/mandos/release : revision 237.7.129

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

39

import SocketServer as socketserver

43

40

import socket

44

41

import argparse

45

42

import datetime

50

47

import gnutls.library.functions

51

48

import gnutls.library.constants

52

49

import gnutls.library.types

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

50

import ConfigParser as configparser

57

51

import sys

58

52

import re

59

53

import os

68

62

import struct

69

63

import fcntl

70

64

import functools

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

65

import cPickle as pickle

75

66

import multiprocessing

76

67

import types

77

68

import binascii

78

69

import tempfile

79

70

import itertools

80

import collections

81

import codecs

82

71

83

72

import dbus

84

73

import dbus.service

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

74

import gobject

89

75

import avahi

90

76

from dbus.mainloop.glib import DBusGMainLoop

91

77

import ctypes

92

78

import ctypes.util

93

79

import xml.dom.minidom

94

80

import inspect

81

import GnuPGInterface

95

82

96

83

try:

97

84

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

101

88

except ImportError:

102

89

SO_BINDTODEVICE = None

103

90

104

if sys.version_info.major == 2:

105

str = unicode

106

107

version = "1.6.9"

91

version = "1.5.3"

108

92

stored_state_file = "clients.pickle"

109

93

110

94

logger = logging.getLogger()

111

syslogger = None

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

112

98

113

99

try:

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

116

103

except (OSError, AttributeError):

117

118

104

def if_nametoindex(interface):

119

105

"Get an interface index the hard way, i.e. using fcntl()"

120

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

121

107

with contextlib.closing(socket.socket()) as s:

122

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

123

struct.pack(b"16s16x", interface))

124

interface_index = struct.unpack("I", ifreq[16:20])[0]

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

125

113

return interface_index

126

114

127

115

128

116

def initlogger(debug, level=logging.WARNING):

129

117

"""init logger and add loglevel"""

130

118

131

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

135

119

syslogger.setFormatter(logging.Formatter

136

120

('Mandos [%(process)d]: %(levelname)s:'

137

121

' %(message)s'))

154

138

155

139

class PGPEngine(object):

156

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

158

141

def __init__(self):

142

self.gnupg = GnuPGInterface.GnuPG()

159

143

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

160

self.gnupgargs = ['--batch',

161

'--home', self.tempdir,

162

'--force-mdc',

163

'--quiet',

164

'--no-use-agent']

144

self.gnupg = GnuPGInterface.GnuPG()

145

self.gnupg.options.meta_interactive = False

146

self.gnupg.options.homedir = self.tempdir

147

self.gnupg.options.extra_args.extend(['--force-mdc',

148

'--quiet',

149

'--no-use-agent'])

165

150

166

151

def __enter__(self):

167

152

return self

168

153

169

def __exit__(self, exc_type, exc_value, traceback):

154

def __exit__ (self, exc_type, exc_value, traceback):

170

155

self._cleanup()

171

156

return False

172

157

189

174

def password_encode(self, password):

190

175

# Passphrase can not be empty and can not contain newlines or

191

176

# NUL bytes. So we prefix it and hex encode it.

192

encoded = b"mandos" + binascii.hexlify(password)

193

if len(encoded) > 2048:

194

# GnuPG can't handle long passwords, so encode differently

195

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

196

.replace(b"\n", b"\\n")

197

.replace(b"\0", b"\\x00"))

198

return encoded

177

return b"mandos" + binascii.hexlify(password)

199

178

200

179

def encrypt(self, data, password):

201

passphrase = self.password_encode(password)

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

204

passfile.write(passphrase)

205

passfile.flush()

206

proc = subprocess.Popen(['gpg', '--symmetric',

207

'--passphrase-file',

208

passfile.name]

209

+ self.gnupgargs,

210

stdin = subprocess.PIPE,

211

stdout = subprocess.PIPE,

212

stderr = subprocess.PIPE)

213

ciphertext, err = proc.communicate(input = data)

214

if proc.returncode != 0:

215

raise PGPError(err)

180

self.gnupg.passphrase = self.password_encode(password)

181

with open(os.devnull, "w") as devnull:

182

try:

183

proc = self.gnupg.run(['--symmetric'],

184

create_fhs=['stdin', 'stdout'],

185

attach_fhs={'stderr': devnull})

186

with contextlib.closing(proc.handles['stdin']) as f:

187

f.write(data)

188

with contextlib.closing(proc.handles['stdout']) as f:

189

ciphertext = f.read()

190

proc.wait()

191

except IOError as e:

192

raise PGPError(e)

193

self.gnupg.passphrase = None

216

194

return ciphertext

217

195

218

196

def decrypt(self, data, password):

219

passphrase = self.password_encode(password)

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

222

passfile.write(passphrase)

223

passfile.flush()

224

proc = subprocess.Popen(['gpg', '--decrypt',

225

'--passphrase-file',

226

passfile.name]

227

+ self.gnupgargs,

228

stdin = subprocess.PIPE,

229

stdout = subprocess.PIPE,

230

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

232

if proc.returncode != 0:

233

raise PGPError(err)

197

self.gnupg.passphrase = self.password_encode(password)

198

with open(os.devnull, "w") as devnull:

199

try:

200

proc = self.gnupg.run(['--decrypt'],

201

create_fhs=['stdin', 'stdout'],

202

attach_fhs={'stderr': devnull})

203

with contextlib.closing(proc.handles['stdin']) as f:

204

f.write(data)

205

with contextlib.closing(proc.handles['stdout']) as f:

206

decrypted_plaintext = f.read()

207

proc.wait()

208

except IOError as e:

209

raise PGPError(e)

210

self.gnupg.passphrase = None

234

211

return decrypted_plaintext

235

212

236

213

237

214

class AvahiError(Exception):

238

215

def __init__(self, value, *args, **kwargs):

239

216

self.value = value

240

return super(AvahiError, self).__init__(value, *args,

241

**kwargs)

242

217

super(AvahiError, self).__init__(value, *args, **kwargs)

218

def __unicode__(self):

219

return unicode(repr(self.value))

243

220

244

221

class AvahiServiceError(AvahiError):

245

222

pass

246

223

247

248

224

class AvahiGroupError(AvahiError):

249

225

pass

250

226

257

233

Used to optionally bind to the specified interface.

258

234

name: string; Example: 'Mandos'

259

235

type: string; Example: '_mandos._tcp'.

260

See <https://www.iana.org/assignments/service-names-port-numbers>

236

See <http://www.dns-sd.org/ServiceTypes.html>

261

237

port: integer; what port to announce

262

238

TXT: list of strings; TXT record for the service

263

239

domain: string; Domain to publish on, default to .local if empty.

270

246

bus: dbus.SystemBus()

271

247

"""

272

248

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

249

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

250

servicetype = None, port = None, TXT = None,

251

domain = "", host = "", max_renames = 32768,

252

protocol = avahi.PROTO_UNSPEC, bus = None):

284

253

self.interface = interface

285

254

self.name = name

286

255

self.type = servicetype

296

265

self.bus = bus

297

266

self.entry_group_state_changed_match = None

298

267

299

def rename(self, remove=True):

268

def rename(self):

300

269

"""Derived from the Avahi example code"""

301

270

if self.rename_count >= self.max_renames:

302

271

logger.critical("No suitable Zeroconf service name found"

303

272

" after %i retries, exiting.",

304

273

self.rename_count)

305

274

raise AvahiServiceError("Too many renames")

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

275

self.name = unicode(self.server

276

.GetAlternativeServiceName(self.name))

309

277

logger.info("Changing Zeroconf service name to %r ...",

310

278

self.name)

311

if remove:

312

self.remove()

279

self.remove()

313

280

try:

314

281

self.add()

315

282

except dbus.exceptions.DBusException as error:

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

283

logger.critical("D-Bus Exception", exc_info=error)

284

self.cleanup()

285

os._exit(1)

286

self.rename_count += 1

324

287

325

288

def remove(self):

326

289

"""Derived from the Avahi example code"""

364

327

self.rename()

365

328

elif state == avahi.ENTRY_GROUP_FAILURE:

366

329

logger.critical("Avahi: Error in group state changed %s",

367

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

330

unicode(error))

331

raise AvahiGroupError("State changed: {0!s}"

332

.format(error))

369

333

370

334

def cleanup(self):

371

335

"""Derived from the Avahi example code"""

381

345

def server_state_changed(self, state, error=None):

382

346

"""Derived from the Avahi example code"""

383

347

logger.debug("Avahi server state change: %i", state)

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

348

bad_states = { avahi.SERVER_INVALID:

349

"Zeroconf server invalid",

350

avahi.SERVER_REGISTERING: None,

351

avahi.SERVER_COLLISION:

352

"Zeroconf server name collision",

353

avahi.SERVER_FAILURE:

354

"Zeroconf server failure" }

390

355

if state in bad_states:

391

356

if bad_states[state] is not None:

392

357

if error is None:

411

376

follow_name_owner_changes=True),

412

377

avahi.DBUS_INTERFACE_SERVER)

413

378

self.server.connect_to_signal("StateChanged",

414

self.server_state_changed)

379

self.server_state_changed)

415

380

self.server_state_changed(self.server.GetState())

416

381

417

418

382

class AvahiServiceToSyslog(AvahiService):

419

def rename(self, *args, **kwargs):

383

def rename(self):

420

384

"""Add the new name to the syslog messages"""

421

ret = AvahiService.rename(self, *args, **kwargs)

422

syslogger.setFormatter(logging.Formatter(

423

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

424

.format(self.name)))

385

ret = AvahiService.rename(self)

386

syslogger.setFormatter(logging.Formatter

387

('Mandos ({0}) [%(process)d]:'

388

' %(levelname)s: %(message)s'

389

.format(self.name)))

425

390

return ret

426

391

427

def call_pipe(connection, # : multiprocessing.Connection

428

func, *args, **kwargs):

429

"""This function is meant to be called by multiprocessing.Process

430

431

This function runs func(*args, **kwargs), and writes the resulting

432

return value on the provided multiprocessing.Connection.

433

"""

434

connection.send(func(*args, **kwargs))

435

connection.close()

392

def timedelta_to_milliseconds(td):

393

"Convert a datetime.timedelta() to milliseconds"

394

return ((td.days * 24 * 60 * 60 * 1000)

395

+ (td.seconds * 1000)

396

+ (td.microseconds // 1000))

436

397

437

398

class Client(object):

438

399

"""A representation of a client host served by this server.

465

426

last_checker_status: integer between 0 and 255 reflecting exit

466

427

status of last checker. -1 reflects crashed

467

428

checker, -2 means no checker completed yet.

468

last_checker_signal: The signal which killed the last checker, if

469

last_checker_status is -1

470

429

last_enabled: datetime.datetime(); (UTC) or None

471

430

name: string; from the config file, used in log messages and

472

431

D-Bus identifiers

477

436

runtime_expansions: Allowed attributes for runtime expansion.

478

437

expires: datetime.datetime(); time (UTC) when a client will be

479

438

disabled, or None

480

server_settings: The server_settings dict from main()

481

439

"""

482

440

483

441

runtime_expansions = ("approval_delay", "approval_duration",

484

"created", "enabled", "expires",

485

"fingerprint", "host", "interval",

486

"last_approval_request", "last_checked_ok",

442

"created", "enabled", "fingerprint",

443

"host", "interval", "last_checked_ok",

487

444

"last_enabled", "name", "timeout")

488

client_defaults = {

489

"timeout": "PT5M",

490

"extended_timeout": "PT15M",

491

"interval": "PT2M",

492

"checker": "fping -q -- %%(host)s",

493

"host": "",

494

"approval_delay": "PT0S",

495

"approval_duration": "PT1S",

496

"approved_by_default": "True",

497

"enabled": "True",

498

}

445

client_defaults = { "timeout": "5m",

446

"extended_timeout": "15m",

447

"interval": "2m",

448

"checker": "fping -q -- %%(host)s",

449

"host": "",

450

"approval_delay": "0s",

451

"approval_duration": "1s",

452

"approved_by_default": "True",

453

"enabled": "True",

454

}

455

456

def timeout_milliseconds(self):

457

"Return the 'timeout' attribute in milliseconds"

458

return timedelta_to_milliseconds(self.timeout)

459

460

def extended_timeout_milliseconds(self):

461

"Return the 'extended_timeout' attribute in milliseconds"

462

return timedelta_to_milliseconds(self.extended_timeout)

463

464

def interval_milliseconds(self):

465

"Return the 'interval' attribute in milliseconds"

466

return timedelta_to_milliseconds(self.interval)

467

468

def approval_delay_milliseconds(self):

469

return timedelta_to_milliseconds(self.approval_delay)

499

470

500

471

@staticmethod

501

472

def config_parser(config):

517

488

client["enabled"] = config.getboolean(client_name,

518

489

"enabled")

519

490

520

# Uppercase and remove spaces from fingerprint for later

521

# comparison purposes with return value from the

522

# fingerprint() function

523

491

client["fingerprint"] = (section["fingerprint"].upper()

524

492

.replace(" ", ""))

525

493

if "secret" in section:

530

498

"rb") as secfile:

531

499

client["secret"] = secfile.read()

532

500

else:

533

raise TypeError("No secret or secfile for section {}"

501

raise TypeError("No secret or secfile for section {0}"

534

502

.format(section))

535

503

client["timeout"] = string_to_delta(section["timeout"])

536

504

client["extended_timeout"] = string_to_delta(

547

515

548

516

return settings

549

517

550

def __init__(self, settings, name = None, server_settings=None):

518

def __init__(self, settings, name = None):

551

519

self.name = name

552

if server_settings is None:

553

server_settings = {}

554

self.server_settings = server_settings

555

520

# adding all client settings

556

for setting, value in settings.items():

521

for setting, value in settings.iteritems():

557

522

setattr(self, setting, value)

558

523

559

524

if self.enabled:

567

532

self.expires = None

568

533

569

534

logger.debug("Creating client %r", self.name)

535

# Uppercase and remove spaces from fingerprint for later

536

# comparison purposes with return value from the fingerprint()

537

# function

570

538

logger.debug(" Fingerprint: %s", self.fingerprint)

571

539

self.created = settings.get("created",

572

540

datetime.datetime.utcnow())

579

547

self.current_checker_command = None

580

548

self.approved = None

581

549

self.approvals_pending = 0

582

self.changedstate = multiprocessing_manager.Condition(

583

multiprocessing_manager.Lock())

584

self.client_structure = [attr

585

for attr in self.__dict__.iterkeys()

550

self.changedstate = (multiprocessing_manager

551

.Condition(multiprocessing_manager

552

.Lock()))

553

self.client_structure = [attr for attr in

554

self.__dict__.iterkeys()

586

555

if not attr.startswith("_")]

587

556

self.client_structure.append("client_structure")

588

557

589

for name, t in inspect.getmembers(

590

type(self), lambda obj: isinstance(obj, property)):

558

for name, t in inspect.getmembers(type(self),

559

lambda obj:

560

isinstance(obj,

561

property)):

591

562

if not name.startswith("_"):

592

563

self.client_structure.append(name)

593

564

635

606

# and every interval from then on.

636

607

if self.checker_initiator_tag is not None:

637

608

gobject.source_remove(self.checker_initiator_tag)

638

self.checker_initiator_tag = gobject.timeout_add(

639

int(self.interval.total_seconds() * 1000),

640

self.start_checker)

609

self.checker_initiator_tag = (gobject.timeout_add

610

(self.interval_milliseconds(),

611

self.start_checker))

641

612

# Schedule a disable() when 'timeout' has passed

642

613

if self.disable_initiator_tag is not None:

643

614

gobject.source_remove(self.disable_initiator_tag)

644

self.disable_initiator_tag = gobject.timeout_add(

645

int(self.timeout.total_seconds() * 1000), self.disable)

615

self.disable_initiator_tag = (gobject.timeout_add

616

(self.timeout_milliseconds(),

617

self.disable))

646

618

# Also start a new checker *right now*.

647

619

self.start_checker()

648

620

649

def checker_callback(self, source, condition, connection,

650

command):

621

def checker_callback(self, pid, condition, command):

651

622

"""The checker has completed, so take appropriate actions."""

652

623

self.checker_callback_tag = None

653

624

self.checker = None

654

# Read return code from connection (see call_pipe)

655

returncode = connection.recv()

656

connection.close()

657

658

if returncode >= 0:

659

self.last_checker_status = returncode

660

self.last_checker_signal = None

625

if os.WIFEXITED(condition):

626

self.last_checker_status = os.WEXITSTATUS(condition)

661

627

if self.last_checker_status == 0:

662

628

logger.info("Checker for %(name)s succeeded",

663

629

vars(self))

664

630

self.checked_ok()

665

631

else:

666

logger.info("Checker for %(name)s failed", vars(self))

632

logger.info("Checker for %(name)s failed",

633

vars(self))

667

634

else:

668

635

self.last_checker_status = -1

669

self.last_checker_signal = -returncode

670

636

logger.warning("Checker for %(name)s crashed?",

671

637

vars(self))

672

return False

673

638

674

639

def checked_ok(self):

675

640

"""Assert that the client has been seen, alive and well."""

676

641

self.last_checked_ok = datetime.datetime.utcnow()

677

642

self.last_checker_status = 0

678

self.last_checker_signal = None

679

643

self.bump_timeout()

680

644

681

645

def bump_timeout(self, timeout=None):

686

650

gobject.source_remove(self.disable_initiator_tag)

687

651

self.disable_initiator_tag = None

688

652

if getattr(self, "enabled", False):

689

self.disable_initiator_tag = gobject.timeout_add(

690

int(timeout.total_seconds() * 1000), self.disable)

653

self.disable_initiator_tag = (gobject.timeout_add

654

(timedelta_to_milliseconds

655

(timeout), self.disable))

691

656

self.expires = datetime.datetime.utcnow() + timeout

692

657

693

658

def need_approval(self):

707

672

# than 'timeout' for the client to be disabled, which is as it

708

673

# should be.

709

674

710

if self.checker is not None and not self.checker.is_alive():

711

logger.warning("Checker was not alive; joining")

712

self.checker.join()

713

self.checker = None

675

# If a checker exists, make sure it is not a zombie

676

try:

677

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

678

except (AttributeError, OSError) as error:

679

if (isinstance(error, OSError)

680

and error.errno != errno.ECHILD):

681

raise error

682

else:

683

if pid:

684

logger.warning("Checker was a zombie")

685

gobject.source_remove(self.checker_callback_tag)

686

self.checker_callback(pid, status,

687

self.current_checker_command)

714

688

# Start a new checker if needed

715

689

if self.checker is None:

716

# Escape attributes for the shell

717

escaped_attrs = {

718

attr: re.escape(str(getattr(self, attr)))

719

for attr in self.runtime_expansions }

720

try:

721

command = self.checker_command % escaped_attrs

722

except TypeError as error:

723

logger.error('Could not format string "%s"',

724

self.checker_command,

690

try:

691

# In case checker_command has exactly one % operator

692

command = self.checker_command % self.host

693

except TypeError:

694

# Escape attributes for the shell

695

escaped_attrs = dict(

696

(attr,

697

re.escape(unicode(str(getattr(self, attr, "")),

698

errors=

699

'replace')))

700

for attr in

701

self.runtime_expansions)

702

703

try:

704

command = self.checker_command % escaped_attrs

705

except TypeError as error:

706

logger.error('Could not format string "%s"',

707

self.checker_command, exc_info=error)

708

return True # Try again later

709

self.current_checker_command = command

710

try:

711

logger.info("Starting checker %r for %s",

712

command, self.name)

713

# We don't need to redirect stdout and stderr, since

714

# in normal mode, that is already done by daemon(),

715

# and in debug mode we don't want to. (Stdin is

716

# always replaced by /dev/null.)

717

self.checker = subprocess.Popen(command,

718

close_fds=True,

719

shell=True, cwd="/")

720

self.checker_callback_tag = (gobject.child_watch_add

721

(self.checker.pid,

722

self.checker_callback,

723

data=command))

724

# The checker may have completed before the gobject

725

# watch was added. Check for this.

726

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

727

if pid:

728

gobject.source_remove(self.checker_callback_tag)

729

self.checker_callback(pid, status, command)

730

except OSError as error:

731

logger.error("Failed to start subprocess",

725

732

exc_info=error)

726

return True # Try again later

727

self.current_checker_command = command

728

logger.info("Starting checker %r for %s", command,

729

self.name)

730

# We don't need to redirect stdout and stderr, since

731

# in normal mode, that is already done by daemon(),

732

# and in debug mode we don't want to. (Stdin is

733

# always replaced by /dev/null.)

734

# The exception is when not debugging but nevertheless

735

# running in the foreground; use the previously

736

# created wnull.

737

popen_args = { "close_fds": True,

738

"shell": True,

739

"cwd": "/" }

740

if (not self.server_settings["debug"]

741

and self.server_settings["foreground"]):

742

popen_args.update({"stdout": wnull,

743

"stderr": wnull })

744

pipe = multiprocessing.Pipe(duplex = False)

745

self.checker = multiprocessing.Process(

746

target = call_pipe,

747

args = (pipe[1], subprocess.call, command),

748

kwargs = popen_args)

749

self.checker.start()

750

self.checker_callback_tag = gobject.io_add_watch(

751

pipe[0].fileno(), gobject.IO_IN,

752

self.checker_callback, pipe[0], command)

753

733

# Re-run this periodically if run by gobject.timeout_add

754

734

return True

755

735

761

741

if getattr(self, "checker", None) is None:

762

742

return

763

743

logger.debug("Stopping checker for %(name)s", vars(self))

764

self.checker.terminate()

744

try:

745

self.checker.terminate()

746

#time.sleep(0.5)

747

#if self.checker.poll() is None:

748

# self.checker.kill()

749

except OSError as error:

750

if error.errno != errno.ESRCH: # No such process

751

raise

765

752

self.checker = None

766

753

767

754

768

def dbus_service_property(dbus_interface,

769

signature="v",

770

access="readwrite",

771

byte_arrays=False):

755

def dbus_service_property(dbus_interface, signature="v",

756

access="readwrite", byte_arrays=False):

772

757

"""Decorators for marking methods of a DBusObjectWithProperties to

773

758

become properties on the D-Bus.

774

759

783

768

# "Set" method, so we fail early here:

784

769

if byte_arrays and signature != "ay":

785

770

raise ValueError("Byte arrays not supported for non-'ay'"

786

" signature {!r}".format(signature))

787

771

" signature {0!r}".format(signature))

788

772

def decorator(func):

789

773

func._dbus_is_property = True

790

774

func._dbus_interface = dbus_interface

795

779

func._dbus_name = func._dbus_name[:-14]

796

780

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

797

781

return func

798

799

782

return decorator

800

783

801

784

810

793

"org.freedesktop.DBus.Property.EmitsChangedSignal":

811

794

"false"}

812

795

"""

813

814

796

def decorator(func):

815

797

func._dbus_is_interface = True

816

798

func._dbus_interface = dbus_interface

817

799

func._dbus_name = dbus_interface

818

800

return func

819

820

801

return decorator

821

802

822

803

824

805

"""Decorator to annotate D-Bus methods, signals or properties

825

806

Usage:

826

807

827

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

828

"org.freedesktop.DBus.Property."

829

"EmitsChangedSignal": "false"})

830

808

@dbus_service_property("org.example.Interface", signature="b",

831

809

access="r")

810

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

811

"org.freedesktop.DBus.Property."

812

"EmitsChangedSignal": "false"})

832

813

def Property_dbus_property(self):

833

814

return dbus.Boolean(False)

834

815

"""

835

836

816

def decorator(func):

837

817

func._dbus_annotations = annotations

838

818

return func

839

840

819

return decorator

841

820

842

821

843

822

class DBusPropertyException(dbus.exceptions.DBusException):

844

823

"""A base class for D-Bus property-related exceptions

845

824

"""

846

pass

825

def __unicode__(self):

826

return unicode(str(self))

847

827

848

828

849

829

class DBusPropertyAccessException(DBusPropertyException):

873

853

If called like _is_dbus_thing("method") it returns a function

874

854

suitable for use as predicate to inspect.getmembers().

875

855

"""

876

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

856

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

877

857

False)

878

858

879

859

def _get_all_dbus_things(self, thing):

880

860

"""Returns a generator of (name, attribute) pairs

881

861

"""

882

return ((getattr(athing.__get__(self), "_dbus_name", name),

862

return ((getattr(athing.__get__(self), "_dbus_name",

863

name),

883

864

athing.__get__(self))

884

865

for cls in self.__class__.__mro__

885

866

for name, athing in

886

inspect.getmembers(cls, self._is_dbus_thing(thing)))

867

inspect.getmembers(cls,

868

self._is_dbus_thing(thing)))

887

869

888

870

def _get_dbus_property(self, interface_name, property_name):

889

871

"""Returns a bound method if one exists which is a D-Bus

890

872

property with the specified name and interface.

891

873

"""

892

for cls in self.__class__.__mro__:

893

for name, value in inspect.getmembers(

894

cls, self._is_dbus_thing("property")):

874

for cls in self.__class__.__mro__:

875

for name, value in (inspect.getmembers

876

(cls,

877

self._is_dbus_thing("property"))):

895

878

if (value._dbus_name == property_name

896

879

and value._dbus_interface == interface_name):

897

880

return value.__get__(self)

898

881

899

882

# No such property

900

raise DBusPropertyNotFound("{}:{}.{}".format(

901

self.dbus_object_path, interface_name, property_name))

883

raise DBusPropertyNotFound(self.dbus_object_path + ":"

884

+ interface_name + "."

885

+ property_name)

902

886

903

@dbus.service.method(dbus.PROPERTIES_IFACE,

904

in_signature="ss",

887

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

905

888

out_signature="v")

906

889

def Get(self, interface_name, property_name):

907

890

"""Standard D-Bus property Get() method, see D-Bus standard.

925

908

# The byte_arrays option is not supported yet on

926

909

# signatures other than "ay".

927

910

if prop._dbus_signature != "ay":

928

raise ValueError("Byte arrays not supported for non-"

929

"'ay' signature {!r}"

930

.format(prop._dbus_signature))

911

raise ValueError

931

912

value = dbus.ByteArray(b''.join(chr(byte)

932

913

for byte in value))

933

914

prop(value)

934

915

935

@dbus.service.method(dbus.PROPERTIES_IFACE,

936

in_signature="s",

916

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

937

917

out_signature="a{sv}")

938

918

def GetAll(self, interface_name):

939

919

"""Standard D-Bus property GetAll() method, see D-Bus

954

934

if not hasattr(value, "variant_level"):

955

935

properties[name] = value

956

936

continue

957

properties[name] = type(value)(

958

value, variant_level = value.variant_level + 1)

937

properties[name] = type(value)(value, variant_level=

938

value.variant_level+1)

959

939

return dbus.Dictionary(properties, signature="sv")

960

940

961

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

962

def PropertiesChanged(self, interface_name, changed_properties,

963

invalidated_properties):

964

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

965

standard.

966

"""

967

pass

968

969

941

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

970

942

out_signature="s",

971

943

path_keyword='object_path',

979

951

connection)

980

952

try:

981

953

document = xml.dom.minidom.parseString(xmlstring)

982

983

954

def make_tag(document, name, prop):

984

955

e = document.createElement("property")

985

956

e.setAttribute("name", name)

986

957

e.setAttribute("type", prop._dbus_signature)

987

958

e.setAttribute("access", prop._dbus_access)

988

959

return e

989

990

960

for if_tag in document.getElementsByTagName("interface"):

991

961

# Add property tags

992

962

for tag in (make_tag(document, name, prop)

1004

974

if (name == tag.getAttribute("name")

1005

975

and prop._dbus_interface

1006

976

== if_tag.getAttribute("name")):

1007

annots.update(getattr(

1008

prop, "_dbus_annotations", {}))

1009

for name, value in annots.items():

977

annots.update(getattr

978

(prop,

979

"_dbus_annotations",

980

{}))

981

for name, value in annots.iteritems():

1010

982

ann_tag = document.createElement(

1011

983

"annotation")

1012

984

ann_tag.setAttribute("name", name)

1015

987

# Add interface annotation tags

1016

988

for annotation, value in dict(

1017

989

itertools.chain.from_iterable(

1018

annotations().items()

1019

for name, annotations

1020

in self._get_all_dbus_things("interface")

990

annotations().iteritems()

991

for name, annotations in

992

self._get_all_dbus_things("interface")

1021

993

if name == if_tag.getAttribute("name")

1022

)).items():

994

)).iteritems():

1023

995

ann_tag = document.createElement("annotation")

1024

996

ann_tag.setAttribute("name", annotation)

1025

997

ann_tag.setAttribute("value", value)

1048

1020

return xmlstring

1049

1021

1050

1022

1051

def datetime_to_dbus(dt, variant_level=0):

1023

def datetime_to_dbus (dt, variant_level=0):

1052

1024

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1053

1025

if dt is None:

1054

1026

return dbus.String("", variant_level = variant_level)

1055

return dbus.String(dt.isoformat(), variant_level=variant_level)

1027

return dbus.String(dt.isoformat(),

1028

variant_level=variant_level)

1056

1029

1057

1030

1058

1031

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1061

1034

interface names according to the "alt_interface_names" mapping.

1062

1035

Usage:

1063

1036

1064

@alternate_dbus_interfaces({"org.example.Interface":

1065

"net.example.AlternateInterface"})

1037

@alternate_dbus_names({"org.example.Interface":

1038

"net.example.AlternateInterface"})

1066

1039

class SampleDBusObject(dbus.service.Object):

1067

1040

@dbus.service.method("org.example.Interface")

1068

1041

def SampleDBusMethod():

1078

1051

(from DBusObjectWithProperties) and interfaces (from the

1079

1052

dbus_interface_annotations decorator).

1080

1053

"""

1081

1082

1054

def wrapper(cls):

1083

1055

for orig_interface_name, alt_interface_name in (

1084

alt_interface_names.items()):

1056

alt_interface_names.iteritems()):

1085

1057

attr = {}

1086

1058

interface_names = set()

1087

1059

# Go though all attributes of the class

1089

1061

# Ignore non-D-Bus attributes, and D-Bus attributes

1090

1062

# with the wrong interface name

1091

1063

if (not hasattr(attribute, "_dbus_interface")

1092

or not attribute._dbus_interface.startswith(

1093

orig_interface_name)):

1064

or not attribute._dbus_interface

1065

.startswith(orig_interface_name)):

1094

1066

continue

1095

1067

# Create an alternate D-Bus interface name based on

1096

1068

# the current name

1097

alt_interface = attribute._dbus_interface.replace(

1098

orig_interface_name, alt_interface_name)

1069

alt_interface = (attribute._dbus_interface

1070

.replace(orig_interface_name,

1071

alt_interface_name))

1099

1072

interface_names.add(alt_interface)

1100

1073

# Is this a D-Bus signal?

1101

1074

if getattr(attribute, "_dbus_is_signal", False):

1102

if sys.version_info.major == 2:

1103

# Extract the original non-method undecorated

1104

# function by black magic

1105

nonmethod_func = (dict(

1075

# Extract the original non-method function by

1076

# black magic

1077

nonmethod_func = (dict(

1106

1078

zip(attribute.func_code.co_freevars,

1107

attribute.__closure__))

1108

["func"].cell_contents)

1109

else:

1110

nonmethod_func = attribute

1079

attribute.__closure__))["func"]

1080

.cell_contents)

1111

1081

# Create a new, but exactly alike, function

1112

1082

# object, and decorate it to be a new D-Bus signal

1113

1083

# with the alternate D-Bus interface name

1114

if sys.version_info.major == 2:

1115

new_function = types.FunctionType(

1116

nonmethod_func.func_code,

1117

nonmethod_func.func_globals,

1118

nonmethod_func.func_name,

1119

nonmethod_func.func_defaults,

1120

nonmethod_func.func_closure)

1121

else:

1122

new_function = types.FunctionType(

1123

nonmethod_func.__code__,

1124

nonmethod_func.__globals__,

1125

nonmethod_func.__name__,

1126

nonmethod_func.__defaults__,

1127

nonmethod_func.__closure__)

1128

new_function = (dbus.service.signal(

1129

alt_interface,

1130

attribute._dbus_signature)(new_function))

1084

new_function = (dbus.service.signal

1085

(alt_interface,

1086

attribute._dbus_signature)

1087

(types.FunctionType(

1088

nonmethod_func.func_code,

1089

nonmethod_func.func_globals,

1090

nonmethod_func.func_name,

1091

nonmethod_func.func_defaults,

1092

nonmethod_func.func_closure)))

1131

1093

# Copy annotations, if any

1132

1094

try:

1133

new_function._dbus_annotations = dict(

1134

attribute._dbus_annotations)

1095

new_function._dbus_annotations = (

1096

dict(attribute._dbus_annotations))

1135

1097

except AttributeError:

1136

1098

pass

1137

1099

# Define a creator of a function to call both the

1142

1104

"""This function is a scope container to pass

1143

1105

func1 and func2 to the "call_both" function

1144

1106

outside of its arguments"""

1145

1146

1107

def call_both(*args, **kwargs):

1147

1108

"""This function will emit two D-Bus

1148

1109

signals by calling func1 and func2"""

1149

1110

func1(*args, **kwargs)

1150

1111

func2(*args, **kwargs)

1151

1152

1112

return call_both

1153

1113

# Create the "call_both" function and add it to

1154

1114

# the class

1159

1119

# object. Decorate it to be a new D-Bus method

1160

1120

# with the alternate D-Bus interface name. Add it

1161

1121

# to the class.

1162

attr[attrname] = (

1163

dbus.service.method(

1164

alt_interface,

1165

attribute._dbus_in_signature,

1166

attribute._dbus_out_signature)

1167

(types.FunctionType(attribute.func_code,

1168

attribute.func_globals,

1169

attribute.func_name,

1170

attribute.func_defaults,

1171

attribute.func_closure)))

1122

attr[attrname] = (dbus.service.method

1123

(alt_interface,

1124

attribute._dbus_in_signature,

1125

attribute._dbus_out_signature)

1126

(types.FunctionType

1127

(attribute.func_code,

1128

attribute.func_globals,

1129

attribute.func_name,

1130

attribute.func_defaults,

1131

attribute.func_closure)))

1172

1132

# Copy annotations, if any

1173

1133

try:

1174

attr[attrname]._dbus_annotations = dict(

1175

attribute._dbus_annotations)

1134

attr[attrname]._dbus_annotations = (

1135

dict(attribute._dbus_annotations))

1176

1136

except AttributeError:

1177

1137

pass

1178

1138

# Is this a D-Bus property?

1181

1141

# object, and decorate it to be a new D-Bus

1182

1142

# property with the alternate D-Bus interface

1183

1143

# name. Add it to the class.

1184

attr[attrname] = (dbus_service_property(

1185

alt_interface, attribute._dbus_signature,

1186

attribute._dbus_access,

1187

attribute._dbus_get_args_options

1188

["byte_arrays"])

1189

(types.FunctionType(

1190

attribute.func_code,

1191

attribute.func_globals,

1192

attribute.func_name,

1193

attribute.func_defaults,

1194

attribute.func_closure)))

1144

attr[attrname] = (dbus_service_property

1145

(alt_interface,

1146

attribute._dbus_signature,

1147

attribute._dbus_access,

1148

attribute

1149

._dbus_get_args_options

1150

["byte_arrays"])

1151

(types.FunctionType

1152

(attribute.func_code,

1153

attribute.func_globals,

1154

attribute.func_name,

1155

attribute.func_defaults,

1156

attribute.func_closure)))

1195

1157

# Copy annotations, if any

1196

1158

try:

1197

attr[attrname]._dbus_annotations = dict(

1198

attribute._dbus_annotations)

1159

attr[attrname]._dbus_annotations = (

1160

dict(attribute._dbus_annotations))

1199

1161

except AttributeError:

1200

1162

pass

1201

1163

# Is this a D-Bus interface?

1204

1166

# object. Decorate it to be a new D-Bus interface

1205

1167

# with the alternate D-Bus interface name. Add it

1206

1168

# to the class.

1207

attr[attrname] = (

1208

dbus_interface_annotations(alt_interface)

1209

(types.FunctionType(attribute.func_code,

1210

attribute.func_globals,

1211

attribute.func_name,

1212

attribute.func_defaults,

1213

attribute.func_closure)))

1169

attr[attrname] = (dbus_interface_annotations

1170

(alt_interface)

1171

(types.FunctionType

1172

(attribute.func_code,

1173

attribute.func_globals,

1174

attribute.func_name,

1175

attribute.func_defaults,

1176

attribute.func_closure)))

1214

1177

if deprecate:

1215

1178

# Deprecate all alternate interfaces

1216

iname="_AlternateDBusNames_interface_annotation{}"

1179

iname="_AlternateDBusNames_interface_annotation{0}"

1217

1180

for interface_name in interface_names:

1218

1219

1181

@dbus_interface_annotations(interface_name)

1220

1182

def func(self):

1221

1183

return { "org.freedesktop.DBus.Deprecated":

1222

"true" }

1184

"true" }

1223

1185

# Find an unused name

1224

1186

for aname in (iname.format(i)

1225

1187

for i in itertools.count()):

1229

1191

if interface_names:

1230

1192

# Replace the class with a new subclass of it with

1231

1193

# methods, signals, etc. as created above.

1232

cls = type(b"{}Alternate".format(cls.__name__),

1233

(cls, ), attr)

1194

cls = type(b"{0}Alternate".format(cls.__name__),

1195

(cls,), attr)

1234

1196

return cls

1235

1236

1197

return wrapper

1237

1198

1238

1199

1239

1200

@alternate_dbus_interfaces({"se.recompile.Mandos":

1240

"se.bsnet.fukt.Mandos"})

1201

"se.bsnet.fukt.Mandos"})

1241

1202

class ClientDBus(Client, DBusObjectWithProperties):

1242

1203

"""A Client class using D-Bus

1243

1204

1247

1208

"""

1248

1209

1249

1210

runtime_expansions = (Client.runtime_expansions

1250

+ ("dbus_object_path", ))

1251

1252

_interface = "se.recompile.Mandos.Client"

1211

+ ("dbus_object_path",))

1253

1212

1254

1213

# dbus.service.Object doesn't use super(), so we can't either.

1255

1214

1258

1217

Client.__init__(self, *args, **kwargs)

1259

1218

# Only now, when this client is initialized, can it show up on

1260

1219

# the D-Bus

1261

client_object_name = str(self.name).translate(

1220

client_object_name = unicode(self.name).translate(

1262

1221

{ord("."): ord("_"),

1263

1222

ord("-"): ord("_")})

1264

self.dbus_object_path = dbus.ObjectPath(

1265

"/clients/" + client_object_name)

1223

self.dbus_object_path = (dbus.ObjectPath

1224

("/clients/" + client_object_name))

1266

1225

DBusObjectWithProperties.__init__(self, self.bus,

1267

1226

self.dbus_object_path)

1268

1227

1269

def notifychangeproperty(transform_func, dbus_name,

1270

type_func=lambda x: x,

1271

variant_level=1,

1272

invalidate_only=False,

1273

_interface=_interface):

1228

def notifychangeproperty(transform_func,

1229

dbus_name, type_func=lambda x: x,

1230

variant_level=1):

1274

1231

""" Modify a variable so that it's a property which announces

1275

1232

its changes to DBus.

1276

1233

1281

1238

to the D-Bus. Default: no transform

1282

1239

variant_level: D-Bus variant level. Default: 1

1283

1240

"""

1284

attrname = "_{}".format(dbus_name)

1285

1241

attrname = "_{0}".format(dbus_name)

1286

1242

def setter(self, value):

1287

1243

if hasattr(self, "dbus_object_path"):

1288

1244

if (not hasattr(self, attrname) or

1289

1245

type_func(getattr(self, attrname, None))

1290

1246

!= type_func(value)):

1291

if invalidate_only:

1292

self.PropertiesChanged(

1293

_interface, dbus.Dictionary(),

1294

dbus.Array((dbus_name, )))

1295

else:

1296

dbus_value = transform_func(

1297

type_func(value),

1298

variant_level = variant_level)

1299

self.PropertyChanged(dbus.String(dbus_name),

1300

dbus_value)

1301

self.PropertiesChanged(

1302

_interface,

1303

dbus.Dictionary({ dbus.String(dbus_name):

1304

dbus_value }),

1305

dbus.Array())

1247

dbus_value = transform_func(type_func(value),

1248

variant_level

1249

=variant_level)

1250

self.PropertyChanged(dbus.String(dbus_name),

1251

dbus_value)

1306

1252

setattr(self, attrname, value)

1307

1253

1308

1254

return property(lambda self: getattr(self, attrname), setter)

1314

1260

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1315

1261

last_enabled = notifychangeproperty(datetime_to_dbus,

1316

1262

"LastEnabled")

1317

checker = notifychangeproperty(

1318

dbus.Boolean, "CheckerRunning",

1319

type_func = lambda checker: checker is not None)

1263

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1264

type_func = lambda checker:

1265

checker is not None)

1320

1266

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1321

1267

"LastCheckedOK")

1322

1268

last_checker_status = notifychangeproperty(dbus.Int16,

1325

1271

datetime_to_dbus, "LastApprovalRequest")

1326

1272

approved_by_default = notifychangeproperty(dbus.Boolean,

1327

1273

"ApprovedByDefault")

1328

approval_delay = notifychangeproperty(

1329

dbus.UInt64, "ApprovalDelay",

1330

type_func = lambda td: td.total_seconds() * 1000)

1274

approval_delay = notifychangeproperty(dbus.UInt64,

1275

"ApprovalDelay",

1276

type_func =

1277

timedelta_to_milliseconds)

1331

1278

approval_duration = notifychangeproperty(

1332

1279

dbus.UInt64, "ApprovalDuration",

1333

type_func = lambda td: td.total_seconds() * 1000)

1280

type_func = timedelta_to_milliseconds)

1334

1281

host = notifychangeproperty(dbus.String, "Host")

1335

timeout = notifychangeproperty(

1336

dbus.UInt64, "Timeout",

1337

type_func = lambda td: td.total_seconds() * 1000)

1282

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1283

type_func =

1284

timedelta_to_milliseconds)

1338

1285

extended_timeout = notifychangeproperty(

1339

1286

dbus.UInt64, "ExtendedTimeout",

1340

type_func = lambda td: td.total_seconds() * 1000)

1341

interval = notifychangeproperty(

1342

dbus.UInt64, "Interval",

1343

type_func = lambda td: td.total_seconds() * 1000)

1287

type_func = timedelta_to_milliseconds)

1288

interval = notifychangeproperty(dbus.UInt64,

1289

"Interval",

1290

type_func =

1291

timedelta_to_milliseconds)

1344

1292

checker_command = notifychangeproperty(dbus.String, "Checker")

1345

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1346

invalidate_only=True)

1347

1293

1348

1294

del notifychangeproperty

1349

1295

1356

1302

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1357

1303

Client.__del__(self, *args, **kwargs)

1358

1304

1359

def checker_callback(self, source, condition,

1360

connection, command, *args, **kwargs):

1361

ret = Client.checker_callback(self, source, condition,

1362

connection, command, *args,

1363

**kwargs)

1364

exitstatus = self.last_checker_status

1365

if exitstatus >= 0:

1305

def checker_callback(self, pid, condition, command,

1306

*args, **kwargs):

1307

self.checker_callback_tag = None

1308

self.checker = None

1309

if os.WIFEXITED(condition):

1310

exitstatus = os.WEXITSTATUS(condition)

1366

1311

# Emit D-Bus signal

1367

1312

self.CheckerCompleted(dbus.Int16(exitstatus),

1368

dbus.Int64(0),

1313

dbus.Int64(condition),

1369

1314

dbus.String(command))

1370

1315

else:

1371

1316

# Emit D-Bus signal

1372

1317

self.CheckerCompleted(dbus.Int16(-1),

1373

dbus.Int64(

1374

self.last_checker_signal),

1318

dbus.Int64(condition),

1375

1319

dbus.String(command))

1376

return ret

1320

1321

return Client.checker_callback(self, pid, condition, command,

1322

*args, **kwargs)

1377

1323

1378

1324

def start_checker(self, *args, **kwargs):

1379

old_checker_pid = getattr(self.checker, "pid", None)

1325

old_checker = self.checker

1326

if self.checker is not None:

1327

old_checker_pid = self.checker.pid

1328

else:

1329

old_checker_pid = None

1380

1330

r = Client.start_checker(self, *args, **kwargs)

1381

1331

# Only if new checker process was started

1382

1332

if (self.checker is not None

1391

1341

1392

1342

def approve(self, value=True):

1393

1343

self.approved = value

1394

gobject.timeout_add(int(self.approval_duration.total_seconds()

1395

* 1000), self._reset_approved)

1344

gobject.timeout_add(timedelta_to_milliseconds

1345

(self.approval_duration),

1346

self._reset_approved)

1396

1347

self.send_changedstate()

1397

1348

1398

1349

## D-Bus methods, signals & properties

1350

_interface = "se.recompile.Mandos.Client"

1399

1351

1400

1352

## Interfaces

1401

1353

1354

@dbus_interface_annotations(_interface)

1355

def _foo(self):

1356

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1357

"false"}

1358

1402

1359

## Signals

1403

1360

1404

1361

# CheckerCompleted - signal

1414

1371

pass

1415

1372

1416

1373

# PropertyChanged - signal

1417

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1418

1374

@dbus.service.signal(_interface, signature="sv")

1419

1375

def PropertyChanged(self, property, value):

1420

1376

"D-Bus signal"

1484

1440

return dbus.Boolean(bool(self.approvals_pending))

1485

1441

1486

1442

# ApprovedByDefault - property

1487

@dbus_service_property(_interface,

1488

signature="b",

1443

@dbus_service_property(_interface, signature="b",

1489

1444

access="readwrite")

1490

1445

def ApprovedByDefault_dbus_property(self, value=None):

1491

1446

if value is None: # get

1493

1448

self.approved_by_default = bool(value)

1494

1449

1495

1450

# ApprovalDelay - property

1496

@dbus_service_property(_interface,

1497

signature="t",

1451

@dbus_service_property(_interface, signature="t",

1498

1452

access="readwrite")

1499

1453

def ApprovalDelay_dbus_property(self, value=None):

1500

1454

if value is None: # get

1501

return dbus.UInt64(self.approval_delay.total_seconds()

1502

* 1000)

1455

return dbus.UInt64(self.approval_delay_milliseconds())

1503

1456

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1504

1457

1505

1458

# ApprovalDuration - property

1506

@dbus_service_property(_interface,

1507

signature="t",

1459

@dbus_service_property(_interface, signature="t",

1508

1460

access="readwrite")

1509

1461

def ApprovalDuration_dbus_property(self, value=None):

1510

1462

if value is None: # get

1511

return dbus.UInt64(self.approval_duration.total_seconds()

1512

* 1000)

1463

return dbus.UInt64(timedelta_to_milliseconds(

1464

self.approval_duration))

1513

1465

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1514

1466

1515

1467

# Name - property

1523

1475

return dbus.String(self.fingerprint)

1524

1476

1525

1477

# Host - property

1526

@dbus_service_property(_interface,

1527

signature="s",

1478

@dbus_service_property(_interface, signature="s",

1528

1479

access="readwrite")

1529

1480

def Host_dbus_property(self, value=None):

1530

1481

if value is None: # get

1531

1482

return dbus.String(self.host)

1532

self.host = str(value)

1483

self.host = unicode(value)

1533

1484

1534

1485

# Created - property

1535

1486

@dbus_service_property(_interface, signature="s", access="read")

1542

1493

return datetime_to_dbus(self.last_enabled)

1543

1494

1544

1495

# Enabled - property

1545

@dbus_service_property(_interface,

1546

signature="b",

1496

@dbus_service_property(_interface, signature="b",

1547

1497

access="readwrite")

1548

1498

def Enabled_dbus_property(self, value=None):

1549

1499

if value is None: # get

1554

1504

self.disable()

1555

1505

1556

1506

# LastCheckedOK - property

1557

@dbus_service_property(_interface,

1558

signature="s",

1507

@dbus_service_property(_interface, signature="s",

1559

1508

access="readwrite")

1560

1509

def LastCheckedOK_dbus_property(self, value=None):

1561

1510

if value is not None:

1564

1513

return datetime_to_dbus(self.last_checked_ok)

1565

1514

1566

1515

# LastCheckerStatus - property

1567

@dbus_service_property(_interface, signature="n", access="read")

1516

@dbus_service_property(_interface, signature="n",

1517

access="read")

1568

1518

def LastCheckerStatus_dbus_property(self):

1569

1519

return dbus.Int16(self.last_checker_status)

1570

1520

1579

1529

return datetime_to_dbus(self.last_approval_request)

1580

1530

1581

1531

# Timeout - property

1582

@dbus_service_property(_interface,

1583

signature="t",

1532

@dbus_service_property(_interface, signature="t",

1584

1533

access="readwrite")

1585

1534

def Timeout_dbus_property(self, value=None):

1586

1535

if value is None: # get

1587

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1536

return dbus.UInt64(self.timeout_milliseconds())

1588

1537

old_timeout = self.timeout

1589

1538

self.timeout = datetime.timedelta(0, 0, 0, value)

1590

1539

# Reschedule disabling

1599

1548

is None):

1600

1549

return

1601

1550

gobject.source_remove(self.disable_initiator_tag)

1602

self.disable_initiator_tag = gobject.timeout_add(

1603

int((self.expires - now).total_seconds() * 1000),

1604

self.disable)

1551

self.disable_initiator_tag = (

1552

gobject.timeout_add(

1553

timedelta_to_milliseconds(self.expires - now),

1554

self.disable))

1605

1555

1606

1556

# ExtendedTimeout - property

1607

@dbus_service_property(_interface,

1608

signature="t",

1557

@dbus_service_property(_interface, signature="t",

1609

1558

access="readwrite")

1610

1559

def ExtendedTimeout_dbus_property(self, value=None):

1611

1560

if value is None: # get

1612

return dbus.UInt64(self.extended_timeout.total_seconds()

1613

* 1000)

1561

return dbus.UInt64(self.extended_timeout_milliseconds())

1614

1562

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1615

1563

1616

1564

# Interval - property

1617

@dbus_service_property(_interface,

1618

signature="t",

1565

@dbus_service_property(_interface, signature="t",

1619

1566

access="readwrite")

1620

1567

def Interval_dbus_property(self, value=None):

1621

1568

if value is None: # get

1622

return dbus.UInt64(self.interval.total_seconds() * 1000)

1569

return dbus.UInt64(self.interval_milliseconds())

1623

1570

self.interval = datetime.timedelta(0, 0, 0, value)

1624

1571

if getattr(self, "checker_initiator_tag", None) is None:

1625

1572

return

1626

1573

if self.enabled:

1627

1574

# Reschedule checker run

1628

1575

gobject.source_remove(self.checker_initiator_tag)

1629

self.checker_initiator_tag = gobject.timeout_add(

1630

value, self.start_checker)

1631

self.start_checker() # Start one now, too

1576

self.checker_initiator_tag = (gobject.timeout_add

1577

(value, self.start_checker))

1578

self.start_checker() # Start one now, too

1632

1579

1633

1580

# Checker - property

1634

@dbus_service_property(_interface,

1635

signature="s",

1581

@dbus_service_property(_interface, signature="s",

1636

1582

access="readwrite")

1637

1583

def Checker_dbus_property(self, value=None):

1638

1584

if value is None: # get

1639

1585

return dbus.String(self.checker_command)

1640

self.checker_command = str(value)

1586

self.checker_command = unicode(value)

1641

1587

1642

1588

# CheckerRunning - property

1643

@dbus_service_property(_interface,

1644

signature="b",

1589

@dbus_service_property(_interface, signature="b",

1645

1590

access="readwrite")

1646

1591

def CheckerRunning_dbus_property(self, value=None):

1647

1592

if value is None: # get

1657

1602

return self.dbus_object_path # is already a dbus.ObjectPath

1658

1603

1659

1604

# Secret = property

1660

@dbus_service_property(_interface,

1661

signature="ay",

1662

access="write",

1663

byte_arrays=True)

1605

@dbus_service_property(_interface, signature="ay",

1606

access="write", byte_arrays=True)

1664

1607

def Secret_dbus_property(self, value):

1665

self.secret = bytes(value)

1608

self.secret = str(value)

1666

1609

1667

1610

del _interface

1668

1611

1672

1615

self._pipe = child_pipe

1673

1616

self._pipe.send(('init', fpr, address))

1674

1617

if not self._pipe.recv():

1675

raise KeyError(fpr)

1618

raise KeyError()

1676

1619

1677

1620

def __getattribute__(self, name):

1678

1621

if name == '_pipe':

1682

1625

if data[0] == 'data':

1683

1626

return data[1]

1684

1627

if data[0] == 'function':

1685

1686

1628

def func(*args, **kwargs):

1687

1629

self._pipe.send(('funcall', name, args, kwargs))

1688

1630

return self._pipe.recv()[1]

1689

1690

1631

return func

1691

1632

1692

1633

def __setattr__(self, name, value):

1704

1645

def handle(self):

1705

1646

with contextlib.closing(self.server.child_pipe) as child_pipe:

1706

1647

logger.info("TCP connection from: %s",

1707

str(self.client_address))

1648

unicode(self.client_address))

1708

1649

logger.debug("Pipe FD: %d",

1709

1650

self.server.child_pipe.fileno())

1710

1651

1711

session = gnutls.connection.ClientSession(

1712

self.request, gnutls.connection .X509Credentials())

1652

session = (gnutls.connection

1653

.ClientSession(self.request,

1654

gnutls.connection

1655

.X509Credentials()))

1713

1656

1714

1657

# Note: gnutls.connection.X509Credentials is really a

1715

1658

# generic GnuTLS certificate credentials object so long as

1724

1667

priority = self.server.gnutls_priority

1725

1668

if priority is None:

1726

1669

priority = "NORMAL"

1727

gnutls.library.functions.gnutls_priority_set_direct(

1728

session._c_object, priority, None)

1670

(gnutls.library.functions

1671

.gnutls_priority_set_direct(session._c_object,

1672

priority, None))

1729

1673

1730

1674

# Start communication using the Mandos protocol

1731

1675

# Get protocol number

1733

1677

logger.debug("Protocol version: %r", line)

1734

1678

try:

1735

1679

if int(line.strip().split()[0]) > 1:

1736

raise RuntimeError(line)

1680

raise RuntimeError

1737

1681

except (ValueError, IndexError, RuntimeError) as error:

1738

1682

logger.error("Unknown protocol version: %s", error)

1739

1683

return

1751

1695

approval_required = False

1752

1696

try:

1753

1697

try:

1754

fpr = self.fingerprint(

1755

self.peer_certificate(session))

1698

fpr = self.fingerprint(self.peer_certificate

1699

(session))

1756

1700

except (TypeError,

1757

1701

gnutls.errors.GNUTLSError) as error:

1758

1702

logger.warning("Bad certificate: %s", error)

1773

1717

while True:

1774

1718

if not client.enabled:

1775

1719

logger.info("Client %s is disabled",

1776

client.name)

1720

client.name)

1777

1721

if self.server.use_dbus:

1778

1722

# Emit D-Bus signal

1779

1723

client.Rejected("Disabled")

1788

1732

if self.server.use_dbus:

1789

1733

# Emit D-Bus signal

1790

1734

client.NeedApproval(

1791

client.approval_delay.total_seconds()

1792

* 1000, client.approved_by_default)

1735

client.approval_delay_milliseconds(),

1736

client.approved_by_default)

1793

1737

else:

1794

1738

logger.warning("Client %s was not approved",

1795

1739

client.name)

1801

1745

#wait until timeout or approved

1802

1746

time = datetime.datetime.now()

1803

1747

client.changedstate.acquire()

1804

client.changedstate.wait(delay.total_seconds())

1748

client.changedstate.wait(

1749

float(timedelta_to_milliseconds(delay)

1750

/ 1000))

1805

1751

client.changedstate.release()

1806

1752

time2 = datetime.datetime.now()

1807

1753

if (time2 - time) >= delay:

1826

1772

logger.warning("gnutls send failed",

1827

1773

exc_info=error)

1828

1774

return

1829

logger.debug("Sent: %d, remaining: %d", sent,

1830

len(client.secret) - (sent_size

1831

+ sent))

1775

logger.debug("Sent: %d, remaining: %d",

1776

sent, len(client.secret)

1777

- (sent_size + sent))

1832

1778

sent_size += sent

1833

1779

1834

1780

logger.info("Sending secret to %s", client.name)

1851

1797

def peer_certificate(session):

1852

1798

"Return the peer's OpenPGP certificate as a bytestring"

1853

1799

# If not an OpenPGP certificate...

1854

if (gnutls.library.functions.gnutls_certificate_type_get(

1855

session._c_object)

1800

if (gnutls.library.functions

1801

.gnutls_certificate_type_get(session._c_object)

1856

1802

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1857

1803

# ...do the normal thing

1858

1804

return session.peer_certificate

1872

1818

def fingerprint(openpgp):

1873

1819

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1874

1820

# New GnuTLS "datum" with the OpenPGP public key

1875

datum = gnutls.library.types.gnutls_datum_t(

1876

ctypes.cast(ctypes.c_char_p(openpgp),

1877

ctypes.POINTER(ctypes.c_ubyte)),

1878

ctypes.c_uint(len(openpgp)))

1821

datum = (gnutls.library.types

1822

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1823

ctypes.POINTER

1824

(ctypes.c_ubyte)),

1825

ctypes.c_uint(len(openpgp))))

1879

1826

# New empty GnuTLS certificate

1880

1827

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1881

gnutls.library.functions.gnutls_openpgp_crt_init(

1882

ctypes.byref(crt))

1828

(gnutls.library.functions

1829

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1883

1830

# Import the OpenPGP public key into the certificate

1884

gnutls.library.functions.gnutls_openpgp_crt_import(

1885

crt, ctypes.byref(datum),

1886

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1831

(gnutls.library.functions

1832

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1833

gnutls.library.constants

1834

.GNUTLS_OPENPGP_FMT_RAW))

1887

1835

# Verify the self signature in the key

1888

1836

crtverify = ctypes.c_uint()

1889

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1890

crt, 0, ctypes.byref(crtverify))

1837

(gnutls.library.functions

1838

.gnutls_openpgp_crt_verify_self(crt, 0,

1839

ctypes.byref(crtverify)))

1891

1840

if crtverify.value != 0:

1892

1841

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1893

raise gnutls.errors.CertificateSecurityError(

1894

"Verify failed")

1842

raise (gnutls.errors.CertificateSecurityError

1843

("Verify failed"))

1895

1844

# New buffer for the fingerprint

1896

1845

buf = ctypes.create_string_buffer(20)

1897

1846

buf_len = ctypes.c_size_t()

1898

1847

# Get the fingerprint from the certificate into the buffer

1899

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1900

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1848

(gnutls.library.functions

1849

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1850

ctypes.byref(buf_len)))

1901

1851

# Deinit the certificate

1902

1852

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1903

1853

# Convert the buffer to a Python bytestring

1909

1859

1910

1860

class MultiprocessingMixIn(object):

1911

1861

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1912

1913

1862

def sub_process_main(self, request, address):

1914

1863

try:

1915

1864

self.finish_request(request, address)

1927

1876

1928

1877

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1929

1878

""" adds a pipe to the MixIn """

1930

1931

1879

def process_request(self, request, client_address):

1932

1880

"""Overrides and wraps the original process_request().

1933

1881

1942

1890

1943

1891

def add_pipe(self, parent_pipe, proc):

1944

1892

"""Dummy function; override as necessary"""

1945

raise NotImplementedError()

1893

raise NotImplementedError

1946

1894

1947

1895

1948

1896

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1954

1902

interface: None or a network interface name (string)

1955

1903

use_ipv6: Boolean; to use IPv6 or not

1956

1904

"""

1957

1958

1905

def __init__(self, server_address, RequestHandlerClass,

1959

interface=None,

1960

use_ipv6=True,

1961

socketfd=None):

1962

"""If socketfd is set, use that file descriptor instead of

1963

creating a new one with socket.socket().

1964

"""

1906

interface=None, use_ipv6=True):

1965

1907

self.interface = interface

1966

1908

if use_ipv6:

1967

1909

self.address_family = socket.AF_INET6

1968

if socketfd is not None:

1969

# Save the file descriptor

1970

self.socketfd = socketfd

1971

# Save the original socket.socket() function

1972

self.socket_socket = socket.socket

1973

# To implement --socket, we monkey patch socket.socket.

1974

#

1975

# (When socketserver.TCPServer is a new-style class, we

1976

# could make self.socket into a property instead of monkey

1977

# patching socket.socket.)

1978

#

1979

# Create a one-time-only replacement for socket.socket()

1980

@functools.wraps(socket.socket)

1981

def socket_wrapper(*args, **kwargs):

1982

# Restore original function so subsequent calls are

1983

# not affected.

1984

socket.socket = self.socket_socket

1985

del self.socket_socket

1986

# This time only, return a new socket object from the

1987

# saved file descriptor.

1988

return socket.fromfd(self.socketfd, *args, **kwargs)

1989

# Replace socket.socket() function with wrapper

1990

socket.socket = socket_wrapper

1991

# The socketserver.TCPServer.__init__ will call

1992

# socket.socket(), which might be our replacement,

1993

# socket_wrapper(), if socketfd was set.

1994

1910

socketserver.TCPServer.__init__(self, server_address,

1995

1911

RequestHandlerClass)

1996

1997

1912

def server_bind(self):

1998

1913

"""This overrides the normal server_bind() function

1999

1914

to bind to an interface if one was specified, and also NOT to

2005

1920

self.interface)

2006

1921

else:

2007

1922

try:

2008

self.socket.setsockopt(

2009

socket.SOL_SOCKET, SO_BINDTODEVICE,

2010

(self.interface + "\0").encode("utf-8"))

1923

self.socket.setsockopt(socket.SOL_SOCKET,

1924

SO_BINDTODEVICE,

1925

str(self.interface

1926

+ '\0'))

2011

1927

except socket.error as error:

2012

if error.errno == errno.EPERM:

2013

logger.error("No permission to bind to"

2014

" interface %s", self.interface)

2015

elif error.errno == errno.ENOPROTOOPT:

1928

if error[0] == errno.EPERM:

1929

logger.error("No permission to"

1930

" bind to interface %s",

1931

self.interface)

1932

elif error[0] == errno.ENOPROTOOPT:

2016

1933

logger.error("SO_BINDTODEVICE not available;"

2017

1934

" cannot bind to interface %s",

2018

1935

self.interface)

2019

elif error.errno == errno.ENODEV:

2020

logger.error("Interface %s does not exist,"

2021

" cannot bind", self.interface)

2022

1936

else:

2023

1937

raise

2024

1938

# Only bind(2) the socket if we really need to.

2027

1941

if self.address_family == socket.AF_INET6:

2028

1942

any_address = "::" # in6addr_any

2029

1943

else:

2030

any_address = "0.0.0.0" # INADDR_ANY

1944

any_address = socket.INADDR_ANY

2031

1945

self.server_address = (any_address,

2032

1946

self.server_address[1])

2033

1947

elif not self.server_address[1]:

2034

self.server_address = (self.server_address[0], 0)

1948

self.server_address = (self.server_address[0],

1949

0)

2035

1950

# if self.interface:

2036

1951

# self.server_address = (self.server_address[0],

2037

1952

# 0, # port

2051

1966

2052

1967

Assumes a gobject.MainLoop event loop.

2053

1968

"""

2054

2055

1969

def __init__(self, server_address, RequestHandlerClass,

2056

interface=None,

2057

use_ipv6=True,

2058

clients=None,

2059

gnutls_priority=None,

2060

use_dbus=True,

2061

socketfd=None):

1970

interface=None, use_ipv6=True, clients=None,

1971

gnutls_priority=None, use_dbus=True):

2062

1972

self.enabled = False

2063

1973

self.clients = clients

2064

1974

if self.clients is None:

2068

1978

IPv6_TCPServer.__init__(self, server_address,

2069

1979

RequestHandlerClass,

2070

1980

interface = interface,

2071

use_ipv6 = use_ipv6,

2072

socketfd = socketfd)

2073

1981

use_ipv6 = use_ipv6)

2074

1982

def server_activate(self):

2075

1983

if self.enabled:

2076

1984

return socketserver.TCPServer.server_activate(self)

2080

1988

2081

1989

def add_pipe(self, parent_pipe, proc):

2082

1990

# Call "handle_ipc" for both data and EOF events

2083

gobject.io_add_watch(

2084

parent_pipe.fileno(),

2085

gobject.IO_IN | gobject.IO_HUP,

2086

functools.partial(self.handle_ipc,

2087

parent_pipe = parent_pipe,

2088

proc = proc))

1991

gobject.io_add_watch(parent_pipe.fileno(),

1992

gobject.IO_IN | gobject.IO_HUP,

1993

functools.partial(self.handle_ipc,

1994

parent_pipe =

1995

parent_pipe,

1996

proc = proc))

2089

1997

2090

def handle_ipc(self, source, condition,

2091

parent_pipe=None,

2092

proc = None,

2093

client_object=None):

1998

def handle_ipc(self, source, condition, parent_pipe=None,

1999

proc = None, client_object=None):

2094

2000

# error, or the other end of multiprocessing.Pipe has closed

2095

2001

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2096

2002

# Wait for other process to exit

2119

2025

parent_pipe.send(False)

2120

2026

return False

2121

2027

2122

gobject.io_add_watch(

2123

parent_pipe.fileno(),

2124

gobject.IO_IN | gobject.IO_HUP,

2125

functools.partial(self.handle_ipc,

2126

parent_pipe = parent_pipe,

2127

proc = proc,

2128

client_object = client))

2028

gobject.io_add_watch(parent_pipe.fileno(),

2029

gobject.IO_IN | gobject.IO_HUP,

2030

functools.partial(self.handle_ipc,

2031

parent_pipe =

2032

parent_pipe,

2033

proc = proc,

2034

client_object =

2035

client))

2129

2036

parent_pipe.send(True)

2130

2037

# remove the old hook in favor of the new above hook on

2131

2038

# same fileno

2137

2044

2138

2045

parent_pipe.send(('data', getattr(client_object,

2139

2046

funcname)(*args,

2140

**kwargs)))

2047

**kwargs)))

2141

2048

2142

2049

if command == 'getattr':

2143

2050

attrname = request[1]

2144

if isinstance(client_object.__getattribute__(attrname),

2145

collections.Callable):

2146

parent_pipe.send(('function', ))

2051

if callable(client_object.__getattribute__(attrname)):

2052

parent_pipe.send(('function',))

2147

2053

else:

2148

parent_pipe.send((

2149

'data', client_object.__getattribute__(attrname)))

2054

parent_pipe.send(('data', client_object

2055

.__getattribute__(attrname)))

2150

2056

2151

2057

if command == 'setattr':

2152

2058

attrname = request[1]

2156

2062

return True

2157

2063

2158

2064

2159

def rfc3339_duration_to_delta(duration):

2160

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2161

2162

>>> rfc3339_duration_to_delta("P7D")

2163

datetime.timedelta(7)

2164

>>> rfc3339_duration_to_delta("PT60S")

2165

datetime.timedelta(0, 60)

2166

>>> rfc3339_duration_to_delta("PT60M")

2167

datetime.timedelta(0, 3600)

2168

>>> rfc3339_duration_to_delta("PT24H")

2169

datetime.timedelta(1)

2170

>>> rfc3339_duration_to_delta("P1W")

2171

datetime.timedelta(7)

2172

>>> rfc3339_duration_to_delta("PT5M30S")

2173

datetime.timedelta(0, 330)

2174

>>> rfc3339_duration_to_delta("P1DT3M20S")

2175

datetime.timedelta(1, 200)

2176

"""

2177

2178

# Parsing an RFC 3339 duration with regular expressions is not

2179

# possible - there would have to be multiple places for the same

2180

# values, like seconds. The current code, while more esoteric, is

2181

# cleaner without depending on a parsing library. If Python had a

2182

# built-in library for parsing we would use it, but we'd like to

2183

# avoid excessive use of external libraries.

2184

2185

# New type for defining tokens, syntax, and semantics all-in-one

2186

Token = collections.namedtuple("Token", (

2187

"regexp", # To match token; if "value" is not None, must have

2188

# a "group" containing digits

2189

"value", # datetime.timedelta or None

2190

"followers")) # Tokens valid after this token

2191

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2192

# the "duration" ABNF definition in RFC 3339, Appendix A.

2193

token_end = Token(re.compile(r"$"), None, frozenset())

2194

token_second = Token(re.compile(r"(\d+)S"),

2195

datetime.timedelta(seconds=1),

2196

frozenset((token_end, )))

2197

token_minute = Token(re.compile(r"(\d+)M"),

2198

datetime.timedelta(minutes=1),

2199

frozenset((token_second, token_end)))

2200

token_hour = Token(re.compile(r"(\d+)H"),

2201

datetime.timedelta(hours=1),

2202

frozenset((token_minute, token_end)))

2203

token_time = Token(re.compile(r"T"),

2204

None,

2205

frozenset((token_hour, token_minute,

2206

token_second)))

2207

token_day = Token(re.compile(r"(\d+)D"),

2208

datetime.timedelta(days=1),

2209

frozenset((token_time, token_end)))

2210

token_month = Token(re.compile(r"(\d+)M"),

2211

datetime.timedelta(weeks=4),

2212

frozenset((token_day, token_end)))

2213

token_year = Token(re.compile(r"(\d+)Y"),

2214

datetime.timedelta(weeks=52),

2215

frozenset((token_month, token_end)))

2216

token_week = Token(re.compile(r"(\d+)W"),

2217

datetime.timedelta(weeks=1),

2218

frozenset((token_end, )))

2219

token_duration = Token(re.compile(r"P"), None,

2220

frozenset((token_year, token_month,

2221

token_day, token_time,

2222

token_week)))

2223

# Define starting values

2224

value = datetime.timedelta() # Value so far

2225

found_token = None

2226

followers = frozenset((token_duration, )) # Following valid tokens

2227

s = duration # String left to parse

2228

# Loop until end token is found

2229

while found_token is not token_end:

2230

# Search for any currently valid tokens

2231

for token in followers:

2232

match = token.regexp.match(s)

2233

if match is not None:

2234

# Token found

2235

if token.value is not None:

2236

# Value found, parse digits

2237

factor = int(match.group(1), 10)

2238

# Add to value so far

2239

value += factor * token.value

2240

# Strip token from string

2241

s = token.regexp.sub("", s, 1)

2242

# Go to found token

2243

found_token = token

2244

# Set valid next tokens

2245

followers = found_token.followers

2246

break

2247

else:

2248

# No currently valid tokens were found

2249

raise ValueError("Invalid RFC 3339 duration: {!r}"

2250

.format(duration))

2251

# End token found

2252

return value

2253

2254

2255

2065

def string_to_delta(interval):

2256

2066

"""Parse a string and return a datetime.timedelta

2257

2067

2268

2078

>>> string_to_delta('5m 30s')

2269

2079

datetime.timedelta(0, 330)

2270

2080

"""

2271

2272

try:

2273

return rfc3339_duration_to_delta(interval)

2274

except ValueError:

2275

pass

2276

2277

2081

timevalue = datetime.timedelta(0)

2278

2082

for s in interval.split():

2279

2083

try:

2280

suffix = s[-1]

2084

suffix = unicode(s[-1])

2281

2085

value = int(s[:-1])

2282

2086

if suffix == "d":

2283

2087

delta = datetime.timedelta(value)

2290

2094

elif suffix == "w":

2291

2095

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2292

2096

else:

2293

raise ValueError("Unknown suffix {!r}".format(suffix))

2294

except IndexError as e:

2097

raise ValueError("Unknown suffix {0!r}"

2098

.format(suffix))

2099

except (ValueError, IndexError) as e:

2295

2100

raise ValueError(*(e.args))

2296

2101

timevalue += delta

2297

2102

return timevalue

2313

2118

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2314

2119

if not stat.S_ISCHR(os.fstat(null).st_mode):

2315

2120

raise OSError(errno.ENODEV,

2316

"{} not a character device"

2121

"{0} not a character device"

2317

2122

.format(os.devnull))

2318

2123

os.dup2(null, sys.stdin.fileno())

2319

2124

os.dup2(null, sys.stdout.fileno())

2329

2134

2330

2135

parser = argparse.ArgumentParser()

2331

2136

parser.add_argument("-v", "--version", action="version",

2332

version = "%(prog)s {}".format(version),

2137

version = "%(prog)s {0}".format(version),

2333

2138

help="show version number and exit")

2334

2139

parser.add_argument("-i", "--interface", metavar="IF",

2335

2140

help="Bind to interface IF")

2341

2146

help="Run self-test")

2342

2147

parser.add_argument("--debug", action="store_true",

2343

2148

help="Debug mode; run in foreground and log"

2344

" to terminal", default=None)

2149

" to terminal")

2345

2150

parser.add_argument("--debuglevel", metavar="LEVEL",

2346

2151

help="Debug level for stdout output")

2347

2152

parser.add_argument("--priority", help="GnuTLS"

2354

2159

" files")

2355

2160

parser.add_argument("--no-dbus", action="store_false",

2356

2161

dest="use_dbus", help="Do not provide D-Bus"

2357

" system bus interface", default=None)

2162

" system bus interface")

2358

2163

parser.add_argument("--no-ipv6", action="store_false",

2359

dest="use_ipv6", help="Do not use IPv6",

2360

default=None)

2164

dest="use_ipv6", help="Do not use IPv6")

2361

2165

parser.add_argument("--no-restore", action="store_false",

2362

2166

dest="restore", help="Do not restore stored"

2363

" state", default=None)

2364

parser.add_argument("--socket", type=int,

2365

help="Specify a file descriptor to a network"

2366

" socket to use instead of creating one")

2167

" state")

2367

2168

parser.add_argument("--statedir", metavar="DIR",

2368

2169

help="Directory to save/restore state in")

2369

parser.add_argument("--foreground", action="store_true",

2370

help="Run in foreground", default=None)

2371

parser.add_argument("--no-zeroconf", action="store_false",

2372

dest="zeroconf", help="Do not use Zeroconf",

2373

default=None)

2374

2170

2375

2171

options = parser.parse_args()

2376

2172

2377

2173

if options.check:

2378

2174

import doctest

2379

fail_count, test_count = doctest.testmod()

2380

sys.exit(os.EX_OK if fail_count == 0 else 1)

2175

doctest.testmod()

2176

sys.exit()

2381

2177

2382

2178

# Default values for config file for server-global settings

2383

2179

server_defaults = { "interface": "",

2385

2181

"port": "",

2386

2182

"debug": "False",

2387

2183

"priority":

2388

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2389

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2184

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2390

2185

"servicename": "Mandos",

2391

2186

"use_dbus": "True",

2392

2187

"use_ipv6": "True",

2393

2188

"debuglevel": "",

2394

2189

"restore": "True",

2395

"socket": "",

2396

"statedir": "/var/lib/mandos",

2397

"foreground": "False",

2398

"zeroconf": "True",

2399

}

2190

"statedir": "/var/lib/mandos"

2191

}

2400

2192

2401

2193

# Parse config file for server-global settings

2402

2194

server_config = configparser.SafeConfigParser(server_defaults)

2403

2195

del server_defaults

2404

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2196

server_config.read(os.path.join(options.configdir,

2197

"mandos.conf"))

2405

2198

# Convert the SafeConfigParser object to a dict

2406

2199

server_settings = server_config.defaults()

2407

2200

# Use the appropriate methods on the non-string config options

2408

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

2201

for option in ("debug", "use_dbus", "use_ipv6"):

2409

2202

server_settings[option] = server_config.getboolean("DEFAULT",

2410

2203

option)

2411

2204

if server_settings["port"]:

2412

2205

server_settings["port"] = server_config.getint("DEFAULT",

2413

2206

"port")

2414

if server_settings["socket"]:

2415

server_settings["socket"] = server_config.getint("DEFAULT",

2416

"socket")

2417

# Later, stdin will, and stdout and stderr might, be dup'ed

2418

# over with an opened os.devnull. But we don't want this to

2419

# happen with a supplied network socket.

2420

if 0 <= server_settings["socket"] <= 2:

2421

server_settings["socket"] = os.dup(server_settings

2422

["socket"])

2423

2207

del server_config

2424

2208

2425

2209

# Override the settings from the config file with command line

2426

2210

# options, if set.

2427

2211

for option in ("interface", "address", "port", "debug",

2428

"priority", "servicename", "configdir", "use_dbus",

2429

"use_ipv6", "debuglevel", "restore", "statedir",

2430

"socket", "foreground", "zeroconf"):

2212

"priority", "servicename", "configdir",

2213

"use_dbus", "use_ipv6", "debuglevel", "restore",

2214

"statedir"):

2431

2215

value = getattr(options, option)

2432

2216

if value is not None:

2433

2217

server_settings[option] = value

2434

2218

del options

2435

2219

# Force all strings to be unicode

2436

2220

for option in server_settings.keys():

2437

if isinstance(server_settings[option], bytes):

2438

server_settings[option] = (server_settings[option]

2439

.decode("utf-8"))

2440

# Force all boolean options to be boolean

2441

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2442

"foreground", "zeroconf"):

2443

server_settings[option] = bool(server_settings[option])

2444

# Debug implies foreground

2445

if server_settings["debug"]:

2446

server_settings["foreground"] = True

2221

if type(server_settings[option]) is str:

2222

server_settings[option] = unicode(server_settings[option])

2447

2223

# Now we have our good server settings in "server_settings"

2448

2224

2449

2225

##################################################################

2450

2226

2451

if (not server_settings["zeroconf"]

2452

and not (server_settings["port"]

2453

or server_settings["socket"] != "")):

2454

parser.error("Needs port or socket to work without Zeroconf")

2455

2456

2227

# For convenience

2457

2228

debug = server_settings["debug"]

2458

2229

debuglevel = server_settings["debuglevel"]

2460

2231

use_ipv6 = server_settings["use_ipv6"]

2461

2232

stored_state_path = os.path.join(server_settings["statedir"],

2462

2233

stored_state_file)

2463

foreground = server_settings["foreground"]

2464

zeroconf = server_settings["zeroconf"]

2465

2234

2466

2235

if debug:

2467

2236

initlogger(debug, logging.DEBUG)

2473

2242

initlogger(debug, level)

2474

2243

2475

2244

if server_settings["servicename"] != "Mandos":

2476

syslogger.setFormatter(

2477

logging.Formatter('Mandos ({}) [%(process)d]:'

2478

' %(levelname)s: %(message)s'.format(

2479

server_settings["servicename"])))

2245

syslogger.setFormatter(logging.Formatter

2246

('Mandos ({0}) [%(process)d]:'

2247

' %(levelname)s: %(message)s'

2248

.format(server_settings

2249

["servicename"])))

2480

2250

2481

2251

# Parse config file with clients

2482

2252

client_config = configparser.SafeConfigParser(Client

2487

2257

global mandos_dbus_service

2488

2258

mandos_dbus_service = None

2489

2259

2490

socketfd = None

2491

if server_settings["socket"] != "":

2492

socketfd = server_settings["socket"]

2493

tcp_server = MandosServer(

2494

(server_settings["address"], server_settings["port"]),

2495

ClientHandler,

2496

interface=(server_settings["interface"] or None),

2497

use_ipv6=use_ipv6,

2498

gnutls_priority=server_settings["priority"],

2499

use_dbus=use_dbus,

2500

socketfd=socketfd)

2501

if not foreground:

2502

pidfilename = "/run/mandos.pid"

2503

if not os.path.isdir("/run/."):

2504

pidfilename = "/var/run/mandos.pid"

2505

pidfile = None

2260

tcp_server = MandosServer((server_settings["address"],

2261

server_settings["port"]),

2262

ClientHandler,

2263

interface=(server_settings["interface"]

2264

or None),

2265

use_ipv6=use_ipv6,

2266

gnutls_priority=

2267

server_settings["priority"],

2268

use_dbus=use_dbus)

2269

if not debug:

2270

pidfilename = "/var/run/mandos.pid"

2506

2271

try:

2507

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2272

pidfile = open(pidfilename, "w")

2508

2273

except IOError as e:

2509

2274

logger.error("Could not open file %r", pidfilename,

2510

2275

exc_info=e)

2523

2288

os.setgid(gid)

2524

2289

os.setuid(uid)

2525

2290

except OSError as error:

2526

if error.errno != errno.EPERM:

2527

raise

2291

if error[0] != errno.EPERM:

2292

raise error

2528

2293

2529

2294

if debug:

2530

2295

# Enable all possible GnuTLS debugging

2537

2302

def debug_gnutls(level, string):

2538

2303

logger.debug("GnuTLS: %s", string[:-1])

2539

2304

2540

gnutls.library.functions.gnutls_global_set_log_function(

2541

debug_gnutls)

2305

(gnutls.library.functions

2306

.gnutls_global_set_log_function(debug_gnutls))

2542

2307

2543

2308

# Redirect stdin so all checkers get /dev/null

2544

2309

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2547

2312

os.close(null)

2548

2313

2549

2314

# Need to fork before connecting to D-Bus

2550

if not foreground:

2315

if not debug:

2551

2316

# Close all input and output, do double fork, etc.

2552

2317

daemon()

2553

2318

2554

# multiprocessing will use threads, so before we use gobject we

2555

# need to inform gobject that threads will be used.

2556

2319

gobject.threads_init()

2557

2320

2558

2321

global main_loop

2564

2327

if use_dbus:

2565

2328

try:

2566

2329

bus_name = dbus.service.BusName("se.recompile.Mandos",

2567

bus,

2568

do_not_queue=True)

2569

old_bus_name = dbus.service.BusName(

2570

"se.bsnet.fukt.Mandos", bus,

2571

do_not_queue=True)

2572

except dbus.exceptions.DBusException as e:

2330

bus, do_not_queue=True)

2331

old_bus_name = (dbus.service.BusName

2332

("se.bsnet.fukt.Mandos", bus,

2333

do_not_queue=True))

2334

except dbus.exceptions.NameExistsException as e:

2573

2335

logger.error("Disabling D-Bus:", exc_info=e)

2574

2336

use_dbus = False

2575

2337

server_settings["use_dbus"] = False

2576

2338

tcp_server.use_dbus = False

2577

if zeroconf:

2578

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2579

service = AvahiServiceToSyslog(

2580

name = server_settings["servicename"],

2581

servicetype = "_mandos._tcp",

2582

protocol = protocol,

2583

bus = bus)

2584

if server_settings["interface"]:

2585

service.interface = if_nametoindex(

2586

server_settings["interface"].encode("utf-8"))

2339

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2340

service = AvahiServiceToSyslog(name =

2341

server_settings["servicename"],

2342

servicetype = "_mandos._tcp",

2343

protocol = protocol, bus = bus)

2344

if server_settings["interface"]:

2345

service.interface = (if_nametoindex

2346

(str(server_settings["interface"])))

2587

2347

2588

2348

global multiprocessing_manager

2589

2349

multiprocessing_manager = multiprocessing.Manager()

2596

2356

old_client_settings = {}

2597

2357

clients_data = {}

2598

2358

2599

# This is used to redirect stdout and stderr for checker processes

2600

global wnull

2601

wnull = open(os.devnull, "w") # A writable /dev/null

2602

# Only used if server is running in foreground but not in debug

2603

# mode

2604

if debug or not foreground:

2605

wnull.close()

2606

2607

2359

# Get client data and settings from last running state.

2608

2360

if server_settings["restore"]:

2609

2361

try:

2610

2362

with open(stored_state_path, "rb") as stored_state:

2611

clients_data, old_client_settings = pickle.load(

2612

stored_state)

2363

clients_data, old_client_settings = (pickle.load

2364

(stored_state))

2613

2365

os.remove(stored_state_path)

2614

2366

except IOError as e:

2615

2367

if e.errno == errno.ENOENT:

2616

logger.warning("Could not load persistent state:"

2617

" {}".format(os.strerror(e.errno)))

2368

logger.warning("Could not load persistent state: {0}"

2369

.format(os.strerror(e.errno)))

2618

2370

else:

2619

2371

logger.critical("Could not load persistent state:",

2620

2372

exc_info=e)

2621

2373

raise

2622

2374

except EOFError as e:

2623

2375

logger.warning("Could not load persistent state: "

2624

"EOFError:",

2625

exc_info=e)

2376

"EOFError:", exc_info=e)

2626

2377

2627

2378

with PGPEngine() as pgp:

2628

for client_name, client in clients_data.items():

2629

# Skip removed clients

2630

if client_name not in client_settings:

2631

continue

2632

2379

for client_name, client in clients_data.iteritems():

2633

2380

# Decide which value to use after restoring saved state.

2634

2381

# We have three different values: Old config file,

2635

2382

# new config file, and saved state.

2640

2387

# For each value in new config, check if it

2641

2388

# differs from the old config value (Except for

2642

2389

# the "secret" attribute)

2643

if (name != "secret"

2644

and (value !=

2645

old_client_settings[client_name][name])):

2390

if (name != "secret" and

2391

value != old_client_settings[client_name]

2392

[name]):

2646

2393

client[name] = value

2647

2394

except KeyError:

2648

2395

pass

2649

2396

2650

2397

# Clients who has passed its expire date can still be

2651

# enabled if its last checker was successful. A Client

2398

# enabled if its last checker was successful. Clients

2652

2399

# whose checker succeeded before we stored its state is

2653

2400

# assumed to have successfully run all checkers during

2654

2401

# downtime.

2656

2403

if datetime.datetime.utcnow() >= client["expires"]:

2657

2404

if not client["last_checked_ok"]:

2658

2405

logger.warning(

2659

"disabling client {} - Client never "

2660

"performed a successful checker".format(

2661

client_name))

2406

"disabling client {0} - Client never "

2407

"performed a successful checker"

2408

.format(client_name))

2662

2409

client["enabled"] = False

2663

2410

elif client["last_checker_status"] != 0:

2664

2411

logger.warning(

2665

"disabling client {} - Client last"

2666

" checker failed with error code"

2667

" {}".format(

2668

client_name,

2669

client["last_checker_status"]))

2412

"disabling client {0} - Client "

2413

"last checker failed with error code {1}"

2414

.format(client_name,

2415

client["last_checker_status"]))

2670

2416

client["enabled"] = False

2671

2417

else:

2672

client["expires"] = (

2673

datetime.datetime.utcnow()

2674

+ client["timeout"])

2418

client["expires"] = (datetime.datetime

2419

.utcnow()

2420

+ client["timeout"])

2675

2421

logger.debug("Last checker succeeded,"

2676

" keeping {} enabled".format(

2677

client_name))

2422

" keeping {0} enabled"

2423

.format(client_name))

2678

2424

try:

2679

client["secret"] = pgp.decrypt(

2680

client["encrypted_secret"],

2681

client_settings[client_name]["secret"])

2425

client["secret"] = (

2426

pgp.decrypt(client["encrypted_secret"],

2427

client_settings[client_name]

2428

["secret"]))

2682

2429

except PGPError:

2683

2430

# If decryption fails, we use secret from new settings

2684

logger.debug("Failed to decrypt {} old secret".format(

2685

client_name))

2686

client["secret"] = (client_settings[client_name]

2687

["secret"])

2431

logger.debug("Failed to decrypt {0} old secret"

2432

.format(client_name))

2433

client["secret"] = (

2434

client_settings[client_name]["secret"])

2688

2435

2689

2436

# Add/remove clients based on new changes made to config

2690

2437

for client_name in (set(old_client_settings)

2695

2442

clients_data[client_name] = client_settings[client_name]

2696

2443

2697

2444

# Create all client objects

2698

for client_name, client in clients_data.items():

2445

for client_name, client in clients_data.iteritems():

2699

2446

tcp_server.clients[client_name] = client_class(

2700

name = client_name,

2701

settings = client,

2702

server_settings = server_settings)

2447

name = client_name, settings = client)

2703

2448

2704

2449

if not tcp_server.clients:

2705

2450

logger.warning("No clients defined")

2706

2451

2707

if not foreground:

2708

if pidfile is not None:

2709

pid = os.getpid()

2710

try:

2711

with pidfile:

2712

print(pid, file=pidfile)

2713

except IOError:

2714

logger.error("Could not write to file %r with PID %d",

2715

pidfilename, pid)

2716

del pidfile

2452

if not debug:

2453

try:

2454

with pidfile:

2455

pid = os.getpid()

2456

pidfile.write(str(pid) + "\n".encode("utf-8"))

2457

del pidfile

2458

except IOError:

2459

logger.error("Could not write to file %r with PID %d",

2460

pidfilename, pid)

2461

except NameError:

2462

# "pidfile" was never created

2463

pass

2717

2464

del pidfilename

2465

signal.signal(signal.SIGINT, signal.SIG_IGN)

2718

2466

2719

2467

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2720

2468

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2721

2469

2722

2470

if use_dbus:

2723

2724

@alternate_dbus_interfaces(

2725

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2471

@alternate_dbus_interfaces({"se.recompile.Mandos":

2472

"se.bsnet.fukt.Mandos"})

2726

2473

class MandosDBusService(DBusObjectWithProperties):

2727

2474

"""A D-Bus proxy object"""

2728

2729

2475

def __init__(self):

2730

2476

dbus.service.Object.__init__(self, bus, "/")

2731

2732

2477

_interface = "se.recompile.Mandos"

2733

2478

2734

2479

@dbus_interface_annotations(_interface)

2735

2480

def _foo(self):

2736

return {

2737

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2738

"false" }

2481

return { "org.freedesktop.DBus.Property"

2482

".EmitsChangedSignal":

2483

"false"}

2739

2484

2740

2485

@dbus.service.signal(_interface, signature="o")

2741

2486

def ClientAdded(self, objpath):

2755

2500

@dbus.service.method(_interface, out_signature="ao")

2756

2501

def GetAllClients(self):

2757

2502

"D-Bus method"

2758

return dbus.Array(c.dbus_object_path for c in

2503

return dbus.Array(c.dbus_object_path

2504

for c in

2759

2505

tcp_server.clients.itervalues())

2760

2506

2761

2507

@dbus.service.method(_interface,

2763

2509

def GetAllClientsWithProperties(self):

2764

2510

"D-Bus method"

2765

2511

return dbus.Dictionary(

2766

{ c.dbus_object_path: c.GetAll("")

2767

for c in tcp_server.clients.itervalues() },

2512

((c.dbus_object_path, c.GetAll(""))

2513

for c in tcp_server.clients.itervalues()),

2768

2514

signature="oa{sv}")

2769

2515

2770

2516

@dbus.service.method(_interface, in_signature="o")

2787

2533

2788

2534

def cleanup():

2789

2535

"Cleanup function; run on exit"

2790

if zeroconf:

2791

service.cleanup()

2536

service.cleanup()

2792

2537

2793

2538

multiprocessing.active_children()

2794

wnull.close()

2795

2539

if not (tcp_server.clients or client_settings):

2796

2540

return

2797

2541

2808

2552

2809

2553

# A list of attributes that can not be pickled

2810

2554

# + secret.

2811

exclude = { "bus", "changedstate", "secret",

2812

"checker", "server_settings" }

2813

for name, typ in inspect.getmembers(dbus.service

2814

.Object):

2555

exclude = set(("bus", "changedstate", "secret",

2556

"checker"))

2557

for name, typ in (inspect.getmembers

2558

(dbus.service.Object)):

2815

2559

exclude.add(name)

2816

2560

2817

2561

client_dict["encrypted_secret"] = (client

2824

2568

del client_settings[client.name]["secret"]

2825

2569

2826

2570

try:

2827

with tempfile.NamedTemporaryFile(

2828

mode='wb',

2829

suffix=".pickle",

2830

prefix='clients-',

2831

dir=os.path.dirname(stored_state_path),

2832

delete=False) as stored_state:

2571

with (tempfile.NamedTemporaryFile

2572

(mode='wb', suffix=".pickle", prefix='clients-',

2573

dir=os.path.dirname(stored_state_path),

2574

delete=False)) as stored_state:

2833

2575

pickle.dump((clients, client_settings), stored_state)

2834

tempname = stored_state.name

2576

tempname=stored_state.name

2835

2577

os.rename(tempname, stored_state_path)

2836

2578

except (IOError, OSError) as e:

2837

2579

if not debug:

2840

2582

except NameError:

2841

2583

pass

2842

2584

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2843

logger.warning("Could not save persistent state: {}"

2585

logger.warning("Could not save persistent state: {0}"

2844

2586

.format(os.strerror(e.errno)))

2845

2587

else:

2846

2588

logger.warning("Could not save persistent state:",

2847

2589

exc_info=e)

2848

raise

2590

raise e

2849

2591

2850

2592

# Delete all clients, and settings from config

2851

2593

while tcp_server.clients:

2856

2598

client.disable(quiet=True)

2857

2599

if use_dbus:

2858

2600

# Emit D-Bus signal

2859

mandos_dbus_service.ClientRemoved(

2860

client.dbus_object_path, client.name)

2601

mandos_dbus_service.ClientRemoved(client

2602

.dbus_object_path,

2603

client.name)

2861

2604

client_settings.clear()

2862

2605

2863

2606

atexit.register(cleanup)

2874

2617

tcp_server.server_activate()

2875

2618

2876

2619

# Find out what port we got

2877

if zeroconf:

2878

service.port = tcp_server.socket.getsockname()[1]

2620

service.port = tcp_server.socket.getsockname()[1]

2879

2621

if use_ipv6:

2880

2622

logger.info("Now listening on address %r, port %d,"

2881

2623

" flowinfo %d, scope_id %d",

2887

2629

#service.interface = tcp_server.socket.getsockname()[3]

2888

2630

2889

2631

try:

2890

if zeroconf:

2891

# From the Avahi example code

2892

try:

2893

service.activate()

2894

except dbus.exceptions.DBusException as error:

2895

logger.critical("D-Bus Exception", exc_info=error)

2896

cleanup()

2897

sys.exit(1)

2898

# End of Avahi example code

2632

# From the Avahi example code

2633

try:

2634

service.activate()

2635

except dbus.exceptions.DBusException as error:

2636

logger.critical("D-Bus Exception", exc_info=error)

2637

cleanup()

2638

sys.exit(1)

2639

# End of Avahi example code

2899

2640

2900

2641

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2901

2642

lambda *args, **kwargs:

2916

2657

# Must run before the D-Bus bus name gets deregistered

2917

2658

cleanup()

2918

2659

2919

2920

2660

if __name__ == '__main__':

2921

2661

main()