/mandos/release : revision 237.7.110

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

21

19

# the Free Software Foundation, either version 3 of the License, or

22

20

# (at your option) any later version.

23

21

#

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

26

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

27

25

# GNU General Public License for more details.

28

#

26

#

29

27

# You should have received a copy of the GNU General Public License

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

32

31

# Contact the authors at <mandos@recompile.se>.

33

#

32

#

34

33

35

34

from __future__ import (division, absolute_import, print_function,

36

35

unicode_literals)

37

36

38

try:

39

from future_builtins import *

40

except ImportError:

41

pass

42

43

try:

44

import SocketServer as socketserver

45

except ImportError:

46

import socketserver

37

import SocketServer as socketserver

47

38

import socket

48

39

import argparse

49

40

import datetime

50

41

import errno

51

try:

52

import ConfigParser as configparser

53

except ImportError:

54

import configparser

42

import gnutls.crypto

43

import gnutls.connection

44

import gnutls.errors

45

import gnutls.library.functions

46

import gnutls.library.constants

47

import gnutls.library.types

48

import ConfigParser as configparser

55

49

import sys

56

50

import re

57

51

import os

66

60

import struct

67

61

import fcntl

68

62

import functools

69

try:

70

import cPickle as pickle

71

except ImportError:

72

import pickle

63

import cPickle as pickle

73

64

import multiprocessing

74

65

import types

75

66

import binascii

76

67

import tempfile

77

68

import itertools

78

import collections

79

import codecs

80

69

81

70

import dbus

82

71

import dbus.service

83

import gi

84

from gi.repository import GLib

72

import gobject

73

import avahi

85

74

from dbus.mainloop.glib import DBusGMainLoop

86

75

import ctypes

87

76

import ctypes.util

88

77

import xml.dom.minidom

89

78

import inspect

79

import GnuPGInterface

90

80

91

# Try to find the value of SO_BINDTODEVICE:

92

81

try:

93

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

94

# newer, and it is also the most natural place for it:

95

82

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

96

83

except AttributeError:

97

84

try:

98

# This is where SO_BINDTODEVICE was up to and including Python

99

# 2.6, and also 3.2:

100

85

from IN import SO_BINDTODEVICE

101

86

except ImportError:

102

# In Python 2.7 it seems to have been removed entirely.

103

# Try running the C preprocessor:

104

try:

105

cc = subprocess.Popen(["cc", "--language=c", "-E",

106

"/dev/stdin"],

107

stdin=subprocess.PIPE,

108

stdout=subprocess.PIPE)

109

stdout = cc.communicate(

110

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

111

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

112

except (OSError, ValueError, IndexError):

113

# No value found

114

SO_BINDTODEVICE = None

115

116

if sys.version_info.major == 2:

117

str = unicode

118

119

if sys.version_info < (3, 2):

120

configparser.Configparser = configparser.SafeConfigParser

121

122

version = "1.8.7"

87

SO_BINDTODEVICE = None

88

89

version = "1.5.3"

123

90

stored_state_file = "clients.pickle"

124

91

125

92

logger = logging.getLogger()

126

syslogger = None

93

syslogger = (logging.handlers.SysLogHandler

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

address = str("/dev/log")))

127

96

128

97

try:

129

if_nametoindex = ctypes.cdll.LoadLibrary(

130

ctypes.util.find_library("c")).if_nametoindex

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

131

101

except (OSError, AttributeError):

132

133

102

def if_nametoindex(interface):

134

103

"Get an interface index the hard way, i.e. using fcntl()"

135

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

136

105

with contextlib.closing(socket.socket()) as s:

137

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

138

struct.pack(b"16s16x", interface))

139

interface_index = struct.unpack("I", ifreq[16:20])[0]

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

140

111

return interface_index

141

112

142

113

143

def copy_function(func):

144

"""Make a copy of a function"""

145

if sys.version_info.major == 2:

146

return types.FunctionType(func.func_code,

147

func.func_globals,

148

func.func_name,

149

func.func_defaults,

150

func.func_closure)

151

else:

152

return types.FunctionType(func.__code__,

153

func.__globals__,

154

func.__name__,

155

func.__defaults__,

156

func.__closure__)

157

158

159

114

def initlogger(debug, level=logging.WARNING):

160

115

"""init logger and add loglevel"""

161

162

global syslogger

163

syslogger = (logging.handlers.SysLogHandler(

164

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

165

address="/dev/log"))

116

166

117

syslogger.setFormatter(logging.Formatter

167

118

('Mandos [%(process)d]: %(levelname)s:'

168

119

' %(message)s'))

169

120

logger.addHandler(syslogger)

170

121

171

122

if debug:

172

123

console = logging.StreamHandler()

173

124

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

185

136

186

137

class PGPEngine(object):

187

138

"""A simple class for OpenPGP symmetric encryption & decryption"""

188

189

139

def __init__(self):

140

self.gnupg = GnuPGInterface.GnuPG()

190

141

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

191

self.gpg = "gpg"

192

try:

193

output = subprocess.check_output(["gpgconf"])

194

for line in output.splitlines():

195

name, text, path = line.split(b":")

196

if name == "gpg":

197

self.gpg = path

198

break

199

except OSError as e:

200

if e.errno != errno.ENOENT:

201

raise

202

self.gnupgargs = ['--batch',

203

'--homedir', self.tempdir,

204

'--force-mdc',

205

'--quiet']

206

# Only GPG version 1 has the --no-use-agent option.

207

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

208

self.gnupgargs.append("--no-use-agent")

209

142

self.gnupg = GnuPGInterface.GnuPG()

143

self.gnupg.options.meta_interactive = False

144

self.gnupg.options.homedir = self.tempdir

145

self.gnupg.options.extra_args.extend(['--force-mdc',

146

'--quiet',

147

'--no-use-agent'])

148

210

149

def __enter__(self):

211

150

return self

212

213

def __exit__(self, exc_type, exc_value, traceback):

151

152

def __exit__ (self, exc_type, exc_value, traceback):

214

153

self._cleanup()

215

154

return False

216

155

217

156

def __del__(self):

218

157

self._cleanup()

219

158

220

159

def _cleanup(self):

221

160

if self.tempdir is not None:

222

161

# Delete contents of tempdir

223

162

for root, dirs, files in os.walk(self.tempdir,

224

topdown=False):

163

topdown = False):

225

164

for filename in files:

226

165

os.remove(os.path.join(root, filename))

227

166

for dirname in dirs:

229

168

# Remove tempdir

230

169

os.rmdir(self.tempdir)

231

170

self.tempdir = None

232

171

233

172

def password_encode(self, password):

234

173

# Passphrase can not be empty and can not contain newlines or

235

174

# NUL bytes. So we prefix it and hex encode it.

236

encoded = b"mandos" + binascii.hexlify(password)

237

if len(encoded) > 2048:

238

# GnuPG can't handle long passwords, so encode differently

239

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

240

.replace(b"\n", b"\\n")

241

.replace(b"\0", b"\\x00"))

242

return encoded

243

175

return b"mandos" + binascii.hexlify(password)

176

244

177

def encrypt(self, data, password):

245

passphrase = self.password_encode(password)

246

with tempfile.NamedTemporaryFile(

247

dir=self.tempdir) as passfile:

248

passfile.write(passphrase)

249

passfile.flush()

250

proc = subprocess.Popen([self.gpg, '--symmetric',

251

'--passphrase-file',

252

passfile.name]

253

+ self.gnupgargs,

254

stdin=subprocess.PIPE,

255

stdout=subprocess.PIPE,

256

stderr=subprocess.PIPE)

257

ciphertext, err = proc.communicate(input=data)

258

if proc.returncode != 0:

259

raise PGPError(err)

178

self.gnupg.passphrase = self.password_encode(password)

179

with open(os.devnull, "w") as devnull:

180

try:

181

proc = self.gnupg.run(['--symmetric'],

182

create_fhs=['stdin', 'stdout'],

183

attach_fhs={'stderr': devnull})

184

with contextlib.closing(proc.handles['stdin']) as f:

185

f.write(data)

186

with contextlib.closing(proc.handles['stdout']) as f:

187

ciphertext = f.read()

188

proc.wait()

189

except IOError as e:

190

raise PGPError(e)

191

self.gnupg.passphrase = None

260

192

return ciphertext

261

193

262

194

def decrypt(self, data, password):

263

passphrase = self.password_encode(password)

264

with tempfile.NamedTemporaryFile(

265

dir=self.tempdir) as passfile:

266

passfile.write(passphrase)

267

passfile.flush()

268

proc = subprocess.Popen([self.gpg, '--decrypt',

269

'--passphrase-file',

270

passfile.name]

271

+ self.gnupgargs,

272

stdin=subprocess.PIPE,

273

stdout=subprocess.PIPE,

274

stderr=subprocess.PIPE)

275

decrypted_plaintext, err = proc.communicate(input=data)

276

if proc.returncode != 0:

277

raise PGPError(err)

195

self.gnupg.passphrase = self.password_encode(password)

196

with open(os.devnull, "w") as devnull:

197

try:

198

proc = self.gnupg.run(['--decrypt'],

199

create_fhs=['stdin', 'stdout'],

200

attach_fhs={'stderr': devnull})

201

with contextlib.closing(proc.handles['stdin']) as f:

202

f.write(data)

203

with contextlib.closing(proc.handles['stdout']) as f:

204

decrypted_plaintext = f.read()

205

proc.wait()

206

except IOError as e:

207

raise PGPError(e)

208

self.gnupg.passphrase = None

278

209

return decrypted_plaintext

279

210

280

211

281

# Pretend that we have an Avahi module

282

class avahi(object):

283

"""This isn't so much a class as it is a module-like namespace."""

284

IF_UNSPEC = -1 # avahi-common/address.h

285

PROTO_UNSPEC = -1 # avahi-common/address.h

286

PROTO_INET = 0 # avahi-common/address.h

287

PROTO_INET6 = 1 # avahi-common/address.h

288

DBUS_NAME = "org.freedesktop.Avahi"

289

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

290

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

291

DBUS_PATH_SERVER = "/"

292

293

@staticmethod

294

def string_array_to_txt_array(t):

295

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

296

for s in t), signature="ay")

297

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

298

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

299

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

300

SERVER_INVALID = 0 # avahi-common/defs.h

301

SERVER_REGISTERING = 1 # avahi-common/defs.h

302

SERVER_RUNNING = 2 # avahi-common/defs.h

303

SERVER_COLLISION = 3 # avahi-common/defs.h

304

SERVER_FAILURE = 4 # avahi-common/defs.h

305

306

212

307

213

class AvahiError(Exception):

308

214

def __init__(self, value, *args, **kwargs):

309

215

self.value = value

310

return super(AvahiError, self).__init__(value, *args,

311

**kwargs)

312

216

super(AvahiError, self).__init__(value, *args, **kwargs)

217

def __unicode__(self):

218

return unicode(repr(self.value))

313

219

314

220

class AvahiServiceError(AvahiError):

315

221

pass

316

222

317

318

223

class AvahiGroupError(AvahiError):

319

224

pass

320

225

321

226

322

227

class AvahiService(object):

323

228

"""An Avahi (Zeroconf) service.

324

229

325

230

Attributes:

326

231

interface: integer; avahi.IF_UNSPEC or an interface index.

327

232

Used to optionally bind to the specified interface.

328

233

name: string; Example: 'Mandos'

329

234

type: string; Example: '_mandos._tcp'.

330

See <https://www.iana.org/assignments/service-names-port-numbers>

235

See <http://www.dns-sd.org/ServiceTypes.html>

331

236

port: integer; what port to announce

332

237

TXT: list of strings; TXT record for the service

333

238

domain: string; Domain to publish on, default to .local if empty.

339

244

server: D-Bus Server

340

245

bus: dbus.SystemBus()

341

246

"""

342

343

def __init__(self,

344

interface=avahi.IF_UNSPEC,

345

name=None,

346

servicetype=None,

347

port=None,

348

TXT=None,

349

domain="",

350

host="",

351

max_renames=32768,

352

protocol=avahi.PROTO_UNSPEC,

353

bus=None):

247

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

248

servicetype = None, port = None, TXT = None,

249

domain = "", host = "", max_renames = 32768,

250

protocol = avahi.PROTO_UNSPEC, bus = None):

354

251

self.interface = interface

355

252

self.name = name

356

253

self.type = servicetype

365

262

self.server = None

366

263

self.bus = bus

367

264

self.entry_group_state_changed_match = None

368

369

def rename(self, remove=True):

265

def rename(self):

370

266

"""Derived from the Avahi example code"""

371

267

if self.rename_count >= self.max_renames:

372

268

logger.critical("No suitable Zeroconf service name found"

373

269

" after %i retries, exiting.",

374

270

self.rename_count)

375

271

raise AvahiServiceError("Too many renames")

376

self.name = str(

377

self.server.GetAlternativeServiceName(self.name))

378

self.rename_count += 1

272

self.name = unicode(self.server

273

.GetAlternativeServiceName(self.name))

379

274

logger.info("Changing Zeroconf service name to %r ...",

380

275

self.name)

381

if remove:

382

self.remove()

276

self.remove()

383

277

try:

384

278

self.add()

385

279

except dbus.exceptions.DBusException as error:

386

if (error.get_dbus_name()

387

== "org.freedesktop.Avahi.CollisionError"):

388

logger.info("Local Zeroconf service name collision.")

389

return self.rename(remove=False)

390

else:

391

logger.critical("D-Bus Exception", exc_info=error)

392

self.cleanup()

393

os._exit(1)

394

280

logger.critical("DBusException: %s", error)

281

self.cleanup()

282

os._exit(1)

283

self.rename_count += 1

395

284

def remove(self):

396

285

"""Derived from the Avahi example code"""

397

286

if self.entry_group_state_changed_match is not None:

399

288

self.entry_group_state_changed_match = None

400

289

if self.group is not None:

401

290

self.group.Reset()

402

403

291

def add(self):

404

292

"""Derived from the Avahi example code"""

405

293

self.remove()

422

310

dbus.UInt16(self.port),

423

311

avahi.string_array_to_txt_array(self.TXT))

424

312

self.group.Commit()

425

426

313

def entry_group_state_changed(self, state, error):

427

314

"""Derived from the Avahi example code"""

428

315

logger.debug("Avahi entry group state change: %i", state)

429

316

430

317

if state == avahi.ENTRY_GROUP_ESTABLISHED:

431

318

logger.debug("Zeroconf service established.")

432

319

elif state == avahi.ENTRY_GROUP_COLLISION:

434

321

self.rename()

435

322

elif state == avahi.ENTRY_GROUP_FAILURE:

436

323

logger.critical("Avahi: Error in group state changed %s",

437

str(error))

438

raise AvahiGroupError("State changed: {!s}".format(error))

439

324

unicode(error))

325

raise AvahiGroupError("State changed: %s"

326

% unicode(error))

440

327

def cleanup(self):

441

328

"""Derived from the Avahi example code"""

442

329

if self.group is not None:

447

334

pass

448

335

self.group = None

449

336

self.remove()

450

451

337

def server_state_changed(self, state, error=None):

452

338

"""Derived from the Avahi example code"""

453

339

logger.debug("Avahi server state change: %i", state)

454

bad_states = {

455

avahi.SERVER_INVALID: "Zeroconf server invalid",

456

avahi.SERVER_REGISTERING: None,

457

avahi.SERVER_COLLISION: "Zeroconf server name collision",

458

avahi.SERVER_FAILURE: "Zeroconf server failure",

459

}

340

bad_states = { avahi.SERVER_INVALID:

341

"Zeroconf server invalid",

342

avahi.SERVER_REGISTERING: None,

343

avahi.SERVER_COLLISION:

344

"Zeroconf server name collision",

345

avahi.SERVER_FAILURE:

346

"Zeroconf server failure" }

460

347

if state in bad_states:

461

348

if bad_states[state] is not None:

462

349

if error is None:

465

352

logger.error(bad_states[state] + ": %r", error)

466

353

self.cleanup()

467

354

elif state == avahi.SERVER_RUNNING:

468

try:

469

self.add()

470

except dbus.exceptions.DBusException as error:

471

if (error.get_dbus_name()

472

== "org.freedesktop.Avahi.CollisionError"):

473

logger.info("Local Zeroconf service name"

474

" collision.")

475

return self.rename(remove=False)

476

else:

477

logger.critical("D-Bus Exception", exc_info=error)

478

self.cleanup()

479

os._exit(1)

355

self.add()

480

356

else:

481

357

if error is None:

482

358

logger.debug("Unknown state: %r", state)

483

359

else:

484

360

logger.debug("Unknown state: %r: %r", state, error)

485

486

361

def activate(self):

487

362

"""Derived from the Avahi example code"""

488

363

if self.server is None:

492

367

follow_name_owner_changes=True),

493

368

avahi.DBUS_INTERFACE_SERVER)

494

369

self.server.connect_to_signal("StateChanged",

495

self.server_state_changed)

370

self.server_state_changed)

496

371

self.server_state_changed(self.server.GetState())

497

372

498

499

373

class AvahiServiceToSyslog(AvahiService):

500

def rename(self, *args, **kwargs):

374

def rename(self):

501

375

"""Add the new name to the syslog messages"""

502

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

503

syslogger.setFormatter(logging.Formatter(

504

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

505

.format(self.name)))

376

ret = AvahiService.rename(self)

377

syslogger.setFormatter(logging.Formatter

378

('Mandos (%s) [%%(process)d]:'

379

' %%(levelname)s: %%(message)s'

380

% self.name))

506

381

return ret

507

382

508

509

# Pretend that we have a GnuTLS module

510

class gnutls(object):

511

"""This isn't so much a class as it is a module-like namespace."""

512

513

library = ctypes.util.find_library("gnutls")

514

if library is None:

515

library = ctypes.util.find_library("gnutls-deb0")

516

_library = ctypes.cdll.LoadLibrary(library)

517

del library

518

519

# Unless otherwise indicated, the constants and types below are

520

# all from the gnutls/gnutls.h C header file.

521

522

# Constants

523

E_SUCCESS = 0

524

E_INTERRUPTED = -52

525

E_AGAIN = -28

526

CRT_OPENPGP = 2

527

CRT_RAWPK = 3

528

CLIENT = 2

529

SHUT_RDWR = 0

530

CRD_CERTIFICATE = 1

531

E_NO_CERTIFICATE_FOUND = -49

532

X509_FMT_DER = 0

533

NO_TICKETS = 1<<10

534

ENABLE_RAWPK = 1<<18

535

CTYPE_PEERS = 3

536

KEYID_USE_SHA256 = 1 # gnutls/x509.h

537

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

538

539

# Types

540

class session_int(ctypes.Structure):

541

_fields_ = []

542

session_t = ctypes.POINTER(session_int)

543

544

class certificate_credentials_st(ctypes.Structure):

545

_fields_ = []

546

certificate_credentials_t = ctypes.POINTER(

547

certificate_credentials_st)

548

certificate_type_t = ctypes.c_int

549

550

class datum_t(ctypes.Structure):

551

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

552

('size', ctypes.c_uint)]

553

554

class openpgp_crt_int(ctypes.Structure):

555

_fields_ = []

556

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

557

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

558

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

559

credentials_type_t = ctypes.c_int

560

transport_ptr_t = ctypes.c_void_p

561

close_request_t = ctypes.c_int

562

563

# Exceptions

564

class Error(Exception):

565

def __init__(self, message=None, code=None, args=()):

566

# Default usage is by a message string, but if a return

567

# code is passed, convert it to a string with

568

# gnutls.strerror()

569

self.code = code

570

if message is None and code is not None:

571

message = gnutls.strerror(code)

572

return super(gnutls.Error, self).__init__(

573

message, *args)

574

575

class CertificateSecurityError(Error):

576

pass

577

578

# Classes

579

class Credentials(object):

580

def __init__(self):

581

self._c_object = gnutls.certificate_credentials_t()

582

gnutls.certificate_allocate_credentials(

583

ctypes.byref(self._c_object))

584

self.type = gnutls.CRD_CERTIFICATE

585

586

def __del__(self):

587

gnutls.certificate_free_credentials(self._c_object)

588

589

class ClientSession(object):

590

def __init__(self, socket, credentials=None):

591

self._c_object = gnutls.session_t()

592

gnutls_flags = gnutls.CLIENT

593

if gnutls.check_version(b"3.5.6"):

594

gnutls_flags |= gnutls.NO_TICKETS

595

if gnutls.has_rawpk:

596

gnutls_flags |= gnutls.ENABLE_RAWPK

597

gnutls.init(ctypes.byref(self._c_object), gnutls_flags)

598

del gnutls_flags

599

gnutls.set_default_priority(self._c_object)

600

gnutls.transport_set_ptr(self._c_object, socket.fileno())

601

gnutls.handshake_set_private_extensions(self._c_object,

602

True)

603

self.socket = socket

604

if credentials is None:

605

credentials = gnutls.Credentials()

606

gnutls.credentials_set(self._c_object, credentials.type,

607

ctypes.cast(credentials._c_object,

608

ctypes.c_void_p))

609

self.credentials = credentials

610

611

def __del__(self):

612

gnutls.deinit(self._c_object)

613

614

def handshake(self):

615

return gnutls.handshake(self._c_object)

616

617

def send(self, data):

618

data = bytes(data)

619

data_len = len(data)

620

while data_len > 0:

621

data_len -= gnutls.record_send(self._c_object,

622

data[-data_len:],

623

data_len)

624

625

def bye(self):

626

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

627

628

# Error handling functions

629

def _error_code(result):

630

"""A function to raise exceptions on errors, suitable

631

for the 'restype' attribute on ctypes functions"""

632

if result >= 0:

633

return result

634

if result == gnutls.E_NO_CERTIFICATE_FOUND:

635

raise gnutls.CertificateSecurityError(code=result)

636

raise gnutls.Error(code=result)

637

638

def _retry_on_error(result, func, arguments):

639

"""A function to retry on some errors, suitable

640

for the 'errcheck' attribute on ctypes functions"""

641

while result < 0:

642

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

643

return _error_code(result)

644

result = func(*arguments)

645

return result

646

647

# Unless otherwise indicated, the function declarations below are

648

# all from the gnutls/gnutls.h C header file.

649

650

# Functions

651

priority_set_direct = _library.gnutls_priority_set_direct

652

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

653

ctypes.POINTER(ctypes.c_char_p)]

654

priority_set_direct.restype = _error_code

655

656

init = _library.gnutls_init

657

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

658

init.restype = _error_code

659

660

set_default_priority = _library.gnutls_set_default_priority

661

set_default_priority.argtypes = [session_t]

662

set_default_priority.restype = _error_code

663

664

record_send = _library.gnutls_record_send

665

record_send.argtypes = [session_t, ctypes.c_void_p,

666

ctypes.c_size_t]

667

record_send.restype = ctypes.c_ssize_t

668

record_send.errcheck = _retry_on_error

669

670

certificate_allocate_credentials = (

671

_library.gnutls_certificate_allocate_credentials)

672

certificate_allocate_credentials.argtypes = [

673

ctypes.POINTER(certificate_credentials_t)]

674

certificate_allocate_credentials.restype = _error_code

675

676

certificate_free_credentials = (

677

_library.gnutls_certificate_free_credentials)

678

certificate_free_credentials.argtypes = [

679

certificate_credentials_t]

680

certificate_free_credentials.restype = None

681

682

handshake_set_private_extensions = (

683

_library.gnutls_handshake_set_private_extensions)

684

handshake_set_private_extensions.argtypes = [session_t,

685

ctypes.c_int]

686

handshake_set_private_extensions.restype = None

687

688

credentials_set = _library.gnutls_credentials_set

689

credentials_set.argtypes = [session_t, credentials_type_t,

690

ctypes.c_void_p]

691

credentials_set.restype = _error_code

692

693

strerror = _library.gnutls_strerror

694

strerror.argtypes = [ctypes.c_int]

695

strerror.restype = ctypes.c_char_p

696

697

certificate_type_get = _library.gnutls_certificate_type_get

698

certificate_type_get.argtypes = [session_t]

699

certificate_type_get.restype = _error_code

700

701

certificate_get_peers = _library.gnutls_certificate_get_peers

702

certificate_get_peers.argtypes = [session_t,

703

ctypes.POINTER(ctypes.c_uint)]

704

certificate_get_peers.restype = ctypes.POINTER(datum_t)

705

706

global_set_log_level = _library.gnutls_global_set_log_level

707

global_set_log_level.argtypes = [ctypes.c_int]

708

global_set_log_level.restype = None

709

710

global_set_log_function = _library.gnutls_global_set_log_function

711

global_set_log_function.argtypes = [log_func]

712

global_set_log_function.restype = None

713

714

deinit = _library.gnutls_deinit

715

deinit.argtypes = [session_t]

716

deinit.restype = None

717

718

handshake = _library.gnutls_handshake

719

handshake.argtypes = [session_t]

720

handshake.restype = _error_code

721

handshake.errcheck = _retry_on_error

722

723

transport_set_ptr = _library.gnutls_transport_set_ptr

724

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

725

transport_set_ptr.restype = None

726

727

bye = _library.gnutls_bye

728

bye.argtypes = [session_t, close_request_t]

729

bye.restype = _error_code

730

bye.errcheck = _retry_on_error

731

732

check_version = _library.gnutls_check_version

733

check_version.argtypes = [ctypes.c_char_p]

734

check_version.restype = ctypes.c_char_p

735

736

_need_version = b"3.3.0"

737

if check_version(_need_version) is None:

738

raise self.Error("Needs GnuTLS {} or later"

739

.format(_need_version))

740

741

_tls_rawpk_version = b"3.6.6"

742

has_rawpk = bool(check_version(_tls_rawpk_version))

743

744

if has_rawpk:

745

# Types

746

class pubkey_st(ctypes.Structure):

747

_fields = []

748

pubkey_t = ctypes.POINTER(pubkey_st)

749

750

x509_crt_fmt_t = ctypes.c_int

751

752

# All the function declarations below are from gnutls/abstract.h

753

pubkey_init = _library.gnutls_pubkey_init

754

pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]

755

pubkey_init.restype = _error_code

756

757

pubkey_import = _library.gnutls_pubkey_import

758

pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),

759

x509_crt_fmt_t]

760

pubkey_import.restype = _error_code

761

762

pubkey_get_key_id = _library.gnutls_pubkey_get_key_id

763

pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,

764

ctypes.POINTER(ctypes.c_ubyte),

765

ctypes.POINTER(ctypes.c_size_t)]

766

pubkey_get_key_id.restype = _error_code

767

768

pubkey_deinit = _library.gnutls_pubkey_deinit

769

pubkey_deinit.argtypes = [pubkey_t]

770

pubkey_deinit.restype = None

771

else:

772

# All the function declarations below are from gnutls/openpgp.h

773

774

openpgp_crt_init = _library.gnutls_openpgp_crt_init

775

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

776

openpgp_crt_init.restype = _error_code

777

778

openpgp_crt_import = _library.gnutls_openpgp_crt_import

779

openpgp_crt_import.argtypes = [openpgp_crt_t,

780

ctypes.POINTER(datum_t),

781

openpgp_crt_fmt_t]

782

openpgp_crt_import.restype = _error_code

783

784

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

785

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

786

ctypes.POINTER(ctypes.c_uint)]

787

openpgp_crt_verify_self.restype = _error_code

788

789

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

790

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

791

openpgp_crt_deinit.restype = None

792

793

openpgp_crt_get_fingerprint = (

794

_library.gnutls_openpgp_crt_get_fingerprint)

795

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

796

ctypes.c_void_p,

797

ctypes.POINTER(

798

ctypes.c_size_t)]

799

openpgp_crt_get_fingerprint.restype = _error_code

800

801

if check_version(b"3.6.4"):

802

certificate_type_get2 = _library.gnutls_certificate_type_get2

803

certificate_type_get2.argtypes = [session_t, ctypes.c_int]

804

certificate_type_get2.restype = _error_code

805

806

# Remove non-public functions

807

del _error_code, _retry_on_error

808

809

810

def call_pipe(connection, # : multiprocessing.Connection

811

func, *args, **kwargs):

812

"""This function is meant to be called by multiprocessing.Process

813

814

This function runs func(*args, **kwargs), and writes the resulting

815

return value on the provided multiprocessing.Connection.

816

"""

817

connection.send(func(*args, **kwargs))

818

connection.close()

819

820

383

def timedelta_to_milliseconds(td):

384

"Convert a datetime.timedelta() to milliseconds"

385

return ((td.days * 24 * 60 * 60 * 1000)

386

+ (td.seconds * 1000)

387

+ (td.microseconds // 1000))

388

821

389

class Client(object):

822

390

"""A representation of a client host served by this server.

823

391

824

392

Attributes:

825

393

approved: bool(); 'None' if not yet approved/disapproved

826

394

approval_delay: datetime.timedelta(); Time to wait for approval

827

395

approval_duration: datetime.timedelta(); Duration of one approval

828

checker: multiprocessing.Process(); a running checker process used

829

to see if the client lives. 'None' if no process is

830

running.

831

checker_callback_tag: a GLib event source tag, or None

396

checker: subprocess.Popen(); a running checker process used

397

to see if the client lives.

398

'None' if no process is running.

399

checker_callback_tag: a gobject event source tag, or None

832

400

checker_command: string; External command which is run to check

833

401

if client lives. %() expansions are done at

834

402

runtime with vars(self) as dict, so that for

835

403

instance %(name)s can be used in the command.

836

checker_initiator_tag: a GLib event source tag, or None

404

checker_initiator_tag: a gobject event source tag, or None

837

405

created: datetime.datetime(); (UTC) object creation

838

406

client_structure: Object describing what attributes a client has

839

407

and is used for storing the client at exit

840

408

current_checker_command: string; current running checker_command

841

disable_initiator_tag: a GLib event source tag, or None

409

disable_initiator_tag: a gobject event source tag, or None

842

410

enabled: bool()

843

411

fingerprint: string (40 or 32 hexadecimal digits); used to

844

uniquely identify an OpenPGP client

845

key_id: string (64 hexadecimal digits); used to uniquely identify

846

a client using raw public keys

412

uniquely identify the client

847

413

host: string; available for use by the checker command

848

414

interval: datetime.timedelta(); How often to start a new checker

849

415

last_approval_request: datetime.datetime(); (UTC) or None

851

417

last_checker_status: integer between 0 and 255 reflecting exit

852

418

status of last checker. -1 reflects crashed

853

419

checker, -2 means no checker completed yet.

854

last_checker_signal: The signal which killed the last checker, if

855

last_checker_status is -1

856

420

last_enabled: datetime.datetime(); (UTC) or None

857

421

name: string; from the config file, used in log messages and

858

422

D-Bus identifiers

863

427

runtime_expansions: Allowed attributes for runtime expansion.

864

428

expires: datetime.datetime(); time (UTC) when a client will be

865

429

disabled, or None

866

server_settings: The server_settings dict from main()

867

430

"""

868

431

869

432

runtime_expansions = ("approval_delay", "approval_duration",

870

"created", "enabled", "expires", "key_id",

871

"fingerprint", "host", "interval",

872

"last_approval_request", "last_checked_ok",

433

"created", "enabled", "fingerprint",

434

"host", "interval", "last_checked_ok",

873

435

"last_enabled", "name", "timeout")

874

client_defaults = {

875

"timeout": "PT5M",

876

"extended_timeout": "PT15M",

877

"interval": "PT2M",

878

"checker": "fping -q -- %%(host)s",

879

"host": "",

880

"approval_delay": "PT0S",

881

"approval_duration": "PT1S",

882

"approved_by_default": "True",

883

"enabled": "True",

884

}

436

client_defaults = { "timeout": "5m",

437

"extended_timeout": "15m",

438

"interval": "2m",

439

"checker": "fping -q -- %%(host)s",

440

"host": "",

441

"approval_delay": "0s",

442

"approval_duration": "1s",

443

"approved_by_default": "True",

444

"enabled": "True",

445

}

446

447

def timeout_milliseconds(self):

448

"Return the 'timeout' attribute in milliseconds"

449

return timedelta_to_milliseconds(self.timeout)

450

451

def extended_timeout_milliseconds(self):

452

"Return the 'extended_timeout' attribute in milliseconds"

453

return timedelta_to_milliseconds(self.extended_timeout)

454

455

def interval_milliseconds(self):

456

"Return the 'interval' attribute in milliseconds"

457

return timedelta_to_milliseconds(self.interval)

458

459

def approval_delay_milliseconds(self):

460

return timedelta_to_milliseconds(self.approval_delay)

885

461

886

462

@staticmethod

887

463

def config_parser(config):

895

471

for client_name in config.sections():

896

472

section = dict(config.items(client_name))

897

473

client = settings[client_name] = {}

898

474

899

475

client["host"] = section["host"]

900

476

# Reformat values from string types to Python types

901

477

client["approved_by_default"] = config.getboolean(

902

478

client_name, "approved_by_default")

903

479

client["enabled"] = config.getboolean(client_name,

904

480

"enabled")

905

906

# Uppercase and remove spaces from key_id and fingerprint

907

# for later comparison purposes with return value from the

908

# key_id() and fingerprint() functions

909

client["key_id"] = (section.get("key_id", "").upper()

910

.replace(" ", ""))

481

911

482

client["fingerprint"] = (section["fingerprint"].upper()

912

483

.replace(" ", ""))

913

484

if "secret" in section:

914

client["secret"] = codecs.decode(section["secret"]

915

.encode("utf-8"),

916

"base64")

485

client["secret"] = section["secret"].decode("base64")

917

486

elif "secfile" in section:

918

487

with open(os.path.expanduser(os.path.expandvars

919

488

(section["secfile"])),

920

489

"rb") as secfile:

921

490

client["secret"] = secfile.read()

922

491

else:

923

raise TypeError("No secret or secfile for section {}"

924

.format(section))

492

raise TypeError("No secret or secfile for section %s"

493

% section)

925

494

client["timeout"] = string_to_delta(section["timeout"])

926

495

client["extended_timeout"] = string_to_delta(

927

496

section["extended_timeout"])

934

503

client["last_approval_request"] = None

935

504

client["last_checked_ok"] = None

936

505

client["last_checker_status"] = -2

937

506

938

507

return settings

939

940

def __init__(self, settings, name=None, server_settings=None):

508

509

510

def __init__(self, settings, name = None):

511

"""Note: the 'checker' key in 'config' sets the

512

'checker_command' attribute and *not* the 'checker'

513

attribute."""

941

514

self.name = name

942

if server_settings is None:

943

server_settings = {}

944

self.server_settings = server_settings

945

515

# adding all client settings

946

for setting, value in settings.items():

516

for setting, value in settings.iteritems():

947

517

setattr(self, setting, value)

948

518

949

519

if self.enabled:

950

520

if not hasattr(self, "last_enabled"):

951

521

self.last_enabled = datetime.datetime.utcnow()

955

525

else:

956

526

self.last_enabled = None

957

527

self.expires = None

958

528

959

529

logger.debug("Creating client %r", self.name)

960

logger.debug(" Key ID: %s", self.key_id)

530

# Uppercase and remove spaces from fingerprint for later

531

# comparison purposes with return value from the fingerprint()

532

# function

961

533

logger.debug(" Fingerprint: %s", self.fingerprint)

962

534

self.created = settings.get("created",

963

535

datetime.datetime.utcnow())

970

542

self.current_checker_command = None

971

543

self.approved = None

972

544

self.approvals_pending = 0

973

self.changedstate = multiprocessing_manager.Condition(

974

multiprocessing_manager.Lock())

975

self.client_structure = [attr

976

for attr in self.__dict__.keys()

545

self.changedstate = (multiprocessing_manager

546

.Condition(multiprocessing_manager

547

.Lock()))

548

self.client_structure = [attr for attr in

549

self.__dict__.iterkeys()

977

550

if not attr.startswith("_")]

978

551

self.client_structure.append("client_structure")

979

980

for name, t in inspect.getmembers(

981

type(self), lambda obj: isinstance(obj, property)):

552

553

for name, t in inspect.getmembers(type(self),

554

lambda obj:

555

isinstance(obj,

556

property)):

982

557

if not name.startswith("_"):

983

558

self.client_structure.append(name)

984

559

985

560

# Send notice to process children that client state has changed

986

561

def send_changedstate(self):

987

562

with self.changedstate:

988

563

self.changedstate.notify_all()

989

564

990

565

def enable(self):

991

566

"""Start this client's checker and timeout hooks"""

992

567

if getattr(self, "enabled", False):

993

568

# Already enabled

994

569

return

570

self.send_changedstate()

995

571

self.expires = datetime.datetime.utcnow() + self.timeout

996

572

self.enabled = True

997

573

self.last_enabled = datetime.datetime.utcnow()

998

574

self.init_checker()

999

self.send_changedstate()

1000

575

1001

576

def disable(self, quiet=True):

1002

577

"""Disable this client."""

1003

578

if not getattr(self, "enabled", False):

1004

579

return False

1005

580

if not quiet:

581

self.send_changedstate()

582

if not quiet:

1006

583

logger.info("Disabling client %s", self.name)

1007

if getattr(self, "disable_initiator_tag", None) is not None:

1008

GLib.source_remove(self.disable_initiator_tag)

584

if getattr(self, "disable_initiator_tag", False):

585

gobject.source_remove(self.disable_initiator_tag)

1009

586

self.disable_initiator_tag = None

1010

587

self.expires = None

1011

if getattr(self, "checker_initiator_tag", None) is not None:

1012

GLib.source_remove(self.checker_initiator_tag)

588

if getattr(self, "checker_initiator_tag", False):

589

gobject.source_remove(self.checker_initiator_tag)

1013

590

self.checker_initiator_tag = None

1014

591

self.stop_checker()

1015

592

self.enabled = False

1016

if not quiet:

1017

self.send_changedstate()

1018

# Do not run this again if called by a GLib.timeout_add

593

# Do not run this again if called by a gobject.timeout_add

1019

594

return False

1020

595

1021

596

def __del__(self):

1022

597

self.disable()

1023

598

1024

599

def init_checker(self):

1025

600

# Schedule a new checker to be started an 'interval' from now,

1026

601

# and every interval from then on.

1027

if self.checker_initiator_tag is not None:

1028

GLib.source_remove(self.checker_initiator_tag)

1029

self.checker_initiator_tag = GLib.timeout_add(

1030

int(self.interval.total_seconds() * 1000),

1031

self.start_checker)

602

self.checker_initiator_tag = (gobject.timeout_add

603

(self.interval_milliseconds(),

604

self.start_checker))

1032

605

# Schedule a disable() when 'timeout' has passed

1033

if self.disable_initiator_tag is not None:

1034

GLib.source_remove(self.disable_initiator_tag)

1035

self.disable_initiator_tag = GLib.timeout_add(

1036

int(self.timeout.total_seconds() * 1000), self.disable)

606

self.disable_initiator_tag = (gobject.timeout_add

607

(self.timeout_milliseconds(),

608

self.disable))

1037

609

# Also start a new checker *right now*.

1038

610

self.start_checker()

1039

1040

def checker_callback(self, source, condition, connection,

1041

command):

611

612

def checker_callback(self, pid, condition, command):

1042

613

"""The checker has completed, so take appropriate actions."""

1043

# Read return code from connection (see call_pipe)

1044

returncode = connection.recv()

1045

connection.close()

1046

self.checker.join()

1047

614

self.checker_callback_tag = None

1048

615

self.checker = None

1049

1050

if returncode >= 0:

1051

self.last_checker_status = returncode

1052

self.last_checker_signal = None

616

if os.WIFEXITED(condition):

617

self.last_checker_status = os.WEXITSTATUS(condition)

1053

618

if self.last_checker_status == 0:

1054

619

logger.info("Checker for %(name)s succeeded",

1055

620

vars(self))

1056

621

self.checked_ok()

1057

622

else:

1058

logger.info("Checker for %(name)s failed", vars(self))

623

logger.info("Checker for %(name)s failed",

624

vars(self))

1059

625

else:

1060

626

self.last_checker_status = -1

1061

self.last_checker_signal = -returncode

1062

627

logger.warning("Checker for %(name)s crashed?",

1063

628

vars(self))

1064

return False

1065

629

1066

630

def checked_ok(self):

1067

631

"""Assert that the client has been seen, alive and well."""

1068

632

self.last_checked_ok = datetime.datetime.utcnow()

1069

633

self.last_checker_status = 0

1070

self.last_checker_signal = None

1071

634

self.bump_timeout()

1072

635

1073

636

def bump_timeout(self, timeout=None):

1074

637

"""Bump up the timeout for this client."""

1075

638

if timeout is None:

1076

639

timeout = self.timeout

1077

640

if self.disable_initiator_tag is not None:

1078

GLib.source_remove(self.disable_initiator_tag)

1079

self.disable_initiator_tag = None

641

gobject.source_remove(self.disable_initiator_tag)

1080

642

if getattr(self, "enabled", False):

1081

self.disable_initiator_tag = GLib.timeout_add(

1082

int(timeout.total_seconds() * 1000), self.disable)

643

self.disable_initiator_tag = (gobject.timeout_add

644

(timedelta_to_milliseconds

645

(timeout), self.disable))

1083

646

self.expires = datetime.datetime.utcnow() + timeout

1084

647

1085

648

def need_approval(self):

1086

649

self.last_approval_request = datetime.datetime.utcnow()

1087

650

1088

651

def start_checker(self):

1089

652

"""Start a new checker subprocess if one is not running.

1090

653

1091

654

If a checker already exists, leave it running and do

1092

655

nothing."""

1093

656

# The reason for not killing a running checker is that if we

1094

# did that, and if a checker (for some reason) started running

1095

# slowly and taking more than 'interval' time, then the client

1096

# would inevitably timeout, since no checker would get a

1097

# chance to run to completion. If we instead leave running

657

# did that, then if a checker (for some reason) started

658

# running slowly and taking more than 'interval' time, the

659

# client would inevitably timeout, since no checker would get

660

# a chance to run to completion. If we instead leave running

1098

661

# checkers alone, the checker would have to take more time

1099

662

# than 'timeout' for the client to be disabled, which is as it

1100

663

# should be.

1101

1102

if self.checker is not None and not self.checker.is_alive():

1103

logger.warning("Checker was not alive; joining")

1104

self.checker.join()

1105

self.checker = None

664

665

# If a checker exists, make sure it is not a zombie

666

try:

667

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

668

except (AttributeError, OSError) as error:

669

if (isinstance(error, OSError)

670

and error.errno != errno.ECHILD):

671

raise error

672

else:

673

if pid:

674

logger.warning("Checker was a zombie")

675

gobject.source_remove(self.checker_callback_tag)

676

self.checker_callback(pid, status,

677

self.current_checker_command)

1106

678

# Start a new checker if needed

1107

679

if self.checker is None:

1108

# Escape attributes for the shell

1109

escaped_attrs = {

1110

attr: re.escape(str(getattr(self, attr)))

1111

for attr in self.runtime_expansions}

1112

680

try:

1113

command = self.checker_command % escaped_attrs

1114

except TypeError as error:

1115

logger.error('Could not format string "%s"',

1116

self.checker_command,

1117

exc_info=error)

1118

return True # Try again later

681

# In case checker_command has exactly one % operator

682

command = self.checker_command % self.host

683

except TypeError:

684

# Escape attributes for the shell

685

escaped_attrs = dict(

686

(attr,

687

re.escape(unicode(str(getattr(self, attr, "")),

688

errors=

689

'replace')))

690

for attr in

691

self.runtime_expansions)

692

693

try:

694

command = self.checker_command % escaped_attrs

695

except TypeError as error:

696

logger.error('Could not format string "%s":'

697

' %s', self.checker_command, error)

698

return True # Try again later

1119

699

self.current_checker_command = command

1120

logger.info("Starting checker %r for %s", command,

1121

self.name)

1122

# We don't need to redirect stdout and stderr, since

1123

# in normal mode, that is already done by daemon(),

1124

# and in debug mode we don't want to. (Stdin is

1125

# always replaced by /dev/null.)

1126

# The exception is when not debugging but nevertheless

1127

# running in the foreground; use the previously

1128

# created wnull.

1129

popen_args = {"close_fds": True,

1130

"shell": True,

1131

"cwd": "/"}

1132

if (not self.server_settings["debug"]

1133

and self.server_settings["foreground"]):

1134

popen_args.update({"stdout": wnull,

1135

"stderr": wnull})

1136

pipe = multiprocessing.Pipe(duplex=False)

1137

self.checker = multiprocessing.Process(

1138

target=call_pipe,

1139

args=(pipe[1], subprocess.call, command),

1140

kwargs=popen_args)

1141

self.checker.start()

1142

self.checker_callback_tag = GLib.io_add_watch(

1143

pipe[0].fileno(), GLib.IO_IN,

1144

self.checker_callback, pipe[0], command)

1145

# Re-run this periodically if run by GLib.timeout_add

700

try:

701

logger.info("Starting checker %r for %s",

702

command, self.name)

703

# We don't need to redirect stdout and stderr, since

704

# in normal mode, that is already done by daemon(),

705

# and in debug mode we don't want to. (Stdin is

706

# always replaced by /dev/null.)

707

self.checker = subprocess.Popen(command,

708

close_fds=True,

709

shell=True, cwd="/")

710

self.checker_callback_tag = (gobject.child_watch_add

711

(self.checker.pid,

712

self.checker_callback,

713

data=command))

714

# The checker may have completed before the gobject

715

# watch was added. Check for this.

716

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

717

if pid:

718

gobject.source_remove(self.checker_callback_tag)

719

self.checker_callback(pid, status, command)

720

except OSError as error:

721

logger.error("Failed to start subprocess: %s",

722

error)

723

# Re-run this periodically if run by gobject.timeout_add

1146

724

return True

1147

725

1148

726

def stop_checker(self):

1149

727

"""Force the checker process, if any, to stop."""

1150

728

if self.checker_callback_tag:

1151

GLib.source_remove(self.checker_callback_tag)

729

gobject.source_remove(self.checker_callback_tag)

1152

730

self.checker_callback_tag = None

1153

731

if getattr(self, "checker", None) is None:

1154

732

return

1155

733

logger.debug("Stopping checker for %(name)s", vars(self))

1156

self.checker.terminate()

734

try:

735

os.kill(self.checker.pid, signal.SIGTERM)

736

#time.sleep(0.5)

737

#if self.checker.poll() is None:

738

# os.kill(self.checker.pid, signal.SIGKILL)

739

except OSError as error:

740

if error.errno != errno.ESRCH: # No such process

741

raise

1157

742

self.checker = None

1158

743

1159

744

1160

def dbus_service_property(dbus_interface,

1161

signature="v",

1162

access="readwrite",

1163

byte_arrays=False):

745

def dbus_service_property(dbus_interface, signature="v",

746

access="readwrite", byte_arrays=False):

1164

747

"""Decorators for marking methods of a DBusObjectWithProperties to

1165

748

become properties on the D-Bus.

1166

749

1167

750

The decorated method will be called with no arguments by "Get"

1168

751

and with one argument by "Set".

1169

752

1170

753

The parameters, where they are supported, are the same as

1171

754

dbus.service.method, except there is only "signature", since the

1172

755

type from Get() and the type sent to Set() is the same.

1175

758

# "Set" method, so we fail early here:

1176

759

if byte_arrays and signature != "ay":

1177

760

raise ValueError("Byte arrays not supported for non-'ay'"

1178

" signature {!r}".format(signature))

1179

761

" signature %r" % signature)

1180

762

def decorator(func):

1181

763

func._dbus_is_property = True

1182

764

func._dbus_interface = dbus_interface

1185

767

func._dbus_name = func.__name__

1186

768

if func._dbus_name.endswith("_dbus_property"):

1187

769

func._dbus_name = func._dbus_name[:-14]

1188

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

770

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1189

771

return func

1190

1191

772

return decorator

1192

773

1193

774

1194

775

def dbus_interface_annotations(dbus_interface):

1195

"""Decorator for marking functions returning interface annotations

1196

776

"""Decorator for marking functions returning interface annotations.

777

1197

778

Usage:

1198

779

1199

780

@dbus_interface_annotations("org.example.Interface")

1200

781

def _foo(self): # Function name does not matter

1201

782

return {"org.freedesktop.DBus.Deprecated": "true",

1202

783

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1203

784

"false"}

1204

785

"""

1205

1206

786

def decorator(func):

1207

787

func._dbus_is_interface = True

1208

788

func._dbus_interface = dbus_interface

1209

789

func._dbus_name = dbus_interface

1210

790

return func

1211

1212

791

return decorator

1213

792

1214

793

1215

794

def dbus_annotations(annotations):

1216

795

"""Decorator to annotate D-Bus methods, signals or properties

1217

796

Usage:

1218

1219

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1220

"org.freedesktop.DBus.Property."

1221

"EmitsChangedSignal": "false"})

797

1222

798

@dbus_service_property("org.example.Interface", signature="b",

1223

799

access="r")

800

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

801

"org.freedesktop.DBus.Property."

802

"EmitsChangedSignal": "false"})

1224

803

def Property_dbus_property(self):

1225

804

return dbus.Boolean(False)

1226

1227

See also the DBusObjectWithAnnotations class.

1228

805

"""

1229

1230

806

def decorator(func):

1231

807

func._dbus_annotations = annotations

1232

808

return func

1233

1234

809

return decorator

1235

810

1236

811

1237

812

class DBusPropertyException(dbus.exceptions.DBusException):

1238

813

"""A base class for D-Bus property-related exceptions

1239

814

"""

1240

pass

815

def __unicode__(self):

816

return unicode(str(self))

1241

817

1242

818

1243

819

class DBusPropertyAccessException(DBusPropertyException):

1252

828

pass

1253

829

1254

830

1255

class DBusObjectWithAnnotations(dbus.service.Object):

1256

"""A D-Bus object with annotations.

1257

1258

Classes inheriting from this can use the dbus_annotations

1259

decorator to add annotations to methods or signals.

831

class DBusObjectWithProperties(dbus.service.Object):

832

"""A D-Bus object with properties.

833

834

Classes inheriting from this can use the dbus_service_property

835

decorator to expose methods as D-Bus properties. It exposes the

836

standard Get(), Set(), and GetAll() methods on the D-Bus.

1260

837

"""

1261

838

1262

839

@staticmethod

1263

840

def _is_dbus_thing(thing):

1264

841

"""Returns a function testing if an attribute is a D-Bus thing

1265

842

1266

843

If called like _is_dbus_thing("method") it returns a function

1267

844

suitable for use as predicate to inspect.getmembers().

1268

845

"""

1269

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

846

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1270

847

False)

1271

848

1272

849

def _get_all_dbus_things(self, thing):

1273

850

"""Returns a generator of (name, attribute) pairs

1274

851

"""

1275

return ((getattr(athing.__get__(self), "_dbus_name", name),

852

return ((getattr(athing.__get__(self), "_dbus_name",

853

name),

1276

854

athing.__get__(self))

1277

855

for cls in self.__class__.__mro__

1278

856

for name, athing in

1279

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1280

1281

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1282

out_signature="s",

1283

path_keyword='object_path',

1284

connection_keyword='connection')

1285

def Introspect(self, object_path, connection):

1286

"""Overloading of standard D-Bus method.

1287

1288

Inserts annotation tags on methods and signals.

1289

"""

1290

xmlstring = dbus.service.Object.Introspect(self, object_path,

1291

connection)

1292

try:

1293

document = xml.dom.minidom.parseString(xmlstring)

1294

1295

for if_tag in document.getElementsByTagName("interface"):

1296

# Add annotation tags

1297

for typ in ("method", "signal"):

1298

for tag in if_tag.getElementsByTagName(typ):

1299

annots = dict()

1300

for name, prop in (self.

1301

_get_all_dbus_things(typ)):

1302

if (name == tag.getAttribute("name")

1303

and prop._dbus_interface

1304

== if_tag.getAttribute("name")):

1305

annots.update(getattr(

1306

prop, "_dbus_annotations", {}))

1307

for name, value in annots.items():

1308

ann_tag = document.createElement(

1309

"annotation")

1310

ann_tag.setAttribute("name", name)

1311

ann_tag.setAttribute("value", value)

1312

tag.appendChild(ann_tag)

1313

# Add interface annotation tags

1314

for annotation, value in dict(

1315

itertools.chain.from_iterable(

1316

annotations().items()

1317

for name, annotations

1318

in self._get_all_dbus_things("interface")

1319

if name == if_tag.getAttribute("name")

1320

)).items():

1321

ann_tag = document.createElement("annotation")

1322

ann_tag.setAttribute("name", annotation)

1323

ann_tag.setAttribute("value", value)

1324

if_tag.appendChild(ann_tag)

1325

# Fix argument name for the Introspect method itself

1326

if (if_tag.getAttribute("name")

1327

== dbus.INTROSPECTABLE_IFACE):

1328

for cn in if_tag.getElementsByTagName("method"):

1329

if cn.getAttribute("name") == "Introspect":

1330

for arg in cn.getElementsByTagName("arg"):

1331

if (arg.getAttribute("direction")

1332

== "out"):

1333

arg.setAttribute("name",

1334

"xml_data")

1335

xmlstring = document.toxml("utf-8")

1336

document.unlink()

1337

except (AttributeError, xml.dom.DOMException,

1338

xml.parsers.expat.ExpatError) as error:

1339

logger.error("Failed to override Introspection method",

1340

exc_info=error)

1341

return xmlstring

1342

1343

1344

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1345

"""A D-Bus object with properties.

1346

1347

Classes inheriting from this can use the dbus_service_property

1348

decorator to expose methods as D-Bus properties. It exposes the

1349

standard Get(), Set(), and GetAll() methods on the D-Bus.

1350

"""

1351

857

inspect.getmembers(cls,

858

self._is_dbus_thing(thing)))

859

1352

860

def _get_dbus_property(self, interface_name, property_name):

1353

861

"""Returns a bound method if one exists which is a D-Bus

1354

862

property with the specified name and interface.

1355

863

"""

1356

for cls in self.__class__.__mro__:

1357

for name, value in inspect.getmembers(

1358

cls, self._is_dbus_thing("property")):

864

for cls in self.__class__.__mro__:

865

for name, value in (inspect.getmembers

866

(cls,

867

self._is_dbus_thing("property"))):

1359

868

if (value._dbus_name == property_name

1360

869

and value._dbus_interface == interface_name):

1361

870

return value.__get__(self)

1362

871

1363

872

# No such property

1364

raise DBusPropertyNotFound("{}:{}.{}".format(

1365

self.dbus_object_path, interface_name, property_name))

1366

1367

@classmethod

1368

def _get_all_interface_names(cls):

1369

"""Get a sequence of all interfaces supported by an object"""

1370

return (name for name in set(getattr(getattr(x, attr),

1371

"_dbus_interface", None)

1372

for x in (inspect.getmro(cls))

1373

for attr in dir(x))

1374

if name is not None)

1375

1376

@dbus.service.method(dbus.PROPERTIES_IFACE,

1377

in_signature="ss",

873

raise DBusPropertyNotFound(self.dbus_object_path + ":"

874

+ interface_name + "."

875

+ property_name)

876

877

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1378

878

out_signature="v")

1379

879

def Get(self, interface_name, property_name):

1380

880

"""Standard D-Bus property Get() method, see D-Bus standard.

1386

886

if not hasattr(value, "variant_level"):

1387

887

return value

1388

888

return type(value)(value, variant_level=value.variant_level+1)

1389

889

1390

890

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1391

891

def Set(self, interface_name, property_name, value):

1392

892

"""Standard D-Bus property Set() method, see D-Bus standard.

1398

898

# The byte_arrays option is not supported yet on

1399

899

# signatures other than "ay".

1400

900

if prop._dbus_signature != "ay":

1401

raise ValueError("Byte arrays not supported for non-"

1402

"'ay' signature {!r}"

1403

.format(prop._dbus_signature))

901

raise ValueError

1404

902

value = dbus.ByteArray(b''.join(chr(byte)

1405

903

for byte in value))

1406

904

prop(value)

1407

1408

@dbus.service.method(dbus.PROPERTIES_IFACE,

1409

in_signature="s",

905

906

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1410

907

out_signature="a{sv}")

1411

908

def GetAll(self, interface_name):

1412

909

"""Standard D-Bus property GetAll() method, see D-Bus

1413

910

standard.

1414

911

1415

912

Note: Will not include properties with access="write".

1416

913

"""

1417

914

properties = {}

1427

924

if not hasattr(value, "variant_level"):

1428

925

properties[name] = value

1429

926

continue

1430

properties[name] = type(value)(

1431

value, variant_level=value.variant_level + 1)

927

properties[name] = type(value)(value, variant_level=

928

value.variant_level+1)

1432

929

return dbus.Dictionary(properties, signature="sv")

1433

1434

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1435

def PropertiesChanged(self, interface_name, changed_properties,

1436

invalidated_properties):

1437

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1438

standard.

1439

"""

1440

pass

1441

930

1442

931

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1443

932

out_signature="s",

1444

933

path_keyword='object_path',

1445

934

connection_keyword='connection')

1446

935

def Introspect(self, object_path, connection):

1447

936

"""Overloading of standard D-Bus method.

1448

937

1449

938

Inserts property tags and interface annotation tags.

1450

939

"""

1451

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1452

object_path,

1453

connection)

940

xmlstring = dbus.service.Object.Introspect(self, object_path,

941

connection)

1454

942

try:

1455

943

document = xml.dom.minidom.parseString(xmlstring)

1456

1457

944

def make_tag(document, name, prop):

1458

945

e = document.createElement("property")

1459

946

e.setAttribute("name", name)

1460

947

e.setAttribute("type", prop._dbus_signature)

1461

948

e.setAttribute("access", prop._dbus_access)

1462

949

return e

1463

1464

950

for if_tag in document.getElementsByTagName("interface"):

1465

951

# Add property tags

1466

952

for tag in (make_tag(document, name, prop)

1469

955

if prop._dbus_interface

1470

956

== if_tag.getAttribute("name")):

1471

957

if_tag.appendChild(tag)

1472

# Add annotation tags for properties

1473

for tag in if_tag.getElementsByTagName("property"):

1474

annots = dict()

1475

for name, prop in self._get_all_dbus_things(

1476

"property"):

1477

if (name == tag.getAttribute("name")

1478

and prop._dbus_interface

1479

== if_tag.getAttribute("name")):

1480

annots.update(getattr(

1481

prop, "_dbus_annotations", {}))

1482

for name, value in annots.items():

1483

ann_tag = document.createElement(

1484

"annotation")

1485

ann_tag.setAttribute("name", name)

1486

ann_tag.setAttribute("value", value)

1487

tag.appendChild(ann_tag)

958

# Add annotation tags

959

for typ in ("method", "signal", "property"):

960

for tag in if_tag.getElementsByTagName(typ):

961

annots = dict()

962

for name, prop in (self.

963

_get_all_dbus_things(typ)):

964

if (name == tag.getAttribute("name")

965

and prop._dbus_interface

966

== if_tag.getAttribute("name")):

967

annots.update(getattr

968

(prop,

969

"_dbus_annotations",

970

{}))

971

for name, value in annots.iteritems():

972

ann_tag = document.createElement(

973

"annotation")

974

ann_tag.setAttribute("name", name)

975

ann_tag.setAttribute("value", value)

976

tag.appendChild(ann_tag)

977

# Add interface annotation tags

978

for annotation, value in dict(

979

itertools.chain(

980

*(annotations().iteritems()

981

for name, annotations in

982

self._get_all_dbus_things("interface")

983

if name == if_tag.getAttribute("name")

984

))).iteritems():

985

ann_tag = document.createElement("annotation")

986

ann_tag.setAttribute("name", annotation)

987

ann_tag.setAttribute("value", value)

988

if_tag.appendChild(ann_tag)

1488

989

# Add the names to the return values for the

1489

990

# "org.freedesktop.DBus.Properties" methods

1490

991

if (if_tag.getAttribute("name")

1505

1006

except (AttributeError, xml.dom.DOMException,

1506

1007

xml.parsers.expat.ExpatError) as error:

1507

1008

logger.error("Failed to override Introspection method",

1508

exc_info=error)

1509

return xmlstring

1510

1511

1512

try:

1513

dbus.OBJECT_MANAGER_IFACE

1514

except AttributeError:

1515

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1516

1517

1518

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1519

"""A D-Bus object with an ObjectManager.

1520

1521

Classes inheriting from this exposes the standard

1522

GetManagedObjects call and the InterfacesAdded and

1523

InterfacesRemoved signals on the standard

1524

"org.freedesktop.DBus.ObjectManager" interface.

1525

1526

Note: No signals are sent automatically; they must be sent

1527

manually.

1528

"""

1529

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1530

out_signature="a{oa{sa{sv}}}")

1531

def GetManagedObjects(self):

1532

"""This function must be overridden"""

1533

raise NotImplementedError()

1534

1535

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1536

signature="oa{sa{sv}}")

1537

def InterfacesAdded(self, object_path, interfaces_and_properties):

1538

pass

1539

1540

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1541

def InterfacesRemoved(self, object_path, interfaces):

1542

pass

1543

1544

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1545

out_signature="s",

1546

path_keyword='object_path',

1547

connection_keyword='connection')

1548

def Introspect(self, object_path, connection):

1549

"""Overloading of standard D-Bus method.

1550

1551

Override return argument name of GetManagedObjects to be

1552

"objpath_interfaces_and_properties"

1553

"""

1554

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1555

object_path,

1556

connection)

1557

try:

1558

document = xml.dom.minidom.parseString(xmlstring)

1559

1560

for if_tag in document.getElementsByTagName("interface"):

1561

# Fix argument name for the GetManagedObjects method

1562

if (if_tag.getAttribute("name")

1563

== dbus.OBJECT_MANAGER_IFACE):

1564

for cn in if_tag.getElementsByTagName("method"):

1565

if (cn.getAttribute("name")

1566

== "GetManagedObjects"):

1567

for arg in cn.getElementsByTagName("arg"):

1568

if (arg.getAttribute("direction")

1569

== "out"):

1570

arg.setAttribute(

1571

"name",

1572

"objpath_interfaces"

1573

"_and_properties")

1574

xmlstring = document.toxml("utf-8")

1575

document.unlink()

1576

except (AttributeError, xml.dom.DOMException,

1577

xml.parsers.expat.ExpatError) as error:

1578

logger.error("Failed to override Introspection method",

1579

exc_info=error)

1580

return xmlstring

1581

1582

1583

def datetime_to_dbus(dt, variant_level=0):

1009

error)

1010

return xmlstring

1011

1012

1013

def datetime_to_dbus (dt, variant_level=0):

1584

1014

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1585

1015

if dt is None:

1586

return dbus.String("", variant_level=variant_level)

1587

return dbus.String(dt.isoformat(), variant_level=variant_level)

1588

1589

1590

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1591

"""A class decorator; applied to a subclass of

1592

dbus.service.Object, it will add alternate D-Bus attributes with

1593

interface names according to the "alt_interface_names" mapping.

1594

Usage:

1595

1596

@alternate_dbus_interfaces({"org.example.Interface":

1597

"net.example.AlternateInterface"})

1598

class SampleDBusObject(dbus.service.Object):

1599

@dbus.service.method("org.example.Interface")

1600

def SampleDBusMethod():

1601

pass

1602

1603

The above "SampleDBusMethod" on "SampleDBusObject" will be

1604

reachable via two interfaces: "org.example.Interface" and

1605

"net.example.AlternateInterface", the latter of which will have

1606

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1607

"true", unless "deprecate" is passed with a False value.

1608

1609

This works for methods and signals, and also for D-Bus properties

1610

(from DBusObjectWithProperties) and interfaces (from the

1611

dbus_interface_annotations decorator).

1016

return dbus.String("", variant_level = variant_level)

1017

return dbus.String(dt.isoformat(),

1018

variant_level=variant_level)

1019

1020

1021

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

1022

.__metaclass__):

1023

"""Applied to an empty subclass of a D-Bus object, this metaclass

1024

will add additional D-Bus attributes matching a certain pattern.

1612

1025

"""

1613

1614

def wrapper(cls):

1615

for orig_interface_name, alt_interface_name in (

1616

alt_interface_names.items()):

1617

attr = {}

1618

interface_names = set()

1619

# Go though all attributes of the class

1620

for attrname, attribute in inspect.getmembers(cls):

1026

def __new__(mcs, name, bases, attr):

1027

# Go through all the base classes which could have D-Bus

1028

# methods, signals, or properties in them

1029

old_interface_names = []

1030

for base in (b for b in bases

1031

if issubclass(b, dbus.service.Object)):

1032

# Go though all attributes of the base class

1033

for attrname, attribute in inspect.getmembers(base):

1621

1034

# Ignore non-D-Bus attributes, and D-Bus attributes

1622

1035

# with the wrong interface name

1623

1036

if (not hasattr(attribute, "_dbus_interface")

1624

or not attribute._dbus_interface.startswith(

1625

orig_interface_name)):

1037

or not attribute._dbus_interface

1038

.startswith("se.recompile.Mandos")):

1626

1039

continue

1627

1040

# Create an alternate D-Bus interface name based on

1628

1041

# the current name

1629

alt_interface = attribute._dbus_interface.replace(

1630

orig_interface_name, alt_interface_name)

1631

interface_names.add(alt_interface)

1042

alt_interface = (attribute._dbus_interface

1043

.replace("se.recompile.Mandos",

1044

"se.bsnet.fukt.Mandos"))

1045

if alt_interface != attribute._dbus_interface:

1046

old_interface_names.append(alt_interface)

1632

1047

# Is this a D-Bus signal?

1633

1048

if getattr(attribute, "_dbus_is_signal", False):

1634

# Extract the original non-method undecorated

1635

# function by black magic

1636

if sys.version_info.major == 2:

1637

nonmethod_func = (dict(

1049

# Extract the original non-method function by

1050

# black magic

1051

nonmethod_func = (dict(

1638

1052

zip(attribute.func_code.co_freevars,

1639

attribute.__closure__))

1640

["func"].cell_contents)

1641

else:

1642

nonmethod_func = (dict(

1643

zip(attribute.__code__.co_freevars,

1644

attribute.__closure__))

1645

["func"].cell_contents)

1053

attribute.__closure__))["func"]

1054

.cell_contents)

1646

1055

# Create a new, but exactly alike, function

1647

1056

# object, and decorate it to be a new D-Bus signal

1648

1057

# with the alternate D-Bus interface name

1649

new_function = copy_function(nonmethod_func)

1650

new_function = (dbus.service.signal(

1651

alt_interface,

1652

attribute._dbus_signature)(new_function))

1058

new_function = (dbus.service.signal

1059

(alt_interface,

1060

attribute._dbus_signature)

1061

(types.FunctionType(

1062

nonmethod_func.func_code,

1063

nonmethod_func.func_globals,

1064

nonmethod_func.func_name,

1065

nonmethod_func.func_defaults,

1066

nonmethod_func.func_closure)))

1653

1067

# Copy annotations, if any

1654

1068

try:

1655

new_function._dbus_annotations = dict(

1656

attribute._dbus_annotations)

1069

new_function._dbus_annotations = (

1070

dict(attribute._dbus_annotations))

1657

1071

except AttributeError:

1658

1072

pass

1659

1660

1073

# Define a creator of a function to call both the

1661

# original and alternate functions, so both the

1662

# original and alternate signals gets sent when

1663

# the function is called

1074

# old and new functions, so both the old and new

1075

# signals gets sent when the function is called

1664

1076

def fixscope(func1, func2):

1665

1077

"""This function is a scope container to pass

1666

1078

func1 and func2 to the "call_both" function

1667

1079

outside of its arguments"""

1668

1669

@functools.wraps(func2)

1670

1080

def call_both(*args, **kwargs):

1671

1081

"""This function will emit two D-Bus

1672

1082

signals by calling func1 and func2"""

1673

1083

func1(*args, **kwargs)

1674

1084

func2(*args, **kwargs)

1675

# Make wrapper function look like a D-Bus

1676

# signal

1677

for name, attr in inspect.getmembers(func2):

1678

if name.startswith("_dbus_"):

1679

setattr(call_both, name, attr)

1680

1681

1085

return call_both

1682

1086

# Create the "call_both" function and add it to

1683

1087

# the class

1684

attr[attrname] = fixscope(attribute, new_function)

1088

attr[attrname] = fixscope(attribute,

1089

new_function)

1685

1090

# Is this a D-Bus method?

1686

1091

elif getattr(attribute, "_dbus_is_method", False):

1687

1092

# Create a new, but exactly alike, function

1688

1093

# object. Decorate it to be a new D-Bus method

1689

1094

# with the alternate D-Bus interface name. Add it

1690

1095

# to the class.

1691

attr[attrname] = (

1692

dbus.service.method(

1693

alt_interface,

1694

attribute._dbus_in_signature,

1695

attribute._dbus_out_signature)

1696

(copy_function(attribute)))

1096

attr[attrname] = (dbus.service.method

1097

(alt_interface,

1098

attribute._dbus_in_signature,

1099

attribute._dbus_out_signature)

1100

(types.FunctionType

1101

(attribute.func_code,

1102

attribute.func_globals,

1103

attribute.func_name,

1104

attribute.func_defaults,

1105

attribute.func_closure)))

1697

1106

# Copy annotations, if any

1698

1107

try:

1699

attr[attrname]._dbus_annotations = dict(

1700

attribute._dbus_annotations)

1108

attr[attrname]._dbus_annotations = (

1109

dict(attribute._dbus_annotations))

1701

1110

except AttributeError:

1702

1111

pass

1703

1112

# Is this a D-Bus property?

1706

1115

# object, and decorate it to be a new D-Bus

1707

1116

# property with the alternate D-Bus interface

1708

1117

# name. Add it to the class.

1709

attr[attrname] = (dbus_service_property(

1710

alt_interface, attribute._dbus_signature,

1711

attribute._dbus_access,

1712

attribute._dbus_get_args_options

1713

["byte_arrays"])

1714

(copy_function(attribute)))

1118

attr[attrname] = (dbus_service_property

1119

(alt_interface,

1120

attribute._dbus_signature,

1121

attribute._dbus_access,

1122

attribute

1123

._dbus_get_args_options

1124

["byte_arrays"])

1125

(types.FunctionType

1126

(attribute.func_code,

1127

attribute.func_globals,

1128

attribute.func_name,

1129

attribute.func_defaults,

1130

attribute.func_closure)))

1715

1131

# Copy annotations, if any

1716

1132

try:

1717

attr[attrname]._dbus_annotations = dict(

1718

attribute._dbus_annotations)

1133

attr[attrname]._dbus_annotations = (

1134

dict(attribute._dbus_annotations))

1719

1135

except AttributeError:

1720

1136

pass

1721

1137

# Is this a D-Bus interface?

1724

1140

# object. Decorate it to be a new D-Bus interface

1725

1141

# with the alternate D-Bus interface name. Add it

1726

1142

# to the class.

1727

attr[attrname] = (

1728

dbus_interface_annotations(alt_interface)

1729

(copy_function(attribute)))

1730

if deprecate:

1731

# Deprecate all alternate interfaces

1732

iname = "_AlternateDBusNames_interface_annotation{}"

1733

for interface_name in interface_names:

1734

1735

@dbus_interface_annotations(interface_name)

1736

def func(self):

1737

return {"org.freedesktop.DBus.Deprecated":

1738

"true"}

1739

# Find an unused name

1740

for aname in (iname.format(i)

1741

for i in itertools.count()):

1742

if aname not in attr:

1743

attr[aname] = func

1744

break

1745

if interface_names:

1746

# Replace the class with a new subclass of it with

1747

# methods, signals, etc. as created above.

1748

if sys.version_info.major == 2:

1749

cls = type(b"{}Alternate".format(cls.__name__),

1750

(cls, ), attr)

1751

else:

1752

cls = type("{}Alternate".format(cls.__name__),

1753

(cls, ), attr)

1754

return cls

1755

1756

return wrapper

1757

1758

1759

@alternate_dbus_interfaces({"se.recompile.Mandos":

1760

"se.bsnet.fukt.Mandos"})

1143

attr[attrname] = (dbus_interface_annotations

1144

(alt_interface)

1145

(types.FunctionType

1146

(attribute.func_code,

1147

attribute.func_globals,

1148

attribute.func_name,

1149

attribute.func_defaults,

1150

attribute.func_closure)))

1151

# Deprecate all old interfaces

1152

basename="_AlternateDBusNamesMetaclass_interface_annotation{0}"

1153

for old_interface_name in old_interface_names:

1154

@dbus_interface_annotations(old_interface_name)

1155

def func(self):

1156

return { "org.freedesktop.DBus.Deprecated": "true" }

1157

# Find an unused name

1158

for aname in (basename.format(i) for i in

1159

itertools.count()):

1160

if aname not in attr:

1161

attr[aname] = func

1162

break

1163

return type.__new__(mcs, name, bases, attr)

1164

1165

1761

1166

class ClientDBus(Client, DBusObjectWithProperties):

1762

1167

"""A Client class using D-Bus

1763

1168

1764

1169

Attributes:

1765

1170

dbus_object_path: dbus.ObjectPath

1766

1171

bus: dbus.SystemBus()

1767

1172

"""

1768

1173

1769

1174

runtime_expansions = (Client.runtime_expansions

1770

+ ("dbus_object_path", ))

1771

1772

_interface = "se.recompile.Mandos.Client"

1773

1175

+ ("dbus_object_path",))

1176

1774

1177

# dbus.service.Object doesn't use super(), so we can't either.

1775

1776

def __init__(self, bus=None, *args, **kwargs):

1178

1179

def __init__(self, bus = None, *args, **kwargs):

1777

1180

self.bus = bus

1778

1181

Client.__init__(self, *args, **kwargs)

1779

1182

# Only now, when this client is initialized, can it show up on

1780

1183

# the D-Bus

1781

client_object_name = str(self.name).translate(

1184

client_object_name = unicode(self.name).translate(

1782

1185

{ord("."): ord("_"),

1783

1186

ord("-"): ord("_")})

1784

self.dbus_object_path = dbus.ObjectPath(

1785

"/clients/" + client_object_name)

1187

self.dbus_object_path = (dbus.ObjectPath

1188

("/clients/" + client_object_name))

1786

1189

DBusObjectWithProperties.__init__(self, self.bus,

1787

1190

self.dbus_object_path)

1788

1789

def notifychangeproperty(transform_func, dbus_name,

1790

type_func=lambda x: x,

1791

variant_level=1,

1792

invalidate_only=False,

1793

_interface=_interface):

1191

1192

def notifychangeproperty(transform_func,

1193

dbus_name, type_func=lambda x: x,

1194

variant_level=1):

1794

1195

""" Modify a variable so that it's a property which announces

1795

1196

its changes to DBus.

1796

1197

1797

1198

transform_fun: Function that takes a value and a variant_level

1798

1199

and transforms it to a D-Bus type.

1799

1200

dbus_name: D-Bus name of the variable

1801

1202

to the D-Bus. Default: no transform

1802

1203

variant_level: D-Bus variant level. Default: 1

1803

1204

"""

1804

attrname = "_{}".format(dbus_name)

1805

1205

attrname = "_{0}".format(dbus_name)

1806

1206

def setter(self, value):

1807

1207

if hasattr(self, "dbus_object_path"):

1808

1208

if (not hasattr(self, attrname) or

1809

1209

type_func(getattr(self, attrname, None))

1810

1210

!= type_func(value)):

1811

if invalidate_only:

1812

self.PropertiesChanged(

1813

_interface, dbus.Dictionary(),

1814

dbus.Array((dbus_name, )))

1815

else:

1816

dbus_value = transform_func(

1817

type_func(value),

1818

variant_level=variant_level)

1819

self.PropertyChanged(dbus.String(dbus_name),

1820

dbus_value)

1821

self.PropertiesChanged(

1822

_interface,

1823

dbus.Dictionary({dbus.String(dbus_name):

1824

dbus_value}),

1825

dbus.Array())

1211

dbus_value = transform_func(type_func(value),

1212

variant_level

1213

=variant_level)

1214

self.PropertyChanged(dbus.String(dbus_name),

1215

dbus_value)

1826

1216

setattr(self, attrname, value)

1827

1217

1828

1218

return property(lambda self: getattr(self, attrname), setter)

1829

1219

1220

1830

1221

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1831

1222

approvals_pending = notifychangeproperty(dbus.Boolean,

1832

1223

"ApprovalPending",

1833

type_func=bool)

1224

type_func = bool)

1834

1225

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1835

1226

last_enabled = notifychangeproperty(datetime_to_dbus,

1836

1227

"LastEnabled")

1837

checker = notifychangeproperty(

1838

dbus.Boolean, "CheckerRunning",

1839

type_func=lambda checker: checker is not None)

1228

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1229

type_func = lambda checker:

1230

checker is not None)

1840

1231

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1841

1232

"LastCheckedOK")

1842

1233

last_checker_status = notifychangeproperty(dbus.Int16,

1845

1236

datetime_to_dbus, "LastApprovalRequest")

1846

1237

approved_by_default = notifychangeproperty(dbus.Boolean,

1847

1238

"ApprovedByDefault")

1848

approval_delay = notifychangeproperty(

1849

dbus.UInt64, "ApprovalDelay",

1850

type_func=lambda td: td.total_seconds() * 1000)

1239

approval_delay = notifychangeproperty(dbus.UInt64,

1240

"ApprovalDelay",

1241

type_func =

1242

timedelta_to_milliseconds)

1851

1243

approval_duration = notifychangeproperty(

1852

1244

dbus.UInt64, "ApprovalDuration",

1853

type_func=lambda td: td.total_seconds() * 1000)

1245

type_func = timedelta_to_milliseconds)

1854

1246

host = notifychangeproperty(dbus.String, "Host")

1855

timeout = notifychangeproperty(

1856

dbus.UInt64, "Timeout",

1857

type_func=lambda td: td.total_seconds() * 1000)

1247

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1248

type_func =

1249

timedelta_to_milliseconds)

1858

1250

extended_timeout = notifychangeproperty(

1859

1251

dbus.UInt64, "ExtendedTimeout",

1860

type_func=lambda td: td.total_seconds() * 1000)

1861

interval = notifychangeproperty(

1862

dbus.UInt64, "Interval",

1863

type_func=lambda td: td.total_seconds() * 1000)

1252

type_func = timedelta_to_milliseconds)

1253

interval = notifychangeproperty(dbus.UInt64,

1254

"Interval",

1255

type_func =

1256

timedelta_to_milliseconds)

1864

1257

checker_command = notifychangeproperty(dbus.String, "Checker")

1865

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1866

invalidate_only=True)

1867

1258

1868

1259

del notifychangeproperty

1869

1260

1870

1261

def __del__(self, *args, **kwargs):

1871

1262

try:

1872

1263

self.remove_from_connection()

1875

1266

if hasattr(DBusObjectWithProperties, "__del__"):

1876

1267

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1877

1268

Client.__del__(self, *args, **kwargs)

1878

1879

def checker_callback(self, source, condition,

1880

connection, command, *args, **kwargs):

1881

ret = Client.checker_callback(self, source, condition,

1882

connection, command, *args,

1883

**kwargs)

1884

exitstatus = self.last_checker_status

1885

if exitstatus >= 0:

1269

1270

def checker_callback(self, pid, condition, command,

1271

*args, **kwargs):

1272

self.checker_callback_tag = None

1273

self.checker = None

1274

if os.WIFEXITED(condition):

1275

exitstatus = os.WEXITSTATUS(condition)

1886

1276

# Emit D-Bus signal

1887

1277

self.CheckerCompleted(dbus.Int16(exitstatus),

1888

# This is specific to GNU libC

1889

dbus.Int64(exitstatus << 8),

1278

dbus.Int64(condition),

1890

1279

dbus.String(command))

1891

1280

else:

1892

1281

# Emit D-Bus signal

1893

1282

self.CheckerCompleted(dbus.Int16(-1),

1894

dbus.Int64(

1895

# This is specific to GNU libC

1896

(exitstatus << 8)

1897

| self.last_checker_signal),

1283

dbus.Int64(condition),

1898

1284

dbus.String(command))

1899

return ret

1900

1285

1286

return Client.checker_callback(self, pid, condition, command,

1287

*args, **kwargs)

1288

1901

1289

def start_checker(self, *args, **kwargs):

1902

old_checker_pid = getattr(self.checker, "pid", None)

1290

old_checker = self.checker

1291

if self.checker is not None:

1292

old_checker_pid = self.checker.pid

1293

else:

1294

old_checker_pid = None

1903

1295

r = Client.start_checker(self, *args, **kwargs)

1904

1296

# Only if new checker process was started

1905

1297

if (self.checker is not None

1907

1299

# Emit D-Bus signal

1908

1300

self.CheckerStarted(self.current_checker_command)

1909

1301

return r

1910

1302

1911

1303

def _reset_approved(self):

1912

1304

self.approved = None

1913

1305

return False

1914

1306

1915

1307

def approve(self, value=True):

1308

self.send_changedstate()

1916

1309

self.approved = value

1917

GLib.timeout_add(int(self.approval_duration.total_seconds()

1918

* 1000), self._reset_approved)

1919

self.send_changedstate()

1920

1921

# D-Bus methods, signals & properties

1922

1923

# Interfaces

1924

1925

# Signals

1926

1310

gobject.timeout_add(timedelta_to_milliseconds

1311

(self.approval_duration),

1312

self._reset_approved)

1313

1314

1315

## D-Bus methods, signals & properties

1316

_interface = "se.recompile.Mandos.Client"

1317

1318

## Interfaces

1319

1320

@dbus_interface_annotations(_interface)

1321

def _foo(self):

1322

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1323

"false"}

1324

1325

## Signals

1326

1927

1327

# CheckerCompleted - signal

1928

1328

@dbus.service.signal(_interface, signature="nxs")

1929

1329

def CheckerCompleted(self, exitcode, waitstatus, command):

1930

1330

"D-Bus signal"

1931

1331

pass

1932

1332

1933

1333

# CheckerStarted - signal

1934

1334

@dbus.service.signal(_interface, signature="s")

1935

1335

def CheckerStarted(self, command):

1936

1336

"D-Bus signal"

1937

1337

pass

1938

1338

1939

1339

# PropertyChanged - signal

1940

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1941

1340

@dbus.service.signal(_interface, signature="sv")

1942

1341

def PropertyChanged(self, property, value):

1943

1342

"D-Bus signal"

1944

1343

pass

1945

1344

1946

1345

# GotSecret - signal

1947

1346

@dbus.service.signal(_interface)

1948

1347

def GotSecret(self):

1951

1350

server to mandos-client

1952

1351

"""

1953

1352

pass

1954

1353

1955

1354

# Rejected - signal

1956

1355

@dbus.service.signal(_interface, signature="s")

1957

1356

def Rejected(self, reason):

1958

1357

"D-Bus signal"

1959

1358

pass

1960

1359

1961

1360

# NeedApproval - signal

1962

1361

@dbus.service.signal(_interface, signature="tb")

1963

1362

def NeedApproval(self, timeout, default):

1964

1363

"D-Bus signal"

1965

1364

return self.need_approval()

1966

1967

# Methods

1968

1365

1366

## Methods

1367

1969

1368

# Approve - method

1970

1369

@dbus.service.method(_interface, in_signature="b")

1971

1370

def Approve(self, value):

1972

1371

self.approve(value)

1973

1372

1974

1373

# CheckedOK - method

1975

1374

@dbus.service.method(_interface)

1976

1375

def CheckedOK(self):

1977

1376

self.checked_ok()

1978

1377

1979

1378

# Enable - method

1980

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1981

1379

@dbus.service.method(_interface)

1982

1380

def Enable(self):

1983

1381

"D-Bus method"

1984

1382

self.enable()

1985

1383

1986

1384

# StartChecker - method

1987

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1988

1385

@dbus.service.method(_interface)

1989

1386

def StartChecker(self):

1990

1387

"D-Bus method"

1991

1388

self.start_checker()

1992

1389

1993

1390

# Disable - method

1994

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1995

1391

@dbus.service.method(_interface)

1996

1392

def Disable(self):

1997

1393

"D-Bus method"

1998

1394

self.disable()

1999

1395

2000

1396

# StopChecker - method

2001

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

2002

1397

@dbus.service.method(_interface)

2003

1398

def StopChecker(self):

2004

1399

self.stop_checker()

2005

2006

# Properties

2007

1400

1401

## Properties

1402

2008

1403

# ApprovalPending - property

2009

1404

@dbus_service_property(_interface, signature="b", access="read")

2010

1405

def ApprovalPending_dbus_property(self):

2011

1406

return dbus.Boolean(bool(self.approvals_pending))

2012

1407

2013

1408

# ApprovedByDefault - property

2014

@dbus_service_property(_interface,

2015

signature="b",

1409

@dbus_service_property(_interface, signature="b",

2016

1410

access="readwrite")

2017

1411

def ApprovedByDefault_dbus_property(self, value=None):

2018

1412

if value is None: # get

2019

1413

return dbus.Boolean(self.approved_by_default)

2020

1414

self.approved_by_default = bool(value)

2021

1415

2022

1416

# ApprovalDelay - property

2023

@dbus_service_property(_interface,

2024

signature="t",

1417

@dbus_service_property(_interface, signature="t",

2025

1418

access="readwrite")

2026

1419

def ApprovalDelay_dbus_property(self, value=None):

2027

1420

if value is None: # get

2028

return dbus.UInt64(self.approval_delay.total_seconds()

2029

* 1000)

1421

return dbus.UInt64(self.approval_delay_milliseconds())

2030

1422

self.approval_delay = datetime.timedelta(0, 0, 0, value)

2031

1423

2032

1424

# ApprovalDuration - property

2033

@dbus_service_property(_interface,

2034

signature="t",

1425

@dbus_service_property(_interface, signature="t",

2035

1426

access="readwrite")

2036

1427

def ApprovalDuration_dbus_property(self, value=None):

2037

1428

if value is None: # get

2038

return dbus.UInt64(self.approval_duration.total_seconds()

2039

* 1000)

1429

return dbus.UInt64(timedelta_to_milliseconds(

1430

self.approval_duration))

2040

1431

self.approval_duration = datetime.timedelta(0, 0, 0, value)

2041

1432

2042

1433

# Name - property

2043

@dbus_annotations(

2044

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2045

1434

@dbus_service_property(_interface, signature="s", access="read")

2046

1435

def Name_dbus_property(self):

2047

1436

return dbus.String(self.name)

2048

2049

# KeyID - property

2050

@dbus_annotations(

2051

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2052

@dbus_service_property(_interface, signature="s", access="read")

2053

def KeyID_dbus_property(self):

2054

return dbus.String(self.key_id)

2055

1437

2056

1438

# Fingerprint - property

2057

@dbus_annotations(

2058

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2059

1439

@dbus_service_property(_interface, signature="s", access="read")

2060

1440

def Fingerprint_dbus_property(self):

2061

1441

return dbus.String(self.fingerprint)

2062

1442

2063

1443

# Host - property

2064

@dbus_service_property(_interface,

2065

signature="s",

1444

@dbus_service_property(_interface, signature="s",

2066

1445

access="readwrite")

2067

1446

def Host_dbus_property(self, value=None):

2068

1447

if value is None: # get

2069

1448

return dbus.String(self.host)

2070

self.host = str(value)

2071

1449

self.host = unicode(value)

1450

2072

1451

# Created - property

2073

@dbus_annotations(

2074

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2075

1452

@dbus_service_property(_interface, signature="s", access="read")

2076

1453

def Created_dbus_property(self):

2077

1454

return datetime_to_dbus(self.created)

2078

1455

2079

1456

# LastEnabled - property

2080

1457

@dbus_service_property(_interface, signature="s", access="read")

2081

1458

def LastEnabled_dbus_property(self):

2082

1459

return datetime_to_dbus(self.last_enabled)

2083

1460

2084

1461

# Enabled - property

2085

@dbus_service_property(_interface,

2086

signature="b",

1462

@dbus_service_property(_interface, signature="b",

2087

1463

access="readwrite")

2088

1464

def Enabled_dbus_property(self, value=None):

2089

1465

if value is None: # get

2092

1468

self.enable()

2093

1469

else:

2094

1470

self.disable()

2095

1471

2096

1472

# LastCheckedOK - property

2097

@dbus_service_property(_interface,

2098

signature="s",

1473

@dbus_service_property(_interface, signature="s",

2099

1474

access="readwrite")

2100

1475

def LastCheckedOK_dbus_property(self, value=None):

2101

1476

if value is not None:

2102

1477

self.checked_ok()

2103

1478

return

2104

1479

return datetime_to_dbus(self.last_checked_ok)

2105

1480

2106

1481

# LastCheckerStatus - property

2107

@dbus_service_property(_interface, signature="n", access="read")

1482

@dbus_service_property(_interface, signature="n",

1483

access="read")

2108

1484

def LastCheckerStatus_dbus_property(self):

2109

1485

return dbus.Int16(self.last_checker_status)

2110

1486

2111

1487

# Expires - property

2112

1488

@dbus_service_property(_interface, signature="s", access="read")

2113

1489

def Expires_dbus_property(self):

2114

1490

return datetime_to_dbus(self.expires)

2115

1491

2116

1492

# LastApprovalRequest - property

2117

1493

@dbus_service_property(_interface, signature="s", access="read")

2118

1494

def LastApprovalRequest_dbus_property(self):

2119

1495

return datetime_to_dbus(self.last_approval_request)

2120

1496

2121

1497

# Timeout - property

2122

@dbus_service_property(_interface,

2123

signature="t",

1498

@dbus_service_property(_interface, signature="t",

2124

1499

access="readwrite")

2125

1500

def Timeout_dbus_property(self, value=None):

2126

1501

if value is None: # get

2127

return dbus.UInt64(self.timeout.total_seconds() * 1000)

2128

old_timeout = self.timeout

1502

return dbus.UInt64(self.timeout_milliseconds())

2129

1503

self.timeout = datetime.timedelta(0, 0, 0, value)

2130

# Reschedule disabling

1504

# Reschedule timeout

2131

1505

if self.enabled:

2132

1506

now = datetime.datetime.utcnow()

2133

self.expires += self.timeout - old_timeout

2134

if self.expires <= now:

1507

time_to_die = timedelta_to_milliseconds(

1508

(self.last_checked_ok + self.timeout) - now)

1509

if time_to_die <= 0:

2135

1510

# The timeout has passed

2136

1511

self.disable()

2137

1512

else:

1513

self.expires = (now +

1514

datetime.timedelta(milliseconds =

1515

time_to_die))

2138

1516

if (getattr(self, "disable_initiator_tag", None)

2139

1517

is None):

2140

1518

return

2141

GLib.source_remove(self.disable_initiator_tag)

2142

self.disable_initiator_tag = GLib.timeout_add(

2143

int((self.expires - now).total_seconds() * 1000),

2144

self.disable)

2145

1519

gobject.source_remove(self.disable_initiator_tag)

1520

self.disable_initiator_tag = (gobject.timeout_add

1521

(time_to_die,

1522

self.disable))

1523

2146

1524

# ExtendedTimeout - property

2147

@dbus_service_property(_interface,

2148

signature="t",

1525

@dbus_service_property(_interface, signature="t",

2149

1526

access="readwrite")

2150

1527

def ExtendedTimeout_dbus_property(self, value=None):

2151

1528

if value is None: # get

2152

return dbus.UInt64(self.extended_timeout.total_seconds()

2153

* 1000)

1529

return dbus.UInt64(self.extended_timeout_milliseconds())

2154

1530

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2155

1531

2156

1532

# Interval - property

2157

@dbus_service_property(_interface,

2158

signature="t",

1533

@dbus_service_property(_interface, signature="t",

2159

1534

access="readwrite")

2160

1535

def Interval_dbus_property(self, value=None):

2161

1536

if value is None: # get

2162

return dbus.UInt64(self.interval.total_seconds() * 1000)

1537

return dbus.UInt64(self.interval_milliseconds())

2163

1538

self.interval = datetime.timedelta(0, 0, 0, value)

2164

1539

if getattr(self, "checker_initiator_tag", None) is None:

2165

1540

return

2166

1541

if self.enabled:

2167

1542

# Reschedule checker run

2168

GLib.source_remove(self.checker_initiator_tag)

2169

self.checker_initiator_tag = GLib.timeout_add(

2170

value, self.start_checker)

2171

self.start_checker() # Start one now, too

2172

1543

gobject.source_remove(self.checker_initiator_tag)

1544

self.checker_initiator_tag = (gobject.timeout_add

1545

(value, self.start_checker))

1546

self.start_checker() # Start one now, too

1547

2173

1548

# Checker - property

2174

@dbus_service_property(_interface,

2175

signature="s",

1549

@dbus_service_property(_interface, signature="s",

2176

1550

access="readwrite")

2177

1551

def Checker_dbus_property(self, value=None):

2178

1552

if value is None: # get

2179

1553

return dbus.String(self.checker_command)

2180

self.checker_command = str(value)

2181

1554

self.checker_command = unicode(value)

1555

2182

1556

# CheckerRunning - property

2183

@dbus_service_property(_interface,

2184

signature="b",

1557

@dbus_service_property(_interface, signature="b",

2185

1558

access="readwrite")

2186

1559

def CheckerRunning_dbus_property(self, value=None):

2187

1560

if value is None: # get

2190

1563

self.start_checker()

2191

1564

else:

2192

1565

self.stop_checker()

2193

1566

2194

1567

# ObjectPath - property

2195

@dbus_annotations(

2196

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2197

"org.freedesktop.DBus.Deprecated": "true"})

2198

1568

@dbus_service_property(_interface, signature="o", access="read")

2199

1569

def ObjectPath_dbus_property(self):

2200

return self.dbus_object_path # is already a dbus.ObjectPath

2201

1570

return self.dbus_object_path # is already a dbus.ObjectPath

1571

2202

1572

# Secret = property

2203

@dbus_annotations(

2204

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2205

"invalidates"})

2206

@dbus_service_property(_interface,

2207

signature="ay",

2208

access="write",

2209

byte_arrays=True)

1573

@dbus_service_property(_interface, signature="ay",

1574

access="write", byte_arrays=True)

2210

1575

def Secret_dbus_property(self, value):

2211

self.secret = bytes(value)

2212

1576

self.secret = str(value)

1577

2213

1578

del _interface

2214

1579

2215

1580

2216

1581

class ProxyClient(object):

2217

def __init__(self, child_pipe, key_id, fpr, address):

1582

def __init__(self, child_pipe, fpr, address):

2218

1583

self._pipe = child_pipe

2219

self._pipe.send(('init', key_id, fpr, address))

1584

self._pipe.send(('init', fpr, address))

2220

1585

if not self._pipe.recv():

2221

raise KeyError(key_id or fpr)

2222

1586

raise KeyError()

1587

2223

1588

def __getattribute__(self, name):

2224

1589

if name == '_pipe':

2225

1590

return super(ProxyClient, self).__getattribute__(name)

2228

1593

if data[0] == 'data':

2229

1594

return data[1]

2230

1595

if data[0] == 'function':

2231

2232

1596

def func(*args, **kwargs):

2233

1597

self._pipe.send(('funcall', name, args, kwargs))

2234

1598

return self._pipe.recv()[1]

2235

2236

1599

return func

2237

1600

2238

1601

def __setattr__(self, name, value):

2239

1602

if name == '_pipe':

2240

1603

return super(ProxyClient, self).__setattr__(name, value)

2241

1604

self._pipe.send(('setattr', name, value))

2242

1605

2243

1606

1607

class ClientDBusTransitional(ClientDBus):

1608

__metaclass__ = AlternateDBusNamesMetaclass

1609

1610

2244

1611

class ClientHandler(socketserver.BaseRequestHandler, object):

2245

1612

"""A class to handle client connections.

2246

1613

2247

1614

Instantiated once for each connection to handle it.

2248

1615

Note: This will run in its own forked process."""

2249

1616

2250

1617

def handle(self):

2251

1618

with contextlib.closing(self.server.child_pipe) as child_pipe:

2252

1619

logger.info("TCP connection from: %s",

2253

str(self.client_address))

1620

unicode(self.client_address))

2254

1621

logger.debug("Pipe FD: %d",

2255

1622

self.server.child_pipe.fileno())

2256

2257

session = gnutls.ClientSession(self.request)

2258

2259

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2260

# "+AES-256-CBC", "+SHA1",

2261

# "+COMP-NULL", "+CTYPE-OPENPGP",

2262

# "+DHE-DSS"))

1623

1624

session = (gnutls.connection

1625

.ClientSession(self.request,

1626

gnutls.connection

1627

.X509Credentials()))

1628

1629

# Note: gnutls.connection.X509Credentials is really a

1630

# generic GnuTLS certificate credentials object so long as

1631

# no X.509 keys are added to it. Therefore, we can use it

1632

# here despite using OpenPGP certificates.

1633

1634

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1635

# "+AES-256-CBC", "+SHA1",

1636

# "+COMP-NULL", "+CTYPE-OPENPGP",

1637

# "+DHE-DSS"))

2263

1638

# Use a fallback default, since this MUST be set.

2264

1639

priority = self.server.gnutls_priority

2265

1640

if priority is None:

2266

1641

priority = "NORMAL"

2267

gnutls.priority_set_direct(session._c_object,

2268

priority.encode("utf-8"),

2269

None)

2270

1642

(gnutls.library.functions

1643

.gnutls_priority_set_direct(session._c_object,

1644

priority, None))

1645

2271

1646

# Start communication using the Mandos protocol

2272

1647

# Get protocol number

2273

1648

line = self.request.makefile().readline()

2274

1649

logger.debug("Protocol version: %r", line)

2275

1650

try:

2276

1651

if int(line.strip().split()[0]) > 1:

2277

raise RuntimeError(line)

1652

raise RuntimeError

2278

1653

except (ValueError, IndexError, RuntimeError) as error:

2279

1654

logger.error("Unknown protocol version: %s", error)

2280

1655

return

2281

1656

2282

1657

# Start GnuTLS connection

2283

1658

try:

2284

1659

session.handshake()

2285

except gnutls.Error as error:

1660

except gnutls.errors.GNUTLSError as error:

2286

1661

logger.warning("Handshake failed: %s", error)

2287

1662

# Do not run session.bye() here: the session is not

2288

1663

# established. Just abandon the request.

2289

1664

return

2290

1665

logger.debug("Handshake succeeded")

2291

1666

2292

1667

approval_required = False

2293

1668

try:

2294

if gnutls.has_rawpk:

2295

fpr = b""

2296

try:

2297

key_id = self.key_id(

2298

self.peer_certificate(session))

2299

except (TypeError, gnutls.Error) as error:

2300

logger.warning("Bad certificate: %s", error)

2301

return

2302

logger.debug("Key ID: %s", key_id)

2303

2304

else:

2305

key_id = b""

2306

try:

2307

fpr = self.fingerprint(

2308

self.peer_certificate(session))

2309

except (TypeError, gnutls.Error) as error:

2310

logger.warning("Bad certificate: %s", error)

2311

return

2312

logger.debug("Fingerprint: %s", fpr)

2313

2314

try:

2315

client = ProxyClient(child_pipe, key_id, fpr,

1669

try:

1670

fpr = self.fingerprint(self.peer_certificate

1671

(session))

1672

except (TypeError,

1673

gnutls.errors.GNUTLSError) as error:

1674

logger.warning("Bad certificate: %s", error)

1675

return

1676

logger.debug("Fingerprint: %s", fpr)

1677

1678

try:

1679

client = ProxyClient(child_pipe, fpr,

2316

1680

self.client_address)

2317

1681

except KeyError:

2318

1682

return

2319

1683

2320

1684

if client.approval_delay:

2321

1685

delay = client.approval_delay

2322

1686

client.approvals_pending += 1

2323

1687

approval_required = True

2324

1688

2325

1689

while True:

2326

1690

if not client.enabled:

2327

1691

logger.info("Client %s is disabled",

2328

client.name)

1692

client.name)

2329

1693

if self.server.use_dbus:

2330

1694

# Emit D-Bus signal

2331

1695

client.Rejected("Disabled")

2332

1696

return

2333

1697

2334

1698

if client.approved or not client.approval_delay:

2335

# We are approved or approval is disabled

1699

#We are approved or approval is disabled

2336

1700

break

2337

1701

elif client.approved is None:

2338

1702

logger.info("Client %s needs approval",

2340

1704

if self.server.use_dbus:

2341

1705

# Emit D-Bus signal

2342

1706

client.NeedApproval(

2343

client.approval_delay.total_seconds()

2344

* 1000, client.approved_by_default)

1707

client.approval_delay_milliseconds(),

1708

client.approved_by_default)

2345

1709

else:

2346

1710

logger.warning("Client %s was not approved",

2347

1711

client.name)

2349

1713

# Emit D-Bus signal

2350

1714

client.Rejected("Denied")

2351

1715

return

2352

2353

# wait until timeout or approved

1716

1717

#wait until timeout or approved

2354

1718

time = datetime.datetime.now()

2355

1719

client.changedstate.acquire()

2356

client.changedstate.wait(delay.total_seconds())

1720

(client.changedstate.wait

1721

(float(client.timedelta_to_milliseconds(delay)

1722

/ 1000)))

2357

1723

client.changedstate.release()

2358

1724

time2 = datetime.datetime.now()

2359

1725

if (time2 - time) >= delay:

2369

1735

break

2370

1736

else:

2371

1737

delay -= time2 - time

2372

2373

try:

2374

session.send(client.secret)

2375

except gnutls.Error as error:

2376

logger.warning("gnutls send failed",

2377

exc_info=error)

2378

return

2379

1738

1739

sent_size = 0

1740

while sent_size < len(client.secret):

1741

try:

1742

sent = session.send(client.secret[sent_size:])

1743

except gnutls.errors.GNUTLSError as error:

1744

logger.warning("gnutls send failed")

1745

return

1746

logger.debug("Sent: %d, remaining: %d",

1747

sent, len(client.secret)

1748

- (sent_size + sent))

1749

sent_size += sent

1750

2380

1751

logger.info("Sending secret to %s", client.name)

2381

1752

# bump the timeout using extended_timeout

2382

1753

client.bump_timeout(client.extended_timeout)

2383

1754

if self.server.use_dbus:

2384

1755

# Emit D-Bus signal

2385

1756

client.GotSecret()

2386

1757

2387

1758

finally:

2388

1759

if approval_required:

2389

1760

client.approvals_pending -= 1

2390

1761

try:

2391

1762

session.bye()

2392

except gnutls.Error as error:

2393

logger.warning("GnuTLS bye failed",

2394

exc_info=error)

2395

1763

except gnutls.errors.GNUTLSError as error:

1764

logger.warning("GnuTLS bye failed")

1765

2396

1766

@staticmethod

2397

1767

def peer_certificate(session):

2398

"Return the peer's certificate as a bytestring"

2399

try:

2400

cert_type = gnutls.certificate_type_get2(session._c_object,

2401

gnutls.CTYPE_PEERS)

2402

except AttributeError:

2403

cert_type = gnutls.certificate_type_get(session._c_object)

2404

if gnutls.has_rawpk:

2405

valid_cert_types = frozenset((gnutls.CRT_RAWPK,))

2406

else:

2407

valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))

2408

# If not a valid certificate type...

2409

if cert_type not in valid_cert_types:

2410

logger.info("Cert type %r not in %r", cert_type,

2411

valid_cert_types)

2412

# ...return invalid data

2413

return b""

1768

"Return the peer's OpenPGP certificate as a bytestring"

1769

# If not an OpenPGP certificate...

1770

if (gnutls.library.functions

1771

.gnutls_certificate_type_get(session._c_object)

1772

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1773

# ...do the normal thing

1774

return session.peer_certificate

2414

1775

list_size = ctypes.c_uint(1)

2415

cert_list = (gnutls.certificate_get_peers

1776

cert_list = (gnutls.library.functions

1777

.gnutls_certificate_get_peers

2416

1778

(session._c_object, ctypes.byref(list_size)))

2417

1779

if not bool(cert_list) and list_size.value != 0:

2418

raise gnutls.Error("error getting peer certificate")

1780

raise gnutls.errors.GNUTLSError("error getting peer"

1781

" certificate")

2419

1782

if list_size.value == 0:

2420

1783

return None

2421

1784

cert = cert_list[0]

2422

1785

return ctypes.string_at(cert.data, cert.size)

2423

2424

@staticmethod

2425

def key_id(certificate):

2426

"Convert a certificate bytestring to a hexdigit key ID"

2427

# New GnuTLS "datum" with the public key

2428

datum = gnutls.datum_t(

2429

ctypes.cast(ctypes.c_char_p(certificate),

2430

ctypes.POINTER(ctypes.c_ubyte)),

2431

ctypes.c_uint(len(certificate)))

2432

# XXX all these need to be created in the gnutls "module"

2433

# New empty GnuTLS certificate

2434

pubkey = gnutls.pubkey_t()

2435

gnutls.pubkey_init(ctypes.byref(pubkey))

2436

# Import the raw public key into the certificate

2437

gnutls.pubkey_import(pubkey,

2438

ctypes.byref(datum),

2439

gnutls.X509_FMT_DER)

2440

# New buffer for the key ID

2441

buf = ctypes.create_string_buffer(32)

2442

buf_len = ctypes.c_size_t(len(buf))

2443

# Get the key ID from the raw public key into the buffer

2444

gnutls.pubkey_get_key_id(pubkey,

2445

gnutls.KEYID_USE_SHA256,

2446

ctypes.cast(ctypes.byref(buf),

2447

ctypes.POINTER(ctypes.c_ubyte)),

2448

ctypes.byref(buf_len))

2449

# Deinit the certificate

2450

gnutls.pubkey_deinit(pubkey)

2451

2452

# Convert the buffer to a Python bytestring

2453

key_id = ctypes.string_at(buf, buf_len.value)

2454

# Convert the bytestring to hexadecimal notation

2455

hex_key_id = binascii.hexlify(key_id).upper()

2456

return hex_key_id

2457

1786

2458

1787

@staticmethod

2459

1788

def fingerprint(openpgp):

2460

1789

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2461

1790

# New GnuTLS "datum" with the OpenPGP public key

2462

datum = gnutls.datum_t(

2463

ctypes.cast(ctypes.c_char_p(openpgp),

2464

ctypes.POINTER(ctypes.c_ubyte)),

2465

ctypes.c_uint(len(openpgp)))

1791

datum = (gnutls.library.types

1792

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1793

ctypes.POINTER

1794

(ctypes.c_ubyte)),

1795

ctypes.c_uint(len(openpgp))))

2466

1796

# New empty GnuTLS certificate

2467

crt = gnutls.openpgp_crt_t()

2468

gnutls.openpgp_crt_init(ctypes.byref(crt))

1797

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1798

(gnutls.library.functions

1799

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2469

1800

# Import the OpenPGP public key into the certificate

2470

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2471

gnutls.OPENPGP_FMT_RAW)

1801

(gnutls.library.functions

1802

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1803

gnutls.library.constants

1804

.GNUTLS_OPENPGP_FMT_RAW))

2472

1805

# Verify the self signature in the key

2473

1806

crtverify = ctypes.c_uint()

2474

gnutls.openpgp_crt_verify_self(crt, 0,

2475

ctypes.byref(crtverify))

1807

(gnutls.library.functions

1808

.gnutls_openpgp_crt_verify_self(crt, 0,

1809

ctypes.byref(crtverify)))

2476

1810

if crtverify.value != 0:

2477

gnutls.openpgp_crt_deinit(crt)

2478

raise gnutls.CertificateSecurityError(code

2479

=crtverify.value)

1811

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1812

raise (gnutls.errors.CertificateSecurityError

1813

("Verify failed"))

2480

1814

# New buffer for the fingerprint

2481

1815

buf = ctypes.create_string_buffer(20)

2482

1816

buf_len = ctypes.c_size_t()

2483

1817

# Get the fingerprint from the certificate into the buffer

2484

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2485

ctypes.byref(buf_len))

1818

(gnutls.library.functions

1819

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1820

ctypes.byref(buf_len)))

2486

1821

# Deinit the certificate

2487

gnutls.openpgp_crt_deinit(crt)

1822

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2488

1823

# Convert the buffer to a Python bytestring

2489

1824

fpr = ctypes.string_at(buf, buf_len.value)

2490

1825

# Convert the bytestring to hexadecimal notation

2494

1829

2495

1830

class MultiprocessingMixIn(object):

2496

1831

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2497

2498

1832

def sub_process_main(self, request, address):

2499

1833

try:

2500

1834

self.finish_request(request, address)

2501

1835

except Exception:

2502

1836

self.handle_error(request, address)

2503

1837

self.close_request(request)

2504

1838

2505

1839

def process_request(self, request, address):

2506

1840

"""Start a new process to process the request."""

2507

proc = multiprocessing.Process(target=self.sub_process_main,

2508

args=(request, address))

1841

proc = multiprocessing.Process(target = self.sub_process_main,

1842

args = (request,

1843

address))

2509

1844

proc.start()

2510

1845

return proc

2511

1846

2512

1847

2513

1848

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2514

1849

""" adds a pipe to the MixIn """

2515

2516

1850

def process_request(self, request, client_address):

2517

1851

"""Overrides and wraps the original process_request().

2518

1852

2519

1853

This function creates a new pipe in self.pipe

2520

1854

"""

2521

1855

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2522

1856

2523

1857

proc = MultiprocessingMixIn.process_request(self, request,

2524

1858

client_address)

2525

1859

self.child_pipe.close()

2526

1860

self.add_pipe(parent_pipe, proc)

2527

1861

2528

1862

def add_pipe(self, parent_pipe, proc):

2529

1863

"""Dummy function; override as necessary"""

2530

raise NotImplementedError()

1864

raise NotImplementedError

2531

1865

2532

1866

2533

1867

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2534

1868

socketserver.TCPServer, object):

2535

1869

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2536

1870

2537

1871

Attributes:

2538

1872

enabled: Boolean; whether this server is activated yet

2539

1873

interface: None or a network interface name (string)

2540

1874

use_ipv6: Boolean; to use IPv6 or not

2541

1875

"""

2542

2543

1876

def __init__(self, server_address, RequestHandlerClass,

2544

interface=None,

2545

use_ipv6=True,

2546

socketfd=None):

2547

"""If socketfd is set, use that file descriptor instead of

2548

creating a new one with socket.socket().

2549

"""

1877

interface=None, use_ipv6=True):

2550

1878

self.interface = interface

2551

1879

if use_ipv6:

2552

1880

self.address_family = socket.AF_INET6

2553

if socketfd is not None:

2554

# Save the file descriptor

2555

self.socketfd = socketfd

2556

# Save the original socket.socket() function

2557

self.socket_socket = socket.socket

2558

2559

# To implement --socket, we monkey patch socket.socket.

2560

#

2561

# (When socketserver.TCPServer is a new-style class, we

2562

# could make self.socket into a property instead of monkey

2563

# patching socket.socket.)

2564

#

2565

# Create a one-time-only replacement for socket.socket()

2566

@functools.wraps(socket.socket)

2567

def socket_wrapper(*args, **kwargs):

2568

# Restore original function so subsequent calls are

2569

# not affected.

2570

socket.socket = self.socket_socket

2571

del self.socket_socket

2572

# This time only, return a new socket object from the

2573

# saved file descriptor.

2574

return socket.fromfd(self.socketfd, *args, **kwargs)

2575

# Replace socket.socket() function with wrapper

2576

socket.socket = socket_wrapper

2577

# The socketserver.TCPServer.__init__ will call

2578

# socket.socket(), which might be our replacement,

2579

# socket_wrapper(), if socketfd was set.

2580

1881

socketserver.TCPServer.__init__(self, server_address,

2581

1882

RequestHandlerClass)

2582

2583

1883

def server_bind(self):

2584

1884

"""This overrides the normal server_bind() function

2585

1885

to bind to an interface if one was specified, and also NOT to

2586

1886

bind to an address or port if they were not specified."""

2587

global SO_BINDTODEVICE

2588

1887

if self.interface is not None:

2589

1888

if SO_BINDTODEVICE is None:

2590

# Fall back to a hard-coded value which seems to be

2591

# common enough.

2592

logger.warning("SO_BINDTODEVICE not found, trying 25")

2593

SO_BINDTODEVICE = 25

2594

try:

2595

self.socket.setsockopt(

2596

socket.SOL_SOCKET, SO_BINDTODEVICE,

2597

(self.interface + "\0").encode("utf-8"))

2598

except socket.error as error:

2599

if error.errno == errno.EPERM:

2600

logger.error("No permission to bind to"

2601

" interface %s", self.interface)

2602

elif error.errno == errno.ENOPROTOOPT:

2603

logger.error("SO_BINDTODEVICE not available;"

2604

" cannot bind to interface %s",

2605

self.interface)

2606

elif error.errno == errno.ENODEV:

2607

logger.error("Interface %s does not exist,"

2608

" cannot bind", self.interface)

2609

else:

2610

raise

1889

logger.error("SO_BINDTODEVICE does not exist;"

1890

" cannot bind to interface %s",

1891

self.interface)

1892

else:

1893

try:

1894

self.socket.setsockopt(socket.SOL_SOCKET,

1895

SO_BINDTODEVICE,

1896

str(self.interface

1897

+ '\0'))

1898

except socket.error as error:

1899

if error[0] == errno.EPERM:

1900

logger.error("No permission to"

1901

" bind to interface %s",

1902

self.interface)

1903

elif error[0] == errno.ENOPROTOOPT:

1904

logger.error("SO_BINDTODEVICE not available;"

1905

" cannot bind to interface %s",

1906

self.interface)

1907

else:

1908

raise

2611

1909

# Only bind(2) the socket if we really need to.

2612

1910

if self.server_address[0] or self.server_address[1]:

2613

if self.server_address[1]:

2614

self.allow_reuse_address = True

2615

1911

if not self.server_address[0]:

2616

1912

if self.address_family == socket.AF_INET6:

2617

any_address = "::" # in6addr_any

1913

any_address = "::" # in6addr_any

2618

1914

else:

2619

any_address = "0.0.0.0" # INADDR_ANY

1915

any_address = socket.INADDR_ANY

2620

1916

self.server_address = (any_address,

2621

1917

self.server_address[1])

2622

1918

elif not self.server_address[1]:

2623

self.server_address = (self.server_address[0], 0)

1919

self.server_address = (self.server_address[0],

1920

0)

2624

1921

# if self.interface:

2625

1922

# self.server_address = (self.server_address[0],

2626

1923

# 0, # port

2632

1929

2633

1930

class MandosServer(IPv6_TCPServer):

2634

1931

"""Mandos server.

2635

1932

2636

1933

Attributes:

2637

1934

clients: set of Client objects

2638

1935

gnutls_priority GnuTLS priority string

2639

1936

use_dbus: Boolean; to emit D-Bus signals or not

2640

2641

Assumes a GLib.MainLoop event loop.

1937

1938

Assumes a gobject.MainLoop event loop.

2642

1939

"""

2643

2644

1940

def __init__(self, server_address, RequestHandlerClass,

2645

interface=None,

2646

use_ipv6=True,

2647

clients=None,

2648

gnutls_priority=None,

2649

use_dbus=True,

2650

socketfd=None):

1941

interface=None, use_ipv6=True, clients=None,

1942

gnutls_priority=None, use_dbus=True):

2651

1943

self.enabled = False

2652

1944

self.clients = clients

2653

1945

if self.clients is None:

2656

1948

self.gnutls_priority = gnutls_priority

2657

1949

IPv6_TCPServer.__init__(self, server_address,

2658

1950

RequestHandlerClass,

2659

interface=interface,

2660

use_ipv6=use_ipv6,

2661

socketfd=socketfd)

2662

1951

interface = interface,

1952

use_ipv6 = use_ipv6)

2663

1953

def server_activate(self):

2664

1954

if self.enabled:

2665

1955

return socketserver.TCPServer.server_activate(self)

2666

1956

2667

1957

def enable(self):

2668

1958

self.enabled = True

2669

1959

2670

1960

def add_pipe(self, parent_pipe, proc):

2671

1961

# Call "handle_ipc" for both data and EOF events

2672

GLib.io_add_watch(

2673

parent_pipe.fileno(),

2674

GLib.IO_IN | GLib.IO_HUP,

2675

functools.partial(self.handle_ipc,

2676

parent_pipe=parent_pipe,

2677

proc=proc))

2678

2679

def handle_ipc(self, source, condition,

2680

parent_pipe=None,

2681

proc=None,

2682

client_object=None):

1962

gobject.io_add_watch(parent_pipe.fileno(),

1963

gobject.IO_IN | gobject.IO_HUP,

1964

functools.partial(self.handle_ipc,

1965

parent_pipe =

1966

parent_pipe,

1967

proc = proc))

1968

1969

def handle_ipc(self, source, condition, parent_pipe=None,

1970

proc = None, client_object=None):

1971

condition_names = {

1972

gobject.IO_IN: "IN", # There is data to read.

1973

gobject.IO_OUT: "OUT", # Data can be written (without

1974

# blocking).

1975

gobject.IO_PRI: "PRI", # There is urgent data to read.

1976

gobject.IO_ERR: "ERR", # Error condition.

1977

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1978

# broken, usually for pipes and

1979

# sockets).

1980

}

1981

conditions_string = ' | '.join(name

1982

for cond, name in

1983

condition_names.iteritems()

1984

if cond & condition)

2683

1985

# error, or the other end of multiprocessing.Pipe has closed

2684

if condition & (GLib.IO_ERR | GLib.IO_HUP):

1986

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2685

1987

# Wait for other process to exit

2686

1988

proc.join()

2687

1989

return False

2688

1990

2689

1991

# Read a request from the child

2690

1992

request = parent_pipe.recv()

2691

1993

command = request[0]

2692

1994

2693

1995

if command == 'init':

2694

key_id = request[1].decode("ascii")

2695

fpr = request[2].decode("ascii")

2696

address = request[3]

2697

2698

for c in self.clients.values():

2699

if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":

2700

continue

2701

if key_id and c.key_id == key_id:

2702

client = c

2703

break

2704

if fpr and c.fingerprint == fpr:

1996

fpr = request[1]

1997

address = request[2]

1998

1999

for c in self.clients.itervalues():

2000

if c.fingerprint == fpr:

2705

2001

client = c

2706

2002

break

2707

2003

else:

2708

logger.info("Client not found for key ID: %s, address"

2709

": %s", key_id or fpr, address)

2004

logger.info("Client not found for fingerprint: %s, ad"

2005

"dress: %s", fpr, address)

2710

2006

if self.use_dbus:

2711

2007

# Emit D-Bus signal

2712

mandos_dbus_service.ClientNotFound(key_id or fpr,

2008

mandos_dbus_service.ClientNotFound(fpr,

2713

2009

address[0])

2714

2010

parent_pipe.send(False)

2715

2011

return False

2716

2717

GLib.io_add_watch(

2718

parent_pipe.fileno(),

2719

GLib.IO_IN | GLib.IO_HUP,

2720

functools.partial(self.handle_ipc,

2721

parent_pipe=parent_pipe,

2722

proc=proc,

2723

client_object=client))

2012

2013

gobject.io_add_watch(parent_pipe.fileno(),

2014

gobject.IO_IN | gobject.IO_HUP,

2015

functools.partial(self.handle_ipc,

2016

parent_pipe =

2017

parent_pipe,

2018

proc = proc,

2019

client_object =

2020

client))

2724

2021

parent_pipe.send(True)

2725

2022

# remove the old hook in favor of the new above hook on

2726

2023

# same fileno

2729

2026

funcname = request[1]

2730

2027

args = request[2]

2731

2028

kwargs = request[3]

2732

2029

2733

2030

parent_pipe.send(('data', getattr(client_object,

2734

2031

funcname)(*args,

2735

**kwargs)))

2736

2032

**kwargs)))

2033

2737

2034

if command == 'getattr':

2738

2035

attrname = request[1]

2739

if isinstance(client_object.__getattribute__(attrname),

2740

collections.Callable):

2741

parent_pipe.send(('function', ))

2036

if callable(client_object.__getattribute__(attrname)):

2037

parent_pipe.send(('function',))

2742

2038

else:

2743

parent_pipe.send((

2744

'data', client_object.__getattribute__(attrname)))

2745

2039

parent_pipe.send(('data', client_object

2040

.__getattribute__(attrname)))

2041

2746

2042

if command == 'setattr':

2747

2043

attrname = request[1]

2748

2044

value = request[2]

2749

2045

setattr(client_object, attrname, value)

2750

2046

2751

2047

return True

2752

2048

2753

2049

2754

def rfc3339_duration_to_delta(duration):

2755

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2756

2757

>>> rfc3339_duration_to_delta("P7D")

2758

datetime.timedelta(7)

2759

>>> rfc3339_duration_to_delta("PT60S")

2760

datetime.timedelta(0, 60)

2761

>>> rfc3339_duration_to_delta("PT60M")

2762

datetime.timedelta(0, 3600)

2763

>>> rfc3339_duration_to_delta("PT24H")

2764

datetime.timedelta(1)

2765

>>> rfc3339_duration_to_delta("P1W")

2766

datetime.timedelta(7)

2767

>>> rfc3339_duration_to_delta("PT5M30S")

2768

datetime.timedelta(0, 330)

2769

>>> rfc3339_duration_to_delta("P1DT3M20S")

2770

datetime.timedelta(1, 200)

2771

"""

2772

2773

# Parsing an RFC 3339 duration with regular expressions is not

2774

# possible - there would have to be multiple places for the same

2775

# values, like seconds. The current code, while more esoteric, is

2776

# cleaner without depending on a parsing library. If Python had a

2777

# built-in library for parsing we would use it, but we'd like to

2778

# avoid excessive use of external libraries.

2779

2780

# New type for defining tokens, syntax, and semantics all-in-one

2781

Token = collections.namedtuple("Token", (

2782

"regexp", # To match token; if "value" is not None, must have

2783

# a "group" containing digits

2784

"value", # datetime.timedelta or None

2785

"followers")) # Tokens valid after this token

2786

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2787

# the "duration" ABNF definition in RFC 3339, Appendix A.

2788

token_end = Token(re.compile(r"$"), None, frozenset())

2789

token_second = Token(re.compile(r"(\d+)S"),

2790

datetime.timedelta(seconds=1),

2791

frozenset((token_end, )))

2792

token_minute = Token(re.compile(r"(\d+)M"),

2793

datetime.timedelta(minutes=1),

2794

frozenset((token_second, token_end)))

2795

token_hour = Token(re.compile(r"(\d+)H"),

2796

datetime.timedelta(hours=1),

2797

frozenset((token_minute, token_end)))

2798

token_time = Token(re.compile(r"T"),

2799

None,

2800

frozenset((token_hour, token_minute,

2801

token_second)))

2802

token_day = Token(re.compile(r"(\d+)D"),

2803

datetime.timedelta(days=1),

2804

frozenset((token_time, token_end)))

2805

token_month = Token(re.compile(r"(\d+)M"),

2806

datetime.timedelta(weeks=4),

2807

frozenset((token_day, token_end)))

2808

token_year = Token(re.compile(r"(\d+)Y"),

2809

datetime.timedelta(weeks=52),

2810

frozenset((token_month, token_end)))

2811

token_week = Token(re.compile(r"(\d+)W"),

2812

datetime.timedelta(weeks=1),

2813

frozenset((token_end, )))

2814

token_duration = Token(re.compile(r"P"), None,

2815

frozenset((token_year, token_month,

2816

token_day, token_time,

2817

token_week)))

2818

# Define starting values:

2819

# Value so far

2820

value = datetime.timedelta()

2821

found_token = None

2822

# Following valid tokens

2823

followers = frozenset((token_duration, ))

2824

# String left to parse

2825

s = duration

2826

# Loop until end token is found

2827

while found_token is not token_end:

2828

# Search for any currently valid tokens

2829

for token in followers:

2830

match = token.regexp.match(s)

2831

if match is not None:

2832

# Token found

2833

if token.value is not None:

2834

# Value found, parse digits

2835

factor = int(match.group(1), 10)

2836

# Add to value so far

2837

value += factor * token.value

2838

# Strip token from string

2839

s = token.regexp.sub("", s, 1)

2840

# Go to found token

2841

found_token = token

2842

# Set valid next tokens

2843

followers = found_token.followers

2844

break

2845

else:

2846

# No currently valid tokens were found

2847

raise ValueError("Invalid RFC 3339 duration: {!r}"

2848

.format(duration))

2849

# End token found

2850

return value

2851

2852

2853

2050

def string_to_delta(interval):

2854

2051

"""Parse a string and return a datetime.timedelta

2855

2052

2856

2053

>>> string_to_delta('7d')

2857

2054

datetime.timedelta(7)

2858

2055

>>> string_to_delta('60s')

2866

2063

>>> string_to_delta('5m 30s')

2867

2064

datetime.timedelta(0, 330)

2868

2065

"""

2869

2870

try:

2871

return rfc3339_duration_to_delta(interval)

2872

except ValueError:

2873

pass

2874

2875

2066

timevalue = datetime.timedelta(0)

2876

2067

for s in interval.split():

2877

2068

try:

2878

suffix = s[-1]

2069

suffix = unicode(s[-1])

2879

2070

value = int(s[:-1])

2880

2071

if suffix == "d":

2881

2072

delta = datetime.timedelta(value)

2888

2079

elif suffix == "w":

2889

2080

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2890

2081

else:

2891

raise ValueError("Unknown suffix {!r}".format(suffix))

2892

except IndexError as e:

2082

raise ValueError("Unknown suffix %r" % suffix)

2083

except (ValueError, IndexError) as e:

2893

2084

raise ValueError(*(e.args))

2894

2085

timevalue += delta

2895

2086

return timevalue

2896

2087

2897

2088

2898

def daemon(nochdir=False, noclose=False):

2089

def daemon(nochdir = False, noclose = False):

2899

2090

"""See daemon(3). Standard BSD Unix function.

2900

2091

2901

2092

This should really exist as os.daemon, but it doesn't (yet)."""

2902

2093

if os.fork():

2903

2094

sys.exit()

2911

2102

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2912

2103

if not stat.S_ISCHR(os.fstat(null).st_mode):

2913

2104

raise OSError(errno.ENODEV,

2914

"{} not a character device"

2915

.format(os.devnull))

2105

"%s not a character device"

2106

% os.devnull)

2916

2107

os.dup2(null, sys.stdin.fileno())

2917

2108

os.dup2(null, sys.stdout.fileno())

2918

2109

os.dup2(null, sys.stderr.fileno())

2921

2112

2922

2113

2923

2114

def main():

2924

2115

2925

2116

##################################################################

2926

2117

# Parsing of options, both command line and config file

2927

2118

2928

2119

parser = argparse.ArgumentParser()

2929

2120

parser.add_argument("-v", "--version", action="version",

2930

version="%(prog)s {}".format(version),

2121

version = "%%(prog)s %s" % version,

2931

2122

help="show version number and exit")

2932

2123

parser.add_argument("-i", "--interface", metavar="IF",

2933

2124

help="Bind to interface IF")

2939

2130

help="Run self-test")

2940

2131

parser.add_argument("--debug", action="store_true",

2941

2132

help="Debug mode; run in foreground and log"

2942

" to terminal", default=None)

2133

" to terminal")

2943

2134

parser.add_argument("--debuglevel", metavar="LEVEL",

2944

2135

help="Debug level for stdout output")

2945

2136

parser.add_argument("--priority", help="GnuTLS"

2952

2143

" files")

2953

2144

parser.add_argument("--no-dbus", action="store_false",

2954

2145

dest="use_dbus", help="Do not provide D-Bus"

2955

" system bus interface", default=None)

2146

" system bus interface")

2956

2147

parser.add_argument("--no-ipv6", action="store_false",

2957

dest="use_ipv6", help="Do not use IPv6",

2958

default=None)

2148

dest="use_ipv6", help="Do not use IPv6")

2959

2149

parser.add_argument("--no-restore", action="store_false",

2960

2150

dest="restore", help="Do not restore stored"

2961

" state", default=None)

2962

parser.add_argument("--socket", type=int,

2963

help="Specify a file descriptor to a network"

2964

" socket to use instead of creating one")

2151

" state")

2965

2152

parser.add_argument("--statedir", metavar="DIR",

2966

2153

help="Directory to save/restore state in")

2967

parser.add_argument("--foreground", action="store_true",

2968

help="Run in foreground", default=None)

2969

parser.add_argument("--no-zeroconf", action="store_false",

2970

dest="zeroconf", help="Do not use Zeroconf",

2971

default=None)

2972

2154

2973

2155

options = parser.parse_args()

2974

2156

2975

2157

if options.check:

2976

2158

import doctest

2977

fail_count, test_count = doctest.testmod()

2978

sys.exit(os.EX_OK if fail_count == 0 else 1)

2979

2159

doctest.testmod()

2160

sys.exit()

2161

2980

2162

# Default values for config file for server-global settings

2981

if gnutls.has_rawpk:

2982

priority = ("SECURE128:!CTYPE-X.509:+CTYPE-RAWPK:!RSA"

2983

":!VERS-ALL:+VERS-TLS1.3:%PROFILE_ULTRA")

2984

else:

2985

priority = ("SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2986

":+SIGN-DSA-SHA256")

2987

server_defaults = {"interface": "",

2988

"address": "",

2989

"port": "",

2990

"debug": "False",

2991

"priority": priority,

2992

"servicename": "Mandos",

2993

"use_dbus": "True",

2994

"use_ipv6": "True",

2995

"debuglevel": "",

2996

"restore": "True",

2997

"socket": "",

2998

"statedir": "/var/lib/mandos",

2999

"foreground": "False",

3000

"zeroconf": "True",

3001

}

3002

del priority

3003

2163

server_defaults = { "interface": "",

2164

"address": "",

2165

"port": "",

2166

"debug": "False",

2167

"priority":

2168

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2169

"servicename": "Mandos",

2170

"use_dbus": "True",

2171

"use_ipv6": "True",

2172

"debuglevel": "",

2173

"restore": "True",

2174

"statedir": "/var/lib/mandos"

2175

}

2176

3004

2177

# Parse config file for server-global settings

3005

server_config = configparser.ConfigParser(server_defaults)

2178

server_config = configparser.SafeConfigParser(server_defaults)

3006

2179

del server_defaults

3007

server_config.read(os.path.join(options.configdir, "mandos.conf"))

3008

# Convert the ConfigParser object to a dict

2180

server_config.read(os.path.join(options.configdir,

2181

"mandos.conf"))

2182

# Convert the SafeConfigParser object to a dict

3009

2183

server_settings = server_config.defaults()

3010

2184

# Use the appropriate methods on the non-string config options

3011

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3012

"foreground", "zeroconf"):

2185

for option in ("debug", "use_dbus", "use_ipv6"):

3013

2186

server_settings[option] = server_config.getboolean("DEFAULT",

3014

2187

option)

3015

2188

if server_settings["port"]:

3016

2189

server_settings["port"] = server_config.getint("DEFAULT",

3017

2190

"port")

3018

if server_settings["socket"]:

3019

server_settings["socket"] = server_config.getint("DEFAULT",

3020

"socket")

3021

# Later, stdin will, and stdout and stderr might, be dup'ed

3022

# over with an opened os.devnull. But we don't want this to

3023

# happen with a supplied network socket.

3024

if 0 <= server_settings["socket"] <= 2:

3025

server_settings["socket"] = os.dup(server_settings

3026

["socket"])

3027

2191

del server_config

3028

2192

3029

2193

# Override the settings from the config file with command line

3030

2194

# options, if set.

3031

2195

for option in ("interface", "address", "port", "debug",

3032

"priority", "servicename", "configdir", "use_dbus",

3033

"use_ipv6", "debuglevel", "restore", "statedir",

3034

"socket", "foreground", "zeroconf"):

2196

"priority", "servicename", "configdir",

2197

"use_dbus", "use_ipv6", "debuglevel", "restore",

2198

"statedir"):

3035

2199

value = getattr(options, option)

3036

2200

if value is not None:

3037

2201

server_settings[option] = value

3038

2202

del options

3039

2203

# Force all strings to be unicode

3040

2204

for option in server_settings.keys():

3041

if isinstance(server_settings[option], bytes):

3042

server_settings[option] = (server_settings[option]

3043

.decode("utf-8"))

3044

# Force all boolean options to be boolean

3045

for option in ("debug", "use_dbus", "use_ipv6", "restore",

3046

"foreground", "zeroconf"):

3047

server_settings[option] = bool(server_settings[option])

3048

# Debug implies foreground

3049

if server_settings["debug"]:

3050

server_settings["foreground"] = True

2205

if type(server_settings[option]) is str:

2206

server_settings[option] = unicode(server_settings[option])

3051

2207

# Now we have our good server settings in "server_settings"

3052

2208

3053

2209

##################################################################

3054

3055

if (not server_settings["zeroconf"]

3056

and not (server_settings["port"]

3057

or server_settings["socket"] != "")):

3058

parser.error("Needs port or socket to work without Zeroconf")

3059

2210

3060

2211

# For convenience

3061

2212

debug = server_settings["debug"]

3062

2213

debuglevel = server_settings["debuglevel"]

3064

2215

use_ipv6 = server_settings["use_ipv6"]

3065

2216

stored_state_path = os.path.join(server_settings["statedir"],

3066

2217

stored_state_file)

3067

foreground = server_settings["foreground"]

3068

zeroconf = server_settings["zeroconf"]

3069

2218

3070

2219

if debug:

3071

2220

initlogger(debug, logging.DEBUG)

3072

2221

else:

3075

2224

else:

3076

2225

level = getattr(logging, debuglevel.upper())

3077

2226

initlogger(debug, level)

3078

2227

3079

2228

if server_settings["servicename"] != "Mandos":

3080

syslogger.setFormatter(

3081

logging.Formatter('Mandos ({}) [%(process)d]:'

3082

' %(levelname)s: %(message)s'.format(

3083

server_settings["servicename"])))

3084

2229

syslogger.setFormatter(logging.Formatter

2230

('Mandos (%s) [%%(process)d]:'

2231

' %%(levelname)s: %%(message)s'

2232

% server_settings["servicename"]))

2233

3085

2234

# Parse config file with clients

3086

client_config = configparser.ConfigParser(Client.client_defaults)

2235

client_config = configparser.SafeConfigParser(Client

2236

.client_defaults)

3087

2237

client_config.read(os.path.join(server_settings["configdir"],

3088

2238

"clients.conf"))

3089

2239

3090

2240

global mandos_dbus_service

3091

2241

mandos_dbus_service = None

3092

3093

socketfd = None

3094

if server_settings["socket"] != "":

3095

socketfd = server_settings["socket"]

3096

tcp_server = MandosServer(

3097

(server_settings["address"], server_settings["port"]),

3098

ClientHandler,

3099

interface=(server_settings["interface"] or None),

3100

use_ipv6=use_ipv6,

3101

gnutls_priority=server_settings["priority"],

3102

use_dbus=use_dbus,

3103

socketfd=socketfd)

3104

if not foreground:

3105

pidfilename = "/run/mandos.pid"

3106

if not os.path.isdir("/run/."):

3107

pidfilename = "/var/run/mandos.pid"

3108

pidfile = None

3109

try:

3110

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

3111

except IOError as e:

3112

logger.error("Could not open file %r", pidfilename,

3113

exc_info=e)

3114

3115

for name, group in (("_mandos", "_mandos"),

3116

("mandos", "mandos"),

3117

("nobody", "nogroup")):

3118

try:

3119

uid = pwd.getpwnam(name).pw_uid

3120

gid = pwd.getpwnam(group).pw_gid

3121

break

2242

2243

tcp_server = MandosServer((server_settings["address"],

2244

server_settings["port"]),

2245

ClientHandler,

2246

interface=(server_settings["interface"]

2247

or None),

2248

use_ipv6=use_ipv6,

2249

gnutls_priority=

2250

server_settings["priority"],

2251

use_dbus=use_dbus)

2252

if not debug:

2253

pidfilename = "/var/run/mandos.pid"

2254

try:

2255

pidfile = open(pidfilename, "w")

2256

except IOError:

2257

logger.error("Could not open file %r", pidfilename)

2258

2259

try:

2260

uid = pwd.getpwnam("_mandos").pw_uid

2261

gid = pwd.getpwnam("_mandos").pw_gid

2262

except KeyError:

2263

try:

2264

uid = pwd.getpwnam("mandos").pw_uid

2265

gid = pwd.getpwnam("mandos").pw_gid

3122

2266

except KeyError:

3123

continue

3124

else:

3125

uid = 65534

3126

gid = 65534

2267

try:

2268

uid = pwd.getpwnam("nobody").pw_uid

2269

gid = pwd.getpwnam("nobody").pw_gid

2270

except KeyError:

2271

uid = 65534

2272

gid = 65534

3127

2273

try:

3128

2274

os.setgid(gid)

3129

2275

os.setuid(uid)

3130

if debug:

3131

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3132

gid))

3133

2276

except OSError as error:

3134

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3135

.format(uid, gid, os.strerror(error.errno)))

3136

if error.errno != errno.EPERM:

3137

raise

3138

2277

if error[0] != errno.EPERM:

2278

raise error

2279

3139

2280

if debug:

3140

2281

# Enable all possible GnuTLS debugging

3141

2282

3142

2283

# "Use a log level over 10 to enable all debugging options."

3143

2284

# - GnuTLS manual

3144

gnutls.global_set_log_level(11)

3145

3146

@gnutls.log_func

2285

gnutls.library.functions.gnutls_global_set_log_level(11)

2286

2287

@gnutls.library.types.gnutls_log_func

3147

2288

def debug_gnutls(level, string):

3148

2289

logger.debug("GnuTLS: %s", string[:-1])

3149

3150

gnutls.global_set_log_function(debug_gnutls)

3151

2290

2291

(gnutls.library.functions

2292

.gnutls_global_set_log_function(debug_gnutls))

2293

3152

2294

# Redirect stdin so all checkers get /dev/null

3153

2295

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3154

2296

os.dup2(null, sys.stdin.fileno())

3155

2297

if null > 2:

3156

2298

os.close(null)

3157

2299

3158

2300

# Need to fork before connecting to D-Bus

3159

if not foreground:

2301

if not debug:

3160

2302

# Close all input and output, do double fork, etc.

3161

2303

daemon()

3162

3163

if gi.version_info < (3, 10, 2):

3164

# multiprocessing will use threads, so before we use GLib we

3165

# need to inform GLib that threads will be used.

3166

GLib.threads_init()

3167

2304

2305

gobject.threads_init()

2306

3168

2307

global main_loop

3169

2308

# From the Avahi example code

3170

2309

DBusGMainLoop(set_as_default=True)

3171

main_loop = GLib.MainLoop()

2310

main_loop = gobject.MainLoop()

3172

2311

bus = dbus.SystemBus()

3173

2312

# End of Avahi example code

3174

2313

if use_dbus:

3175

2314

try:

3176

2315

bus_name = dbus.service.BusName("se.recompile.Mandos",

3177

bus,

3178

do_not_queue=True)

3179

old_bus_name = dbus.service.BusName(

3180

"se.bsnet.fukt.Mandos", bus,

3181

do_not_queue=True)

3182

except dbus.exceptions.DBusException as e:

3183

logger.error("Disabling D-Bus:", exc_info=e)

2316

bus, do_not_queue=True)

2317

old_bus_name = (dbus.service.BusName

2318

("se.bsnet.fukt.Mandos", bus,

2319

do_not_queue=True))

2320

except dbus.exceptions.NameExistsException as e:

2321

logger.error(unicode(e) + ", disabling D-Bus")

3184

2322

use_dbus = False

3185

2323

server_settings["use_dbus"] = False

3186

2324

tcp_server.use_dbus = False

3187

if zeroconf:

3188

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3189

service = AvahiServiceToSyslog(

3190

name=server_settings["servicename"],

3191

servicetype="_mandos._tcp",

3192

protocol=protocol,

3193

bus=bus)

3194

if server_settings["interface"]:

3195

service.interface = if_nametoindex(

3196

server_settings["interface"].encode("utf-8"))

3197

2325

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2326

service = AvahiServiceToSyslog(name =

2327

server_settings["servicename"],

2328

servicetype = "_mandos._tcp",

2329

protocol = protocol, bus = bus)

2330

if server_settings["interface"]:

2331

service.interface = (if_nametoindex

2332

(str(server_settings["interface"])))

2333

3198

2334

global multiprocessing_manager

3199

2335

multiprocessing_manager = multiprocessing.Manager()

3200

2336

3201

2337

client_class = Client

3202

2338

if use_dbus:

3203

client_class = functools.partial(ClientDBus, bus=bus)

3204

2339

client_class = functools.partial(ClientDBusTransitional,

2340

bus = bus)

2341

3205

2342

client_settings = Client.config_parser(client_config)

3206

2343

old_client_settings = {}

3207

2344

clients_data = {}

3208

3209

# This is used to redirect stdout and stderr for checker processes

3210

global wnull

3211

wnull = open(os.devnull, "w") # A writable /dev/null

3212

# Only used if server is running in foreground but not in debug

3213

# mode

3214

if debug or not foreground:

3215

wnull.close()

3216

2345

3217

2346

# Get client data and settings from last running state.

3218

2347

if server_settings["restore"]:

3219

2348

try:

3220

2349

with open(stored_state_path, "rb") as stored_state:

3221

if sys.version_info.major == 2:

3222

clients_data, old_client_settings = pickle.load(

3223

stored_state)

3224

else:

3225

bytes_clients_data, bytes_old_client_settings = (

3226

pickle.load(stored_state, encoding="bytes"))

3227

# Fix bytes to strings

3228

# clients_data

3229

# .keys()

3230

clients_data = {(key.decode("utf-8")

3231

if isinstance(key, bytes)

3232

else key): value

3233

for key, value in

3234

bytes_clients_data.items()}

3235

del bytes_clients_data

3236

for key in clients_data:

3237

value = {(k.decode("utf-8")

3238

if isinstance(k, bytes) else k): v

3239

for k, v in

3240

clients_data[key].items()}

3241

clients_data[key] = value

3242

# .client_structure

3243

value["client_structure"] = [

3244

(s.decode("utf-8")

3245

if isinstance(s, bytes)

3246

else s) for s in

3247

value["client_structure"]]

3248

# .name & .host

3249

for k in ("name", "host"):

3250

if isinstance(value[k], bytes):

3251

value[k] = value[k].decode("utf-8")

3252

if "key_id" not in value:

3253

value["key_id"] = ""

3254

elif "fingerprint" not in value:

3255

value["fingerprint"] = ""

3256

# old_client_settings

3257

# .keys()

3258

old_client_settings = {

3259

(key.decode("utf-8")

3260

if isinstance(key, bytes)

3261

else key): value

3262

for key, value in

3263

bytes_old_client_settings.items()}

3264

del bytes_old_client_settings

3265

# .host

3266

for value in old_client_settings.values():

3267

if isinstance(value["host"], bytes):

3268

value["host"] = (value["host"]

3269

.decode("utf-8"))

2350

clients_data, old_client_settings = (pickle.load

2351

(stored_state))

3270

2352

os.remove(stored_state_path)

3271

2353

except IOError as e:

3272

if e.errno == errno.ENOENT:

3273

logger.warning("Could not load persistent state:"

3274

" {}".format(os.strerror(e.errno)))

3275

else:

3276

logger.critical("Could not load persistent state:",

3277

exc_info=e)

2354

logger.warning("Could not load persistent state: {0}"

2355

.format(e))

2356

if e.errno != errno.ENOENT:

3278

2357

raise

3279

2358

except EOFError as e:

3280

2359

logger.warning("Could not load persistent state: "

3281

"EOFError:",

3282

exc_info=e)

3283

2360

"EOFError: {0}".format(e))

2361

3284

2362

with PGPEngine() as pgp:

3285

for client_name, client in clients_data.items():

3286

# Skip removed clients

3287

if client_name not in client_settings:

3288

continue

3289

2363

for client_name, client in clients_data.iteritems():

3290

2364

# Decide which value to use after restoring saved state.

3291

2365

# We have three different values: Old config file,

3292

2366

# new config file, and saved state.

3297

2371

# For each value in new config, check if it

3298

2372

# differs from the old config value (Except for

3299

2373

# the "secret" attribute)

3300

if (name != "secret"

3301

and (value !=

3302

old_client_settings[client_name][name])):

2374

if (name != "secret" and

2375

value != old_client_settings[client_name]

2376

[name]):

3303

2377

client[name] = value

3304

2378

except KeyError:

3305

2379

pass

3306

2380

3307

2381

# Clients who has passed its expire date can still be

3308

# enabled if its last checker was successful. A Client

2382

# enabled if its last checker was successful. Clients

3309

2383

# whose checker succeeded before we stored its state is

3310

2384

# assumed to have successfully run all checkers during

3311

2385

# downtime.

3313

2387

if datetime.datetime.utcnow() >= client["expires"]:

3314

2388

if not client["last_checked_ok"]:

3315

2389

logger.warning(

3316

"disabling client {} - Client never "

3317

"performed a successful checker".format(

3318

client_name))

2390

"disabling client {0} - Client never "

2391

"performed a successful checker"

2392

.format(client_name))

3319

2393

client["enabled"] = False

3320

2394

elif client["last_checker_status"] != 0:

3321

2395

logger.warning(

3322

"disabling client {} - Client last"

3323

" checker failed with error code"

3324

" {}".format(

3325

client_name,

3326

client["last_checker_status"]))

2396

"disabling client {0} - Client "

2397

"last checker failed with error code {1}"

2398

.format(client_name,

2399

client["last_checker_status"]))

3327

2400

client["enabled"] = False

3328

2401

else:

3329

client["expires"] = (

3330

datetime.datetime.utcnow()

3331

+ client["timeout"])

2402

client["expires"] = (datetime.datetime

2403

.utcnow()

2404

+ client["timeout"])

3332

2405

logger.debug("Last checker succeeded,"

3333

" keeping {} enabled".format(

3334

client_name))

2406

" keeping {0} enabled"

2407

.format(client_name))

3335

2408

try:

3336

client["secret"] = pgp.decrypt(

3337

client["encrypted_secret"],

3338

client_settings[client_name]["secret"])

2409

client["secret"] = (

2410

pgp.decrypt(client["encrypted_secret"],

2411

client_settings[client_name]

2412

["secret"]))

3339

2413

except PGPError:

3340

2414

# If decryption fails, we use secret from new settings

3341

logger.debug("Failed to decrypt {} old secret".format(

3342

client_name))

3343

client["secret"] = (client_settings[client_name]

3344

["secret"])

2415

logger.debug("Failed to decrypt {0} old secret"

2416

.format(client_name))

2417

client["secret"] = (

2418

client_settings[client_name]["secret"])

3345

2419

2420

3346

2421

# Add/remove clients based on new changes made to config

3347

2422

for client_name in (set(old_client_settings)

3348

2423

- set(client_settings)):

3352

2427

clients_data[client_name] = client_settings[client_name]

3353

2428

3354

2429

# Create all client objects

3355

for client_name, client in clients_data.items():

2430

for client_name, client in clients_data.iteritems():

3356

2431

tcp_server.clients[client_name] = client_class(

3357

name=client_name,

3358

settings=client,

3359

server_settings=server_settings)

3360

2432

name = client_name, settings = client)

2433

3361

2434

if not tcp_server.clients:

3362

2435

logger.warning("No clients defined")

3363

3364

if not foreground:

3365

if pidfile is not None:

3366

pid = os.getpid()

3367

try:

3368

with pidfile:

3369

print(pid, file=pidfile)

3370

except IOError:

3371

logger.error("Could not write to file %r with PID %d",

3372

pidfilename, pid)

3373

del pidfile

2436

2437

if not debug:

2438

try:

2439

with pidfile:

2440

pid = os.getpid()

2441

pidfile.write(str(pid) + "\n".encode("utf-8"))

2442

del pidfile

2443

except IOError:

2444

logger.error("Could not write to file %r with PID %d",

2445

pidfilename, pid)

2446

except NameError:

2447

# "pidfile" was never created

2448

pass

3374

2449

del pidfilename

3375

3376

for termsig in (signal.SIGHUP, signal.SIGTERM):

3377

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3378

lambda: main_loop.quit() and False)

3379

2450

signal.signal(signal.SIGINT, signal.SIG_IGN)

2451

2452

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2453

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2454

3380

2455

if use_dbus:

3381

3382

@alternate_dbus_interfaces(

3383

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3384

class MandosDBusService(DBusObjectWithObjectManager):

2456

class MandosDBusService(DBusObjectWithProperties):

3385

2457

"""A D-Bus proxy object"""

3386

3387

2458

def __init__(self):

3388

2459

dbus.service.Object.__init__(self, bus, "/")

3389

3390

2460

_interface = "se.recompile.Mandos"

3391

2461

2462

@dbus_interface_annotations(_interface)

2463

def _foo(self):

2464

return { "org.freedesktop.DBus.Property"

2465

".EmitsChangedSignal":

2466

"false"}

2467

3392

2468

@dbus.service.signal(_interface, signature="o")

3393

2469

def ClientAdded(self, objpath):

3394

2470

"D-Bus signal"

3395

2471

pass

3396

2472

3397

2473

@dbus.service.signal(_interface, signature="ss")

3398

def ClientNotFound(self, key_id, address):

2474

def ClientNotFound(self, fingerprint, address):

3399

2475

"D-Bus signal"

3400

2476

pass

3401

3402

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3403

"true"})

2477

3404

2478

@dbus.service.signal(_interface, signature="os")

3405

2479

def ClientRemoved(self, objpath, name):

3406

2480

"D-Bus signal"

3407

2481

pass

3408

3409

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3410

"true"})

2482

3411

2483

@dbus.service.method(_interface, out_signature="ao")

3412

2484

def GetAllClients(self):

3413

2485

"D-Bus method"

3414

return dbus.Array(c.dbus_object_path for c in

3415

tcp_server.clients.values())

3416

3417

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3418

"true"})

2486

return dbus.Array(c.dbus_object_path

2487

for c in

2488

tcp_server.clients.itervalues())

2489

3419

2490

@dbus.service.method(_interface,

3420

2491

out_signature="a{oa{sv}}")

3421

2492

def GetAllClientsWithProperties(self):

3422

2493

"D-Bus method"

3423

2494

return dbus.Dictionary(

3424

{c.dbus_object_path: c.GetAll(

3425

"se.recompile.Mandos.Client")

3426

for c in tcp_server.clients.values()},

2495

((c.dbus_object_path, c.GetAll(""))

2496

for c in tcp_server.clients.itervalues()),

3427

2497

signature="oa{sv}")

3428

2498

3429

2499

@dbus.service.method(_interface, in_signature="o")

3430

2500

def RemoveClient(self, object_path):

3431

2501

"D-Bus method"

3432

for c in tcp_server.clients.values():

2502

for c in tcp_server.clients.itervalues():

3433

2503

if c.dbus_object_path == object_path:

3434

2504

del tcp_server.clients[c.name]

3435

2505

c.remove_from_connection()

3436

# Don't signal the disabling

2506

# Don't signal anything except ClientRemoved

3437

2507

c.disable(quiet=True)

3438

# Emit D-Bus signal for removal

3439

self.client_removed_signal(c)

2508

# Emit D-Bus signal

2509

self.ClientRemoved(object_path, c.name)

3440

2510

return

3441

2511

raise KeyError(object_path)

3442

2512

3443

2513

del _interface

3444

3445

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3446

out_signature="a{oa{sa{sv}}}")

3447

def GetManagedObjects(self):

3448

"""D-Bus method"""

3449

return dbus.Dictionary(

3450

{client.dbus_object_path:

3451

dbus.Dictionary(

3452

{interface: client.GetAll(interface)

3453

for interface in

3454

client._get_all_interface_names()})

3455

for client in tcp_server.clients.values()})

3456

3457

def client_added_signal(self, client):

3458

"""Send the new standard signal and the old signal"""

3459

if use_dbus:

3460

# New standard signal

3461

self.InterfacesAdded(

3462

client.dbus_object_path,

3463

dbus.Dictionary(

3464

{interface: client.GetAll(interface)

3465

for interface in

3466

client._get_all_interface_names()}))

3467

# Old signal

3468

self.ClientAdded(client.dbus_object_path)

3469

3470

def client_removed_signal(self, client):

3471

"""Send the new standard signal and the old signal"""

3472

if use_dbus:

3473

# New standard signal

3474

self.InterfacesRemoved(

3475

client.dbus_object_path,

3476

client._get_all_interface_names())

3477

# Old signal

3478

self.ClientRemoved(client.dbus_object_path,

3479

client.name)

3480

3481

mandos_dbus_service = MandosDBusService()

3482

3483

# Save modules to variables to exempt the modules from being

3484

# unloaded before the function registered with atexit() is run.

3485

mp = multiprocessing

3486

wn = wnull

3487

2514

2515

class MandosDBusServiceTransitional(MandosDBusService):

2516

__metaclass__ = AlternateDBusNamesMetaclass

2517

mandos_dbus_service = MandosDBusServiceTransitional()

2518

3488

2519

def cleanup():

3489

2520

"Cleanup function; run on exit"

3490

if zeroconf:

3491

service.cleanup()

3492

3493

mp.active_children()

3494

wn.close()

2521

service.cleanup()

2522

2523

multiprocessing.active_children()

3495

2524

if not (tcp_server.clients or client_settings):

3496

2525

return

3497

2526

3498

2527

# Store client before exiting. Secrets are encrypted with key

3499

2528

# based on what config file has. If config file is

3500

2529

# removed/edited, old secret will thus be unrecovable.

3501

2530

clients = {}

3502

2531

with PGPEngine() as pgp:

3503

for client in tcp_server.clients.values():

2532

for client in tcp_server.clients.itervalues():

3504

2533

key = client_settings[client.name]["secret"]

3505

2534

client.encrypted_secret = pgp.encrypt(client.secret,

3506

2535

key)

3507

2536

client_dict = {}

3508

2537

3509

2538

# A list of attributes that can not be pickled

3510

2539

# + secret.

3511

exclude = {"bus", "changedstate", "secret",

3512

"checker", "server_settings"}

3513

for name, typ in inspect.getmembers(dbus.service

3514

.Object):

2540

exclude = set(("bus", "changedstate", "secret",

2541

"checker"))

2542

for name, typ in (inspect.getmembers

2543

(dbus.service.Object)):

3515

2544

exclude.add(name)

3516

2545

3517

2546

client_dict["encrypted_secret"] = (client

3518

2547

.encrypted_secret)

3519

2548

for attr in client.client_structure:

3520

2549

if attr not in exclude:

3521

2550

client_dict[attr] = getattr(client, attr)

3522

2551

3523

2552

clients[client.name] = client_dict

3524

2553

del client_settings[client.name]["secret"]

3525

2554

3526

2555

try:

3527

with tempfile.NamedTemporaryFile(

3528

mode='wb',

3529

suffix=".pickle",

3530

prefix='clients-',

3531

dir=os.path.dirname(stored_state_path),

3532

delete=False) as stored_state:

3533

pickle.dump((clients, client_settings), stored_state,

3534

protocol=2)

3535

tempname = stored_state.name

2556

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2557

prefix="clients-",

2558

dir=os.path.dirname

2559

(stored_state_path))

2560

with os.fdopen(tempfd, "wb") as stored_state:

2561

pickle.dump((clients, client_settings), stored_state)

3536

2562

os.rename(tempname, stored_state_path)

3537

2563

except (IOError, OSError) as e:

2564

logger.warning("Could not save persistent state: {0}"

2565

.format(e))

3538

2566

if not debug:

3539

2567

try:

3540

2568

os.remove(tempname)

3541

2569

except NameError:

3542

2570

pass

3543

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3544

logger.warning("Could not save persistent state: {}"

3545

.format(os.strerror(e.errno)))

3546

else:

3547

logger.warning("Could not save persistent state:",

3548

exc_info=e)

3549

raise

3550

2571

if e.errno not in set((errno.ENOENT, errno.EACCES,

2572

errno.EEXIST)):

2573

raise e

2574

3551

2575

# Delete all clients, and settings from config

3552

2576

while tcp_server.clients:

3553

2577

name, client = tcp_server.clients.popitem()

3554

2578

if use_dbus:

3555

2579

client.remove_from_connection()

3556

# Don't signal the disabling

2580

# Don't signal anything except ClientRemoved

3557

2581

client.disable(quiet=True)

3558

# Emit D-Bus signal for removal

3559

2582

if use_dbus:

3560

mandos_dbus_service.client_removed_signal(client)

2583

# Emit D-Bus signal

2584

mandos_dbus_service.ClientRemoved(client

2585

.dbus_object_path,

2586

client.name)

3561

2587

client_settings.clear()

3562

2588

3563

2589

atexit.register(cleanup)

3564

3565

for client in tcp_server.clients.values():

2590

2591

for client in tcp_server.clients.itervalues():

3566

2592

if use_dbus:

3567

# Emit D-Bus signal for adding

3568

mandos_dbus_service.client_added_signal(client)

2593

# Emit D-Bus signal

2594

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3569

2595

# Need to initiate checking of clients

3570

2596

if client.enabled:

3571

2597

client.init_checker()

3572

2598

3573

2599

tcp_server.enable()

3574

2600

tcp_server.server_activate()

3575

2601

3576

2602

# Find out what port we got

3577

if zeroconf:

3578

service.port = tcp_server.socket.getsockname()[1]

2603

service.port = tcp_server.socket.getsockname()[1]

3579

2604

if use_ipv6:

3580

2605

logger.info("Now listening on address %r, port %d,"

3581

" flowinfo %d, scope_id %d",

3582

*tcp_server.socket.getsockname())

2606

" flowinfo %d, scope_id %d"

2607

% tcp_server.socket.getsockname())

3583

2608

else: # IPv4

3584

logger.info("Now listening on address %r, port %d",

3585

*tcp_server.socket.getsockname())

3586

3587

# service.interface = tcp_server.socket.getsockname()[3]

3588

2609

logger.info("Now listening on address %r, port %d"

2610

% tcp_server.socket.getsockname())

2611

2612

#service.interface = tcp_server.socket.getsockname()[3]

2613

3589

2614

try:

3590

if zeroconf:

3591

# From the Avahi example code

3592

try:

3593

service.activate()

3594

except dbus.exceptions.DBusException as error:

3595

logger.critical("D-Bus Exception", exc_info=error)

3596

cleanup()

3597

sys.exit(1)

3598

# End of Avahi example code

3599

3600

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3601

lambda *args, **kwargs:

3602

(tcp_server.handle_request

3603

(*args[2:], **kwargs) or True))

3604

2615

# From the Avahi example code

2616

try:

2617

service.activate()

2618

except dbus.exceptions.DBusException as error:

2619

logger.critical("DBusException: %s", error)

2620

cleanup()

2621

sys.exit(1)

2622

# End of Avahi example code

2623

2624

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2625

lambda *args, **kwargs:

2626

(tcp_server.handle_request

2627

(*args[2:], **kwargs) or True))

2628

3605

2629

logger.debug("Starting main loop")

3606

2630

main_loop.run()

3607

2631

except AvahiError as error:

3608

logger.critical("Avahi Error", exc_info=error)

2632

logger.critical("AvahiError: %s", error)

3609

2633

cleanup()

3610

2634

sys.exit(1)

3611

2635

except KeyboardInterrupt:

3616

2640

# Must run before the D-Bus bus name gets deregistered

3617

2641

cleanup()

3618

2642

3619

3620

2643

if __name__ == '__main__':

3621

2644

main()