timedelta(); Time to wait for approval
835
393
checker: subprocess.Popen(); a running checker process used
836
394
to see if the client lives.
837
395
'None' if no process is running.
838
checker_callback_tag: a GLib event source tag, or None
396
checker_callback_tag: a gobject event source tag, or None
839
397
checker_command: string; External command which is run to check
840
398
if client lives. %() expansions are done at
841
399
runtime with vars(self) as dict, so that for
842
400
instance %(name)s can be used in the command.
843
checker_initiator_tag: a GLib event source tag, or None
401
checker_initiator_tag: a gobject event source tag, or None
844
402
created: datetime.datetime(); (UTC) object creation
845
403
client_structure: Object describing what attributes a client has
846
404
and is used for storing the client at exit
847
405
current_checker_command: string; current running checker_command
848
disable_initiator_tag: a GLib event source tag, or None
406
disable_initiator_tag: a gobject event source tag, or None
850
408
fingerprint: string (40 or 32 hexadecimal digits); used to
851
uniquely identify an OpenPGP client
852
key_id: string (64 hexadecimal digits); used to uniquely identify
853
a client using raw public keys
409
uniquely identify the client
854
410
host: string; available for use by the checker command
855
411
interval: datetime.timedelta(); How often to start a new checker
856
412
last_approval_request: datetime.datetime(); (UTC) or None
857
413
last_checked_ok: datetime.datetime(); (UTC) or None
858
414
last_checker_status: integer between 0 and 255 reflecting exit
859
415
status of last checker. -1 reflects crashed
860
checker, -2 means no checker completed yet.
861
last_checker_signal: The signal which killed the last checker, if
862
last_checker_status is -1
863
417
last_enabled: datetime.datetime(); (UTC) or None
864
418
name: string; from the config file, used in log messages and
865
419
D-Bus identifiers
866
420
secret: bytestring; sent verbatim (over TLS) to client
867
421
timeout: datetime.timedelta(); How long from last_checked_ok
868
422
until this client is disabled
869
extended_timeout: extra long timeout when secret has been sent
423
extended_timeout: extra long timeout when password has been sent
870
424
runtime_expansions: Allowed attributes for runtime expansion.
871
425
expires: datetime.datetime(); time (UTC) when a client will be
872
426
disabled, or None
873
server_settings: The server_settings dict from main()
876
429
runtime_expansions = ("approval_delay", "approval_duration",
877
"created", "enabled", "expires", "key_id",
878
"fingerprint", "host", "interval",
879
"last_approval_request", "last_checked_ok",
430
"created", "enabled", "fingerprint",
431
"host", "interval", "last_checked_ok",
880
432
"last_enabled", "name", "timeout")
883
"extended_timeout": "PT15M",
885
"checker": "fping -q -- %%(host)s",
887
"approval_delay": "PT0S",
888
"approval_duration": "PT1S",
889
"approved_by_default": "True",
433
client_defaults = { "timeout": "5m",
434
"extended_timeout": "15m",
436
"checker": "fping -q -- %%(host)s",
438
"approval_delay": "0s",
439
"approval_duration": "1s",
440
"approved_by_default": "True",
444
def timeout_milliseconds(self):
445
"Return the 'timeout' attribute in milliseconds"
446
return timedelta_to_milliseconds(self.timeout)
448
def extended_timeout_milliseconds(self):
449
"Return the 'extended_timeout' attribute in milliseconds"
450
return timedelta_to_milliseconds(self.extended_timeout)
452
def interval_milliseconds(self):
453
"Return the 'interval' attribute in milliseconds"
454
return timedelta_to_milliseconds(self.interval)
456
def approval_delay_milliseconds(self):
457
return timedelta_to_milliseconds(self.approval_delay)
894
460
def config_parser(config):
895
"""Construct a new dict of client settings of this form:
461
""" Construct a new dict of client settings of this form:
896
462
{ client_name: {setting_name: value, ...}, ...}
897
with exceptions for any special settings as defined above.
898
NOTE: Must be a pure function. Must return the same result
899
value given the same arguments.
463
with exceptions for any special settings as defined above"""
902
465
for client_name in config.sections():
903
466
section = dict(config.items(client_name))
904
467
client = settings[client_name] = {}
906
469
client["host"] = section["host"]
907
470
# Reformat values from string types to Python types
908
471
client["approved_by_default"] = config.getboolean(
909
472
client_name, "approved_by_default")
910
client["enabled"] = config.getboolean(client_name,
913
# Uppercase and remove spaces from key_id and fingerprint
914
# for later comparison purposes with return value from the
915
# key_id() and fingerprint() functions
916
client["key_id"] = (section.get("key_id", "").upper()
473
client["enabled"] = config.getboolean(client_name, "enabled")
918
475
client["fingerprint"] = (section["fingerprint"].upper()
919
476
.replace(" ", ""))
920
477
if "secret" in section:
921
client["secret"] = codecs.decode(section["secret"]
478
client["secret"] = section["secret"].decode("base64")
924
479
elif "secfile" in section:
925
480
with open(os.path.expanduser(os.path.expandvars
926
481
(section["secfile"])),
927
482
"rb") as secfile:
928
483
client["secret"] = secfile.read()
930
raise TypeError("No secret or secfile for section {}"
485
raise TypeError("No secret or secfile for section %s"
932
487
client["timeout"] = string_to_delta(section["timeout"])
933
488
client["extended_timeout"] = string_to_delta(
934
489
section["extended_timeout"])
977
531
self.current_checker_command = None
978
532
self.approved = None
979
533
self.approvals_pending = 0
980
self.changedstate = multiprocessing_manager.Condition(
981
multiprocessing_manager.Lock())
982
self.client_structure = [attr
983
for attr in self.__dict__.keys()
534
self.changedstate = (multiprocessing_manager
535
.Condition(multiprocessing_manager
537
self.client_structure = [attr for attr in
538
self.__dict__.iterkeys()
984
539
if not attr.startswith("_")]
985
540
self.client_structure.append("client_structure")
987
for name, t in inspect.getmembers(
988
type(self), lambda obj: isinstance(obj, property)):
542
for name, t in inspect.getmembers(type(self),
989
546
if not name.startswith("_"):
990
547
self.client_structure.append(name)
992
549
# Send notice to process children that client state has changed
993
550
def send_changedstate(self):
994
551
with self.changedstate:
995
552
self.changedstate.notify_all()
997
554
def enable(self):
998
555
"""Start this client's checker and timeout hooks"""
999
556
if getattr(self, "enabled", False):
1000
557
# Already enabled
559
self.send_changedstate()
1002
560
self.expires = datetime.datetime.utcnow() + self.timeout
1003
561
self.enabled = True
1004
562
self.last_enabled = datetime.datetime.utcnow()
1005
563
self.init_checker()
1006
self.send_changedstate()
1008
565
def disable(self, quiet=True):
1009
566
"""Disable this client."""
1010
567
if not getattr(self, "enabled", False):
570
self.send_changedstate()
1013
572
logger.info("Disabling client %s", self.name)
1014
if getattr(self, "disable_initiator_tag", None) is not None:
1015
GLib.source_remove(self.disable_initiator_tag)
573
if getattr(self, "disable_initiator_tag", False):
574
gobject.source_remove(self.disable_initiator_tag)
1016
575
self.disable_initiator_tag = None
1017
576
self.expires = None
1018
if getattr(self, "checker_initiator_tag", None) is not None:
1019
GLib.source_remove(self.checker_initiator_tag)
577
if getattr(self, "checker_initiator_tag", False):
578
gobject.source_remove(self.checker_initiator_tag)
1020
579
self.checker_initiator_tag = None
1021
580
self.stop_checker()
1022
581
self.enabled = False
1024
self.send_changedstate()
1025
# Do not run this again if called by a GLib.timeout_add
582
# Do not run this again if called by a gobject.timeout_add
1028
585
def __del__(self):
1031
588
def init_checker(self):
1032
589
# Schedule a new checker to be started an 'interval' from now,
1033
590
# and every interval from then on.
1034
if self.checker_initiator_tag is not None:
1035
GLib.source_remove(self.checker_initiator_tag)
1036
self.checker_initiator_tag = GLib.timeout_add(
1037
int(self.interval.total_seconds() * 1000),
591
self.checker_initiator_tag = (gobject.timeout_add
592
(self.interval_milliseconds(),
1039
594
# Schedule a disable() when 'timeout' has passed
1040
if self.disable_initiator_tag is not None:
1041
GLib.source_remove(self.disable_initiator_tag)
1042
self.disable_initiator_tag = GLib.timeout_add(
1043
int(self.timeout.total_seconds() * 1000), self.disable)
595
self.disable_initiator_tag = (gobject.timeout_add
596
(self.timeout_milliseconds(),
1044
598
# Also start a new checker *right now*.
1045
599
self.start_checker()
1047
def checker_callback(self, source, condition, connection,
601
def checker_callback(self, pid, condition, command):
1049
602
"""The checker has completed, so take appropriate actions."""
1050
603
self.checker_callback_tag = None
1051
604
self.checker = None
1052
# Read return code from connection (see call_pipe)
1053
returncode = connection.recv()
1057
self.last_checker_status = returncode
1058
self.last_checker_signal = None
605
if os.WIFEXITED(condition):
606
self.last_checker_status = os.WEXITSTATUS(condition)
1059
607
if self.last_checker_status == 0:
1060
608
logger.info("Checker for %(name)s succeeded",
1062
610
self.checked_ok()
1064
logger.info("Checker for %(name)s failed", vars(self))
612
logger.info("Checker for %(name)s failed",
1066
615
self.last_checker_status = -1
1067
self.last_checker_signal = -returncode
1068
616
logger.warning("Checker for %(name)s crashed?",
1072
def checked_ok(self):
1073
"""Assert that the client has been seen, alive and well."""
1074
self.last_checked_ok = datetime.datetime.utcnow()
1075
self.last_checker_status = 0
1076
self.last_checker_signal = None
1079
def bump_timeout(self, timeout=None):
1080
"""Bump up the timeout for this client."""
619
def checked_ok(self, timeout=None):
620
"""Bump up the timeout for this client.
622
This should only be called when the client has been seen,
1081
625
if timeout is None:
1082
626
timeout = self.timeout
627
self.last_checked_ok = datetime.datetime.utcnow()
1083
628
if self.disable_initiator_tag is not None:
1084
GLib.source_remove(self.disable_initiator_tag)
1085
self.disable_initiator_tag = None
629
gobject.source_remove(self.disable_initiator_tag)
1086
630
if getattr(self, "enabled", False):
1087
self.disable_initiator_tag = GLib.timeout_add(
1088
int(timeout.total_seconds() * 1000), self.disable)
631
self.disable_initiator_tag = (gobject.timeout_add
632
(timedelta_to_milliseconds
633
(timeout), self.disable))
1089
634
self.expires = datetime.datetime.utcnow() + timeout
1091
636
def need_approval(self):
1092
637
self.last_approval_request = datetime.datetime.utcnow()
1094
639
def start_checker(self):
1095
640
"""Start a new checker subprocess if one is not running.
1097
642
If a checker already exists, leave it running and do
1099
644
# The reason for not killing a running checker is that if we
1100
# did that, and if a checker (for some reason) started running
1101
# slowly and taking more than 'interval' time, then the client
1102
# would inevitably timeout, since no checker would get a
1103
# chance to run to completion. If we instead leave running
645
# did that, then if a checker (for some reason) started
646
# running slowly and taking more than 'interval' time, the
647
# client would inevitably timeout, since no checker would get
648
# a chance to run to completion. If we instead leave running
1104
649
# checkers alone, the checker would have to take more time
1105
650
# than 'timeout' for the client to be disabled, which is as it
1108
if self.checker is not None and not self.checker.is_alive():
1109
logger.warning("Checker was not alive; joining")
653
# If a checker exists, make sure it is not a zombie
655
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
656
except (AttributeError, OSError) as error:
657
if (isinstance(error, OSError)
658
and error.errno != errno.ECHILD):
662
logger.warning("Checker was a zombie")
663
gobject.source_remove(self.checker_callback_tag)
664
self.checker_callback(pid, status,
665
self.current_checker_command)
1112
666
# Start a new checker if needed
1113
667
if self.checker is None:
1114
# Escape attributes for the shell
1116
attr: re.escape(str(getattr(self, attr)))
1117
for attr in self.runtime_expansions}
1119
command = self.checker_command % escaped_attrs
1120
except TypeError as error:
1121
logger.error('Could not format string "%s"',
1122
self.checker_command,
1124
return True # Try again later
669
# In case checker_command has exactly one % operator
670
command = self.checker_command % self.host
672
# Escape attributes for the shell
673
escaped_attrs = dict(
675
re.escape(unicode(str(getattr(self, attr, "")),
679
self.runtime_expansions)
682
command = self.checker_command % escaped_attrs
683
except TypeError as error:
684
logger.error('Could not format string "%s":'
685
' %s', self.checker_command, error)
686
return True # Try again later
1125
687
self.current_checker_command = command
1126
logger.info("Starting checker %r for %s", command,
1128
# We don't need to redirect stdout and stderr, since
1129
# in normal mode, that is already done by daemon(),
1130
# and in debug mode we don't want to. (Stdin is
1131
# always replaced by /dev/null.)
1132
# The exception is when not debugging but nevertheless
1133
# running in the foreground; use the previously
1135
popen_args = {"close_fds": True,
1138
if (not self.server_settings["debug"]
1139
and self.server_settings["foreground"]):
1140
popen_args.update({"stdout": wnull,
1142
pipe = multiprocessing.Pipe(duplex=False)
1143
self.checker = multiprocessing.Process(
1145
args=(pipe[1], subprocess.call, command),
1147
self.checker.start()
1148
self.checker_callback_tag = GLib.io_add_watch(
1149
pipe[0].fileno(), GLib.IO_IN,
1150
self.checker_callback, pipe[0], command)
1151
# Re-run this periodically if run by GLib.timeout_add
689
logger.info("Starting checker %r for %s",
691
# We don't need to redirect stdout and stderr, since
692
# in normal mode, that is already done by daemon(),
693
# and in debug mode we don't want to. (Stdin is
694
# always replaced by /dev/null.)
695
self.checker = subprocess.Popen(command,
698
self.checker_callback_tag = (gobject.child_watch_add
700
self.checker_callback,
702
# The checker may have completed before the gobject
703
# watch was added. Check for this.
704
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
706
gobject.source_remove(self.checker_callback_tag)
707
self.checker_callback(pid, status, command)
708
except OSError as error:
709
logger.error("Failed to start subprocess: %s",
711
# Re-run this periodically if run by gobject.timeout_add
1154
714
def stop_checker(self):
1155
715
"""Force the checker process, if any, to stop."""
1156
716
if self.checker_callback_tag:
1157
GLib.source_remove(self.checker_callback_tag)
717
gobject.source_remove(self.checker_callback_tag)
1158
718
self.checker_callback_tag = None
1159
719
if getattr(self, "checker", None) is None:
1161
721
logger.debug("Stopping checker for %(name)s", vars(self))
1162
self.checker.terminate()
723
os.kill(self.checker.pid, signal.SIGTERM)
725
#if self.checker.poll() is None:
726
# os.kill(self.checker.pid, signal.SIGKILL)
727
except OSError as error:
728
if error.errno != errno.ESRCH: # No such process
1163
730
self.checker = None
1166
def dbus_service_property(dbus_interface,
733
def dbus_service_property(dbus_interface, signature="v",
734
access="readwrite", byte_arrays=False):
1170
735
"""Decorators for marking methods of a DBusObjectWithProperties to
1171
736
become properties on the D-Bus.
1173
738
The decorated method will be called with no arguments by "Get"
1174
739
and with one argument by "Set".
1176
741
The parameters, where they are supported, are the same as
1177
742
dbus.service.method, except there is only "signature", since the
1178
743
type from Get() and the type sent to Set() is the same.
1261
class DBusObjectWithAnnotations(dbus.service.Object):
1262
"""A D-Bus object with annotations.
1264
Classes inheriting from this can use the dbus_annotations
1265
decorator to add annotations to methods or signals.
1269
def _is_dbus_thing(thing):
1270
"""Returns a function testing if an attribute is a D-Bus thing
1272
If called like _is_dbus_thing("method") it returns a function
1273
suitable for use as predicate to inspect.getmembers().
1275
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
1278
def _get_all_dbus_things(self, thing):
1279
"""Returns a generator of (name, attribute) pairs
1281
return ((getattr(athing.__get__(self), "_dbus_name", name),
1282
athing.__get__(self))
1283
for cls in self.__class__.__mro__
1285
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1287
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1289
path_keyword='object_path',
1290
connection_keyword='connection')
1291
def Introspect(self, object_path, connection):
1292
"""Overloading of standard D-Bus method.
1294
Inserts annotation tags on methods and signals.
1296
xmlstring = dbus.service.Object.Introspect(self, object_path,
1299
document = xml.dom.minidom.parseString(xmlstring)
1301
for if_tag in document.getElementsByTagName("interface"):
1302
# Add annotation tags
1303
for typ in ("method", "signal"):
1304
for tag in if_tag.getElementsByTagName(typ):
1306
for name, prop in (self.
1307
_get_all_dbus_things(typ)):
1308
if (name == tag.getAttribute("name")
1309
and prop._dbus_interface
1310
== if_tag.getAttribute("name")):
1311
annots.update(getattr(
1312
prop, "_dbus_annotations", {}))
1313
for name, value in annots.items():
1314
ann_tag = document.createElement(
1316
ann_tag.setAttribute("name", name)
1317
ann_tag.setAttribute("value", value)
1318
tag.appendChild(ann_tag)
1319
# Add interface annotation tags
1320
for annotation, value in dict(
1321
itertools.chain.from_iterable(
1322
annotations().items()
1323
for name, annotations
1324
in self._get_all_dbus_things("interface")
1325
if name == if_tag.getAttribute("name")
1327
ann_tag = document.createElement("annotation")
1328
ann_tag.setAttribute("name", annotation)
1329
ann_tag.setAttribute("value", value)
1330
if_tag.appendChild(ann_tag)
1331
# Fix argument name for the Introspect method itself
1332
if (if_tag.getAttribute("name")
1333
== dbus.INTROSPECTABLE_IFACE):
1334
for cn in if_tag.getElementsByTagName("method"):
1335
if cn.getAttribute("name") == "Introspect":
1336
for arg in cn.getElementsByTagName("arg"):
1337
if (arg.getAttribute("direction")
1339
arg.setAttribute("name",
1341
xmlstring = document.toxml("utf-8")
1343
except (AttributeError, xml.dom.DOMException,
1344
xml.parsers.expat.ExpatError) as error:
1345
logger.error("Failed to override Introspection method",
1350
class DBusObjectWithProperties(DBusObjectWithAnnotations):
782
class DBusObjectWithProperties(dbus.service.Object):
1351
783
"""A D-Bus object with properties.
1353
785
Classes inheriting from this can use the dbus_service_property
1354
786
decorator to expose methods as D-Bus properties. It exposes the
1355
787
standard Get(), Set(), and GetAll() methods on the D-Bus.
791
def _is_dbus_property(obj):
792
return getattr(obj, "_dbus_is_property", False)
794
def _get_all_dbus_properties(self):
795
"""Returns a generator of (name, attribute) pairs
797
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
798
for cls in self.__class__.__mro__
800
inspect.getmembers(cls, self._is_dbus_property))
1358
802
def _get_dbus_property(self, interface_name, property_name):
1359
803
"""Returns a bound method if one exists which is a D-Bus
1360
804
property with the specified name and interface.
1362
for cls in self.__class__.__mro__:
1363
for name, value in inspect.getmembers(
1364
cls, self._is_dbus_thing("property")):
806
for cls in self.__class__.__mro__:
807
for name, value in (inspect.getmembers
808
(cls, self._is_dbus_property)):
1365
809
if (value._dbus_name == property_name
1366
810
and value._dbus_interface == interface_name):
1367
811
return value.__get__(self)
1369
813
# No such property
1370
raise DBusPropertyNotFound("{}:{}.{}".format(
1371
self.dbus_object_path, interface_name, property_name))
1374
def _get_all_interface_names(cls):
1375
"""Get a sequence of all interfaces supported by an object"""
1376
return (name for name in set(getattr(getattr(x, attr),
1377
"_dbus_interface", None)
1378
for x in (inspect.getmro(cls))
1380
if name is not None)
1382
@dbus.service.method(dbus.PROPERTIES_IFACE,
814
raise DBusPropertyNotFound(self.dbus_object_path + ":"
815
+ interface_name + "."
818
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1384
819
out_signature="v")
1385
820
def Get(self, interface_name, property_name):
1386
821
"""Standard D-Bus property Get() method, see D-Bus standard.
1433
865
if not hasattr(value, "variant_level"):
1434
866
properties[name] = value
1436
properties[name] = type(value)(
1437
value, variant_level=value.variant_level + 1)
868
properties[name] = type(value)(value, variant_level=
869
value.variant_level+1)
1438
870
return dbus.Dictionary(properties, signature="sv")
1440
@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
1441
def PropertiesChanged(self, interface_name, changed_properties,
1442
invalidated_properties):
1443
"""Standard D-Bus PropertiesChanged() signal, see D-Bus
1448
872
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1449
873
out_signature="s",
1450
874
path_keyword='object_path',
1451
875
connection_keyword='connection')
1452
876
def Introspect(self, object_path, connection):
1453
"""Overloading of standard D-Bus method.
1455
Inserts property tags and interface annotation tags.
877
"""Standard D-Bus method, overloaded to insert property tags.
1457
xmlstring = DBusObjectWithAnnotations.Introspect(self,
879
xmlstring = dbus.service.Object.Introspect(self, object_path,
1461
882
document = xml.dom.minidom.parseString(xmlstring)
1463
883
def make_tag(document, name, prop):
1464
884
e = document.createElement("property")
1465
885
e.setAttribute("name", name)
1466
886
e.setAttribute("type", prop._dbus_signature)
1467
887
e.setAttribute("access", prop._dbus_access)
1470
889
for if_tag in document.getElementsByTagName("interface"):
1472
890
for tag in (make_tag(document, name, prop)
1474
in self._get_all_dbus_things("property")
892
in self._get_all_dbus_properties()
1475
893
if prop._dbus_interface
1476
894
== if_tag.getAttribute("name")):
1477
895
if_tag.appendChild(tag)
1478
# Add annotation tags for properties
1479
for tag in if_tag.getElementsByTagName("property"):
1481
for name, prop in self._get_all_dbus_things(
1483
if (name == tag.getAttribute("name")
1484
and prop._dbus_interface
1485
== if_tag.getAttribute("name")):
1486
annots.update(getattr(
1487
prop, "_dbus_annotations", {}))
1488
for name, value in annots.items():
1489
ann_tag = document.createElement(
1491
ann_tag.setAttribute("name", name)
1492
ann_tag.setAttribute("value", value)
1493
tag.appendChild(ann_tag)
1494
896
# Add the names to the return values for the
1495
897
# "org.freedesktop.DBus.Properties" methods
1496
898
if (if_tag.getAttribute("name")
1511
913
except (AttributeError, xml.dom.DOMException,
1512
914
xml.parsers.expat.ExpatError) as error:
1513
915
logger.error("Failed to override Introspection method",
1519
dbus.OBJECT_MANAGER_IFACE
1520
except AttributeError:
1521
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1524
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1525
"""A D-Bus object with an ObjectManager.
1527
Classes inheriting from this exposes the standard
1528
GetManagedObjects call and the InterfacesAdded and
1529
InterfacesRemoved signals on the standard
1530
"org.freedesktop.DBus.ObjectManager" interface.
1532
Note: No signals are sent automatically; they must be sent
1535
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1536
out_signature="a{oa{sa{sv}}}")
1537
def GetManagedObjects(self):
1538
"""This function must be overridden"""
1539
raise NotImplementedError()
1541
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1542
signature="oa{sa{sv}}")
1543
def InterfacesAdded(self, object_path, interfaces_and_properties):
1546
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1547
def InterfacesRemoved(self, object_path, interfaces):
1550
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1552
path_keyword='object_path',
1553
connection_keyword='connection')
1554
def Introspect(self, object_path, connection):
1555
"""Overloading of standard D-Bus method.
1557
Override return argument name of GetManagedObjects to be
1558
"objpath_interfaces_and_properties"
1560
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1564
document = xml.dom.minidom.parseString(xmlstring)
1566
for if_tag in document.getElementsByTagName("interface"):
1567
# Fix argument name for the GetManagedObjects method
1568
if (if_tag.getAttribute("name")
1569
== dbus.OBJECT_MANAGER_IFACE):
1570
for cn in if_tag.getElementsByTagName("method"):
1571
if (cn.getAttribute("name")
1572
== "GetManagedObjects"):
1573
for arg in cn.getElementsByTagName("arg"):
1574
if (arg.getAttribute("direction")
1578
"objpath_interfaces"
1580
xmlstring = document.toxml("utf-8")
1582
except (AttributeError, xml.dom.DOMException,
1583
xml.parsers.expat.ExpatError) as error:
1584
logger.error("Failed to override Introspection method",
1589
def datetime_to_dbus(dt, variant_level=0):
920
def datetime_to_dbus (dt, variant_level=0):
1590
921
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1592
return dbus.String("", variant_level=variant_level)
1593
return dbus.String(dt.isoformat(), variant_level=variant_level)
1596
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1597
"""A class decorator; applied to a subclass of
1598
dbus.service.Object, it will add alternate D-Bus attributes with
1599
interface names according to the "alt_interface_names" mapping.
1602
@alternate_dbus_interfaces({"org.example.Interface":
1603
"net.example.AlternateInterface"})
1604
class SampleDBusObject(dbus.service.Object):
1605
@dbus.service.method("org.example.Interface")
1606
def SampleDBusMethod():
1609
The above "SampleDBusMethod" on "SampleDBusObject" will be
1610
reachable via two interfaces: "org.example.Interface" and
1611
"net.example.AlternateInterface", the latter of which will have
1612
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1613
"true", unless "deprecate" is passed with a False value.
1615
This works for methods and signals, and also for D-Bus properties
1616
(from DBusObjectWithProperties) and interfaces (from the
1617
dbus_interface_annotations decorator).
923
return dbus.String("", variant_level = variant_level)
924
return dbus.String(dt.isoformat(),
925
variant_level=variant_level)
928
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
930
"""Applied to an empty subclass of a D-Bus object, this metaclass
931
will add additional D-Bus attributes matching a certain pattern.
1621
for orig_interface_name, alt_interface_name in (
1622
alt_interface_names.items()):
1624
interface_names = set()
1625
# Go though all attributes of the class
1626
for attrname, attribute in inspect.getmembers(cls):
933
def __new__(mcs, name, bases, attr):
934
# Go through all the base classes which could have D-Bus
935
# methods, signals, or properties in them
936
for base in (b for b in bases
937
if issubclass(b, dbus.service.Object)):
938
# Go though all attributes of the base class
939
for attrname, attribute in inspect.getmembers(base):
1627
940
# Ignore non-D-Bus attributes, and D-Bus attributes
1628
941
# with the wrong interface name
1629
942
if (not hasattr(attribute, "_dbus_interface")
1630
or not attribute._dbus_interface.startswith(
1631
orig_interface_name)):
943
or not attribute._dbus_interface
944
.startswith("se.recompile.Mandos")):
1633
946
# Create an alternate D-Bus interface name based on
1634
947
# the current name
1635
alt_interface = attribute._dbus_interface.replace(
1636
orig_interface_name, alt_interface_name)
1637
interface_names.add(alt_interface)
948
alt_interface = (attribute._dbus_interface
949
.replace("se.recompile.Mandos",
950
"se.bsnet.fukt.Mandos"))
1638
951
# Is this a D-Bus signal?
1639
952
if getattr(attribute, "_dbus_is_signal", False):
1640
# Extract the original non-method undecorated
1641
# function by black magic
1642
if sys.version_info.major == 2:
1643
nonmethod_func = (dict(
953
# Extract the original non-method function by
955
nonmethod_func = (dict(
1644
956
zip(attribute.func_code.co_freevars,
1645
attribute.__closure__))
1646
["func"].cell_contents)
1648
nonmethod_func = (dict(
1649
zip(attribute.__code__.co_freevars,
1650
attribute.__closure__))
1651
["func"].cell_contents)
957
attribute.__closure__))["func"]
1652
959
# Create a new, but exactly alike, function
1653
960
# object, and decorate it to be a new D-Bus signal
1654
961
# with the alternate D-Bus interface name
1655
new_function = copy_function(nonmethod_func)
1656
new_function = (dbus.service.signal(
1658
attribute._dbus_signature)(new_function))
1659
# Copy annotations, if any
1661
new_function._dbus_annotations = dict(
1662
attribute._dbus_annotations)
1663
except AttributeError:
962
new_function = (dbus.service.signal
964
attribute._dbus_signature)
966
nonmethod_func.func_code,
967
nonmethod_func.func_globals,
968
nonmethod_func.func_name,
969
nonmethod_func.func_defaults,
970
nonmethod_func.func_closure)))
1666
971
# Define a creator of a function to call both the
1667
# original and alternate functions, so both the
1668
# original and alternate signals gets sent when
1669
# the function is called
972
# old and new functions, so both the old and new
973
# signals gets sent when the function is called
1670
974
def fixscope(func1, func2):
1671
975
"""This function is a scope container to pass
1672
976
func1 and func2 to the "call_both" function
1673
977
outside of its arguments"""
1675
@functools.wraps(func2)
1676
978
def call_both(*args, **kwargs):
1677
979
"""This function will emit two D-Bus
1678
980
signals by calling func1 and func2"""
1679
981
func1(*args, **kwargs)
1680
982
func2(*args, **kwargs)
1681
# Make wrapper function look like a D-Bus
1683
for name, attr in inspect.getmembers(func2):
1684
if name.startswith("_dbus_"):
1685
setattr(call_both, name, attr)
1687
983
return call_both
1688
984
# Create the "call_both" function and add it to
1690
attr[attrname] = fixscope(attribute, new_function)
986
attr[attrname] = fixscope(attribute,
1691
988
# Is this a D-Bus method?
1692
989
elif getattr(attribute, "_dbus_is_method", False):
1693
990
# Create a new, but exactly alike, function
1694
991
# object. Decorate it to be a new D-Bus method
1695
992
# with the alternate D-Bus interface name. Add it
1698
dbus.service.method(
1700
attribute._dbus_in_signature,
1701
attribute._dbus_out_signature)
1702
(copy_function(attribute)))
1703
# Copy annotations, if any
1705
attr[attrname]._dbus_annotations = dict(
1706
attribute._dbus_annotations)
1707
except AttributeError:
994
attr[attrname] = (dbus.service.method
996
attribute._dbus_in_signature,
997
attribute._dbus_out_signature)
999
(attribute.func_code,
1000
attribute.func_globals,
1001
attribute.func_name,
1002
attribute.func_defaults,
1003
attribute.func_closure)))
1709
1004
# Is this a D-Bus property?
1710
1005
elif getattr(attribute, "_dbus_is_property", False):
1711
1006
# Create a new, but exactly alike, function
1712
1007
# object, and decorate it to be a new D-Bus
1713
1008
# property with the alternate D-Bus interface
1714
1009
# name. Add it to the class.
1715
attr[attrname] = (dbus_service_property(
1716
alt_interface, attribute._dbus_signature,
1717
attribute._dbus_access,
1718
attribute._dbus_get_args_options
1720
(copy_function(attribute)))
1721
# Copy annotations, if any
1723
attr[attrname]._dbus_annotations = dict(
1724
attribute._dbus_annotations)
1725
except AttributeError:
1727
# Is this a D-Bus interface?
1728
elif getattr(attribute, "_dbus_is_interface", False):
1729
# Create a new, but exactly alike, function
1730
# object. Decorate it to be a new D-Bus interface
1731
# with the alternate D-Bus interface name. Add it
1734
dbus_interface_annotations(alt_interface)
1735
(copy_function(attribute)))
1737
# Deprecate all alternate interfaces
1738
iname = "_AlternateDBusNames_interface_annotation{}"
1739
for interface_name in interface_names:
1741
@dbus_interface_annotations(interface_name)
1743
return {"org.freedesktop.DBus.Deprecated":
1745
# Find an unused name
1746
for aname in (iname.format(i)
1747
for i in itertools.count()):
1748
if aname not in attr:
1752
# Replace the class with a new subclass of it with
1753
# methods, signals, etc. as created above.
1754
if sys.version_info.major == 2:
1755
cls = type(b"{}Alternate".format(cls.__name__),
1758
cls = type("{}Alternate".format(cls.__name__),
1765
@alternate_dbus_interfaces({"se.recompile.Mandos":
1766
"se.bsnet.fukt.Mandos"})
1010
attr[attrname] = (dbus_service_property
1012
attribute._dbus_signature,
1013
attribute._dbus_access,
1015
._dbus_get_args_options
1018
(attribute.func_code,
1019
attribute.func_globals,
1020
attribute.func_name,
1021
attribute.func_defaults,
1022
attribute.func_closure)))
1023
return type.__new__(mcs, name, bases, attr)
1767
1026
class ClientDBus(Client, DBusObjectWithProperties):
1768
1027
"""A Client class using D-Bus
1771
1030
dbus_object_path: dbus.ObjectPath
1772
1031
bus: dbus.SystemBus()
1775
1034
runtime_expansions = (Client.runtime_expansions
1776
+ ("dbus_object_path", ))
1778
_interface = "se.recompile.Mandos.Client"
1035
+ ("dbus_object_path",))
1780
1037
# dbus.service.Object doesn't use super(), so we can't either.
1782
def __init__(self, bus=None, *args, **kwargs):
1039
def __init__(self, bus = None, *args, **kwargs):
1784
1041
Client.__init__(self, *args, **kwargs)
1042
self._approvals_pending = 0
1044
self._approvals_pending = 0
1785
1045
# Only now, when this client is initialized, can it show up on
1787
client_object_name = str(self.name).translate(
1047
client_object_name = unicode(self.name).translate(
1788
1048
{ord("."): ord("_"),
1789
1049
ord("-"): ord("_")})
1790
self.dbus_object_path = dbus.ObjectPath(
1791
"/clients/" + client_object_name)
1050
self.dbus_object_path = (dbus.ObjectPath
1051
("/clients/" + client_object_name))
1792
1052
DBusObjectWithProperties.__init__(self, self.bus,
1793
1053
self.dbus_object_path)
1795
def notifychangeproperty(transform_func, dbus_name,
1796
type_func=lambda x: x,
1798
invalidate_only=False,
1799
_interface=_interface):
1055
def notifychangeproperty(transform_func,
1056
dbus_name, type_func=lambda x: x,
1800
1058
""" Modify a variable so that it's a property which announces
1801
1059
its changes to DBus.
1803
1061
transform_fun: Function that takes a value and a variant_level
1804
1062
and transforms it to a D-Bus type.
1805
1063
dbus_name: D-Bus name of the variable
1807
1065
to the D-Bus. Default: no transform
1808
1066
variant_level: D-Bus variant level. Default: 1
1810
attrname = "_{}".format(dbus_name)
1068
attrname = "_{0}".format(dbus_name)
1812
1069
def setter(self, value):
1813
1070
if hasattr(self, "dbus_object_path"):
1814
1071
if (not hasattr(self, attrname) or
1815
1072
type_func(getattr(self, attrname, None))
1816
1073
!= type_func(value)):
1818
self.PropertiesChanged(
1819
_interface, dbus.Dictionary(),
1820
dbus.Array((dbus_name, )))
1822
dbus_value = transform_func(
1824
variant_level=variant_level)
1825
self.PropertyChanged(dbus.String(dbus_name),
1827
self.PropertiesChanged(
1829
dbus.Dictionary({dbus.String(dbus_name):
1074
dbus_value = transform_func(type_func(value),
1077
self.PropertyChanged(dbus.String(dbus_name),
1832
1079
setattr(self, attrname, value)
1834
1081
return property(lambda self: getattr(self, attrname), setter)
1836
1084
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1837
1085
approvals_pending = notifychangeproperty(dbus.Boolean,
1838
1086
"ApprovalPending",
1840
1088
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1841
1089
last_enabled = notifychangeproperty(datetime_to_dbus,
1843
checker = notifychangeproperty(
1844
dbus.Boolean, "CheckerRunning",
1845
type_func=lambda checker: checker is not None)
1091
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1092
type_func = lambda checker:
1093
checker is not None)
1846
1094
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1847
1095
"LastCheckedOK")
1848
last_checker_status = notifychangeproperty(dbus.Int16,
1849
"LastCheckerStatus")
1850
1096
last_approval_request = notifychangeproperty(
1851
1097
datetime_to_dbus, "LastApprovalRequest")
1852
1098
approved_by_default = notifychangeproperty(dbus.Boolean,
1853
1099
"ApprovedByDefault")
1854
approval_delay = notifychangeproperty(
1855
dbus.UInt64, "ApprovalDelay",
1856
type_func=lambda td: td.total_seconds() * 1000)
1100
approval_delay = notifychangeproperty(dbus.UInt64,
1103
timedelta_to_milliseconds)
1857
1104
approval_duration = notifychangeproperty(
1858
1105
dbus.UInt64, "ApprovalDuration",
1859
type_func=lambda td: td.total_seconds() * 1000)
1106
type_func = timedelta_to_milliseconds)
1860
1107
host = notifychangeproperty(dbus.String, "Host")
1861
timeout = notifychangeproperty(
1862
dbus.UInt64, "Timeout",
1863
type_func=lambda td: td.total_seconds() * 1000)
1108
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1110
timedelta_to_milliseconds)
1864
1111
extended_timeout = notifychangeproperty(
1865
1112
dbus.UInt64, "ExtendedTimeout",
1866
type_func=lambda td: td.total_seconds() * 1000)
1867
interval = notifychangeproperty(
1868
dbus.UInt64, "Interval",
1869
type_func=lambda td: td.total_seconds() * 1000)
1113
type_func = timedelta_to_milliseconds)
1114
interval = notifychangeproperty(dbus.UInt64,
1117
timedelta_to_milliseconds)
1870
1118
checker_command = notifychangeproperty(dbus.String, "Checker")
1871
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1872
invalidate_only=True)
1874
1120
del notifychangeproperty
1876
1122
def __del__(self, *args, **kwargs):
1878
1124
self.remove_from_connection()
1957
1204
server to mandos-client
1961
1208
# Rejected - signal
1962
1209
@dbus.service.signal(_interface, signature="s")
1963
1210
def Rejected(self, reason):
1967
1214
# NeedApproval - signal
1968
1215
@dbus.service.signal(_interface, signature="tb")
1969
1216
def NeedApproval(self, timeout, default):
1971
1218
return self.need_approval()
1220
# NeRwequest - signal
1221
@dbus.service.signal(_interface, signature="s")
1222
def NewRequest(self, ip):
1224
Is sent after a client request a password.
1975
1230
# Approve - method
1976
1231
@dbus.service.method(_interface, in_signature="b")
1977
1232
def Approve(self, value):
1978
1233
self.approve(value)
1980
1235
# CheckedOK - method
1981
1236
@dbus.service.method(_interface)
1982
1237
def CheckedOK(self):
1983
1238
self.checked_ok()
1985
1240
# Enable - method
1986
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1987
1241
@dbus.service.method(_interface)
1988
1242
def Enable(self):
1992
1246
# StartChecker - method
1993
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1994
1247
@dbus.service.method(_interface)
1995
1248
def StartChecker(self):
1997
1250
self.start_checker()
1999
1252
# Disable - method
2000
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2001
1253
@dbus.service.method(_interface)
2002
1254
def Disable(self):
2006
1258
# StopChecker - method
2007
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2008
1259
@dbus.service.method(_interface)
2009
1260
def StopChecker(self):
2010
1261
self.stop_checker()
2014
1265
# ApprovalPending - property
2015
1266
@dbus_service_property(_interface, signature="b", access="read")
2016
1267
def ApprovalPending_dbus_property(self):
2017
1268
return dbus.Boolean(bool(self.approvals_pending))
2019
1270
# ApprovedByDefault - property
2020
@dbus_service_property(_interface,
1271
@dbus_service_property(_interface, signature="b",
2022
1272
access="readwrite")
2023
1273
def ApprovedByDefault_dbus_property(self, value=None):
2024
1274
if value is None: # get
2025
1275
return dbus.Boolean(self.approved_by_default)
2026
1276
self.approved_by_default = bool(value)
2028
1278
# ApprovalDelay - property
2029
@dbus_service_property(_interface,
1279
@dbus_service_property(_interface, signature="t",
2031
1280
access="readwrite")
2032
1281
def ApprovalDelay_dbus_property(self, value=None):
2033
1282
if value is None: # get
2034
return dbus.UInt64(self.approval_delay.total_seconds()
1283
return dbus.UInt64(self.approval_delay_milliseconds())
2036
1284
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2038
1286
# ApprovalDuration - property
2039
@dbus_service_property(_interface,
1287
@dbus_service_property(_interface, signature="t",
2041
1288
access="readwrite")
2042
1289
def ApprovalDuration_dbus_property(self, value=None):
2043
1290
if value is None: # get
2044
return dbus.UInt64(self.approval_duration.total_seconds()
1291
return dbus.UInt64(timedelta_to_milliseconds(
1292
self.approval_duration))
2046
1293
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2048
1295
# Name - property
2050
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2051
1296
@dbus_service_property(_interface, signature="s", access="read")
2052
1297
def Name_dbus_property(self):
2053
1298
return dbus.String(self.name)
2057
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2058
@dbus_service_property(_interface, signature="s", access="read")
2059
def KeyID_dbus_property(self):
2060
return dbus.String(self.key_id)
2062
1300
# Fingerprint - property
2064
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2065
1301
@dbus_service_property(_interface, signature="s", access="read")
2066
1302
def Fingerprint_dbus_property(self):
2067
1303
return dbus.String(self.fingerprint)
2069
1305
# Host - property
2070
@dbus_service_property(_interface,
1306
@dbus_service_property(_interface, signature="s",
2072
1307
access="readwrite")
2073
1308
def Host_dbus_property(self, value=None):
2074
1309
if value is None: # get
2075
1310
return dbus.String(self.host)
2076
self.host = str(value)
1311
self.host = unicode(value)
2078
1313
# Created - property
2080
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2081
1314
@dbus_service_property(_interface, signature="s", access="read")
2082
1315
def Created_dbus_property(self):
2083
1316
return datetime_to_dbus(self.created)
2085
1318
# LastEnabled - property
2086
1319
@dbus_service_property(_interface, signature="s", access="read")
2087
1320
def LastEnabled_dbus_property(self):
2088
1321
return datetime_to_dbus(self.last_enabled)
2090
1323
# Enabled - property
2091
@dbus_service_property(_interface,
1324
@dbus_service_property(_interface, signature="b",
2093
1325
access="readwrite")
2094
1326
def Enabled_dbus_property(self, value=None):
2095
1327
if value is None: # get
2102
1334
# LastCheckedOK - property
2103
@dbus_service_property(_interface,
1335
@dbus_service_property(_interface, signature="s",
2105
1336
access="readwrite")
2106
1337
def LastCheckedOK_dbus_property(self, value=None):
2107
1338
if value is not None:
2108
1339
self.checked_ok()
2110
1341
return datetime_to_dbus(self.last_checked_ok)
2112
# LastCheckerStatus - property
2113
@dbus_service_property(_interface, signature="n", access="read")
2114
def LastCheckerStatus_dbus_property(self):
2115
return dbus.Int16(self.last_checker_status)
2117
1343
# Expires - property
2118
1344
@dbus_service_property(_interface, signature="s", access="read")
2119
1345
def Expires_dbus_property(self):
2120
1346
return datetime_to_dbus(self.expires)
2122
1348
# LastApprovalRequest - property
2123
1349
@dbus_service_property(_interface, signature="s", access="read")
2124
1350
def LastApprovalRequest_dbus_property(self):
2125
1351
return datetime_to_dbus(self.last_approval_request)
2127
1353
# Timeout - property
2128
@dbus_service_property(_interface,
1354
@dbus_service_property(_interface, signature="t",
2130
1355
access="readwrite")
2131
1356
def Timeout_dbus_property(self, value=None):
2132
1357
if value is None: # get
2133
return dbus.UInt64(self.timeout.total_seconds() * 1000)
2134
old_timeout = self.timeout
1358
return dbus.UInt64(self.timeout_milliseconds())
2135
1359
self.timeout = datetime.timedelta(0, 0, 0, value)
2136
# Reschedule disabling
2138
now = datetime.datetime.utcnow()
2139
self.expires += self.timeout - old_timeout
2140
if self.expires <= now:
2141
# The timeout has passed
2144
if (getattr(self, "disable_initiator_tag", None)
2147
GLib.source_remove(self.disable_initiator_tag)
2148
self.disable_initiator_tag = GLib.timeout_add(
2149
int((self.expires - now).total_seconds() * 1000),
1360
if getattr(self, "disable_initiator_tag", None) is None:
1362
# Reschedule timeout
1363
gobject.source_remove(self.disable_initiator_tag)
1364
self.disable_initiator_tag = None
1366
time_to_die = timedelta_to_milliseconds((self
1371
if time_to_die <= 0:
1372
# The timeout has passed
1375
self.expires = (datetime.datetime.utcnow()
1376
+ datetime.timedelta(milliseconds =
1378
self.disable_initiator_tag = (gobject.timeout_add
1379
(time_to_die, self.disable))
2152
1381
# ExtendedTimeout - property
2153
@dbus_service_property(_interface,
1382
@dbus_service_property(_interface, signature="t",
2155
1383
access="readwrite")
2156
1384
def ExtendedTimeout_dbus_property(self, value=None):
2157
1385
if value is None: # get
2158
return dbus.UInt64(self.extended_timeout.total_seconds()
1386
return dbus.UInt64(self.extended_timeout_milliseconds())
2160
1387
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
2162
1389
# Interval - property
2163
@dbus_service_property(_interface,
1390
@dbus_service_property(_interface, signature="t",
2165
1391
access="readwrite")
2166
1392
def Interval_dbus_property(self, value=None):
2167
1393
if value is None: # get
2168
return dbus.UInt64(self.interval.total_seconds() * 1000)
1394
return dbus.UInt64(self.interval_milliseconds())
2169
1395
self.interval = datetime.timedelta(0, 0, 0, value)
2170
1396
if getattr(self, "checker_initiator_tag", None) is None:
2172
1398
if self.enabled:
2173
1399
# Reschedule checker run
2174
GLib.source_remove(self.checker_initiator_tag)
2175
self.checker_initiator_tag = GLib.timeout_add(
2176
value, self.start_checker)
2177
self.start_checker() # Start one now, too
1400
gobject.source_remove(self.checker_initiator_tag)
1401
self.checker_initiator_tag = (gobject.timeout_add
1402
(value, self.start_checker))
1403
self.start_checker() # Start one now, too
2179
1405
# Checker - property
2180
@dbus_service_property(_interface,
1406
@dbus_service_property(_interface, signature="s",
2182
1407
access="readwrite")
2183
1408
def Checker_dbus_property(self, value=None):
2184
1409
if value is None: # get
2185
1410
return dbus.String(self.checker_command)
2186
self.checker_command = str(value)
1411
self.checker_command = unicode(value)
2188
1413
# CheckerRunning - property
2189
@dbus_service_property(_interface,
1414
@dbus_service_property(_interface, signature="b",
2191
1415
access="readwrite")
2192
1416
def CheckerRunning_dbus_property(self, value=None):
2193
1417
if value is None: # get
2234
1450
if data[0] == 'data':
2236
1452
if data[0] == 'function':
2238
1453
def func(*args, **kwargs):
2239
1454
self._pipe.send(('funcall', name, args, kwargs))
2240
1455
return self._pipe.recv()[1]
2244
1458
def __setattr__(self, name, value):
2245
1459
if name == '_pipe':
2246
1460
return super(ProxyClient, self).__setattr__(name, value)
2247
1461
self._pipe.send(('setattr', name, value))
1464
class ClientDBusTransitional(ClientDBus):
1465
__metaclass__ = AlternateDBusNamesMetaclass
2250
1468
class ClientHandler(socketserver.BaseRequestHandler, object):
2251
1469
"""A class to handle client connections.
2253
1471
Instantiated once for each connection to handle it.
2254
1472
Note: This will run in its own forked process."""
2256
1474
def handle(self):
2257
1475
with contextlib.closing(self.server.child_pipe) as child_pipe:
2258
1476
logger.info("TCP connection from: %s",
2259
str(self.client_address))
1477
unicode(self.client_address))
2260
1478
logger.debug("Pipe FD: %d",
2261
1479
self.server.child_pipe.fileno())
2263
session = gnutls.ClientSession(self.request)
2265
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2266
# "+AES-256-CBC", "+SHA1",
2267
# "+COMP-NULL", "+CTYPE-OPENPGP",
1481
session = (gnutls.connection
1482
.ClientSession(self.request,
1484
.X509Credentials()))
1486
# Note: gnutls.connection.X509Credentials is really a
1487
# generic GnuTLS certificate credentials object so long as
1488
# no X.509 keys are added to it. Therefore, we can use it
1489
# here despite using OpenPGP certificates.
1491
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1492
# "+AES-256-CBC", "+SHA1",
1493
# "+COMP-NULL", "+CTYPE-OPENPGP",
2269
1495
# Use a fallback default, since this MUST be set.
2270
1496
priority = self.server.gnutls_priority
2271
1497
if priority is None:
2272
1498
priority = "NORMAL"
2273
gnutls.priority_set_direct(session._c_object,
2274
priority.encode("utf-8"),
1499
(gnutls.library.functions
1500
.gnutls_priority_set_direct(session._c_object,
2277
1503
# Start communication using the Mandos protocol
2278
1504
# Get protocol number
2279
1505
line = self.request.makefile().readline()
2280
1506
logger.debug("Protocol version: %r", line)
2282
1508
if int(line.strip().split()[0]) > 1:
2283
raise RuntimeError(line)
2284
1510
except (ValueError, IndexError, RuntimeError) as error:
2285
1511
logger.error("Unknown protocol version: %s", error)
2288
1514
# Start GnuTLS connection
2290
1516
session.handshake()
2291
except gnutls.Error as error:
1517
except gnutls.errors.GNUTLSError as error:
2292
1518
logger.warning("Handshake failed: %s", error)
2293
1519
# Do not run session.bye() here: the session is not
2294
1520
# established. Just abandon the request.
2296
1522
logger.debug("Handshake succeeded")
2298
1524
approval_required = False
2300
if gnutls.has_rawpk:
2303
key_id = self.key_id(
2304
self.peer_certificate(session))
2305
except (TypeError, gnutls.Error) as error:
2306
logger.warning("Bad certificate: %s", error)
2308
logger.debug("Key ID: %s", key_id)
2313
fpr = self.fingerprint(
2314
self.peer_certificate(session))
2315
except (TypeError, gnutls.Error) as error:
2316
logger.warning("Bad certificate: %s", error)
2318
logger.debug("Fingerprint: %s", fpr)
2321
client = ProxyClient(child_pipe, key_id, fpr,
1527
fpr = self.fingerprint(self.peer_certificate
1530
gnutls.errors.GNUTLSError) as error:
1531
logger.warning("Bad certificate: %s", error)
1533
logger.debug("Fingerprint: %s", fpr)
1536
client = ProxyClient(child_pipe, fpr,
2322
1537
self.client_address)
2323
1538
except KeyError:
1541
if self.server.use_dbus:
1543
client.NewRequest(str(self.client_address))
2326
1545
if client.approval_delay:
2327
1546
delay = client.approval_delay
2328
1547
client.approvals_pending += 1
2329
1548
approval_required = True
2332
1551
if not client.enabled:
2333
1552
logger.info("Client %s is disabled",
2335
1554
if self.server.use_dbus:
2336
1555
# Emit D-Bus signal
2337
1556
client.Rejected("Disabled")
2340
1559
if client.approved or not client.approval_delay:
2341
# We are approved or approval is disabled
1560
#We are approved or approval is disabled
2343
1562
elif client.approved is None:
2344
1563
logger.info("Client %s needs approval",
2377
1598
delay -= time2 - time
2380
session.send(client.secret)
2381
except gnutls.Error as error:
2382
logger.warning("gnutls send failed",
1601
while sent_size < len(client.secret):
1603
sent = session.send(client.secret[sent_size:])
1604
except gnutls.errors.GNUTLSError as error:
1605
logger.warning("gnutls send failed")
1607
logger.debug("Sent: %d, remaining: %d",
1608
sent, len(client.secret)
1609
- (sent_size + sent))
2386
1612
logger.info("Sending secret to %s", client.name)
2387
1613
# bump the timeout using extended_timeout
2388
client.bump_timeout(client.extended_timeout)
1614
client.checked_ok(client.extended_timeout)
2389
1615
if self.server.use_dbus:
2390
1616
# Emit D-Bus signal
2391
1617
client.GotSecret()
2394
1620
if approval_required:
2395
1621
client.approvals_pending -= 1
2398
except gnutls.Error as error:
2399
logger.warning("GnuTLS bye failed",
1624
except gnutls.errors.GNUTLSError as error:
1625
logger.warning("GnuTLS bye failed")
2403
1628
def peer_certificate(session):
2404
"Return the peer's certificate as a bytestring"
2406
cert_type = gnutls.certificate_type_get2(session._c_object,
2408
except AttributeError:
2409
cert_type = gnutls.certificate_type_get(session._c_object)
2410
if gnutls.has_rawpk:
2411
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2413
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2414
# If not a valid certificate type...
2415
if cert_type not in valid_cert_types:
2416
logger.info("Cert type %r not in %r", cert_type,
2418
# ...return invalid data
1629
"Return the peer's OpenPGP certificate as a bytestring"
1630
# If not an OpenPGP certificate...
1631
if (gnutls.library.functions
1632
.gnutls_certificate_type_get(session._c_object)
1633
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1634
# ...do the normal thing
1635
return session.peer_certificate
2420
1636
list_size = ctypes.c_uint(1)
2421
cert_list = (gnutls.certificate_get_peers
1637
cert_list = (gnutls.library.functions
1638
.gnutls_certificate_get_peers
2422
1639
(session._c_object, ctypes.byref(list_size)))
2423
1640
if not bool(cert_list) and list_size.value != 0:
2424
raise gnutls.Error("error getting peer certificate")
1641
raise gnutls.errors.GNUTLSError("error getting peer"
2425
1643
if list_size.value == 0:
2427
1645
cert = cert_list[0]
2428
1646
return ctypes.string_at(cert.data, cert.size)
2431
def key_id(certificate):
2432
"Convert a certificate bytestring to a hexdigit key ID"
2433
# New GnuTLS "datum" with the public key
2434
datum = gnutls.datum_t(
2435
ctypes.cast(ctypes.c_char_p(certificate),
2436
ctypes.POINTER(ctypes.c_ubyte)),
2437
ctypes.c_uint(len(certificate)))
2438
# XXX all these need to be created in the gnutls "module"
2439
# New empty GnuTLS certificate
2440
pubkey = gnutls.pubkey_t()
2441
gnutls.pubkey_init(ctypes.byref(pubkey))
2442
# Import the raw public key into the certificate
2443
gnutls.pubkey_import(pubkey,
2444
ctypes.byref(datum),
2445
gnutls.X509_FMT_DER)
2446
# New buffer for the key ID
2447
buf = ctypes.create_string_buffer(32)
2448
buf_len = ctypes.c_size_t(len(buf))
2449
# Get the key ID from the raw public key into the buffer
2450
gnutls.pubkey_get_key_id(pubkey,
2451
gnutls.KEYID_USE_SHA256,
2452
ctypes.cast(ctypes.byref(buf),
2453
ctypes.POINTER(ctypes.c_ubyte)),
2454
ctypes.byref(buf_len))
2455
# Deinit the certificate
2456
gnutls.pubkey_deinit(pubkey)
2458
# Convert the buffer to a Python bytestring
2459
key_id = ctypes.string_at(buf, buf_len.value)
2460
# Convert the bytestring to hexadecimal notation
2461
hex_key_id = binascii.hexlify(key_id).upper()
2465
1649
def fingerprint(openpgp):
2466
1650
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2467
1651
# New GnuTLS "datum" with the OpenPGP public key
2468
datum = gnutls.datum_t(
2469
ctypes.cast(ctypes.c_char_p(openpgp),
2470
ctypes.POINTER(ctypes.c_ubyte)),
2471
ctypes.c_uint(len(openpgp)))
1652
datum = (gnutls.library.types
1653
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1656
ctypes.c_uint(len(openpgp))))
2472
1657
# New empty GnuTLS certificate
2473
crt = gnutls.openpgp_crt_t()
2474
gnutls.openpgp_crt_init(ctypes.byref(crt))
1658
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1659
(gnutls.library.functions
1660
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2475
1661
# Import the OpenPGP public key into the certificate
2476
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2477
gnutls.OPENPGP_FMT_RAW)
1662
(gnutls.library.functions
1663
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1664
gnutls.library.constants
1665
.GNUTLS_OPENPGP_FMT_RAW))
2478
1666
# Verify the self signature in the key
2479
1667
crtverify = ctypes.c_uint()
2480
gnutls.openpgp_crt_verify_self(crt, 0,
2481
ctypes.byref(crtverify))
1668
(gnutls.library.functions
1669
.gnutls_openpgp_crt_verify_self(crt, 0,
1670
ctypes.byref(crtverify)))
2482
1671
if crtverify.value != 0:
2483
gnutls.openpgp_crt_deinit(crt)
2484
raise gnutls.CertificateSecurityError(code
1672
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1673
raise (gnutls.errors.CertificateSecurityError
2486
1675
# New buffer for the fingerprint
2487
1676
buf = ctypes.create_string_buffer(20)
2488
1677
buf_len = ctypes.c_size_t()
2489
1678
# Get the fingerprint from the certificate into the buffer
2490
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2491
ctypes.byref(buf_len))
1679
(gnutls.library.functions
1680
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1681
ctypes.byref(buf_len)))
2492
1682
# Deinit the certificate
2493
gnutls.openpgp_crt_deinit(crt)
1683
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2494
1684
# Convert the buffer to a Python bytestring
2495
1685
fpr = ctypes.string_at(buf, buf_len.value)
2496
1686
# Convert the bytestring to hexadecimal notation
2501
1691
class MultiprocessingMixIn(object):
2502
1692
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2504
1693
def sub_process_main(self, request, address):
2506
1695
self.finish_request(request, address)
2507
1696
except Exception:
2508
1697
self.handle_error(request, address)
2509
1698
self.close_request(request)
2511
1700
def process_request(self, request, address):
2512
1701
"""Start a new process to process the request."""
2513
proc = multiprocessing.Process(target=self.sub_process_main,
2514
args=(request, address))
1702
proc = multiprocessing.Process(target = self.sub_process_main,
2519
1709
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2520
1710
""" adds a pipe to the MixIn """
2522
1711
def process_request(self, request, client_address):
2523
1712
"""Overrides and wraps the original process_request().
2525
1714
This function creates a new pipe in self.pipe
2527
1716
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2529
1718
proc = MultiprocessingMixIn.process_request(self, request,
2530
1719
client_address)
2531
1720
self.child_pipe.close()
2532
1721
self.add_pipe(parent_pipe, proc)
2534
1723
def add_pipe(self, parent_pipe, proc):
2535
1724
"""Dummy function; override as necessary"""
2536
raise NotImplementedError()
1725
raise NotImplementedError
2539
1728
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
2540
1729
socketserver.TCPServer, object):
2541
1730
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
2544
1733
enabled: Boolean; whether this server is activated yet
2545
1734
interface: None or a network interface name (string)
2546
1735
use_ipv6: Boolean; to use IPv6 or not
2549
1737
def __init__(self, server_address, RequestHandlerClass,
2553
"""If socketfd is set, use that file descriptor instead of
2554
creating a new one with socket.socket().
1738
interface=None, use_ipv6=True):
2556
1739
self.interface = interface
2558
1741
self.address_family = socket.AF_INET6
2559
if socketfd is not None:
2560
# Save the file descriptor
2561
self.socketfd = socketfd
2562
# Save the original socket.socket() function
2563
self.socket_socket = socket.socket
2565
# To implement --socket, we monkey patch socket.socket.
2567
# (When socketserver.TCPServer is a new-style class, we
2568
# could make self.socket into a property instead of monkey
2569
# patching socket.socket.)
2571
# Create a one-time-only replacement for socket.socket()
2572
@functools.wraps(socket.socket)
2573
def socket_wrapper(*args, **kwargs):
2574
# Restore original function so subsequent calls are
2576
socket.socket = self.socket_socket
2577
del self.socket_socket
2578
# This time only, return a new socket object from the
2579
# saved file descriptor.
2580
return socket.fromfd(self.socketfd, *args, **kwargs)
2581
# Replace socket.socket() function with wrapper
2582
socket.socket = socket_wrapper
2583
# The socketserver.TCPServer.__init__ will call
2584
# socket.socket(), which might be our replacement,
2585
# socket_wrapper(), if socketfd was set.
2586
1742
socketserver.TCPServer.__init__(self, server_address,
2587
1743
RequestHandlerClass)
2589
1744
def server_bind(self):
2590
1745
"""This overrides the normal server_bind() function
2591
1746
to bind to an interface if one was specified, and also NOT to
2592
1747
bind to an address or port if they were not specified."""
2593
global SO_BINDTODEVICE
2594
1748
if self.interface is not None:
2595
1749
if SO_BINDTODEVICE is None:
2596
# Fall back to a hard-coded value which seems to be
2598
logger.warning("SO_BINDTODEVICE not found, trying 25")
2599
SO_BINDTODEVICE = 25
2601
self.socket.setsockopt(
2602
socket.SOL_SOCKET, SO_BINDTODEVICE,
2603
(self.interface + "\0").encode("utf-8"))
2604
except socket.error as error:
2605
if error.errno == errno.EPERM:
2606
logger.error("No permission to bind to"
2607
" interface %s", self.interface)
2608
elif error.errno == errno.ENOPROTOOPT:
2609
logger.error("SO_BINDTODEVICE not available;"
2610
" cannot bind to interface %s",
2612
elif error.errno == errno.ENODEV:
2613
logger.error("Interface %s does not exist,"
2614
" cannot bind", self.interface)
1750
logger.error("SO_BINDTODEVICE does not exist;"
1751
" cannot bind to interface %s",
1755
self.socket.setsockopt(socket.SOL_SOCKET,
1759
except socket.error as error:
1760
if error[0] == errno.EPERM:
1761
logger.error("No permission to"
1762
" bind to interface %s",
1764
elif error[0] == errno.ENOPROTOOPT:
1765
logger.error("SO_BINDTODEVICE not available;"
1766
" cannot bind to interface %s",
2617
1770
# Only bind(2) the socket if we really need to.
2618
1771
if self.server_address[0] or self.server_address[1]:
2619
1772
if not self.server_address[0]:
2620
1773
if self.address_family == socket.AF_INET6:
2621
any_address = "::" # in6addr_any
1774
any_address = "::" # in6addr_any
2623
any_address = "0.0.0.0" # INADDR_ANY
1776
any_address = socket.INADDR_ANY
2624
1777
self.server_address = (any_address,
2625
1778
self.server_address[1])
2626
1779
elif not self.server_address[1]:
2627
self.server_address = (self.server_address[0], 0)
1780
self.server_address = (self.server_address[0],
2628
1782
# if self.interface:
2629
1783
# self.server_address = (self.server_address[0],
2660
1809
self.gnutls_priority = gnutls_priority
2661
1810
IPv6_TCPServer.__init__(self, server_address,
2662
1811
RequestHandlerClass,
2663
interface=interface,
1812
interface = interface,
1813
use_ipv6 = use_ipv6)
2667
1814
def server_activate(self):
2668
1815
if self.enabled:
2669
1816
return socketserver.TCPServer.server_activate(self)
2671
1818
def enable(self):
2672
1819
self.enabled = True
2674
1821
def add_pipe(self, parent_pipe, proc):
2675
1822
# Call "handle_ipc" for both data and EOF events
2677
parent_pipe.fileno(),
2678
GLib.IO_IN | GLib.IO_HUP,
2679
functools.partial(self.handle_ipc,
2680
parent_pipe=parent_pipe,
2683
def handle_ipc(self, source, condition,
2686
client_object=None):
1823
gobject.io_add_watch(parent_pipe.fileno(),
1824
gobject.IO_IN | gobject.IO_HUP,
1825
functools.partial(self.handle_ipc,
1830
def handle_ipc(self, source, condition, parent_pipe=None,
1831
proc = None, client_object=None):
1833
gobject.IO_IN: "IN", # There is data to read.
1834
gobject.IO_OUT: "OUT", # Data can be written (without
1836
gobject.IO_PRI: "PRI", # There is urgent data to read.
1837
gobject.IO_ERR: "ERR", # Error condition.
1838
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1839
# broken, usually for pipes and
1842
conditions_string = ' | '.join(name
1844
condition_names.iteritems()
1845
if cond & condition)
2687
1846
# error, or the other end of multiprocessing.Pipe has closed
2688
if condition & (GLib.IO_ERR | GLib.IO_HUP):
1847
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
2689
1848
# Wait for other process to exit
2693
1852
# Read a request from the child
2694
1853
request = parent_pipe.recv()
2695
1854
command = request[0]
2697
1856
if command == 'init':
2698
key_id = request[1].decode("ascii")
2699
fpr = request[2].decode("ascii")
2700
address = request[3]
2702
for c in self.clients.values():
2703
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2705
if key_id and c.key_id == key_id:
2708
if fpr and c.fingerprint == fpr:
1858
address = request[2]
1860
for c in self.clients.itervalues():
1861
if c.fingerprint == fpr:
2712
logger.info("Client not found for key ID: %s, address"
2713
": %s", key_id or fpr, address)
1865
logger.info("Client not found for fingerprint: %s, ad"
1866
"dress: %s", fpr, address)
2714
1867
if self.use_dbus:
2715
1868
# Emit D-Bus signal
2716
mandos_dbus_service.ClientNotFound(key_id or fpr,
1869
mandos_dbus_service.ClientNotFound(fpr,
2718
1871
parent_pipe.send(False)
2722
parent_pipe.fileno(),
2723
GLib.IO_IN | GLib.IO_HUP,
2724
functools.partial(self.handle_ipc,
2725
parent_pipe=parent_pipe,
2727
client_object=client))
1874
gobject.io_add_watch(parent_pipe.fileno(),
1875
gobject.IO_IN | gobject.IO_HUP,
1876
functools.partial(self.handle_ipc,
2728
1882
parent_pipe.send(True)
2729
1883
# remove the old hook in favor of the new above hook on
2733
1887
funcname = request[1]
2734
1888
args = request[2]
2735
1889
kwargs = request[3]
2737
1891
parent_pipe.send(('data', getattr(client_object,
2738
1892
funcname)(*args,
2741
1895
if command == 'getattr':
2742
1896
attrname = request[1]
2743
if isinstance(client_object.__getattribute__(attrname),
2744
collections.Callable):
2745
parent_pipe.send(('function', ))
1897
if callable(client_object.__getattribute__(attrname)):
1898
parent_pipe.send(('function',))
2748
'data', client_object.__getattribute__(attrname)))
1900
parent_pipe.send(('data', client_object
1901
.__getattribute__(attrname)))
2750
1903
if command == 'setattr':
2751
1904
attrname = request[1]
2752
1905
value = request[2]
2753
1906
setattr(client_object, attrname, value)
2758
def rfc3339_duration_to_delta(duration):
2759
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2761
>>> rfc3339_duration_to_delta("P7D")
2762
datetime.timedelta(7)
2763
>>> rfc3339_duration_to_delta("PT60S")
2764
datetime.timedelta(0, 60)
2765
>>> rfc3339_duration_to_delta("PT60M")
2766
datetime.timedelta(0, 3600)
2767
>>> rfc3339_duration_to_delta("PT24H")
2768
datetime.timedelta(1)
2769
>>> rfc3339_duration_to_delta("P1W")
2770
datetime.timedelta(7)
2771
>>> rfc3339_duration_to_delta("PT5M30S")
2772
datetime.timedelta(0, 330)
2773
>>> rfc3339_duration_to_delta("P1DT3M20S")
2774
datetime.timedelta(1, 200)
2777
# Parsing an RFC 3339 duration with regular expressions is not
2778
# possible - there would have to be multiple places for the same
2779
# values, like seconds. The current code, while more esoteric, is
2780
# cleaner without depending on a parsing library. If Python had a
2781
# built-in library for parsing we would use it, but we'd like to
2782
# avoid excessive use of external libraries.
2784
# New type for defining tokens, syntax, and semantics all-in-one
2785
Token = collections.namedtuple("Token", (
2786
"regexp", # To match token; if "value" is not None, must have
2787
# a "group" containing digits
2788
"value", # datetime.timedelta or None
2789
"followers")) # Tokens valid after this token
2790
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2791
# the "duration" ABNF definition in RFC 3339, Appendix A.
2792
token_end = Token(re.compile(r"$"), None, frozenset())
2793
token_second = Token(re.compile(r"(\d+)S"),
2794
datetime.timedelta(seconds=1),
2795
frozenset((token_end, )))
2796
token_minute = Token(re.compile(r"(\d+)M"),
2797
datetime.timedelta(minutes=1),
2798
frozenset((token_second, token_end)))
2799
token_hour = Token(re.compile(r"(\d+)H"),
2800
datetime.timedelta(hours=1),
2801
frozenset((token_minute, token_end)))
2802
token_time = Token(re.compile(r"T"),
2804
frozenset((token_hour, token_minute,
2806
token_day = Token(re.compile(r"(\d+)D"),
2807
datetime.timedelta(days=1),
2808
frozenset((token_time, token_end)))
2809
token_month = Token(re.compile(r"(\d+)M"),
2810
datetime.timedelta(weeks=4),
2811
frozenset((token_day, token_end)))
2812
token_year = Token(re.compile(r"(\d+)Y"),
2813
datetime.timedelta(weeks=52),
2814
frozenset((token_month, token_end)))
2815
token_week = Token(re.compile(r"(\d+)W"),
2816
datetime.timedelta(weeks=1),
2817
frozenset((token_end, )))
2818
token_duration = Token(re.compile(r"P"), None,
2819
frozenset((token_year, token_month,
2820
token_day, token_time,
2822
# Define starting values:
2824
value = datetime.timedelta()
2826
# Following valid tokens
2827
followers = frozenset((token_duration, ))
2828
# String left to parse
2830
# Loop until end token is found
2831
while found_token is not token_end:
2832
# Search for any currently valid tokens
2833
for token in followers:
2834
match = token.regexp.match(s)
2835
if match is not None:
2837
if token.value is not None:
2838
# Value found, parse digits
2839
factor = int(match.group(1), 10)
2840
# Add to value so far
2841
value += factor * token.value
2842
# Strip token from string
2843
s = token.regexp.sub("", s, 1)
2846
# Set valid next tokens
2847
followers = found_token.followers
2850
# No currently valid tokens were found
2851
raise ValueError("Invalid RFC 3339 duration: {!r}"
2857
1911
def string_to_delta(interval):
2858
1912
"""Parse a string and return a datetime.timedelta
2860
1914
>>> string_to_delta('7d')
2861
1915
datetime.timedelta(7)
2862
1916
>>> string_to_delta('60s')
2957
2005
parser.add_argument("--no-dbus", action="store_false",
2958
2006
dest="use_dbus", help="Do not provide D-Bus"
2959
" system bus interface", default=None)
2007
" system bus interface")
2960
2008
parser.add_argument("--no-ipv6", action="store_false",
2961
dest="use_ipv6", help="Do not use IPv6",
2009
dest="use_ipv6", help="Do not use IPv6")
2963
2010
parser.add_argument("--no-restore", action="store_false",
2964
2011
dest="restore", help="Do not restore stored"
2965
" state", default=None)
2966
parser.add_argument("--socket", type=int,
2967
help="Specify a file descriptor to a network"
2968
" socket to use instead of creating one")
2969
2013
parser.add_argument("--statedir", metavar="DIR",
2970
2014
help="Directory to save/restore state in")
2971
parser.add_argument("--foreground", action="store_true",
2972
help="Run in foreground", default=None)
2973
parser.add_argument("--no-zeroconf", action="store_false",
2974
dest="zeroconf", help="Do not use Zeroconf",
2977
2016
options = parser.parse_args()
2979
2018
if options.check:
2981
fail_count, test_count = doctest.testmod()
2982
sys.exit(os.EX_OK if fail_count == 0 else 1)
2984
2023
# Default values for config file for server-global settings
2985
if gnutls.has_rawpk:
2986
priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"
2987
":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")
2989
priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2990
":+SIGN-DSA-SHA256")
2991
server_defaults = {"interface": "",
2995
"priority": priority,
2996
"servicename": "Mandos",
3002
"statedir": "/var/lib/mandos",
3003
"foreground": "False",
2024
server_defaults = { "interface": "",
2029
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2030
"servicename": "Mandos",
2035
"statedir": "/var/lib/mandos"
3008
2038
# Parse config file for server-global settings
3009
2039
server_config = configparser.SafeConfigParser(server_defaults)
3010
2040
del server_defaults
3011
server_config.read(os.path.join(options.configdir, "mandos.conf"))
2041
server_config.read(os.path.join(options.configdir,
3012
2043
# Convert the SafeConfigParser object to a dict
3013
2044
server_settings = server_config.defaults()
3014
2045
# Use the appropriate methods on the non-string config options
3015
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3016
"foreground", "zeroconf"):
2046
for option in ("debug", "use_dbus", "use_ipv6"):
3017
2047
server_settings[option] = server_config.getboolean("DEFAULT",
3019
2049
if server_settings["port"]:
3020
2050
server_settings["port"] = server_config.getint("DEFAULT",
3022
if server_settings["socket"]:
3023
server_settings["socket"] = server_config.getint("DEFAULT",
3025
# Later, stdin will, and stdout and stderr might, be dup'ed
3026
# over with an opened os.devnull. But we don't want this to
3027
# happen with a supplied network socket.
3028
if 0 <= server_settings["socket"] <= 2:
3029
server_settings["socket"] = os.dup(server_settings
3031
2052
del server_config
3033
2054
# Override the settings from the config file with command line
3034
2055
# options, if set.
3035
2056
for option in ("interface", "address", "port", "debug",
3036
"priority", "servicename", "configdir", "use_dbus",
3037
"use_ipv6", "debuglevel", "restore", "statedir",
3038
"socket", "foreground", "zeroconf"):
2057
"priority", "servicename", "configdir",
2058
"use_dbus", "use_ipv6", "debuglevel", "restore",
3039
2060
value = getattr(options, option)
3040
2061
if value is not None:
3041
2062
server_settings[option] = value
3043
2064
# Force all strings to be unicode
3044
2065
for option in server_settings.keys():
3045
if isinstance(server_settings[option], bytes):
3046
server_settings[option] = (server_settings[option]
3048
# Force all boolean options to be boolean
3049
for option in ("debug", "use_dbus", "use_ipv6", "restore",
3050
"foreground", "zeroconf"):
3051
server_settings[option] = bool(server_settings[option])
3052
# Debug implies foreground
3053
if server_settings["debug"]:
3054
server_settings["foreground"] = True
2066
if type(server_settings[option]) is str:
2067
server_settings[option] = unicode(server_settings[option])
3055
2068
# Now we have our good server settings in "server_settings"
3057
2070
##################################################################
3059
if (not server_settings["zeroconf"]
3060
and not (server_settings["port"]
3061
or server_settings["socket"] != "")):
3062
parser.error("Needs port or socket to work without Zeroconf")
3064
2072
# For convenience
3065
2073
debug = server_settings["debug"]
3066
2074
debuglevel = server_settings["debuglevel"]
3068
2076
use_ipv6 = server_settings["use_ipv6"]
3069
2077
stored_state_path = os.path.join(server_settings["statedir"],
3070
2078
stored_state_file)
3071
foreground = server_settings["foreground"]
3072
zeroconf = server_settings["zeroconf"]
3075
initlogger(debug, logging.DEBUG)
2081
initlogger(logging.DEBUG)
3077
2083
if not debuglevel:
3080
2086
level = getattr(logging, debuglevel.upper())
3081
initlogger(debug, level)
3083
2089
if server_settings["servicename"] != "Mandos":
3084
syslogger.setFormatter(
3085
logging.Formatter('Mandos ({}) [%(process)d]:'
3086
' %(levelname)s: %(message)s'.format(
3087
server_settings["servicename"])))
2090
syslogger.setFormatter(logging.Formatter
2091
('Mandos (%s) [%%(process)d]:'
2092
' %%(levelname)s: %%(message)s'
2093
% server_settings["servicename"]))
3089
2095
# Parse config file with clients
3090
client_config = configparser.SafeConfigParser(Client
2096
client_config = configparser.SafeConfigParser(Client.client_defaults)
3092
2097
client_config.read(os.path.join(server_settings["configdir"],
3093
2098
"clients.conf"))
3095
2100
global mandos_dbus_service
3096
2101
mandos_dbus_service = None
3099
if server_settings["socket"] != "":
3100
socketfd = server_settings["socket"]
3101
tcp_server = MandosServer(
3102
(server_settings["address"], server_settings["port"]),
3104
interface=(server_settings["interface"] or None),
3106
gnutls_priority=server_settings["priority"],
3110
pidfilename = "/run/mandos.pid"
3111
if not os.path.isdir("/run/."):
3112
pidfilename = "/var/run/mandos.pid"
3115
pidfile = codecs.open(pidfilename, "w", encoding="utf-8")
3116
except IOError as e:
3117
logger.error("Could not open file %r", pidfilename,
3120
for name, group in (("_mandos", "_mandos"),
3121
("mandos", "mandos"),
3122
("nobody", "nogroup")):
3124
uid = pwd.getpwnam(name).pw_uid
3125
gid = pwd.getpwnam(group).pw_gid
2103
tcp_server = MandosServer((server_settings["address"],
2104
server_settings["port"]),
2106
interface=(server_settings["interface"]
2110
server_settings["priority"],
2113
pidfilename = "/var/run/mandos.pid"
2115
pidfile = open(pidfilename, "w")
2117
logger.error("Could not open file %r", pidfilename)
2120
uid = pwd.getpwnam("_mandos").pw_uid
2121
gid = pwd.getpwnam("_mandos").pw_gid
2124
uid = pwd.getpwnam("mandos").pw_uid
2125
gid = pwd.getpwnam("mandos").pw_gid
3127
2126
except KeyError:
2128
uid = pwd.getpwnam("nobody").pw_uid
2129
gid = pwd.getpwnam("nobody").pw_gid
3136
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3138
2136
except OSError as error:
3139
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3140
.format(uid, gid, os.strerror(error.errno)))
3141
if error.errno != errno.EPERM:
2137
if error[0] != errno.EPERM:
3145
2141
# Enable all possible GnuTLS debugging
3147
2143
# "Use a log level over 10 to enable all debugging options."
3148
2144
# - GnuTLS manual
3149
gnutls.global_set_log_level(11)
2145
gnutls.library.functions.gnutls_global_set_log_level(11)
2147
@gnutls.library.types.gnutls_log_func
3152
2148
def debug_gnutls(level, string):
3153
2149
logger.debug("GnuTLS: %s", string[:-1])
3155
gnutls.global_set_log_function(debug_gnutls)
2151
(gnutls.library.functions
2152
.gnutls_global_set_log_function(debug_gnutls))
3157
2154
# Redirect stdin so all checkers get /dev/null
3158
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2155
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
3159
2156
os.dup2(null, sys.stdin.fileno())
2160
# No console logging
2161
logger.removeHandler(console)
3163
2163
# Need to fork before connecting to D-Bus
3165
2165
# Close all input and output, do double fork, etc.
3168
# multiprocessing will use threads, so before we use GLib we need
3169
# to inform GLib that threads will be used.
2168
gobject.threads_init()
3172
2170
global main_loop
3173
2171
# From the Avahi example code
3174
DBusGMainLoop(set_as_default=True)
3175
main_loop = GLib.MainLoop()
2172
DBusGMainLoop(set_as_default=True )
2173
main_loop = gobject.MainLoop()
3176
2174
bus = dbus.SystemBus()
3177
2175
# End of Avahi example code
3180
2178
bus_name = dbus.service.BusName("se.recompile.Mandos",
3183
old_bus_name = dbus.service.BusName(
3184
"se.bsnet.fukt.Mandos", bus,
3186
except dbus.exceptions.DBusException as e:
3187
logger.error("Disabling D-Bus:", exc_info=e)
2179
bus, do_not_queue=True)
2180
old_bus_name = (dbus.service.BusName
2181
("se.bsnet.fukt.Mandos", bus,
2183
except dbus.exceptions.NameExistsException as e:
2184
logger.error(unicode(e) + ", disabling D-Bus")
3188
2185
use_dbus = False
3189
2186
server_settings["use_dbus"] = False
3190
2187
tcp_server.use_dbus = False
3192
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3193
service = AvahiServiceToSyslog(
3194
name=server_settings["servicename"],
3195
servicetype="_mandos._tcp",
3198
if server_settings["interface"]:
3199
service.interface = if_nametoindex(
3200
server_settings["interface"].encode("utf-8"))
2188
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2189
service = AvahiServiceToSyslog(name =
2190
server_settings["servicename"],
2191
servicetype = "_mandos._tcp",
2192
protocol = protocol, bus = bus)
2193
if server_settings["interface"]:
2194
service.interface = (if_nametoindex
2195
(str(server_settings["interface"])))
3202
2197
global multiprocessing_manager
3203
2198
multiprocessing_manager = multiprocessing.Manager()
3205
2200
client_class = Client
3207
client_class = functools.partial(ClientDBus, bus=bus)
2202
client_class = functools.partial(ClientDBusTransitional,
3209
2205
client_settings = Client.config_parser(client_config)
3210
2206
old_client_settings = {}
3211
2207
clients_data = {}
3213
# This is used to redirect stdout and stderr for checker processes
3215
wnull = open(os.devnull, "w") # A writable /dev/null
3216
# Only used if server is running in foreground but not in debug
3218
if debug or not foreground:
3221
2209
# Get client data and settings from last running state.
3222
2210
if server_settings["restore"]:
3224
2212
with open(stored_state_path, "rb") as stored_state:
3225
if sys.version_info.major == 2:
3226
clients_data, old_client_settings = pickle.load(
3229
bytes_clients_data, bytes_old_client_settings = (
3230
pickle.load(stored_state, encoding="bytes"))
3231
# Fix bytes to strings
3234
clients_data = {(key.decode("utf-8")
3235
if isinstance(key, bytes)
3238
bytes_clients_data.items()}
3239
del bytes_clients_data
3240
for key in clients_data:
3241
value = {(k.decode("utf-8")
3242
if isinstance(k, bytes) else k): v
3244
clients_data[key].items()}
3245
clients_data[key] = value
3247
value["client_structure"] = [
3249
if isinstance(s, bytes)
3251
value["client_structure"]]
3253
for k in ("name", "host"):
3254
if isinstance(value[k], bytes):
3255
value[k] = value[k].decode("utf-8")
3256
if not value.has_key("key_id"):
3257
value["key_id"] = ""
3258
elif not value.has_key("fingerprint"):
3259
value["fingerprint"] = ""
3260
# old_client_settings
3262
old_client_settings = {
3263
(key.decode("utf-8")
3264
if isinstance(key, bytes)
3267
bytes_old_client_settings.items()}
3268
del bytes_old_client_settings
3270
for value in old_client_settings.values():
3271
if isinstance(value["host"], bytes):
3272
value["host"] = (value["host"]
2213
clients_data, old_client_settings = (pickle.load
3274
2215
os.remove(stored_state_path)
3275
2216
except IOError as e:
3276
if e.errno == errno.ENOENT:
3277
logger.warning("Could not load persistent state:"
3278
" {}".format(os.strerror(e.errno)))
3280
logger.critical("Could not load persistent state:",
2217
logger.warning("Could not load persistent state: {0}"
2219
if e.errno != errno.ENOENT:
3283
2221
except EOFError as e:
3284
2222
logger.warning("Could not load persistent state: "
2223
"EOFError: {0}".format(e))
3288
2225
with PGPEngine() as pgp:
3289
for client_name, client in clients_data.items():
3290
# Skip removed clients
3291
if client_name not in client_settings:
2226
for client_name, client in clients_data.iteritems():
3294
2227
# Decide which value to use after restoring saved state.
3295
2228
# We have three different values: Old config file,
3296
2229
# new config file, and saved state.
3301
2234
# For each value in new config, check if it
3302
2235
# differs from the old config value (Except for
3303
2236
# the "secret" attribute)
3304
if (name != "secret"
3306
old_client_settings[client_name][name])):
2237
if (name != "secret" and
2238
value != old_client_settings[client_name]
3307
2240
client[name] = value
3308
2241
except KeyError:
3311
2244
# Clients who has passed its expire date can still be
3312
# enabled if its last checker was successful. A Client
3313
# whose checker succeeded before we stored its state is
3314
# assumed to have successfully run all checkers during
2245
# enabled if its last checker was successful. Clients
2246
# whose checker failed before we stored its state is
2247
# assumed to have failed all checkers during downtime.
3316
2248
if client["enabled"]:
3317
2249
if datetime.datetime.utcnow() >= client["expires"]:
3318
2250
if not client["last_checked_ok"]:
3319
2251
logger.warning(
3320
"disabling client {} - Client never "
3321
"performed a successful checker".format(
2252
"disabling client {0} - Client never "
2253
"performed a successfull checker"
2254
.format(client["name"]))
3323
2255
client["enabled"] = False
3324
2256
elif client["last_checker_status"] != 0:
3325
2257
logger.warning(
3326
"disabling client {} - Client last"
3327
" checker failed with error code"
3330
client["last_checker_status"]))
2258
"disabling client {0} - Client "
2259
"last checker failed with error code {1}"
2260
.format(client["name"],
2261
client["last_checker_status"]))
3331
2262
client["enabled"] = False
3333
client["expires"] = (
3334
datetime.datetime.utcnow()
3335
+ client["timeout"])
3336
logger.debug("Last checker succeeded,"
3337
" keeping {} enabled".format(
2264
client["expires"] = (datetime.datetime
2266
+ client["timeout"])
3340
client["secret"] = pgp.decrypt(
3341
client["encrypted_secret"],
3342
client_settings[client_name]["secret"])
2269
client["secret"] = (
2270
pgp.decrypt(client["encrypted_secret"],
2271
client_settings[client_name]
3343
2273
except PGPError:
3344
2274
# If decryption fails, we use secret from new settings
3345
logger.debug("Failed to decrypt {} old secret".format(
3347
client["secret"] = (client_settings[client_name]
2275
logger.debug("Failed to decrypt {0} old secret"
2276
.format(client_name))
2277
client["secret"] = (
2278
client_settings[client_name]["secret"])
3350
2281
# Add/remove clients based on new changes made to config
3351
for client_name in (set(old_client_settings)
3352
- set(client_settings)):
2282
for client_name in set(old_client_settings) - set(client_settings):
3353
2283
del clients_data[client_name]
3354
for client_name in (set(client_settings)
3355
- set(old_client_settings)):
2284
for client_name in set(client_settings) - set(old_client_settings):
3356
2285
clients_data[client_name] = client_settings[client_name]
3358
# Create all client objects
3359
for client_name, client in clients_data.items():
2287
# Create clients all clients
2288
for client_name, client in clients_data.iteritems():
3360
2289
tcp_server.clients[client_name] = client_class(
3363
server_settings=server_settings)
2290
name = client_name, settings = client)
3365
2292
if not tcp_server.clients:
3366
2293
logger.warning("No clients defined")
3369
if pidfile is not None:
3373
print(pid, file=pidfile)
3375
logger.error("Could not write to file %r with PID %d",
2299
pidfile.write(str(pid) + "\n".encode("utf-8"))
2302
logger.error("Could not write to file %r with PID %d",
2305
# "pidfile" was never created
3378
2307
del pidfilename
3380
for termsig in (signal.SIGHUP, signal.SIGTERM):
3381
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3382
lambda: main_loop.quit() and False)
2308
signal.signal(signal.SIGINT, signal.SIG_IGN)
2310
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2311
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3386
@alternate_dbus_interfaces(
3387
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3388
class MandosDBusService(DBusObjectWithObjectManager):
2314
class MandosDBusService(dbus.service.Object):
3389
2315
"""A D-Bus proxy object"""
3391
2316
def __init__(self):
3392
2317
dbus.service.Object.__init__(self, bus, "/")
3394
2318
_interface = "se.recompile.Mandos"
3396
2320
@dbus.service.signal(_interface, signature="o")
3397
2321
def ClientAdded(self, objpath):
3401
2325
@dbus.service.signal(_interface, signature="ss")
3402
def ClientNotFound(self, key_id, address):
2326
def ClientNotFound(self, fingerprint, address):
3406
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3408
2330
@dbus.service.signal(_interface, signature="os")
3409
2331
def ClientRemoved(self, objpath, name):
3413
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3415
2335
@dbus.service.method(_interface, out_signature="ao")
3416
2336
def GetAllClients(self):
3418
return dbus.Array(c.dbus_object_path for c in
3419
tcp_server.clients.values())
3421
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2338
return dbus.Array(c.dbus_object_path
2340
tcp_server.clients.itervalues())
3423
2342
@dbus.service.method(_interface,
3424
2343
out_signature="a{oa{sv}}")
3425
2344
def GetAllClientsWithProperties(self):
3427
2346
return dbus.Dictionary(
3428
{c.dbus_object_path: c.GetAll(
3429
"se.recompile.Mandos.Client")
3430
for c in tcp_server.clients.values()},
2347
((c.dbus_object_path, c.GetAll(""))
2348
for c in tcp_server.clients.itervalues()),
3431
2349
signature="oa{sv}")
3433
2351
@dbus.service.method(_interface, in_signature="o")
3434
2352
def RemoveClient(self, object_path):
3436
for c in tcp_server.clients.values():
2354
for c in tcp_server.clients.itervalues():
3437
2355
if c.dbus_object_path == object_path:
3438
2356
del tcp_server.clients[c.name]
3439
2357
c.remove_from_connection()
3440
# Don't signal the disabling
2358
# Don't signal anything except ClientRemoved
3441
2359
c.disable(quiet=True)
3442
# Emit D-Bus signal for removal
3443
self.client_removed_signal(c)
2361
self.ClientRemoved(object_path, c.name)
3445
2363
raise KeyError(object_path)
3449
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3450
out_signature="a{oa{sa{sv}}}")
3451
def GetManagedObjects(self):
3453
return dbus.Dictionary(
3454
{client.dbus_object_path:
3456
{interface: client.GetAll(interface)
3458
client._get_all_interface_names()})
3459
for client in tcp_server.clients.values()})
3461
def client_added_signal(self, client):
3462
"""Send the new standard signal and the old signal"""
3464
# New standard signal
3465
self.InterfacesAdded(
3466
client.dbus_object_path,
3468
{interface: client.GetAll(interface)
3470
client._get_all_interface_names()}))
3472
self.ClientAdded(client.dbus_object_path)
3474
def client_removed_signal(self, client):
3475
"""Send the new standard signal and the old signal"""
3477
# New standard signal
3478
self.InterfacesRemoved(
3479
client.dbus_object_path,
3480
client._get_all_interface_names())
3482
self.ClientRemoved(client.dbus_object_path,
3485
mandos_dbus_service = MandosDBusService()
3487
# Save modules to variables to exempt the modules from being
3488
# unloaded before the function registered with atexit() is run.
3489
mp = multiprocessing
2367
class MandosDBusServiceTransitional(MandosDBusService):
2368
__metaclass__ = AlternateDBusNamesMetaclass
2369
mandos_dbus_service = MandosDBusServiceTransitional()
3493
2372
"Cleanup function; run on exit"
3497
mp.active_children()
2375
multiprocessing.active_children()
3499
2376
if not (tcp_server.clients or client_settings):
3502
2379
# Store client before exiting. Secrets are encrypted with key
3503
2380
# based on what config file has. If config file is
3504
2381
# removed/edited, old secret will thus be unrecovable.
3506
2383
with PGPEngine() as pgp:
3507
for client in tcp_server.clients.values():
2384
for client in tcp_server.clients.itervalues():
3508
2385
key = client_settings[client.name]["secret"]
3509
2386
client.encrypted_secret = pgp.encrypt(client.secret,
3511
2388
client_dict = {}
3513
2390
# A list of attributes that can not be pickled
3515
exclude = {"bus", "changedstate", "secret",
3516
"checker", "server_settings"}
3517
for name, typ in inspect.getmembers(dbus.service
2392
exclude = set(("bus", "changedstate", "secret",
2394
for name, typ in (inspect.getmembers
2395
(dbus.service.Object)):
3519
2396
exclude.add(name)
3521
2398
client_dict["encrypted_secret"] = (client
3522
2399
.encrypted_secret)
3523
2400
for attr in client.client_structure:
3524
2401
if attr not in exclude:
3525
2402
client_dict[attr] = getattr(client, attr)
3527
2404
clients[client.name] = client_dict
3528
2405
del client_settings[client.name]["secret"]
3531
with tempfile.NamedTemporaryFile(
3535
dir=os.path.dirname(stored_state_path),
3536
delete=False) as stored_state:
3537
pickle.dump((clients, client_settings), stored_state,
3539
tempname = stored_state.name
3540
os.rename(tempname, stored_state_path)
2408
with os.fdopen(os.open(stored_state_path,
2409
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2410
0600), "wb") as stored_state:
2411
pickle.dump((clients, client_settings), stored_state)
3541
2412
except (IOError, OSError) as e:
3547
if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
3548
logger.warning("Could not save persistent state: {}"
3549
.format(os.strerror(e.errno)))
3551
logger.warning("Could not save persistent state:",
2413
logger.warning("Could not save persistent state: {0}"
2415
if e.errno not in (errno.ENOENT, errno.EACCES):
3555
2418
# Delete all clients, and settings from config
3556
2419
while tcp_server.clients:
3557
2420
name, client = tcp_server.clients.popitem()
3559
2422
client.remove_from_connection()
3560
# Don't signal the disabling
2423
# Don't signal anything except ClientRemoved
3561
2424
client.disable(quiet=True)
3562
# Emit D-Bus signal for removal
3564
mandos_dbus_service.client_removed_signal(client)
2427
mandos_dbus_service.ClientRemoved(client
3565
2430
client_settings.clear()
3567
2432
atexit.register(cleanup)
3569
for client in tcp_server.clients.values():
2434
for client in tcp_server.clients.itervalues():
3571
# Emit D-Bus signal for adding
3572
mandos_dbus_service.client_added_signal(client)
2437
mandos_dbus_service.ClientAdded(client.dbus_object_path)
3573
2438
# Need to initiate checking of clients
3574
2439
if client.enabled:
3575
2440
client.init_checker()
3577
2442
tcp_server.enable()
3578
2443
tcp_server.server_activate()
3580
2445
# Find out what port we got
3582
service.port = tcp_server.socket.getsockname()[1]
2446
service.port = tcp_server.socket.getsockname()[1]
3584
2448
logger.info("Now listening on address %r, port %d,"
3585
" flowinfo %d, scope_id %d",
3586
*tcp_server.socket.getsockname())
2449
" flowinfo %d, scope_id %d"
2450
% tcp_server.socket.getsockname())
3588
logger.info("Now listening on address %r, port %d",
3589
*tcp_server.socket.getsockname())
3591
# service.interface = tcp_server.socket.getsockname()[3]
2452
logger.info("Now listening on address %r, port %d"
2453
% tcp_server.socket.getsockname())
2455
#service.interface = tcp_server.socket.getsockname()[3]
3595
# From the Avahi example code
3598
except dbus.exceptions.DBusException as error:
3599
logger.critical("D-Bus Exception", exc_info=error)
3602
# End of Avahi example code
3604
GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,
3605
lambda *args, **kwargs:
3606
(tcp_server.handle_request
3607
(*args[2:], **kwargs) or True))
2458
# From the Avahi example code
2461
except dbus.exceptions.DBusException as error:
2462
logger.critical("DBusException: %s", error)
2465
# End of Avahi example code
2467
gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2468
lambda *args, **kwargs:
2469
(tcp_server.handle_request
2470
(*args[2:], **kwargs) or True))
3609
2472
logger.debug("Starting main loop")
3610
2473
main_loop.run()
3611
2474
except AvahiError as error:
3612
logger.critical("Avahi Error", exc_info=error)
2475
logger.critical("AvahiError: %s", error)
3615
2478
except KeyboardInterrupt: