/mandos/release : revision 237.7.154

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

39

import SocketServer as socketserver

43

40

import socket

44

41

import argparse

45

42

import datetime

50

47

import gnutls.library.functions

51

48

import gnutls.library.constants

52

49

import gnutls.library.types

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

50

import ConfigParser as configparser

57

51

import sys

58

52

import re

59

53

import os

68

62

import struct

69

63

import fcntl

70

64

import functools

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

65

import cPickle as pickle

75

66

import multiprocessing

76

67

import types

77

68

import binascii

78

69

import tempfile

79

70

import itertools

80

import collections

81

import codecs

82

71

83

72

import dbus

84

73

import dbus.service

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

74

import gobject

89

75

import avahi

90

76

from dbus.mainloop.glib import DBusGMainLoop

91

77

import ctypes

92

78

import ctypes.util

93

79

import xml.dom.minidom

94

80

import inspect

81

import GnuPGInterface

95

82

96

83

try:

97

84

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

101

88

except ImportError:

102

89

SO_BINDTODEVICE = None

103

90

104

if sys.version_info.major == 2:

105

str = unicode

106

107

version = "1.6.9"

91

version = "1.5.5"

108

92

stored_state_file = "clients.pickle"

109

93

110

94

logger = logging.getLogger()

111

syslogger = None

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

112

98

113

99

try:

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

116

103

except (OSError, AttributeError):

117

118

104

def if_nametoindex(interface):

119

105

"Get an interface index the hard way, i.e. using fcntl()"

120

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

121

107

with contextlib.closing(socket.socket()) as s:

122

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

123

struct.pack(b"16s16x", interface))

124

interface_index = struct.unpack("I", ifreq[16:20])[0]

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

125

113

return interface_index

126

114

127

115

128

116

def initlogger(debug, level=logging.WARNING):

129

117

"""init logger and add loglevel"""

130

118

131

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

135

119

syslogger.setFormatter(logging.Formatter

136

120

('Mandos [%(process)d]: %(levelname)s:'

137

121

' %(message)s'))

154

138

155

139

class PGPEngine(object):

156

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

158

141

def __init__(self):

142

self.gnupg = GnuPGInterface.GnuPG()

159

143

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

160

self.gnupgargs = ['--batch',

161

'--home', self.tempdir,

162

'--force-mdc',

163

'--quiet',

164

'--no-use-agent']

144

self.gnupg = GnuPGInterface.GnuPG()

145

self.gnupg.options.meta_interactive = False

146

self.gnupg.options.homedir = self.tempdir

147

self.gnupg.options.extra_args.extend(['--force-mdc',

148

'--quiet',

149

'--no-use-agent'])

165

150

166

151

def __enter__(self):

167

152

return self

189

174

def password_encode(self, password):

190

175

# Passphrase can not be empty and can not contain newlines or

191

176

# NUL bytes. So we prefix it and hex encode it.

192

encoded = b"mandos" + binascii.hexlify(password)

193

if len(encoded) > 2048:

194

# GnuPG can't handle long passwords, so encode differently

195

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

196

.replace(b"\n", b"\\n")

197

.replace(b"\0", b"\\x00"))

198

return encoded

177

return b"mandos" + binascii.hexlify(password)

199

178

200

179

def encrypt(self, data, password):

201

passphrase = self.password_encode(password)

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

204

passfile.write(passphrase)

205

passfile.flush()

206

proc = subprocess.Popen(['gpg', '--symmetric',

207

'--passphrase-file',

208

passfile.name]

209

+ self.gnupgargs,

210

stdin = subprocess.PIPE,

211

stdout = subprocess.PIPE,

212

stderr = subprocess.PIPE)

213

ciphertext, err = proc.communicate(input = data)

214

if proc.returncode != 0:

215

raise PGPError(err)

180

self.gnupg.passphrase = self.password_encode(password)

181

with open(os.devnull, "w") as devnull:

182

try:

183

proc = self.gnupg.run(['--symmetric'],

184

create_fhs=['stdin', 'stdout'],

185

attach_fhs={'stderr': devnull})

186

with contextlib.closing(proc.handles['stdin']) as f:

187

f.write(data)

188

with contextlib.closing(proc.handles['stdout']) as f:

189

ciphertext = f.read()

190

proc.wait()

191

except IOError as e:

192

raise PGPError(e)

193

self.gnupg.passphrase = None

216

194

return ciphertext

217

195

218

196

def decrypt(self, data, password):

219

passphrase = self.password_encode(password)

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

222

passfile.write(passphrase)

223

passfile.flush()

224

proc = subprocess.Popen(['gpg', '--decrypt',

225

'--passphrase-file',

226

passfile.name]

227

+ self.gnupgargs,

228

stdin = subprocess.PIPE,

229

stdout = subprocess.PIPE,

230

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

232

if proc.returncode != 0:

233

raise PGPError(err)

197

self.gnupg.passphrase = self.password_encode(password)

198

with open(os.devnull, "w") as devnull:

199

try:

200

proc = self.gnupg.run(['--decrypt'],

201

create_fhs=['stdin', 'stdout'],

202

attach_fhs={'stderr': devnull})

203

with contextlib.closing(proc.handles['stdin']) as f:

204

f.write(data)

205

with contextlib.closing(proc.handles['stdout']) as f:

206

decrypted_plaintext = f.read()

207

proc.wait()

208

except IOError as e:

209

raise PGPError(e)

210

self.gnupg.passphrase = None

234

211

return decrypted_plaintext

235

212

236

213

237

214

class AvahiError(Exception):

238

215

def __init__(self, value, *args, **kwargs):

239

216

self.value = value

240

return super(AvahiError, self).__init__(value, *args,

241

**kwargs)

242

217

super(AvahiError, self).__init__(value, *args, **kwargs)

218

def __unicode__(self):

219

return unicode(repr(self.value))

243

220

244

221

class AvahiServiceError(AvahiError):

245

222

pass

246

223

247

248

224

class AvahiGroupError(AvahiError):

249

225

pass

250

226

257

233

Used to optionally bind to the specified interface.

258

234

name: string; Example: 'Mandos'

259

235

type: string; Example: '_mandos._tcp'.

260

See <https://www.iana.org/assignments/service-names-port-numbers>

236

See <http://www.dns-sd.org/ServiceTypes.html>

261

237

port: integer; what port to announce

262

238

TXT: list of strings; TXT record for the service

263

239

domain: string; Domain to publish on, default to .local if empty.

270

246

bus: dbus.SystemBus()

271

247

"""

272

248

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

249

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

250

servicetype = None, port = None, TXT = None,

251

domain = "", host = "", max_renames = 32768,

252

protocol = avahi.PROTO_UNSPEC, bus = None):

284

253

self.interface = interface

285

254

self.name = name

286

255

self.type = servicetype

296

265

self.bus = bus

297

266

self.entry_group_state_changed_match = None

298

267

299

def rename(self, remove=True):

268

def rename(self):

300

269

"""Derived from the Avahi example code"""

301

270

if self.rename_count >= self.max_renames:

302

271

logger.critical("No suitable Zeroconf service name found"

303

272

" after %i retries, exiting.",

304

273

self.rename_count)

305

274

raise AvahiServiceError("Too many renames")

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

275

self.name = unicode(self.server

276

.GetAlternativeServiceName(self.name))

309

277

logger.info("Changing Zeroconf service name to %r ...",

310

278

self.name)

311

if remove:

312

self.remove()

279

self.remove()

313

280

try:

314

281

self.add()

315

282

except dbus.exceptions.DBusException as error:

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

283

logger.critical("D-Bus Exception", exc_info=error)

284

self.cleanup()

285

os._exit(1)

286

self.rename_count += 1

324

287

325

288

def remove(self):

326

289

"""Derived from the Avahi example code"""

364

327

self.rename()

365

328

elif state == avahi.ENTRY_GROUP_FAILURE:

366

329

logger.critical("Avahi: Error in group state changed %s",

367

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

330

unicode(error))

331

raise AvahiGroupError("State changed: {0!s}"

332

.format(error))

369

333

370

334

def cleanup(self):

371

335

"""Derived from the Avahi example code"""

381

345

def server_state_changed(self, state, error=None):

382

346

"""Derived from the Avahi example code"""

383

347

logger.debug("Avahi server state change: %i", state)

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

348

bad_states = { avahi.SERVER_INVALID:

349

"Zeroconf server invalid",

350

avahi.SERVER_REGISTERING: None,

351

avahi.SERVER_COLLISION:

352

"Zeroconf server name collision",

353

avahi.SERVER_FAILURE:

354

"Zeroconf server failure" }

390

355

if state in bad_states:

391

356

if bad_states[state] is not None:

392

357

if error is None:

411

376

follow_name_owner_changes=True),

412

377

avahi.DBUS_INTERFACE_SERVER)

413

378

self.server.connect_to_signal("StateChanged",

414

self.server_state_changed)

379

self.server_state_changed)

415

380

self.server_state_changed(self.server.GetState())

416

381

417

382

418

383

class AvahiServiceToSyslog(AvahiService):

419

def rename(self, *args, **kwargs):

384

def rename(self):

420

385

"""Add the new name to the syslog messages"""

421

ret = AvahiService.rename(self, *args, **kwargs)

422

syslogger.setFormatter(logging.Formatter(

423

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

424

.format(self.name)))

386

ret = AvahiService.rename(self)

387

syslogger.setFormatter(logging.Formatter

388

('Mandos ({0}) [%(process)d]:'

389

' %(levelname)s: %(message)s'

390

.format(self.name)))

425

391

return ret

426

392

427

393

394

def timedelta_to_milliseconds(td):

395

"Convert a datetime.timedelta() to milliseconds"

396

return ((td.days * 24 * 60 * 60 * 1000)

397

+ (td.seconds * 1000)

398

+ (td.microseconds // 1000))

399

400

428

401

class Client(object):

429

402

"""A representation of a client host served by this server.

430

403

466

439

runtime_expansions: Allowed attributes for runtime expansion.

467

440

expires: datetime.datetime(); time (UTC) when a client will be

468

441

disabled, or None

469

server_settings: The server_settings dict from main()

470

442

"""

471

443

472

444

runtime_expansions = ("approval_delay", "approval_duration",

474

446

"fingerprint", "host", "interval",

475

447

"last_approval_request", "last_checked_ok",

476

448

"last_enabled", "name", "timeout")

477

client_defaults = {

478

"timeout": "PT5M",

479

"extended_timeout": "PT15M",

480

"interval": "PT2M",

481

"checker": "fping -q -- %%(host)s",

482

"host": "",

483

"approval_delay": "PT0S",

484

"approval_duration": "PT1S",

485

"approved_by_default": "True",

486

"enabled": "True",

487

}

449

client_defaults = { "timeout": "5m",

450

"extended_timeout": "15m",

451

"interval": "2m",

452

"checker": "fping -q -- %%(host)s",

453

"host": "",

454

"approval_delay": "0s",

455

"approval_duration": "1s",

456

"approved_by_default": "True",

457

"enabled": "True",

458

}

459

460

def timeout_milliseconds(self):

461

"Return the 'timeout' attribute in milliseconds"

462

return timedelta_to_milliseconds(self.timeout)

463

464

def extended_timeout_milliseconds(self):

465

"Return the 'extended_timeout' attribute in milliseconds"

466

return timedelta_to_milliseconds(self.extended_timeout)

467

468

def interval_milliseconds(self):

469

"Return the 'interval' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.interval)

471

472

def approval_delay_milliseconds(self):

473

return timedelta_to_milliseconds(self.approval_delay)

488

474

489

475

@staticmethod

490

476

def config_parser(config):

506

492

client["enabled"] = config.getboolean(client_name,

507

493

"enabled")

508

494

509

# Uppercase and remove spaces from fingerprint for later

510

# comparison purposes with return value from the

511

# fingerprint() function

512

495

client["fingerprint"] = (section["fingerprint"].upper()

513

496

.replace(" ", ""))

514

497

if "secret" in section:

519

502

"rb") as secfile:

520

503

client["secret"] = secfile.read()

521

504

else:

522

raise TypeError("No secret or secfile for section {}"

505

raise TypeError("No secret or secfile for section {0}"

523

506

.format(section))

524

507

client["timeout"] = string_to_delta(section["timeout"])

525

508

client["extended_timeout"] = string_to_delta(

536

519

537

520

return settings

538

521

539

def __init__(self, settings, name = None, server_settings=None):

522

def __init__(self, settings, name = None):

540

523

self.name = name

541

if server_settings is None:

542

server_settings = {}

543

self.server_settings = server_settings

544

524

# adding all client settings

545

for setting, value in settings.items():

525

for setting, value in settings.iteritems():

546

526

setattr(self, setting, value)

547

527

548

528

if self.enabled:

556

536

self.expires = None

557

537

558

538

logger.debug("Creating client %r", self.name)

539

# Uppercase and remove spaces from fingerprint for later

540

# comparison purposes with return value from the fingerprint()

541

# function

559

542

logger.debug(" Fingerprint: %s", self.fingerprint)

560

543

self.created = settings.get("created",

561

544

datetime.datetime.utcnow())

568

551

self.current_checker_command = None

569

552

self.approved = None

570

553

self.approvals_pending = 0

571

self.changedstate = multiprocessing_manager.Condition(

572

multiprocessing_manager.Lock())

573

self.client_structure = [attr

574

for attr in self.__dict__.iterkeys()

554

self.changedstate = (multiprocessing_manager

555

.Condition(multiprocessing_manager

556

.Lock()))

557

self.client_structure = [attr for attr in

558

self.__dict__.iterkeys()

575

559

if not attr.startswith("_")]

576

560

self.client_structure.append("client_structure")

577

561

578

for name, t in inspect.getmembers(

579

type(self), lambda obj: isinstance(obj, property)):

562

for name, t in inspect.getmembers(type(self),

563

lambda obj:

564

isinstance(obj,

565

property)):

580

566

if not name.startswith("_"):

581

567

self.client_structure.append(name)

582

568

624

610

# and every interval from then on.

625

611

if self.checker_initiator_tag is not None:

626

612

gobject.source_remove(self.checker_initiator_tag)

627

self.checker_initiator_tag = gobject.timeout_add(

628

int(self.interval.total_seconds() * 1000),

629

self.start_checker)

613

self.checker_initiator_tag = (gobject.timeout_add

614

(self.interval_milliseconds(),

615

self.start_checker))

630

616

# Schedule a disable() when 'timeout' has passed

631

617

if self.disable_initiator_tag is not None:

632

618

gobject.source_remove(self.disable_initiator_tag)

633

self.disable_initiator_tag = gobject.timeout_add(

634

int(self.timeout.total_seconds() * 1000), self.disable)

619

self.disable_initiator_tag = (gobject.timeout_add

620

(self.timeout_milliseconds(),

621

self.disable))

635

622

# Also start a new checker *right now*.

636

623

self.start_checker()

637

624

646

633

vars(self))

647

634

self.checked_ok()

648

635

else:

649

logger.info("Checker for %(name)s failed", vars(self))

636

logger.info("Checker for %(name)s failed",

637

vars(self))

650

638

else:

651

639

self.last_checker_status = -1

652

640

logger.warning("Checker for %(name)s crashed?",

666

654

gobject.source_remove(self.disable_initiator_tag)

667

655

self.disable_initiator_tag = None

668

656

if getattr(self, "enabled", False):

669

self.disable_initiator_tag = gobject.timeout_add(

670

int(timeout.total_seconds() * 1000), self.disable)

657

self.disable_initiator_tag = (gobject.timeout_add

658

(timedelta_to_milliseconds

659

(timeout), self.disable))

671

660

self.expires = datetime.datetime.utcnow() + timeout

672

661

673

662

def need_approval(self):

690

679

# If a checker exists, make sure it is not a zombie

691

680

try:

692

681

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

693

except AttributeError:

694

pass

695

except OSError as error:

696

if error.errno != errno.ECHILD:

697

raise

682

except (AttributeError, OSError) as error:

683

if (isinstance(error, OSError)

684

and error.errno != errno.ECHILD):

685

raise error

698

686

else:

699

687

if pid:

700

688

logger.warning("Checker was a zombie")

704

692

# Start a new checker if needed

705

693

if self.checker is None:

706

694

# Escape attributes for the shell

707

escaped_attrs = {

708

attr: re.escape(str(getattr(self, attr)))

709

for attr in self.runtime_expansions }

695

escaped_attrs = dict(

696

(attr, re.escape(unicode(getattr(self, attr))))

697

for attr in

698

self.runtime_expansions)

710

699

try:

711

700

command = self.checker_command % escaped_attrs

712

701

except TypeError as error:

713

702

logger.error('Could not format string "%s"',

714

self.checker_command,

715

exc_info=error)

716

return True # Try again later

703

self.checker_command, exc_info=error)

704

return True # Try again later

717

705

self.current_checker_command = command

718

706

try:

719

logger.info("Starting checker %r for %s", command,

720

self.name)

707

logger.info("Starting checker %r for %s",

708

command, self.name)

721

709

# We don't need to redirect stdout and stderr, since

722

710

# in normal mode, that is already done by daemon(),

723

711

# and in debug mode we don't want to. (Stdin is

724

712

# always replaced by /dev/null.)

725

# The exception is when not debugging but nevertheless

726

# running in the foreground; use the previously

727

# created wnull.

728

popen_args = {}

729

if (not self.server_settings["debug"]

730

and self.server_settings["foreground"]):

731

popen_args.update({"stdout": wnull,

732

"stderr": wnull })

733

713

self.checker = subprocess.Popen(command,

734

714

close_fds=True,

735

shell=True,

736

cwd="/",

737

**popen_args)

715

shell=True, cwd="/")

738

716

except OSError as error:

739

717

logger.error("Failed to start subprocess",

740

718

exc_info=error)

741

return True

742

self.checker_callback_tag = gobject.child_watch_add(

743

self.checker.pid, self.checker_callback, data=command)

719

self.checker_callback_tag = (gobject.child_watch_add

720

(self.checker.pid,

721

self.checker_callback,

722

data=command))

744

723

# The checker may have completed before the gobject

745

724

# watch was added. Check for this.

746

try:

747

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

748

except OSError as error:

749

if error.errno == errno.ECHILD:

750

# This should never happen

751

logger.error("Child process vanished",

752

exc_info=error)

753

return True

754

raise

725

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

755

726

if pid:

756

727

gobject.source_remove(self.checker_callback_tag)

757

728

self.checker_callback(pid, status, command)

777

748

self.checker = None

778

749

779

750

780

def dbus_service_property(dbus_interface,

781

signature="v",

782

access="readwrite",

783

byte_arrays=False):

751

def dbus_service_property(dbus_interface, signature="v",

752

access="readwrite", byte_arrays=False):

784

753

"""Decorators for marking methods of a DBusObjectWithProperties to

785

754

become properties on the D-Bus.

786

755

795

764

# "Set" method, so we fail early here:

796

765

if byte_arrays and signature != "ay":

797

766

raise ValueError("Byte arrays not supported for non-'ay'"

798

" signature {!r}".format(signature))

799

767

" signature {0!r}".format(signature))

800

768

def decorator(func):

801

769

func._dbus_is_property = True

802

770

func._dbus_interface = dbus_interface

807

775

func._dbus_name = func._dbus_name[:-14]

808

776

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

809

777

return func

810

811

778

return decorator

812

779

813

780

822

789

"org.freedesktop.DBus.Property.EmitsChangedSignal":

823

790

"false"}

824

791

"""

825

826

792

def decorator(func):

827

793

func._dbus_is_interface = True

828

794

func._dbus_interface = dbus_interface

829

795

func._dbus_name = dbus_interface

830

796

return func

831

832

797

return decorator

833

798

834

799

836

801

"""Decorator to annotate D-Bus methods, signals or properties

837

802

Usage:

838

803

839

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

840

"org.freedesktop.DBus.Property."

841

"EmitsChangedSignal": "false"})

842

804

@dbus_service_property("org.example.Interface", signature="b",

843

805

access="r")

806

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

807

"org.freedesktop.DBus.Property."

808

"EmitsChangedSignal": "false"})

844

809

def Property_dbus_property(self):

845

810

return dbus.Boolean(False)

846

811

"""

847

848

812

def decorator(func):

849

813

func._dbus_annotations = annotations

850

814

return func

851

852

815

return decorator

853

816

854

817

855

818

class DBusPropertyException(dbus.exceptions.DBusException):

856

819

"""A base class for D-Bus property-related exceptions

857

820

"""

858

pass

821

def __unicode__(self):

822

return unicode(str(self))

859

823

860

824

861

825

class DBusPropertyAccessException(DBusPropertyException):

885

849

If called like _is_dbus_thing("method") it returns a function

886

850

suitable for use as predicate to inspect.getmembers().

887

851

"""

888

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

852

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

889

853

False)

890

854

891

855

def _get_all_dbus_things(self, thing):

892

856

"""Returns a generator of (name, attribute) pairs

893

857

"""

894

return ((getattr(athing.__get__(self), "_dbus_name", name),

858

return ((getattr(athing.__get__(self), "_dbus_name",

859

name),

895

860

athing.__get__(self))

896

861

for cls in self.__class__.__mro__

897

862

for name, athing in

898

inspect.getmembers(cls, self._is_dbus_thing(thing)))

863

inspect.getmembers(cls,

864

self._is_dbus_thing(thing)))

899

865

900

866

def _get_dbus_property(self, interface_name, property_name):

901

867

"""Returns a bound method if one exists which is a D-Bus

902

868

property with the specified name and interface.

903

869

"""

904

for cls in self.__class__.__mro__:

905

for name, value in inspect.getmembers(

906

cls, self._is_dbus_thing("property")):

870

for cls in self.__class__.__mro__:

871

for name, value in (inspect.getmembers

872

(cls,

873

self._is_dbus_thing("property"))):

907

874

if (value._dbus_name == property_name

908

875

and value._dbus_interface == interface_name):

909

876

return value.__get__(self)

910

877

911

878

# No such property

912

raise DBusPropertyNotFound("{}:{}.{}".format(

913

self.dbus_object_path, interface_name, property_name))

879

raise DBusPropertyNotFound(self.dbus_object_path + ":"

880

+ interface_name + "."

881

+ property_name)

914

882

915

@dbus.service.method(dbus.PROPERTIES_IFACE,

916

in_signature="ss",

883

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

917

884

out_signature="v")

918

885

def Get(self, interface_name, property_name):

919

886

"""Standard D-Bus property Get() method, see D-Bus standard.

937

904

# The byte_arrays option is not supported yet on

938

905

# signatures other than "ay".

939

906

if prop._dbus_signature != "ay":

940

raise ValueError("Byte arrays not supported for non-"

941

"'ay' signature {!r}"

942

.format(prop._dbus_signature))

907

raise ValueError

943

908

value = dbus.ByteArray(b''.join(chr(byte)

944

909

for byte in value))

945

910

prop(value)

946

911

947

@dbus.service.method(dbus.PROPERTIES_IFACE,

948

in_signature="s",

912

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

949

913

out_signature="a{sv}")

950

914

def GetAll(self, interface_name):

951

915

"""Standard D-Bus property GetAll() method, see D-Bus

966

930

if not hasattr(value, "variant_level"):

967

931

properties[name] = value

968

932

continue

969

properties[name] = type(value)(

970

value, variant_level = value.variant_level + 1)

933

properties[name] = type(value)(value, variant_level=

934

value.variant_level+1)

971

935

return dbus.Dictionary(properties, signature="sv")

972

936

973

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

974

def PropertiesChanged(self, interface_name, changed_properties,

975

invalidated_properties):

976

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

977

standard.

978

"""

979

pass

980

981

937

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

982

938

out_signature="s",

983

939

path_keyword='object_path',

991

947

connection)

992

948

try:

993

949

document = xml.dom.minidom.parseString(xmlstring)

994

995

950

def make_tag(document, name, prop):

996

951

e = document.createElement("property")

997

952

e.setAttribute("name", name)

998

953

e.setAttribute("type", prop._dbus_signature)

999

954

e.setAttribute("access", prop._dbus_access)

1000

955

return e

1001

1002

956

for if_tag in document.getElementsByTagName("interface"):

1003

957

# Add property tags

1004

958

for tag in (make_tag(document, name, prop)

1016

970

if (name == tag.getAttribute("name")

1017

971

and prop._dbus_interface

1018

972

== if_tag.getAttribute("name")):

1019

annots.update(getattr(

1020

prop, "_dbus_annotations", {}))

1021

for name, value in annots.items():

973

annots.update(getattr

974

(prop,

975

"_dbus_annotations",

976

{}))

977

for name, value in annots.iteritems():

1022

978

ann_tag = document.createElement(

1023

979

"annotation")

1024

980

ann_tag.setAttribute("name", name)

1027

983

# Add interface annotation tags

1028

984

for annotation, value in dict(

1029

985

itertools.chain.from_iterable(

1030

annotations().items()

1031

for name, annotations

1032

in self._get_all_dbus_things("interface")

986

annotations().iteritems()

987

for name, annotations in

988

self._get_all_dbus_things("interface")

1033

989

if name == if_tag.getAttribute("name")

1034

)).items():

990

)).iteritems():

1035

991

ann_tag = document.createElement("annotation")

1036

992

ann_tag.setAttribute("name", annotation)

1037

993

ann_tag.setAttribute("value", value)

1064

1020

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1065

1021

if dt is None:

1066

1022

return dbus.String("", variant_level = variant_level)

1067

return dbus.String(dt.isoformat(), variant_level=variant_level)

1023

return dbus.String(dt.isoformat(),

1024

variant_level=variant_level)

1068

1025

1069

1026

1070

1027

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1090

1047

(from DBusObjectWithProperties) and interfaces (from the

1091

1048

dbus_interface_annotations decorator).

1092

1049

"""

1093

1094

1050

def wrapper(cls):

1095

1051

for orig_interface_name, alt_interface_name in (

1096

alt_interface_names.items()):

1052

alt_interface_names.iteritems()):

1097

1053

attr = {}

1098

1054

interface_names = set()

1099

1055

# Go though all attributes of the class

1101

1057

# Ignore non-D-Bus attributes, and D-Bus attributes

1102

1058

# with the wrong interface name

1103

1059

if (not hasattr(attribute, "_dbus_interface")

1104

or not attribute._dbus_interface.startswith(

1105

orig_interface_name)):

1060

or not attribute._dbus_interface

1061

.startswith(orig_interface_name)):

1106

1062

continue

1107

1063

# Create an alternate D-Bus interface name based on

1108

1064

# the current name

1109

alt_interface = attribute._dbus_interface.replace(

1110

orig_interface_name, alt_interface_name)

1065

alt_interface = (attribute._dbus_interface

1066

.replace(orig_interface_name,

1067

alt_interface_name))

1111

1068

interface_names.add(alt_interface)

1112

1069

# Is this a D-Bus signal?

1113

1070

if getattr(attribute, "_dbus_is_signal", False):

1114

# Extract the original non-method undecorated

1115

# function by black magic

1071

# Extract the original non-method function by

1072

# black magic

1116

1073

nonmethod_func = (dict(

1117

zip(attribute.func_code.co_freevars,

1118

attribute.__closure__))

1119

["func"].cell_contents)

1074

zip(attribute.func_code.co_freevars,

1075

attribute.__closure__))["func"]

1076

.cell_contents)

1120

1077

# Create a new, but exactly alike, function

1121

1078

# object, and decorate it to be a new D-Bus signal

1122

1079

# with the alternate D-Bus interface name

1123

new_function = (dbus.service.signal(

1124

alt_interface, attribute._dbus_signature)

1080

new_function = (dbus.service.signal

1081

(alt_interface,

1082

attribute._dbus_signature)

1125

1083

(types.FunctionType(

1126

nonmethod_func.func_code,

1127

nonmethod_func.func_globals,

1128

nonmethod_func.func_name,

1129

nonmethod_func.func_defaults,

1130

nonmethod_func.func_closure)))

1084

nonmethod_func.func_code,

1085

nonmethod_func.func_globals,

1086

nonmethod_func.func_name,

1087

nonmethod_func.func_defaults,

1088

nonmethod_func.func_closure)))

1131

1089

# Copy annotations, if any

1132

1090

try:

1133

new_function._dbus_annotations = dict(

1134

attribute._dbus_annotations)

1091

new_function._dbus_annotations = (

1092

dict(attribute._dbus_annotations))

1135

1093

except AttributeError:

1136

1094

pass

1137

1095

# Define a creator of a function to call both the

1142

1100

"""This function is a scope container to pass

1143

1101

func1 and func2 to the "call_both" function

1144

1102

outside of its arguments"""

1145

1146

1103

def call_both(*args, **kwargs):

1147

1104

"""This function will emit two D-Bus

1148

1105

signals by calling func1 and func2"""

1149

1106

func1(*args, **kwargs)

1150

1107

func2(*args, **kwargs)

1151

1152

1108

return call_both

1153

1109

# Create the "call_both" function and add it to

1154

1110

# the class

1159

1115

# object. Decorate it to be a new D-Bus method

1160

1116

# with the alternate D-Bus interface name. Add it

1161

1117

# to the class.

1162

attr[attrname] = (

1163

dbus.service.method(

1164

alt_interface,

1165

attribute._dbus_in_signature,

1166

attribute._dbus_out_signature)

1167

(types.FunctionType(attribute.func_code,

1168

attribute.func_globals,

1169

attribute.func_name,

1170

attribute.func_defaults,

1171

attribute.func_closure)))

1118

attr[attrname] = (dbus.service.method

1119

(alt_interface,

1120

attribute._dbus_in_signature,

1121

attribute._dbus_out_signature)

1122

(types.FunctionType

1123

(attribute.func_code,

1124

attribute.func_globals,

1125

attribute.func_name,

1126

attribute.func_defaults,

1127

attribute.func_closure)))

1172

1128

# Copy annotations, if any

1173

1129

try:

1174

attr[attrname]._dbus_annotations = dict(

1175

attribute._dbus_annotations)

1130

attr[attrname]._dbus_annotations = (

1131

dict(attribute._dbus_annotations))

1176

1132

except AttributeError:

1177

1133

pass

1178

1134

# Is this a D-Bus property?

1181

1137

# object, and decorate it to be a new D-Bus

1182

1138

# property with the alternate D-Bus interface

1183

1139

# name. Add it to the class.

1184

attr[attrname] = (dbus_service_property(

1185

alt_interface, attribute._dbus_signature,

1186

attribute._dbus_access,

1187

attribute._dbus_get_args_options

1188

["byte_arrays"])

1189

(types.FunctionType(

1190

attribute.func_code,

1191

attribute.func_globals,

1192

attribute.func_name,

1193

attribute.func_defaults,

1194

attribute.func_closure)))

1140

attr[attrname] = (dbus_service_property

1141

(alt_interface,

1142

attribute._dbus_signature,

1143

attribute._dbus_access,

1144

attribute

1145

._dbus_get_args_options

1146

["byte_arrays"])

1147

(types.FunctionType

1148

(attribute.func_code,

1149

attribute.func_globals,

1150

attribute.func_name,

1151

attribute.func_defaults,

1152

attribute.func_closure)))

1195

1153

# Copy annotations, if any

1196

1154

try:

1197

attr[attrname]._dbus_annotations = dict(

1198

attribute._dbus_annotations)

1155

attr[attrname]._dbus_annotations = (

1156

dict(attribute._dbus_annotations))

1199

1157

except AttributeError:

1200

1158

pass

1201

1159

# Is this a D-Bus interface?

1204

1162

# object. Decorate it to be a new D-Bus interface

1205

1163

# with the alternate D-Bus interface name. Add it

1206

1164

# to the class.

1207

attr[attrname] = (

1208

dbus_interface_annotations(alt_interface)

1209

(types.FunctionType(attribute.func_code,

1210

attribute.func_globals,

1211

attribute.func_name,

1212

attribute.func_defaults,

1213

attribute.func_closure)))

1165

attr[attrname] = (dbus_interface_annotations

1166

(alt_interface)

1167

(types.FunctionType

1168

(attribute.func_code,

1169

attribute.func_globals,

1170

attribute.func_name,

1171

attribute.func_defaults,

1172

attribute.func_closure)))

1214

1173

if deprecate:

1215

1174

# Deprecate all alternate interfaces

1216

iname="_AlternateDBusNames_interface_annotation{}"

1175

iname="_AlternateDBusNames_interface_annotation{0}"

1217

1176

for interface_name in interface_names:

1218

1219

1177

@dbus_interface_annotations(interface_name)

1220

1178

def func(self):

1221

1179

return { "org.freedesktop.DBus.Deprecated":

1222

"true" }

1180

"true" }

1223

1181

# Find an unused name

1224

1182

for aname in (iname.format(i)

1225

1183

for i in itertools.count()):

1229

1187

if interface_names:

1230

1188

# Replace the class with a new subclass of it with

1231

1189

# methods, signals, etc. as created above.

1232

cls = type(b"{}Alternate".format(cls.__name__),

1233

(cls, ), attr)

1190

cls = type(b"{0}Alternate".format(cls.__name__),

1191

(cls,), attr)

1234

1192

return cls

1235

1236

1193

return wrapper

1237

1194

1238

1195

1239

1196

@alternate_dbus_interfaces({"se.recompile.Mandos":

1240

"se.bsnet.fukt.Mandos"})

1197

"se.bsnet.fukt.Mandos"})

1241

1198

class ClientDBus(Client, DBusObjectWithProperties):

1242

1199

"""A Client class using D-Bus

1243

1200

1247

1204

"""

1248

1205

1249

1206

runtime_expansions = (Client.runtime_expansions

1250

+ ("dbus_object_path", ))

1251

1252

_interface = "se.recompile.Mandos.Client"

1207

+ ("dbus_object_path",))

1253

1208

1254

1209

# dbus.service.Object doesn't use super(), so we can't either.

1255

1210

1258

1213

Client.__init__(self, *args, **kwargs)

1259

1214

# Only now, when this client is initialized, can it show up on

1260

1215

# the D-Bus

1261

client_object_name = str(self.name).translate(

1216

client_object_name = unicode(self.name).translate(

1262

1217

{ord("."): ord("_"),

1263

1218

ord("-"): ord("_")})

1264

self.dbus_object_path = dbus.ObjectPath(

1265

"/clients/" + client_object_name)

1219

self.dbus_object_path = (dbus.ObjectPath

1220

("/clients/" + client_object_name))

1266

1221

DBusObjectWithProperties.__init__(self, self.bus,

1267

1222

self.dbus_object_path)

1268

1223

1269

def notifychangeproperty(transform_func, dbus_name,

1270

type_func=lambda x: x,

1271

variant_level=1,

1272

invalidate_only=False,

1273

_interface=_interface):

1224

def notifychangeproperty(transform_func,

1225

dbus_name, type_func=lambda x: x,

1226

variant_level=1):

1274

1227

""" Modify a variable so that it's a property which announces

1275

1228

its changes to DBus.

1276

1229

1281

1234

to the D-Bus. Default: no transform

1282

1235

variant_level: D-Bus variant level. Default: 1

1283

1236

"""

1284

attrname = "_{}".format(dbus_name)

1285

1237

attrname = "_{0}".format(dbus_name)

1286

1238

def setter(self, value):

1287

1239

if hasattr(self, "dbus_object_path"):

1288

1240

if (not hasattr(self, attrname) or

1289

1241

type_func(getattr(self, attrname, None))

1290

1242

!= type_func(value)):

1291

if invalidate_only:

1292

self.PropertiesChanged(

1293

_interface, dbus.Dictionary(),

1294

dbus.Array((dbus_name, )))

1295

else:

1296

dbus_value = transform_func(

1297

type_func(value),

1298

variant_level = variant_level)

1299

self.PropertyChanged(dbus.String(dbus_name),

1300

dbus_value)

1301

self.PropertiesChanged(

1302

_interface,

1303

dbus.Dictionary({ dbus.String(dbus_name):

1304

dbus_value }),

1305

dbus.Array())

1243

dbus_value = transform_func(type_func(value),

1244

variant_level

1245

=variant_level)

1246

self.PropertyChanged(dbus.String(dbus_name),

1247

dbus_value)

1306

1248

setattr(self, attrname, value)

1307

1249

1308

1250

return property(lambda self: getattr(self, attrname), setter)

1314

1256

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1315

1257

last_enabled = notifychangeproperty(datetime_to_dbus,

1316

1258

"LastEnabled")

1317

checker = notifychangeproperty(

1318

dbus.Boolean, "CheckerRunning",

1319

type_func = lambda checker: checker is not None)

1259

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1260

type_func = lambda checker:

1261

checker is not None)

1320

1262

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1321

1263

"LastCheckedOK")

1322

1264

last_checker_status = notifychangeproperty(dbus.Int16,

1325

1267

datetime_to_dbus, "LastApprovalRequest")

1326

1268

approved_by_default = notifychangeproperty(dbus.Boolean,

1327

1269

"ApprovedByDefault")

1328

approval_delay = notifychangeproperty(

1329

dbus.UInt64, "ApprovalDelay",

1330

type_func = lambda td: td.total_seconds() * 1000)

1270

approval_delay = notifychangeproperty(dbus.UInt64,

1271

"ApprovalDelay",

1272

type_func =

1273

timedelta_to_milliseconds)

1331

1274

approval_duration = notifychangeproperty(

1332

1275

dbus.UInt64, "ApprovalDuration",

1333

type_func = lambda td: td.total_seconds() * 1000)

1276

type_func = timedelta_to_milliseconds)

1334

1277

host = notifychangeproperty(dbus.String, "Host")

1335

timeout = notifychangeproperty(

1336

dbus.UInt64, "Timeout",

1337

type_func = lambda td: td.total_seconds() * 1000)

1278

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1279

type_func =

1280

timedelta_to_milliseconds)

1338

1281

extended_timeout = notifychangeproperty(

1339

1282

dbus.UInt64, "ExtendedTimeout",

1340

type_func = lambda td: td.total_seconds() * 1000)

1341

interval = notifychangeproperty(

1342

dbus.UInt64, "Interval",

1343

type_func = lambda td: td.total_seconds() * 1000)

1283

type_func = timedelta_to_milliseconds)

1284

interval = notifychangeproperty(dbus.UInt64,

1285

"Interval",

1286

type_func =

1287

timedelta_to_milliseconds)

1344

1288

checker_command = notifychangeproperty(dbus.String, "Checker")

1345

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1346

invalidate_only=True)

1347

1289

1348

1290

del notifychangeproperty

1349

1291

1376

1318

*args, **kwargs)

1377

1319

1378

1320

def start_checker(self, *args, **kwargs):

1379

old_checker_pid = getattr(self.checker, "pid", None)

1321

old_checker = self.checker

1322

if self.checker is not None:

1323

old_checker_pid = self.checker.pid

1324

else:

1325

old_checker_pid = None

1380

1326

r = Client.start_checker(self, *args, **kwargs)

1381

1327

# Only if new checker process was started

1382

1328

if (self.checker is not None

1391

1337

1392

1338

def approve(self, value=True):

1393

1339

self.approved = value

1394

gobject.timeout_add(int(self.approval_duration.total_seconds()

1395

* 1000), self._reset_approved)

1340

gobject.timeout_add(timedelta_to_milliseconds

1341

(self.approval_duration),

1342

self._reset_approved)

1396

1343

self.send_changedstate()

1397

1344

1398

1345

## D-Bus methods, signals & properties

1346

_interface = "se.recompile.Mandos.Client"

1399

1347

1400

1348

## Interfaces

1401

1349

1350

@dbus_interface_annotations(_interface)

1351

def _foo(self):

1352

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1353

"false"}

1354

1402

1355

## Signals

1403

1356

1404

1357

# CheckerCompleted - signal

1414

1367

pass

1415

1368

1416

1369

# PropertyChanged - signal

1417

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1418

1370

@dbus.service.signal(_interface, signature="sv")

1419

1371

def PropertyChanged(self, property, value):

1420

1372

"D-Bus signal"

1484

1436

return dbus.Boolean(bool(self.approvals_pending))

1485

1437

1486

1438

# ApprovedByDefault - property

1487

@dbus_service_property(_interface,

1488

signature="b",

1439

@dbus_service_property(_interface, signature="b",

1489

1440

access="readwrite")

1490

1441

def ApprovedByDefault_dbus_property(self, value=None):

1491

1442

if value is None: # get

1493

1444

self.approved_by_default = bool(value)

1494

1445

1495

1446

# ApprovalDelay - property

1496

@dbus_service_property(_interface,

1497

signature="t",

1447

@dbus_service_property(_interface, signature="t",

1498

1448

access="readwrite")

1499

1449

def ApprovalDelay_dbus_property(self, value=None):

1500

1450

if value is None: # get

1501

return dbus.UInt64(self.approval_delay.total_seconds()

1502

* 1000)

1451

return dbus.UInt64(self.approval_delay_milliseconds())

1503

1452

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1504

1453

1505

1454

# ApprovalDuration - property

1506

@dbus_service_property(_interface,

1507

signature="t",

1455

@dbus_service_property(_interface, signature="t",

1508

1456

access="readwrite")

1509

1457

def ApprovalDuration_dbus_property(self, value=None):

1510

1458

if value is None: # get

1511

return dbus.UInt64(self.approval_duration.total_seconds()

1512

* 1000)

1459

return dbus.UInt64(timedelta_to_milliseconds(

1460

self.approval_duration))

1513

1461

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1514

1462

1515

1463

# Name - property

1523

1471

return dbus.String(self.fingerprint)

1524

1472

1525

1473

# Host - property

1526

@dbus_service_property(_interface,

1527

signature="s",

1474

@dbus_service_property(_interface, signature="s",

1528

1475

access="readwrite")

1529

1476

def Host_dbus_property(self, value=None):

1530

1477

if value is None: # get

1531

1478

return dbus.String(self.host)

1532

self.host = str(value)

1479

self.host = unicode(value)

1533

1480

1534

1481

# Created - property

1535

1482

@dbus_service_property(_interface, signature="s", access="read")

1542

1489

return datetime_to_dbus(self.last_enabled)

1543

1490

1544

1491

# Enabled - property

1545

@dbus_service_property(_interface,

1546

signature="b",

1492

@dbus_service_property(_interface, signature="b",

1547

1493

access="readwrite")

1548

1494

def Enabled_dbus_property(self, value=None):

1549

1495

if value is None: # get

1554

1500

self.disable()

1555

1501

1556

1502

# LastCheckedOK - property

1557

@dbus_service_property(_interface,

1558

signature="s",

1503

@dbus_service_property(_interface, signature="s",

1559

1504

access="readwrite")

1560

1505

def LastCheckedOK_dbus_property(self, value=None):

1561

1506

if value is not None:

1564

1509

return datetime_to_dbus(self.last_checked_ok)

1565

1510

1566

1511

# LastCheckerStatus - property

1567

@dbus_service_property(_interface, signature="n", access="read")

1512

@dbus_service_property(_interface, signature="n",

1513

access="read")

1568

1514

def LastCheckerStatus_dbus_property(self):

1569

1515

return dbus.Int16(self.last_checker_status)

1570

1516

1579

1525

return datetime_to_dbus(self.last_approval_request)

1580

1526

1581

1527

# Timeout - property

1582

@dbus_service_property(_interface,

1583

signature="t",

1528

@dbus_service_property(_interface, signature="t",

1584

1529

access="readwrite")

1585

1530

def Timeout_dbus_property(self, value=None):

1586

1531

if value is None: # get

1587

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1532

return dbus.UInt64(self.timeout_milliseconds())

1588

1533

old_timeout = self.timeout

1589

1534

self.timeout = datetime.timedelta(0, 0, 0, value)

1590

1535

# Reschedule disabling

1599

1544

is None):

1600

1545

return

1601

1546

gobject.source_remove(self.disable_initiator_tag)

1602

self.disable_initiator_tag = gobject.timeout_add(

1603

int((self.expires - now).total_seconds() * 1000),

1604

self.disable)

1547

self.disable_initiator_tag = (

1548

gobject.timeout_add(

1549

timedelta_to_milliseconds(self.expires - now),

1550

self.disable))

1605

1551

1606

1552

# ExtendedTimeout - property

1607

@dbus_service_property(_interface,

1608

signature="t",

1553

@dbus_service_property(_interface, signature="t",

1609

1554

access="readwrite")

1610

1555

def ExtendedTimeout_dbus_property(self, value=None):

1611

1556

if value is None: # get

1612

return dbus.UInt64(self.extended_timeout.total_seconds()

1613

* 1000)

1557

return dbus.UInt64(self.extended_timeout_milliseconds())

1614

1558

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1615

1559

1616

1560

# Interval - property

1617

@dbus_service_property(_interface,

1618

signature="t",

1561

@dbus_service_property(_interface, signature="t",

1619

1562

access="readwrite")

1620

1563

def Interval_dbus_property(self, value=None):

1621

1564

if value is None: # get

1622

return dbus.UInt64(self.interval.total_seconds() * 1000)

1565

return dbus.UInt64(self.interval_milliseconds())

1623

1566

self.interval = datetime.timedelta(0, 0, 0, value)

1624

1567

if getattr(self, "checker_initiator_tag", None) is None:

1625

1568

return

1626

1569

if self.enabled:

1627

1570

# Reschedule checker run

1628

1571

gobject.source_remove(self.checker_initiator_tag)

1629

self.checker_initiator_tag = gobject.timeout_add(

1630

value, self.start_checker)

1631

self.start_checker() # Start one now, too

1572

self.checker_initiator_tag = (gobject.timeout_add

1573

(value, self.start_checker))

1574

self.start_checker() # Start one now, too

1632

1575

1633

1576

# Checker - property

1634

@dbus_service_property(_interface,

1635

signature="s",

1577

@dbus_service_property(_interface, signature="s",

1636

1578

access="readwrite")

1637

1579

def Checker_dbus_property(self, value=None):

1638

1580

if value is None: # get

1639

1581

return dbus.String(self.checker_command)

1640

self.checker_command = str(value)

1582

self.checker_command = unicode(value)

1641

1583

1642

1584

# CheckerRunning - property

1643

@dbus_service_property(_interface,

1644

signature="b",

1585

@dbus_service_property(_interface, signature="b",

1645

1586

access="readwrite")

1646

1587

def CheckerRunning_dbus_property(self, value=None):

1647

1588

if value is None: # get

1657

1598

return self.dbus_object_path # is already a dbus.ObjectPath

1658

1599

1659

1600

# Secret = property

1660

@dbus_service_property(_interface,

1661

signature="ay",

1662

access="write",

1663

byte_arrays=True)

1601

@dbus_service_property(_interface, signature="ay",

1602

access="write", byte_arrays=True)

1664

1603

def Secret_dbus_property(self, value):

1665

self.secret = bytes(value)

1604

self.secret = str(value)

1666

1605

1667

1606

del _interface

1668

1607

1672

1611

self._pipe = child_pipe

1673

1612

self._pipe.send(('init', fpr, address))

1674

1613

if not self._pipe.recv():

1675

raise KeyError(fpr)

1614

raise KeyError()

1676

1615

1677

1616

def __getattribute__(self, name):

1678

1617

if name == '_pipe':

1682

1621

if data[0] == 'data':

1683

1622

return data[1]

1684

1623

if data[0] == 'function':

1685

1686

1624

def func(*args, **kwargs):

1687

1625

self._pipe.send(('funcall', name, args, kwargs))

1688

1626

return self._pipe.recv()[1]

1689

1690

1627

return func

1691

1628

1692

1629

def __setattr__(self, name, value):

1704

1641

def handle(self):

1705

1642

with contextlib.closing(self.server.child_pipe) as child_pipe:

1706

1643

logger.info("TCP connection from: %s",

1707

str(self.client_address))

1644

unicode(self.client_address))

1708

1645

logger.debug("Pipe FD: %d",

1709

1646

self.server.child_pipe.fileno())

1710

1647

1711

session = gnutls.connection.ClientSession(

1712

self.request, gnutls.connection .X509Credentials())

1648

session = (gnutls.connection

1649

.ClientSession(self.request,

1650

gnutls.connection

1651

.X509Credentials()))

1713

1652

1714

1653

# Note: gnutls.connection.X509Credentials is really a

1715

1654

# generic GnuTLS certificate credentials object so long as

1724

1663

priority = self.server.gnutls_priority

1725

1664

if priority is None:

1726

1665

priority = "NORMAL"

1727

gnutls.library.functions.gnutls_priority_set_direct(

1728

session._c_object, priority, None)

1666

(gnutls.library.functions

1667

.gnutls_priority_set_direct(session._c_object,

1668

priority, None))

1729

1669

1730

1670

# Start communication using the Mandos protocol

1731

1671

# Get protocol number

1733

1673

logger.debug("Protocol version: %r", line)

1734

1674

try:

1735

1675

if int(line.strip().split()[0]) > 1:

1736

raise RuntimeError(line)

1676

raise RuntimeError

1737

1677

except (ValueError, IndexError, RuntimeError) as error:

1738

1678

logger.error("Unknown protocol version: %s", error)

1739

1679

return

1751

1691

approval_required = False

1752

1692

try:

1753

1693

try:

1754

fpr = self.fingerprint(

1755

self.peer_certificate(session))

1694

fpr = self.fingerprint(self.peer_certificate

1695

(session))

1756

1696

except (TypeError,

1757

1697

gnutls.errors.GNUTLSError) as error:

1758

1698

logger.warning("Bad certificate: %s", error)

1773

1713

while True:

1774

1714

if not client.enabled:

1775

1715

logger.info("Client %s is disabled",

1776

client.name)

1716

client.name)

1777

1717

if self.server.use_dbus:

1778

1718

# Emit D-Bus signal

1779

1719

client.Rejected("Disabled")

1788

1728

if self.server.use_dbus:

1789

1729

# Emit D-Bus signal

1790

1730

client.NeedApproval(

1791

client.approval_delay.total_seconds()

1792

* 1000, client.approved_by_default)

1731

client.approval_delay_milliseconds(),

1732

client.approved_by_default)

1793

1733

else:

1794

1734

logger.warning("Client %s was not approved",

1795

1735

client.name)

1801

1741

#wait until timeout or approved

1802

1742

time = datetime.datetime.now()

1803

1743

client.changedstate.acquire()

1804

client.changedstate.wait(delay.total_seconds())

1744

client.changedstate.wait(

1745

float(timedelta_to_milliseconds(delay)

1746

/ 1000))

1805

1747

client.changedstate.release()

1806

1748

time2 = datetime.datetime.now()

1807

1749

if (time2 - time) >= delay:

1826

1768

logger.warning("gnutls send failed",

1827

1769

exc_info=error)

1828

1770

return

1829

logger.debug("Sent: %d, remaining: %d", sent,

1830

len(client.secret) - (sent_size

1831

+ sent))

1771

logger.debug("Sent: %d, remaining: %d",

1772

sent, len(client.secret)

1773

- (sent_size + sent))

1832

1774

sent_size += sent

1833

1775

1834

1776

logger.info("Sending secret to %s", client.name)

1851

1793

def peer_certificate(session):

1852

1794

"Return the peer's OpenPGP certificate as a bytestring"

1853

1795

# If not an OpenPGP certificate...

1854

if (gnutls.library.functions.gnutls_certificate_type_get(

1855

session._c_object)

1796

if (gnutls.library.functions

1797

.gnutls_certificate_type_get(session._c_object)

1856

1798

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1857

1799

# ...do the normal thing

1858

1800

return session.peer_certificate

1872

1814

def fingerprint(openpgp):

1873

1815

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1874

1816

# New GnuTLS "datum" with the OpenPGP public key

1875

datum = gnutls.library.types.gnutls_datum_t(

1876

ctypes.cast(ctypes.c_char_p(openpgp),

1877

ctypes.POINTER(ctypes.c_ubyte)),

1878

ctypes.c_uint(len(openpgp)))

1817

datum = (gnutls.library.types

1818

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1819

ctypes.POINTER

1820

(ctypes.c_ubyte)),

1821

ctypes.c_uint(len(openpgp))))

1879

1822

# New empty GnuTLS certificate

1880

1823

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1881

gnutls.library.functions.gnutls_openpgp_crt_init(

1882

ctypes.byref(crt))

1824

(gnutls.library.functions

1825

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1883

1826

# Import the OpenPGP public key into the certificate

1884

gnutls.library.functions.gnutls_openpgp_crt_import(

1885

crt, ctypes.byref(datum),

1886

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1827

(gnutls.library.functions

1828

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1829

gnutls.library.constants

1830

.GNUTLS_OPENPGP_FMT_RAW))

1887

1831

# Verify the self signature in the key

1888

1832

crtverify = ctypes.c_uint()

1889

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1890

crt, 0, ctypes.byref(crtverify))

1833

(gnutls.library.functions

1834

.gnutls_openpgp_crt_verify_self(crt, 0,

1835

ctypes.byref(crtverify)))

1891

1836

if crtverify.value != 0:

1892

1837

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1893

raise gnutls.errors.CertificateSecurityError(

1894

"Verify failed")

1838

raise (gnutls.errors.CertificateSecurityError

1839

("Verify failed"))

1895

1840

# New buffer for the fingerprint

1896

1841

buf = ctypes.create_string_buffer(20)

1897

1842

buf_len = ctypes.c_size_t()

1898

1843

# Get the fingerprint from the certificate into the buffer

1899

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1900

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1844

(gnutls.library.functions

1845

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1846

ctypes.byref(buf_len)))

1901

1847

# Deinit the certificate

1902

1848

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1903

1849

# Convert the buffer to a Python bytestring

1909

1855

1910

1856

class MultiprocessingMixIn(object):

1911

1857

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1912

1913

1858

def sub_process_main(self, request, address):

1914

1859

try:

1915

1860

self.finish_request(request, address)

1927

1872

1928

1873

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1929

1874

""" adds a pipe to the MixIn """

1930

1931

1875

def process_request(self, request, client_address):

1932

1876

"""Overrides and wraps the original process_request().

1933

1877

1942

1886

1943

1887

def add_pipe(self, parent_pipe, proc):

1944

1888

"""Dummy function; override as necessary"""

1945

raise NotImplementedError()

1889

raise NotImplementedError

1946

1890

1947

1891

1948

1892

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1954

1898

interface: None or a network interface name (string)

1955

1899

use_ipv6: Boolean; to use IPv6 or not

1956

1900

"""

1957

1958

1901

def __init__(self, server_address, RequestHandlerClass,

1959

interface=None,

1960

use_ipv6=True,

1961

socketfd=None):

1902

interface=None, use_ipv6=True, socketfd=None):

1962

1903

"""If socketfd is set, use that file descriptor instead of

1963

1904

creating a new one with socket.socket().

1964

1905

"""

2005

1946

self.interface)

2006

1947

else:

2007

1948

try:

2008

self.socket.setsockopt(

2009

socket.SOL_SOCKET, SO_BINDTODEVICE,

2010

(self.interface + "\0").encode("utf-8"))

1949

self.socket.setsockopt(socket.SOL_SOCKET,

1950

SO_BINDTODEVICE,

1951

str(self.interface + '\0'))

2011

1952

except socket.error as error:

2012

1953

if error.errno == errno.EPERM:

2013

1954

logger.error("No permission to bind to"

2027

1968

if self.address_family == socket.AF_INET6:

2028

1969

any_address = "::" # in6addr_any

2029

1970

else:

2030

any_address = "0.0.0.0" # INADDR_ANY

1971

any_address = socket.INADDR_ANY

2031

1972

self.server_address = (any_address,

2032

1973

self.server_address[1])

2033

1974

elif not self.server_address[1]:

2034

self.server_address = (self.server_address[0], 0)

1975

self.server_address = (self.server_address[0],

1976

0)

2035

1977

# if self.interface:

2036

1978

# self.server_address = (self.server_address[0],

2037

1979

# 0, # port

2051

1993

2052

1994

Assumes a gobject.MainLoop event loop.

2053

1995

"""

2054

2055

1996

def __init__(self, server_address, RequestHandlerClass,

2056

interface=None,

2057

use_ipv6=True,

2058

clients=None,

2059

gnutls_priority=None,

2060

use_dbus=True,

2061

socketfd=None):

1997

interface=None, use_ipv6=True, clients=None,

1998

gnutls_priority=None, use_dbus=True, socketfd=None):

2062

1999

self.enabled = False

2063

2000

self.clients = clients

2064

2001

if self.clients is None:

2070

2007

interface = interface,

2071

2008

use_ipv6 = use_ipv6,

2072

2009

socketfd = socketfd)

2073

2074

2010

def server_activate(self):

2075

2011

if self.enabled:

2076

2012

return socketserver.TCPServer.server_activate(self)

2080

2016

2081

2017

def add_pipe(self, parent_pipe, proc):

2082

2018

# Call "handle_ipc" for both data and EOF events

2083

gobject.io_add_watch(

2084

parent_pipe.fileno(),

2085

gobject.IO_IN | gobject.IO_HUP,

2086

functools.partial(self.handle_ipc,

2087

parent_pipe = parent_pipe,

2088

proc = proc))

2019

gobject.io_add_watch(parent_pipe.fileno(),

2020

gobject.IO_IN | gobject.IO_HUP,

2021

functools.partial(self.handle_ipc,

2022

parent_pipe =

2023

parent_pipe,

2024

proc = proc))

2089

2025

2090

def handle_ipc(self, source, condition,

2091

parent_pipe=None,

2092

proc = None,

2093

client_object=None):

2026

def handle_ipc(self, source, condition, parent_pipe=None,

2027

proc = None, client_object=None):

2094

2028

# error, or the other end of multiprocessing.Pipe has closed

2095

2029

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2096

2030

# Wait for other process to exit

2119

2053

parent_pipe.send(False)

2120

2054

return False

2121

2055

2122

gobject.io_add_watch(

2123

parent_pipe.fileno(),

2124

gobject.IO_IN | gobject.IO_HUP,

2125

functools.partial(self.handle_ipc,

2126

parent_pipe = parent_pipe,

2127

proc = proc,

2128

client_object = client))

2056

gobject.io_add_watch(parent_pipe.fileno(),

2057

gobject.IO_IN | gobject.IO_HUP,

2058

functools.partial(self.handle_ipc,

2059

parent_pipe =

2060

parent_pipe,

2061

proc = proc,

2062

client_object =

2063

client))

2129

2064

parent_pipe.send(True)

2130

2065

# remove the old hook in favor of the new above hook on

2131

2066

# same fileno

2137

2072

2138

2073

parent_pipe.send(('data', getattr(client_object,

2139

2074

funcname)(*args,

2140

**kwargs)))

2075

**kwargs)))

2141

2076

2142

2077

if command == 'getattr':

2143

2078

attrname = request[1]

2144

2079

if callable(client_object.__getattribute__(attrname)):

2145

parent_pipe.send(('function', ))

2080

parent_pipe.send(('function',))

2146

2081

else:

2147

parent_pipe.send((

2148

'data', client_object.__getattribute__(attrname)))

2082

parent_pipe.send(('data', client_object

2083

.__getattribute__(attrname)))

2149

2084

2150

2085

if command == 'setattr':

2151

2086

attrname = request[1]

2155

2090

return True

2156

2091

2157

2092

2158

def rfc3339_duration_to_delta(duration):

2159

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2160

2161

>>> rfc3339_duration_to_delta("P7D")

2162

datetime.timedelta(7)

2163

>>> rfc3339_duration_to_delta("PT60S")

2164

datetime.timedelta(0, 60)

2165

>>> rfc3339_duration_to_delta("PT60M")

2166

datetime.timedelta(0, 3600)

2167

>>> rfc3339_duration_to_delta("PT24H")

2168

datetime.timedelta(1)

2169

>>> rfc3339_duration_to_delta("P1W")

2170

datetime.timedelta(7)

2171

>>> rfc3339_duration_to_delta("PT5M30S")

2172

datetime.timedelta(0, 330)

2173

>>> rfc3339_duration_to_delta("P1DT3M20S")

2174

datetime.timedelta(1, 200)

2175

"""

2176

2177

# Parsing an RFC 3339 duration with regular expressions is not

2178

# possible - there would have to be multiple places for the same

2179

# values, like seconds. The current code, while more esoteric, is

2180

# cleaner without depending on a parsing library. If Python had a

2181

# built-in library for parsing we would use it, but we'd like to

2182

# avoid excessive use of external libraries.

2183

2184

# New type for defining tokens, syntax, and semantics all-in-one

2185

Token = collections.namedtuple("Token", (

2186

"regexp", # To match token; if "value" is not None, must have

2187

# a "group" containing digits

2188

"value", # datetime.timedelta or None

2189

"followers")) # Tokens valid after this token

2190

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2191

# the "duration" ABNF definition in RFC 3339, Appendix A.

2192

token_end = Token(re.compile(r"$"), None, frozenset())

2193

token_second = Token(re.compile(r"(\d+)S"),

2194

datetime.timedelta(seconds=1),

2195

frozenset((token_end, )))

2196

token_minute = Token(re.compile(r"(\d+)M"),

2197

datetime.timedelta(minutes=1),

2198

frozenset((token_second, token_end)))

2199

token_hour = Token(re.compile(r"(\d+)H"),

2200

datetime.timedelta(hours=1),

2201

frozenset((token_minute, token_end)))

2202

token_time = Token(re.compile(r"T"),

2203

None,

2204

frozenset((token_hour, token_minute,

2205

token_second)))

2206

token_day = Token(re.compile(r"(\d+)D"),

2207

datetime.timedelta(days=1),

2208

frozenset((token_time, token_end)))

2209

token_month = Token(re.compile(r"(\d+)M"),

2210

datetime.timedelta(weeks=4),

2211

frozenset((token_day, token_end)))

2212

token_year = Token(re.compile(r"(\d+)Y"),

2213

datetime.timedelta(weeks=52),

2214

frozenset((token_month, token_end)))

2215

token_week = Token(re.compile(r"(\d+)W"),

2216

datetime.timedelta(weeks=1),

2217

frozenset((token_end, )))

2218

token_duration = Token(re.compile(r"P"), None,

2219

frozenset((token_year, token_month,

2220

token_day, token_time,

2221

token_week)))

2222

# Define starting values

2223

value = datetime.timedelta() # Value so far

2224

found_token = None

2225

followers = frozenset((token_duration, )) # Following valid tokens

2226

s = duration # String left to parse

2227

# Loop until end token is found

2228

while found_token is not token_end:

2229

# Search for any currently valid tokens

2230

for token in followers:

2231

match = token.regexp.match(s)

2232

if match is not None:

2233

# Token found

2234

if token.value is not None:

2235

# Value found, parse digits

2236

factor = int(match.group(1), 10)

2237

# Add to value so far

2238

value += factor * token.value

2239

# Strip token from string

2240

s = token.regexp.sub("", s, 1)

2241

# Go to found token

2242

found_token = token

2243

# Set valid next tokens

2244

followers = found_token.followers

2245

break

2246

else:

2247

# No currently valid tokens were found

2248

raise ValueError("Invalid RFC 3339 duration: {!r}"

2249

.format(duration))

2250

# End token found

2251

return value

2252

2253

2254

2093

def string_to_delta(interval):

2255

2094

"""Parse a string and return a datetime.timedelta

2256

2095

2267

2106

>>> string_to_delta('5m 30s')

2268

2107

datetime.timedelta(0, 330)

2269

2108

"""

2270

2271

try:

2272

return rfc3339_duration_to_delta(interval)

2273

except ValueError:

2274

pass

2275

2276

2109

timevalue = datetime.timedelta(0)

2277

2110

for s in interval.split():

2278

2111

try:

2279

suffix = s[-1]

2112

suffix = unicode(s[-1])

2280

2113

value = int(s[:-1])

2281

2114

if suffix == "d":

2282

2115

delta = datetime.timedelta(value)

2289

2122

elif suffix == "w":

2290

2123

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2291

2124

else:

2292

raise ValueError("Unknown suffix {!r}".format(suffix))

2293

except IndexError as e:

2125

raise ValueError("Unknown suffix {0!r}"

2126

.format(suffix))

2127

except (ValueError, IndexError) as e:

2294

2128

raise ValueError(*(e.args))

2295

2129

timevalue += delta

2296

2130

return timevalue

2312

2146

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2313

2147

if not stat.S_ISCHR(os.fstat(null).st_mode):

2314

2148

raise OSError(errno.ENODEV,

2315

"{} not a character device"

2149

"{0} not a character device"

2316

2150

.format(os.devnull))

2317

2151

os.dup2(null, sys.stdin.fileno())

2318

2152

os.dup2(null, sys.stdout.fileno())

2328

2162

2329

2163

parser = argparse.ArgumentParser()

2330

2164

parser.add_argument("-v", "--version", action="version",

2331

version = "%(prog)s {}".format(version),

2165

version = "%(prog)s {0}".format(version),

2332

2166

help="show version number and exit")

2333

2167

parser.add_argument("-i", "--interface", metavar="IF",

2334

2168

help="Bind to interface IF")

2340

2174

help="Run self-test")

2341

2175

parser.add_argument("--debug", action="store_true",

2342

2176

help="Debug mode; run in foreground and log"

2343

" to terminal", default=None)

2177

" to terminal")

2344

2178

parser.add_argument("--debuglevel", metavar="LEVEL",

2345

2179

help="Debug level for stdout output")

2346

2180

parser.add_argument("--priority", help="GnuTLS"

2353

2187

" files")

2354

2188

parser.add_argument("--no-dbus", action="store_false",

2355

2189

dest="use_dbus", help="Do not provide D-Bus"

2356

" system bus interface", default=None)

2190

" system bus interface")

2357

2191

parser.add_argument("--no-ipv6", action="store_false",

2358

dest="use_ipv6", help="Do not use IPv6",

2359

default=None)

2192

dest="use_ipv6", help="Do not use IPv6")

2360

2193

parser.add_argument("--no-restore", action="store_false",

2361

2194

dest="restore", help="Do not restore stored"

2362

" state", default=None)

2195

" state")

2363

2196

parser.add_argument("--socket", type=int,

2364

2197

help="Specify a file descriptor to a network"

2365

2198

" socket to use instead of creating one")

2366

2199

parser.add_argument("--statedir", metavar="DIR",

2367

2200

help="Directory to save/restore state in")

2368

2201

parser.add_argument("--foreground", action="store_true",

2369

help="Run in foreground", default=None)

2370

parser.add_argument("--no-zeroconf", action="store_false",

2371

dest="zeroconf", help="Do not use Zeroconf",

2372

default=None)

2202

help="Run in foreground")

2373

2203

2374

2204

options = parser.parse_args()

2375

2205

2376

2206

if options.check:

2377

2207

import doctest

2378

fail_count, test_count = doctest.testmod()

2379

sys.exit(os.EX_OK if fail_count == 0 else 1)

2208

doctest.testmod()

2209

sys.exit()

2380

2210

2381

2211

# Default values for config file for server-global settings

2382

2212

server_defaults = { "interface": "",

2384

2214

"port": "",

2385

2215

"debug": "False",

2386

2216

"priority":

2387

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2388

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2217

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2389

2218

"servicename": "Mandos",

2390

2219

"use_dbus": "True",

2391

2220

"use_ipv6": "True",

2394

2223

"socket": "",

2395

2224

"statedir": "/var/lib/mandos",

2396

2225

"foreground": "False",

2397

"zeroconf": "True",

2398

}

2226

}

2399

2227

2400

2228

# Parse config file for server-global settings

2401

2229

server_config = configparser.SafeConfigParser(server_defaults)

2402

2230

del server_defaults

2403

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2231

server_config.read(os.path.join(options.configdir,

2232

"mandos.conf"))

2404

2233

# Convert the SafeConfigParser object to a dict

2405

2234

server_settings = server_config.defaults()

2406

2235

# Use the appropriate methods on the non-string config options

2424

2253

# Override the settings from the config file with command line

2425

2254

# options, if set.

2426

2255

for option in ("interface", "address", "port", "debug",

2427

"priority", "servicename", "configdir", "use_dbus",

2428

"use_ipv6", "debuglevel", "restore", "statedir",

2429

"socket", "foreground", "zeroconf"):

2256

"priority", "servicename", "configdir",

2257

"use_dbus", "use_ipv6", "debuglevel", "restore",

2258

"statedir", "socket", "foreground"):

2430

2259

value = getattr(options, option)

2431

2260

if value is not None:

2432

2261

server_settings[option] = value

2433

2262

del options

2434

2263

# Force all strings to be unicode

2435

2264

for option in server_settings.keys():

2436

if isinstance(server_settings[option], bytes):

2437

server_settings[option] = (server_settings[option]

2438

.decode("utf-8"))

2439

# Force all boolean options to be boolean

2440

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2441

"foreground", "zeroconf"):

2442

server_settings[option] = bool(server_settings[option])

2265

if type(server_settings[option]) is str:

2266

server_settings[option] = unicode(server_settings[option])

2443

2267

# Debug implies foreground

2444

2268

if server_settings["debug"]:

2445

2269

server_settings["foreground"] = True

2447

2271

2448

2272

##################################################################

2449

2273

2450

if (not server_settings["zeroconf"]

2451

and not (server_settings["port"]

2452

or server_settings["socket"] != "")):

2453

parser.error("Needs port or socket to work without Zeroconf")

2454

2455

2274

# For convenience

2456

2275

debug = server_settings["debug"]

2457

2276

debuglevel = server_settings["debuglevel"]

2460

2279

stored_state_path = os.path.join(server_settings["statedir"],

2461

2280

stored_state_file)

2462

2281

foreground = server_settings["foreground"]

2463

zeroconf = server_settings["zeroconf"]

2464

2282

2465

2283

if debug:

2466

2284

initlogger(debug, logging.DEBUG)

2472

2290

initlogger(debug, level)

2473

2291

2474

2292

if server_settings["servicename"] != "Mandos":

2475

syslogger.setFormatter(

2476

logging.Formatter('Mandos ({}) [%(process)d]:'

2477

' %(levelname)s: %(message)s'.format(

2478

server_settings["servicename"])))

2293

syslogger.setFormatter(logging.Formatter

2294

('Mandos ({0}) [%(process)d]:'

2295

' %(levelname)s: %(message)s'

2296

.format(server_settings

2297

["servicename"])))

2479

2298

2480

2299

# Parse config file with clients

2481

2300

client_config = configparser.SafeConfigParser(Client

2486

2305

global mandos_dbus_service

2487

2306

mandos_dbus_service = None

2488

2307

2489

socketfd = None

2490

if server_settings["socket"] != "":

2491

socketfd = server_settings["socket"]

2492

tcp_server = MandosServer(

2493

(server_settings["address"], server_settings["port"]),

2494

ClientHandler,

2495

interface=(server_settings["interface"] or None),

2496

use_ipv6=use_ipv6,

2497

gnutls_priority=server_settings["priority"],

2498

use_dbus=use_dbus,

2499

socketfd=socketfd)

2308

tcp_server = MandosServer((server_settings["address"],

2309

server_settings["port"]),

2310

ClientHandler,

2311

interface=(server_settings["interface"]

2312

or None),

2313

use_ipv6=use_ipv6,

2314

gnutls_priority=

2315

server_settings["priority"],

2316

use_dbus=use_dbus,

2317

socketfd=(server_settings["socket"]

2318

or None))

2500

2319

if not foreground:

2501

pidfilename = "/run/mandos.pid"

2502

if not os.path.isdir("/run/."):

2503

pidfilename = "/var/run/mandos.pid"

2320

pidfilename = "/var/run/mandos.pid"

2504

2321

pidfile = None

2505

2322

try:

2506

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2323

pidfile = open(pidfilename, "w")

2507

2324

except IOError as e:

2508

2325

logger.error("Could not open file %r", pidfilename,

2509

2326

exc_info=e)

2523

2340

os.setuid(uid)

2524

2341

except OSError as error:

2525

2342

if error.errno != errno.EPERM:

2526

raise

2343

raise error

2527

2344

2528

2345

if debug:

2529

2346

# Enable all possible GnuTLS debugging

2536

2353

def debug_gnutls(level, string):

2537

2354

logger.debug("GnuTLS: %s", string[:-1])

2538

2355

2539

gnutls.library.functions.gnutls_global_set_log_function(

2540

debug_gnutls)

2356

(gnutls.library.functions

2357

.gnutls_global_set_log_function(debug_gnutls))

2541

2358

2542

2359

# Redirect stdin so all checkers get /dev/null

2543

2360

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2563

2380

if use_dbus:

2564

2381

try:

2565

2382

bus_name = dbus.service.BusName("se.recompile.Mandos",

2566

bus,

2567

do_not_queue=True)

2568

old_bus_name = dbus.service.BusName(

2569

"se.bsnet.fukt.Mandos", bus,

2570

do_not_queue=True)

2571

except dbus.exceptions.DBusException as e:

2383

bus, do_not_queue=True)

2384

old_bus_name = (dbus.service.BusName

2385

("se.bsnet.fukt.Mandos", bus,

2386

do_not_queue=True))

2387

except dbus.exceptions.NameExistsException as e:

2572

2388

logger.error("Disabling D-Bus:", exc_info=e)

2573

2389

use_dbus = False

2574

2390

server_settings["use_dbus"] = False

2575

2391

tcp_server.use_dbus = False

2576

if zeroconf:

2577

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2578

service = AvahiServiceToSyslog(

2579

name = server_settings["servicename"],

2580

servicetype = "_mandos._tcp",

2581

protocol = protocol,

2582

bus = bus)

2583

if server_settings["interface"]:

2584

service.interface = if_nametoindex(

2585

server_settings["interface"].encode("utf-8"))

2392

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2393

service = AvahiServiceToSyslog(name =

2394

server_settings["servicename"],

2395

servicetype = "_mandos._tcp",

2396

protocol = protocol, bus = bus)

2397

if server_settings["interface"]:

2398

service.interface = (if_nametoindex

2399

(str(server_settings["interface"])))

2586

2400

2587

2401

global multiprocessing_manager

2588

2402

multiprocessing_manager = multiprocessing.Manager()

2595

2409

old_client_settings = {}

2596

2410

clients_data = {}

2597

2411

2598

# This is used to redirect stdout and stderr for checker processes

2599

global wnull

2600

wnull = open(os.devnull, "w") # A writable /dev/null

2601

# Only used if server is running in foreground but not in debug

2602

# mode

2603

if debug or not foreground:

2604

wnull.close()

2605

2606

2412

# Get client data and settings from last running state.

2607

2413

if server_settings["restore"]:

2608

2414

try:

2609

2415

with open(stored_state_path, "rb") as stored_state:

2610

clients_data, old_client_settings = pickle.load(

2611

stored_state)

2416

clients_data, old_client_settings = (pickle.load

2417

(stored_state))

2612

2418

os.remove(stored_state_path)

2613

2419

except IOError as e:

2614

2420

if e.errno == errno.ENOENT:

2615

logger.warning("Could not load persistent state:"

2616

" {}".format(os.strerror(e.errno)))

2421

logger.warning("Could not load persistent state: {0}"

2422

.format(os.strerror(e.errno)))

2617

2423

else:

2618

2424

logger.critical("Could not load persistent state:",

2619

2425

exc_info=e)

2620

2426

raise

2621

2427

except EOFError as e:

2622

2428

logger.warning("Could not load persistent state: "

2623

"EOFError:",

2624

exc_info=e)

2429

"EOFError:", exc_info=e)

2625

2430

2626

2431

with PGPEngine() as pgp:

2627

for client_name, client in clients_data.items():

2628

# Skip removed clients

2629

if client_name not in client_settings:

2630

continue

2631

2432

for client_name, client in clients_data.iteritems():

2632

2433

# Decide which value to use after restoring saved state.

2633

2434

# We have three different values: Old config file,

2634

2435

# new config file, and saved state.

2639

2440

# For each value in new config, check if it

2640

2441

# differs from the old config value (Except for

2641

2442

# the "secret" attribute)

2642

if (name != "secret"

2643

and (value !=

2644

old_client_settings[client_name][name])):

2443

if (name != "secret" and

2444

value != old_client_settings[client_name]

2445

[name]):

2645

2446

client[name] = value

2646

2447

except KeyError:

2647

2448

pass

2655

2456

if datetime.datetime.utcnow() >= client["expires"]:

2656

2457

if not client["last_checked_ok"]:

2657

2458

logger.warning(

2658

"disabling client {} - Client never "

2659

"performed a successful checker".format(

2660

client_name))

2459

"disabling client {0} - Client never "

2460

"performed a successful checker"

2461

.format(client_name))

2661

2462

client["enabled"] = False

2662

2463

elif client["last_checker_status"] != 0:

2663

2464

logger.warning(

2664

"disabling client {} - Client last"

2665

" checker failed with error code"

2666

" {}".format(

2667

client_name,

2668

client["last_checker_status"]))

2465

"disabling client {0} - Client "

2466

"last checker failed with error code {1}"

2467

.format(client_name,

2468

client["last_checker_status"]))

2669

2469

client["enabled"] = False

2670

2470

else:

2671

client["expires"] = (

2672

datetime.datetime.utcnow()

2673

+ client["timeout"])

2471

client["expires"] = (datetime.datetime

2472

.utcnow()

2473

+ client["timeout"])

2674

2474

logger.debug("Last checker succeeded,"

2675

" keeping {} enabled".format(

2676

client_name))

2475

" keeping {0} enabled"

2476

.format(client_name))

2677

2477

try:

2678

client["secret"] = pgp.decrypt(

2679

client["encrypted_secret"],

2680

client_settings[client_name]["secret"])

2478

client["secret"] = (

2479

pgp.decrypt(client["encrypted_secret"],

2480

client_settings[client_name]

2481

["secret"]))

2681

2482

except PGPError:

2682

2483

# If decryption fails, we use secret from new settings

2683

logger.debug("Failed to decrypt {} old secret".format(

2684

client_name))

2685

client["secret"] = (client_settings[client_name]

2686

["secret"])

2484

logger.debug("Failed to decrypt {0} old secret"

2485

.format(client_name))

2486

client["secret"] = (

2487

client_settings[client_name]["secret"])

2687

2488

2688

2489

# Add/remove clients based on new changes made to config

2689

2490

for client_name in (set(old_client_settings)

2694

2495

clients_data[client_name] = client_settings[client_name]

2695

2496

2696

2497

# Create all client objects

2697

for client_name, client in clients_data.items():

2498

for client_name, client in clients_data.iteritems():

2698

2499

tcp_server.clients[client_name] = client_class(

2699

name = client_name,

2700

settings = client,

2701

server_settings = server_settings)

2500

name = client_name, settings = client)

2702

2501

2703

2502

if not tcp_server.clients:

2704

2503

logger.warning("No clients defined")

2705

2504

2706

2505

if not foreground:

2707

2506

if pidfile is not None:

2708

pid = os.getpid()

2709

2507

try:

2710

2508

with pidfile:

2711

print(pid, file=pidfile)

2509

pid = os.getpid()

2510

pidfile.write(str(pid) + "\n".encode("utf-8"))

2712

2511

except IOError:

2713

2512

logger.error("Could not write to file %r with PID %d",

2714

2513

pidfilename, pid)

2719

2518

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2720

2519

2721

2520

if use_dbus:

2722

2723

@alternate_dbus_interfaces(

2724

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2521

@alternate_dbus_interfaces({"se.recompile.Mandos":

2522

"se.bsnet.fukt.Mandos"})

2725

2523

class MandosDBusService(DBusObjectWithProperties):

2726

2524

"""A D-Bus proxy object"""

2727

2728

2525

def __init__(self):

2729

2526

dbus.service.Object.__init__(self, bus, "/")

2730

2731

2527

_interface = "se.recompile.Mandos"

2732

2528

2733

2529

@dbus_interface_annotations(_interface)

2734

2530

def _foo(self):

2735

return {

2736

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2737

"false" }

2531

return { "org.freedesktop.DBus.Property"

2532

".EmitsChangedSignal":

2533

"false"}

2738

2534

2739

2535

@dbus.service.signal(_interface, signature="o")

2740

2536

def ClientAdded(self, objpath):

2754

2550

@dbus.service.method(_interface, out_signature="ao")

2755

2551

def GetAllClients(self):

2756

2552

"D-Bus method"

2757

return dbus.Array(c.dbus_object_path for c in

2553

return dbus.Array(c.dbus_object_path

2554

for c in

2758

2555

tcp_server.clients.itervalues())

2759

2556

2760

2557

@dbus.service.method(_interface,

2762

2559

def GetAllClientsWithProperties(self):

2763

2560

"D-Bus method"

2764

2561

return dbus.Dictionary(

2765

{ c.dbus_object_path: c.GetAll("")

2766

for c in tcp_server.clients.itervalues() },

2562

((c.dbus_object_path, c.GetAll(""))

2563

for c in tcp_server.clients.itervalues()),

2767

2564

signature="oa{sv}")

2768

2565

2769

2566

@dbus.service.method(_interface, in_signature="o")

2786

2583

2787

2584

def cleanup():

2788

2585

"Cleanup function; run on exit"

2789

if zeroconf:

2790

service.cleanup()

2586

service.cleanup()

2791

2587

2792

2588

multiprocessing.active_children()

2793

wnull.close()

2794

2589

if not (tcp_server.clients or client_settings):

2795

2590

return

2796

2591

2807

2602

2808

2603

# A list of attributes that can not be pickled

2809

2604

# + secret.

2810

exclude = { "bus", "changedstate", "secret",

2811

"checker", "server_settings" }

2812

for name, typ in inspect.getmembers(dbus.service

2813

.Object):

2605

exclude = set(("bus", "changedstate", "secret",

2606

"checker"))

2607

for name, typ in (inspect.getmembers

2608

(dbus.service.Object)):

2814

2609

exclude.add(name)

2815

2610

2816

2611

client_dict["encrypted_secret"] = (client

2823

2618

del client_settings[client.name]["secret"]

2824

2619

2825

2620

try:

2826

with tempfile.NamedTemporaryFile(

2827

mode='wb',

2828

suffix=".pickle",

2829

prefix='clients-',

2830

dir=os.path.dirname(stored_state_path),

2831

delete=False) as stored_state:

2621

with (tempfile.NamedTemporaryFile

2622

(mode='wb', suffix=".pickle", prefix='clients-',

2623

dir=os.path.dirname(stored_state_path),

2624

delete=False)) as stored_state:

2832

2625

pickle.dump((clients, client_settings), stored_state)

2833

tempname = stored_state.name

2626

tempname=stored_state.name

2834

2627

os.rename(tempname, stored_state_path)

2835

2628

except (IOError, OSError) as e:

2836

2629

if not debug:

2839

2632

except NameError:

2840

2633

pass

2841

2634

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2842

logger.warning("Could not save persistent state: {}"

2635

logger.warning("Could not save persistent state: {0}"

2843

2636

.format(os.strerror(e.errno)))

2844

2637

else:

2845

2638

logger.warning("Could not save persistent state:",

2846

2639

exc_info=e)

2847

raise

2640

raise e

2848

2641

2849

2642

# Delete all clients, and settings from config

2850

2643

while tcp_server.clients:

2855

2648

client.disable(quiet=True)

2856

2649

if use_dbus:

2857

2650

# Emit D-Bus signal

2858

mandos_dbus_service.ClientRemoved(

2859

client.dbus_object_path, client.name)

2651

mandos_dbus_service.ClientRemoved(client

2652

.dbus_object_path,

2653

client.name)

2860

2654

client_settings.clear()

2861

2655

2862

2656

atexit.register(cleanup)

2873

2667

tcp_server.server_activate()

2874

2668

2875

2669

# Find out what port we got

2876

if zeroconf:

2877

service.port = tcp_server.socket.getsockname()[1]

2670

service.port = tcp_server.socket.getsockname()[1]

2878

2671

if use_ipv6:

2879

2672

logger.info("Now listening on address %r, port %d,"

2880

2673

" flowinfo %d, scope_id %d",

2886

2679

#service.interface = tcp_server.socket.getsockname()[3]

2887

2680

2888

2681

try:

2889

if zeroconf:

2890

# From the Avahi example code

2891

try:

2892

service.activate()

2893

except dbus.exceptions.DBusException as error:

2894

logger.critical("D-Bus Exception", exc_info=error)

2895

cleanup()

2896

sys.exit(1)

2897

# End of Avahi example code

2682

# From the Avahi example code

2683

try:

2684

service.activate()

2685

except dbus.exceptions.DBusException as error:

2686

logger.critical("D-Bus Exception", exc_info=error)

2687

cleanup()

2688

sys.exit(1)

2689

# End of Avahi example code

2898

2690

2899

2691

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2900

2692

lambda *args, **kwargs:

2915

2707

# Must run before the D-Bus bus name gets deregistered

2916

2708

cleanup()

2917

2709

2918

2919

2710

if __name__ == '__main__':

2920

2711

main()