/mandos/release : revision 237.7.154

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

39

import SocketServer as socketserver

43

40

import socket

44

41

import argparse

45

42

import datetime

50

47

import gnutls.library.functions

51

48

import gnutls.library.constants

52

49

import gnutls.library.types

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

50

import ConfigParser as configparser

57

51

import sys

58

52

import re

59

53

import os

68

62

import struct

69

63

import fcntl

70

64

import functools

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

65

import cPickle as pickle

75

66

import multiprocessing

76

67

import types

77

68

import binascii

78

69

import tempfile

79

70

import itertools

80

import collections

81

import codecs

82

71

83

72

import dbus

84

73

import dbus.service

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

74

import gobject

89

75

import avahi

90

76

from dbus.mainloop.glib import DBusGMainLoop

91

77

import ctypes

92

78

import ctypes.util

93

79

import xml.dom.minidom

94

80

import inspect

81

import GnuPGInterface

95

82

96

83

try:

97

84

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

101

88

except ImportError:

102

89

SO_BINDTODEVICE = None

103

90

104

if sys.version_info.major == 2:

105

str = unicode

106

107

version = "1.6.9"

91

version = "1.5.5"

108

92

stored_state_file = "clients.pickle"

109

93

110

94

logger = logging.getLogger()

111

syslogger = None

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

112

98

113

99

try:

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

116

103

except (OSError, AttributeError):

117

118

104

def if_nametoindex(interface):

119

105

"Get an interface index the hard way, i.e. using fcntl()"

120

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

121

107

with contextlib.closing(socket.socket()) as s:

122

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

123

struct.pack(b"16s16x", interface))

124

interface_index = struct.unpack("I", ifreq[16:20])[0]

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

125

113

return interface_index

126

114

127

115

128

116

def initlogger(debug, level=logging.WARNING):

129

117

"""init logger and add loglevel"""

130

118

131

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

135

119

syslogger.setFormatter(logging.Formatter

136

120

('Mandos [%(process)d]: %(levelname)s:'

137

121

' %(message)s'))

154

138

155

139

class PGPEngine(object):

156

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

158

141

def __init__(self):

142

self.gnupg = GnuPGInterface.GnuPG()

159

143

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

160

self.gnupgargs = ['--batch',

161

'--home', self.tempdir,

162

'--force-mdc',

163

'--quiet',

164

'--no-use-agent']

144

self.gnupg = GnuPGInterface.GnuPG()

145

self.gnupg.options.meta_interactive = False

146

self.gnupg.options.homedir = self.tempdir

147

self.gnupg.options.extra_args.extend(['--force-mdc',

148

'--quiet',

149

'--no-use-agent'])

165

150

166

151

def __enter__(self):

167

152

return self

189

174

def password_encode(self, password):

190

175

# Passphrase can not be empty and can not contain newlines or

191

176

# NUL bytes. So we prefix it and hex encode it.

192

encoded = b"mandos" + binascii.hexlify(password)

193

if len(encoded) > 2048:

194

# GnuPG can't handle long passwords, so encode differently

195

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

196

.replace(b"\n", b"\\n")

197

.replace(b"\0", b"\\x00"))

198

return encoded

177

return b"mandos" + binascii.hexlify(password)

199

178

200

179

def encrypt(self, data, password):

201

passphrase = self.password_encode(password)

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

204

passfile.write(passphrase)

205

passfile.flush()

206

proc = subprocess.Popen(['gpg', '--symmetric',

207

'--passphrase-file',

208

passfile.name]

209

+ self.gnupgargs,

210

stdin = subprocess.PIPE,

211

stdout = subprocess.PIPE,

212

stderr = subprocess.PIPE)

213

ciphertext, err = proc.communicate(input = data)

214

if proc.returncode != 0:

215

raise PGPError(err)

180

self.gnupg.passphrase = self.password_encode(password)

181

with open(os.devnull, "w") as devnull:

182

try:

183

proc = self.gnupg.run(['--symmetric'],

184

create_fhs=['stdin', 'stdout'],

185

attach_fhs={'stderr': devnull})

186

with contextlib.closing(proc.handles['stdin']) as f:

187

f.write(data)

188

with contextlib.closing(proc.handles['stdout']) as f:

189

ciphertext = f.read()

190

proc.wait()

191

except IOError as e:

192

raise PGPError(e)

193

self.gnupg.passphrase = None

216

194

return ciphertext

217

195

218

196

def decrypt(self, data, password):

219

passphrase = self.password_encode(password)

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

222

passfile.write(passphrase)

223

passfile.flush()

224

proc = subprocess.Popen(['gpg', '--decrypt',

225

'--passphrase-file',

226

passfile.name]

227

+ self.gnupgargs,

228

stdin = subprocess.PIPE,

229

stdout = subprocess.PIPE,

230

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

232

if proc.returncode != 0:

233

raise PGPError(err)

197

self.gnupg.passphrase = self.password_encode(password)

198

with open(os.devnull, "w") as devnull:

199

try:

200

proc = self.gnupg.run(['--decrypt'],

201

create_fhs=['stdin', 'stdout'],

202

attach_fhs={'stderr': devnull})

203

with contextlib.closing(proc.handles['stdin']) as f:

204

f.write(data)

205

with contextlib.closing(proc.handles['stdout']) as f:

206

decrypted_plaintext = f.read()

207

proc.wait()

208

except IOError as e:

209

raise PGPError(e)

210

self.gnupg.passphrase = None

234

211

return decrypted_plaintext

235

212

236

213

237

214

class AvahiError(Exception):

238

215

def __init__(self, value, *args, **kwargs):

239

216

self.value = value

240

return super(AvahiError, self).__init__(value, *args,

241

**kwargs)

242

217

super(AvahiError, self).__init__(value, *args, **kwargs)

218

def __unicode__(self):

219

return unicode(repr(self.value))

243

220

244

221

class AvahiServiceError(AvahiError):

245

222

pass

246

223

247

248

224

class AvahiGroupError(AvahiError):

249

225

pass

250

226

257

233

Used to optionally bind to the specified interface.

258

234

name: string; Example: 'Mandos'

259

235

type: string; Example: '_mandos._tcp'.

260

See <https://www.iana.org/assignments/service-names-port-numbers>

236

See <http://www.dns-sd.org/ServiceTypes.html>

261

237

port: integer; what port to announce

262

238

TXT: list of strings; TXT record for the service

263

239

domain: string; Domain to publish on, default to .local if empty.

270

246

bus: dbus.SystemBus()

271

247

"""

272

248

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

249

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

250

servicetype = None, port = None, TXT = None,

251

domain = "", host = "", max_renames = 32768,

252

protocol = avahi.PROTO_UNSPEC, bus = None):

284

253

self.interface = interface

285

254

self.name = name

286

255

self.type = servicetype

296

265

self.bus = bus

297

266

self.entry_group_state_changed_match = None

298

267

299

def rename(self, remove=True):

268

def rename(self):

300

269

"""Derived from the Avahi example code"""

301

270

if self.rename_count >= self.max_renames:

302

271

logger.critical("No suitable Zeroconf service name found"

303

272

" after %i retries, exiting.",

304

273

self.rename_count)

305

274

raise AvahiServiceError("Too many renames")

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

275

self.name = unicode(self.server

276

.GetAlternativeServiceName(self.name))

309

277

logger.info("Changing Zeroconf service name to %r ...",

310

278

self.name)

311

if remove:

312

self.remove()

279

self.remove()

313

280

try:

314

281

self.add()

315

282

except dbus.exceptions.DBusException as error:

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

283

logger.critical("D-Bus Exception", exc_info=error)

284

self.cleanup()

285

os._exit(1)

286

self.rename_count += 1

324

287

325

288

def remove(self):

326

289

"""Derived from the Avahi example code"""

364

327

self.rename()

365

328

elif state == avahi.ENTRY_GROUP_FAILURE:

366

329

logger.critical("Avahi: Error in group state changed %s",

367

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

330

unicode(error))

331

raise AvahiGroupError("State changed: {0!s}"

332

.format(error))

369

333

370

334

def cleanup(self):

371

335

"""Derived from the Avahi example code"""

381

345

def server_state_changed(self, state, error=None):

382

346

"""Derived from the Avahi example code"""

383

347

logger.debug("Avahi server state change: %i", state)

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

348

bad_states = { avahi.SERVER_INVALID:

349

"Zeroconf server invalid",

350

avahi.SERVER_REGISTERING: None,

351

avahi.SERVER_COLLISION:

352

"Zeroconf server name collision",

353

avahi.SERVER_FAILURE:

354

"Zeroconf server failure" }

390

355

if state in bad_states:

391

356

if bad_states[state] is not None:

392

357

if error is None:

411

376

follow_name_owner_changes=True),

412

377

avahi.DBUS_INTERFACE_SERVER)

413

378

self.server.connect_to_signal("StateChanged",

414

self.server_state_changed)

379

self.server_state_changed)

415

380

self.server_state_changed(self.server.GetState())

416

381

417

382

418

383

class AvahiServiceToSyslog(AvahiService):

419

def rename(self, *args, **kwargs):

384

def rename(self):

420

385

"""Add the new name to the syslog messages"""

421

ret = AvahiService.rename(self, *args, **kwargs)

422

syslogger.setFormatter(logging.Formatter(

423

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

424

.format(self.name)))

386

ret = AvahiService.rename(self)

387

syslogger.setFormatter(logging.Formatter

388

('Mandos ({0}) [%(process)d]:'

389

' %(levelname)s: %(message)s'

390

.format(self.name)))

425

391

return ret

426

392

427

def call_pipe(connection, # : multiprocessing.Connection

428

func, *args, **kwargs):

429

"""This function is meant to be called by multiprocessing.Process

430

431

This function runs func(*args, **kwargs), and writes the resulting

432

return value on the provided multiprocessing.Connection.

433

"""

434

connection.send(func(*args, **kwargs))

435

connection.close()

393

394

def timedelta_to_milliseconds(td):

395

"Convert a datetime.timedelta() to milliseconds"

396

return ((td.days * 24 * 60 * 60 * 1000)

397

+ (td.seconds * 1000)

398

+ (td.microseconds // 1000))

399

436

400

437

401

class Client(object):

438

402

"""A representation of a client host served by this server.

465

429

last_checker_status: integer between 0 and 255 reflecting exit

466

430

status of last checker. -1 reflects crashed

467

431

checker, -2 means no checker completed yet.

468

last_checker_signal: The signal which killed the last checker, if

469

last_checker_status is -1

470

432

last_enabled: datetime.datetime(); (UTC) or None

471

433

name: string; from the config file, used in log messages and

472

434

D-Bus identifiers

477

439

runtime_expansions: Allowed attributes for runtime expansion.

478

440

expires: datetime.datetime(); time (UTC) when a client will be

479

441

disabled, or None

480

server_settings: The server_settings dict from main()

481

442

"""

482

443

483

444

runtime_expansions = ("approval_delay", "approval_duration",

485

446

"fingerprint", "host", "interval",

486

447

"last_approval_request", "last_checked_ok",

487

448

"last_enabled", "name", "timeout")

488

client_defaults = {

489

"timeout": "PT5M",

490

"extended_timeout": "PT15M",

491

"interval": "PT2M",

492

"checker": "fping -q -- %%(host)s",

493

"host": "",

494

"approval_delay": "PT0S",

495

"approval_duration": "PT1S",

496

"approved_by_default": "True",

497

"enabled": "True",

498

}

449

client_defaults = { "timeout": "5m",

450

"extended_timeout": "15m",

451

"interval": "2m",

452

"checker": "fping -q -- %%(host)s",

453

"host": "",

454

"approval_delay": "0s",

455

"approval_duration": "1s",

456

"approved_by_default": "True",

457

"enabled": "True",

458

}

459

460

def timeout_milliseconds(self):

461

"Return the 'timeout' attribute in milliseconds"

462

return timedelta_to_milliseconds(self.timeout)

463

464

def extended_timeout_milliseconds(self):

465

"Return the 'extended_timeout' attribute in milliseconds"

466

return timedelta_to_milliseconds(self.extended_timeout)

467

468

def interval_milliseconds(self):

469

"Return the 'interval' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.interval)

471

472

def approval_delay_milliseconds(self):

473

return timedelta_to_milliseconds(self.approval_delay)

499

474

500

475

@staticmethod

501

476

def config_parser(config):

517

492

client["enabled"] = config.getboolean(client_name,

518

493

"enabled")

519

494

520

# Uppercase and remove spaces from fingerprint for later

521

# comparison purposes with return value from the

522

# fingerprint() function

523

495

client["fingerprint"] = (section["fingerprint"].upper()

524

496

.replace(" ", ""))

525

497

if "secret" in section:

530

502

"rb") as secfile:

531

503

client["secret"] = secfile.read()

532

504

else:

533

raise TypeError("No secret or secfile for section {}"

505

raise TypeError("No secret or secfile for section {0}"

534

506

.format(section))

535

507

client["timeout"] = string_to_delta(section["timeout"])

536

508

client["extended_timeout"] = string_to_delta(

547

519

548

520

return settings

549

521

550

def __init__(self, settings, name = None, server_settings=None):

522

def __init__(self, settings, name = None):

551

523

self.name = name

552

if server_settings is None:

553

server_settings = {}

554

self.server_settings = server_settings

555

524

# adding all client settings

556

for setting, value in settings.items():

525

for setting, value in settings.iteritems():

557

526

setattr(self, setting, value)

558

527

559

528

if self.enabled:

567

536

self.expires = None

568

537

569

538

logger.debug("Creating client %r", self.name)

539

# Uppercase and remove spaces from fingerprint for later

540

# comparison purposes with return value from the fingerprint()

541

# function

570

542

logger.debug(" Fingerprint: %s", self.fingerprint)

571

543

self.created = settings.get("created",

572

544

datetime.datetime.utcnow())

579

551

self.current_checker_command = None

580

552

self.approved = None

581

553

self.approvals_pending = 0

582

self.changedstate = multiprocessing_manager.Condition(

583

multiprocessing_manager.Lock())

584

self.client_structure = [attr

585

for attr in self.__dict__.iterkeys()

554

self.changedstate = (multiprocessing_manager

555

.Condition(multiprocessing_manager

556

.Lock()))

557

self.client_structure = [attr for attr in

558

self.__dict__.iterkeys()

586

559

if not attr.startswith("_")]

587

560

self.client_structure.append("client_structure")

588

561

589

for name, t in inspect.getmembers(

590

type(self), lambda obj: isinstance(obj, property)):

562

for name, t in inspect.getmembers(type(self),

563

lambda obj:

564

isinstance(obj,

565

property)):

591

566

if not name.startswith("_"):

592

567

self.client_structure.append(name)

593

568

635

610

# and every interval from then on.

636

611

if self.checker_initiator_tag is not None:

637

612

gobject.source_remove(self.checker_initiator_tag)

638

self.checker_initiator_tag = gobject.timeout_add(

639

int(self.interval.total_seconds() * 1000),

640

self.start_checker)

613

self.checker_initiator_tag = (gobject.timeout_add

614

(self.interval_milliseconds(),

615

self.start_checker))

641

616

# Schedule a disable() when 'timeout' has passed

642

617

if self.disable_initiator_tag is not None:

643

618

gobject.source_remove(self.disable_initiator_tag)

644

self.disable_initiator_tag = gobject.timeout_add(

645

int(self.timeout.total_seconds() * 1000), self.disable)

619

self.disable_initiator_tag = (gobject.timeout_add

620

(self.timeout_milliseconds(),

621

self.disable))

646

622

# Also start a new checker *right now*.

647

623

self.start_checker()

648

624

649

def checker_callback(self, source, condition, connection,

650

command):

625

def checker_callback(self, pid, condition, command):

651

626

"""The checker has completed, so take appropriate actions."""

652

627

self.checker_callback_tag = None

653

628

self.checker = None

654

# Read return code from connection (see call_pipe)

655

returncode = connection.recv()

656

connection.close()

657

658

if returncode >= 0:

659

self.last_checker_status = returncode

660

self.last_checker_signal = None

629

if os.WIFEXITED(condition):

630

self.last_checker_status = os.WEXITSTATUS(condition)

661

631

if self.last_checker_status == 0:

662

632

logger.info("Checker for %(name)s succeeded",

663

633

vars(self))

664

634

self.checked_ok()

665

635

else:

666

logger.info("Checker for %(name)s failed", vars(self))

636

logger.info("Checker for %(name)s failed",

637

vars(self))

667

638

else:

668

639

self.last_checker_status = -1

669

self.last_checker_signal = -returncode

670

640

logger.warning("Checker for %(name)s crashed?",

671

641

vars(self))

672

return False

673

642

674

643

def checked_ok(self):

675

644

"""Assert that the client has been seen, alive and well."""

676

645

self.last_checked_ok = datetime.datetime.utcnow()

677

646

self.last_checker_status = 0

678

self.last_checker_signal = None

679

647

self.bump_timeout()

680

648

681

649

def bump_timeout(self, timeout=None):

686

654

gobject.source_remove(self.disable_initiator_tag)

687

655

self.disable_initiator_tag = None

688

656

if getattr(self, "enabled", False):

689

self.disable_initiator_tag = gobject.timeout_add(

690

int(timeout.total_seconds() * 1000), self.disable)

657

self.disable_initiator_tag = (gobject.timeout_add

658

(timedelta_to_milliseconds

659

(timeout), self.disable))

691

660

self.expires = datetime.datetime.utcnow() + timeout

692

661

693

662

def need_approval(self):

707

676

# than 'timeout' for the client to be disabled, which is as it

708

677

# should be.

709

678

710

if self.checker is not None and not self.checker.is_alive():

711

logger.warning("Checker was not alive; joining")

712

self.checker.join()

713

self.checker = None

679

# If a checker exists, make sure it is not a zombie

680

try:

681

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

682

except (AttributeError, OSError) as error:

683

if (isinstance(error, OSError)

684

and error.errno != errno.ECHILD):

685

raise error

686

else:

687

if pid:

688

logger.warning("Checker was a zombie")

689

gobject.source_remove(self.checker_callback_tag)

690

self.checker_callback(pid, status,

691

self.current_checker_command)

714

692

# Start a new checker if needed

715

693

if self.checker is None:

716

694

# Escape attributes for the shell

717

escaped_attrs = {

718

attr: re.escape(str(getattr(self, attr)))

719

for attr in self.runtime_expansions }

695

escaped_attrs = dict(

696

(attr, re.escape(unicode(getattr(self, attr))))

697

for attr in

698

self.runtime_expansions)

720

699

try:

721

700

command = self.checker_command % escaped_attrs

722

701

except TypeError as error:

723

702

logger.error('Could not format string "%s"',

724

self.checker_command,

703

self.checker_command, exc_info=error)

704

return True # Try again later

705

self.current_checker_command = command

706

try:

707

logger.info("Starting checker %r for %s",

708

command, self.name)

709

# We don't need to redirect stdout and stderr, since

710

# in normal mode, that is already done by daemon(),

711

# and in debug mode we don't want to. (Stdin is

712

# always replaced by /dev/null.)

713

self.checker = subprocess.Popen(command,

714

close_fds=True,

715

shell=True, cwd="/")

716

except OSError as error:

717

logger.error("Failed to start subprocess",

725

718

exc_info=error)

726

return True # Try again later

727

self.current_checker_command = command

728

logger.info("Starting checker %r for %s", command,

729

self.name)

730

# We don't need to redirect stdout and stderr, since

731

# in normal mode, that is already done by daemon(),

732

# and in debug mode we don't want to. (Stdin is

733

# always replaced by /dev/null.)

734

# The exception is when not debugging but nevertheless

735

# running in the foreground; use the previously

736

# created wnull.

737

popen_args = { "close_fds": True,

738

"shell": True,

739

"cwd": "/" }

740

if (not self.server_settings["debug"]

741

and self.server_settings["foreground"]):

742

popen_args.update({"stdout": wnull,

743

"stderr": wnull })

744

pipe = multiprocessing.Pipe(duplex = False)

745

self.checker = multiprocessing.Process(

746

target = call_pipe,

747

args = (pipe[1], subprocess.call, command),

748

kwargs = popen_args)

749

self.checker.start()

750

self.checker_callback_tag = gobject.io_add_watch(

751

pipe[0].fileno(), gobject.IO_IN,

752

self.checker_callback, pipe[0], command)

719

self.checker_callback_tag = (gobject.child_watch_add

720

(self.checker.pid,

721

self.checker_callback,

722

data=command))

723

# The checker may have completed before the gobject

724

# watch was added. Check for this.

725

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

726

if pid:

727

gobject.source_remove(self.checker_callback_tag)

728

self.checker_callback(pid, status, command)

753

729

# Re-run this periodically if run by gobject.timeout_add

754

730

return True

755

731

761

737

if getattr(self, "checker", None) is None:

762

738

return

763

739

logger.debug("Stopping checker for %(name)s", vars(self))

764

self.checker.terminate()

740

try:

741

self.checker.terminate()

742

#time.sleep(0.5)

743

#if self.checker.poll() is None:

744

# self.checker.kill()

745

except OSError as error:

746

if error.errno != errno.ESRCH: # No such process

747

raise

765

748

self.checker = None

766

749

767

750

768

def dbus_service_property(dbus_interface,

769

signature="v",

770

access="readwrite",

771

byte_arrays=False):

751

def dbus_service_property(dbus_interface, signature="v",

752

access="readwrite", byte_arrays=False):

772

753

"""Decorators for marking methods of a DBusObjectWithProperties to

773

754

become properties on the D-Bus.

774

755

783

764

# "Set" method, so we fail early here:

784

765

if byte_arrays and signature != "ay":

785

766

raise ValueError("Byte arrays not supported for non-'ay'"

786

" signature {!r}".format(signature))

787

767

" signature {0!r}".format(signature))

788

768

def decorator(func):

789

769

func._dbus_is_property = True

790

770

func._dbus_interface = dbus_interface

795

775

func._dbus_name = func._dbus_name[:-14]

796

776

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

797

777

return func

798

799

778

return decorator

800

779

801

780

810

789

"org.freedesktop.DBus.Property.EmitsChangedSignal":

811

790

"false"}

812

791

"""

813

814

792

def decorator(func):

815

793

func._dbus_is_interface = True

816

794

func._dbus_interface = dbus_interface

817

795

func._dbus_name = dbus_interface

818

796

return func

819

820

797

return decorator

821

798

822

799

824

801

"""Decorator to annotate D-Bus methods, signals or properties

825

802

Usage:

826

803

827

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

828

"org.freedesktop.DBus.Property."

829

"EmitsChangedSignal": "false"})

830

804

@dbus_service_property("org.example.Interface", signature="b",

831

805

access="r")

806

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

807

"org.freedesktop.DBus.Property."

808

"EmitsChangedSignal": "false"})

832

809

def Property_dbus_property(self):

833

810

return dbus.Boolean(False)

834

811

"""

835

836

812

def decorator(func):

837

813

func._dbus_annotations = annotations

838

814

return func

839

840

815

return decorator

841

816

842

817

843

818

class DBusPropertyException(dbus.exceptions.DBusException):

844

819

"""A base class for D-Bus property-related exceptions

845

820

"""

846

pass

821

def __unicode__(self):

822

return unicode(str(self))

847

823

848

824

849

825

class DBusPropertyAccessException(DBusPropertyException):

873

849

If called like _is_dbus_thing("method") it returns a function

874

850

suitable for use as predicate to inspect.getmembers().

875

851

"""

876

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

852

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

877

853

False)

878

854

879

855

def _get_all_dbus_things(self, thing):

880

856

"""Returns a generator of (name, attribute) pairs

881

857

"""

882

return ((getattr(athing.__get__(self), "_dbus_name", name),

858

return ((getattr(athing.__get__(self), "_dbus_name",

859

name),

883

860

athing.__get__(self))

884

861

for cls in self.__class__.__mro__

885

862

for name, athing in

886

inspect.getmembers(cls, self._is_dbus_thing(thing)))

863

inspect.getmembers(cls,

864

self._is_dbus_thing(thing)))

887

865

888

866

def _get_dbus_property(self, interface_name, property_name):

889

867

"""Returns a bound method if one exists which is a D-Bus

890

868

property with the specified name and interface.

891

869

"""

892

for cls in self.__class__.__mro__:

893

for name, value in inspect.getmembers(

894

cls, self._is_dbus_thing("property")):

870

for cls in self.__class__.__mro__:

871

for name, value in (inspect.getmembers

872

(cls,

873

self._is_dbus_thing("property"))):

895

874

if (value._dbus_name == property_name

896

875

and value._dbus_interface == interface_name):

897

876

return value.__get__(self)

898

877

899

878

# No such property

900

raise DBusPropertyNotFound("{}:{}.{}".format(

901

self.dbus_object_path, interface_name, property_name))

879

raise DBusPropertyNotFound(self.dbus_object_path + ":"

880

+ interface_name + "."

881

+ property_name)

902

882

903

@dbus.service.method(dbus.PROPERTIES_IFACE,

904

in_signature="ss",

883

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

905

884

out_signature="v")

906

885

def Get(self, interface_name, property_name):

907

886

"""Standard D-Bus property Get() method, see D-Bus standard.

925

904

# The byte_arrays option is not supported yet on

926

905

# signatures other than "ay".

927

906

if prop._dbus_signature != "ay":

928

raise ValueError("Byte arrays not supported for non-"

929

"'ay' signature {!r}"

930

.format(prop._dbus_signature))

907

raise ValueError

931

908

value = dbus.ByteArray(b''.join(chr(byte)

932

909

for byte in value))

933

910

prop(value)

934

911

935

@dbus.service.method(dbus.PROPERTIES_IFACE,

936

in_signature="s",

912

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

937

913

out_signature="a{sv}")

938

914

def GetAll(self, interface_name):

939

915

"""Standard D-Bus property GetAll() method, see D-Bus

954

930

if not hasattr(value, "variant_level"):

955

931

properties[name] = value

956

932

continue

957

properties[name] = type(value)(

958

value, variant_level = value.variant_level + 1)

933

properties[name] = type(value)(value, variant_level=

934

value.variant_level+1)

959

935

return dbus.Dictionary(properties, signature="sv")

960

936

961

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

962

def PropertiesChanged(self, interface_name, changed_properties,

963

invalidated_properties):

964

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

965

standard.

966

"""

967

pass

968

969

937

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

970

938

out_signature="s",

971

939

path_keyword='object_path',

979

947

connection)

980

948

try:

981

949

document = xml.dom.minidom.parseString(xmlstring)

982

983

950

def make_tag(document, name, prop):

984

951

e = document.createElement("property")

985

952

e.setAttribute("name", name)

986

953

e.setAttribute("type", prop._dbus_signature)

987

954

e.setAttribute("access", prop._dbus_access)

988

955

return e

989

990

956

for if_tag in document.getElementsByTagName("interface"):

991

957

# Add property tags

992

958

for tag in (make_tag(document, name, prop)

1004

970

if (name == tag.getAttribute("name")

1005

971

and prop._dbus_interface

1006

972

== if_tag.getAttribute("name")):

1007

annots.update(getattr(

1008

prop, "_dbus_annotations", {}))

1009

for name, value in annots.items():

973

annots.update(getattr

974

(prop,

975

"_dbus_annotations",

976

{}))

977

for name, value in annots.iteritems():

1010

978

ann_tag = document.createElement(

1011

979

"annotation")

1012

980

ann_tag.setAttribute("name", name)

1015

983

# Add interface annotation tags

1016

984

for annotation, value in dict(

1017

985

itertools.chain.from_iterable(

1018

annotations().items()

1019

for name, annotations

1020

in self._get_all_dbus_things("interface")

986

annotations().iteritems()

987

for name, annotations in

988

self._get_all_dbus_things("interface")

1021

989

if name == if_tag.getAttribute("name")

1022

)).items():

990

)).iteritems():

1023

991

ann_tag = document.createElement("annotation")

1024

992

ann_tag.setAttribute("name", annotation)

1025

993

ann_tag.setAttribute("value", value)

1052

1020

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1053

1021

if dt is None:

1054

1022

return dbus.String("", variant_level = variant_level)

1055

return dbus.String(dt.isoformat(), variant_level=variant_level)

1023

return dbus.String(dt.isoformat(),

1024

variant_level=variant_level)

1056

1025

1057

1026

1058

1027

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1078

1047

(from DBusObjectWithProperties) and interfaces (from the

1079

1048

dbus_interface_annotations decorator).

1080

1049

"""

1081

1082

1050

def wrapper(cls):

1083

1051

for orig_interface_name, alt_interface_name in (

1084

alt_interface_names.items()):

1052

alt_interface_names.iteritems()):

1085

1053

attr = {}

1086

1054

interface_names = set()

1087

1055

# Go though all attributes of the class

1089

1057

# Ignore non-D-Bus attributes, and D-Bus attributes

1090

1058

# with the wrong interface name

1091

1059

if (not hasattr(attribute, "_dbus_interface")

1092

or not attribute._dbus_interface.startswith(

1093

orig_interface_name)):

1060

or not attribute._dbus_interface

1061

.startswith(orig_interface_name)):

1094

1062

continue

1095

1063

# Create an alternate D-Bus interface name based on

1096

1064

# the current name

1097

alt_interface = attribute._dbus_interface.replace(

1098

orig_interface_name, alt_interface_name)

1065

alt_interface = (attribute._dbus_interface

1066

.replace(orig_interface_name,

1067

alt_interface_name))

1099

1068

interface_names.add(alt_interface)

1100

1069

# Is this a D-Bus signal?

1101

1070

if getattr(attribute, "_dbus_is_signal", False):

1102

if sys.version_info.major == 2:

1103

# Extract the original non-method undecorated

1104

# function by black magic

1105

nonmethod_func = (dict(

1071

# Extract the original non-method function by

1072

# black magic

1073

nonmethod_func = (dict(

1106

1074

zip(attribute.func_code.co_freevars,

1107

attribute.__closure__))

1108

["func"].cell_contents)

1109

else:

1110

nonmethod_func = attribute

1075

attribute.__closure__))["func"]

1076

.cell_contents)

1111

1077

# Create a new, but exactly alike, function

1112

1078

# object, and decorate it to be a new D-Bus signal

1113

1079

# with the alternate D-Bus interface name

1114

if sys.version_info.major == 2:

1115

new_function = types.FunctionType(

1116

nonmethod_func.func_code,

1117

nonmethod_func.func_globals,

1118

nonmethod_func.func_name,

1119

nonmethod_func.func_defaults,

1120

nonmethod_func.func_closure)

1121

else:

1122

new_function = types.FunctionType(

1123

nonmethod_func.__code__,

1124

nonmethod_func.__globals__,

1125

nonmethod_func.__name__,

1126

nonmethod_func.__defaults__,

1127

nonmethod_func.__closure__)

1128

new_function = (dbus.service.signal(

1129

alt_interface,

1130

attribute._dbus_signature)(new_function))

1080

new_function = (dbus.service.signal

1081

(alt_interface,

1082

attribute._dbus_signature)

1083

(types.FunctionType(

1084

nonmethod_func.func_code,

1085

nonmethod_func.func_globals,

1086

nonmethod_func.func_name,

1087

nonmethod_func.func_defaults,

1088

nonmethod_func.func_closure)))

1131

1089

# Copy annotations, if any

1132

1090

try:

1133

new_function._dbus_annotations = dict(

1134

attribute._dbus_annotations)

1091

new_function._dbus_annotations = (

1092

dict(attribute._dbus_annotations))

1135

1093

except AttributeError:

1136

1094

pass

1137

1095

# Define a creator of a function to call both the

1142

1100

"""This function is a scope container to pass

1143

1101

func1 and func2 to the "call_both" function

1144

1102

outside of its arguments"""

1145

1146

1103

def call_both(*args, **kwargs):

1147

1104

"""This function will emit two D-Bus

1148

1105

signals by calling func1 and func2"""

1149

1106

func1(*args, **kwargs)

1150

1107

func2(*args, **kwargs)

1151

1152

1108

return call_both

1153

1109

# Create the "call_both" function and add it to

1154

1110

# the class

1159

1115

# object. Decorate it to be a new D-Bus method

1160

1116

# with the alternate D-Bus interface name. Add it

1161

1117

# to the class.

1162

attr[attrname] = (

1163

dbus.service.method(

1164

alt_interface,

1165

attribute._dbus_in_signature,

1166

attribute._dbus_out_signature)

1167

(types.FunctionType(attribute.func_code,

1168

attribute.func_globals,

1169

attribute.func_name,

1170

attribute.func_defaults,

1171

attribute.func_closure)))

1118

attr[attrname] = (dbus.service.method

1119

(alt_interface,

1120

attribute._dbus_in_signature,

1121

attribute._dbus_out_signature)

1122

(types.FunctionType

1123

(attribute.func_code,

1124

attribute.func_globals,

1125

attribute.func_name,

1126

attribute.func_defaults,

1127

attribute.func_closure)))

1172

1128

# Copy annotations, if any

1173

1129

try:

1174

attr[attrname]._dbus_annotations = dict(

1175

attribute._dbus_annotations)

1130

attr[attrname]._dbus_annotations = (

1131

dict(attribute._dbus_annotations))

1176

1132

except AttributeError:

1177

1133

pass

1178

1134

# Is this a D-Bus property?

1181

1137

# object, and decorate it to be a new D-Bus

1182

1138

# property with the alternate D-Bus interface

1183

1139

# name. Add it to the class.

1184

attr[attrname] = (dbus_service_property(

1185

alt_interface, attribute._dbus_signature,

1186

attribute._dbus_access,

1187

attribute._dbus_get_args_options

1188

["byte_arrays"])

1189

(types.FunctionType(

1190

attribute.func_code,

1191

attribute.func_globals,

1192

attribute.func_name,

1193

attribute.func_defaults,

1194

attribute.func_closure)))

1140

attr[attrname] = (dbus_service_property

1141

(alt_interface,

1142

attribute._dbus_signature,

1143

attribute._dbus_access,

1144

attribute

1145

._dbus_get_args_options

1146

["byte_arrays"])

1147

(types.FunctionType

1148

(attribute.func_code,

1149

attribute.func_globals,

1150

attribute.func_name,

1151

attribute.func_defaults,

1152

attribute.func_closure)))

1195

1153

# Copy annotations, if any

1196

1154

try:

1197

attr[attrname]._dbus_annotations = dict(

1198

attribute._dbus_annotations)

1155

attr[attrname]._dbus_annotations = (

1156

dict(attribute._dbus_annotations))

1199

1157

except AttributeError:

1200

1158

pass

1201

1159

# Is this a D-Bus interface?

1204

1162

# object. Decorate it to be a new D-Bus interface

1205

1163

# with the alternate D-Bus interface name. Add it

1206

1164

# to the class.

1207

attr[attrname] = (

1208

dbus_interface_annotations(alt_interface)

1209

(types.FunctionType(attribute.func_code,

1210

attribute.func_globals,

1211

attribute.func_name,

1212

attribute.func_defaults,

1213

attribute.func_closure)))

1165

attr[attrname] = (dbus_interface_annotations

1166

(alt_interface)

1167

(types.FunctionType

1168

(attribute.func_code,

1169

attribute.func_globals,

1170

attribute.func_name,

1171

attribute.func_defaults,

1172

attribute.func_closure)))

1214

1173

if deprecate:

1215

1174

# Deprecate all alternate interfaces

1216

iname="_AlternateDBusNames_interface_annotation{}"

1175

iname="_AlternateDBusNames_interface_annotation{0}"

1217

1176

for interface_name in interface_names:

1218

1219

1177

@dbus_interface_annotations(interface_name)

1220

1178

def func(self):

1221

1179

return { "org.freedesktop.DBus.Deprecated":

1222

"true" }

1180

"true" }

1223

1181

# Find an unused name

1224

1182

for aname in (iname.format(i)

1225

1183

for i in itertools.count()):

1229

1187

if interface_names:

1230

1188

# Replace the class with a new subclass of it with

1231

1189

# methods, signals, etc. as created above.

1232

cls = type(b"{}Alternate".format(cls.__name__),

1233

(cls, ), attr)

1190

cls = type(b"{0}Alternate".format(cls.__name__),

1191

(cls,), attr)

1234

1192

return cls

1235

1236

1193

return wrapper

1237

1194

1238

1195

1239

1196

@alternate_dbus_interfaces({"se.recompile.Mandos":

1240

"se.bsnet.fukt.Mandos"})

1197

"se.bsnet.fukt.Mandos"})

1241

1198

class ClientDBus(Client, DBusObjectWithProperties):

1242

1199

"""A Client class using D-Bus

1243

1200

1247

1204

"""

1248

1205

1249

1206

runtime_expansions = (Client.runtime_expansions

1250

+ ("dbus_object_path", ))

1251

1252

_interface = "se.recompile.Mandos.Client"

1207

+ ("dbus_object_path",))

1253

1208

1254

1209

# dbus.service.Object doesn't use super(), so we can't either.

1255

1210

1258

1213

Client.__init__(self, *args, **kwargs)

1259

1214

# Only now, when this client is initialized, can it show up on

1260

1215

# the D-Bus

1261

client_object_name = str(self.name).translate(

1216

client_object_name = unicode(self.name).translate(

1262

1217

{ord("."): ord("_"),

1263

1218

ord("-"): ord("_")})

1264

self.dbus_object_path = dbus.ObjectPath(

1265

"/clients/" + client_object_name)

1219

self.dbus_object_path = (dbus.ObjectPath

1220

("/clients/" + client_object_name))

1266

1221

DBusObjectWithProperties.__init__(self, self.bus,

1267

1222

self.dbus_object_path)

1268

1223

1269

def notifychangeproperty(transform_func, dbus_name,

1270

type_func=lambda x: x,

1271

variant_level=1,

1272

invalidate_only=False,

1273

_interface=_interface):

1224

def notifychangeproperty(transform_func,

1225

dbus_name, type_func=lambda x: x,

1226

variant_level=1):

1274

1227

""" Modify a variable so that it's a property which announces

1275

1228

its changes to DBus.

1276

1229

1281

1234

to the D-Bus. Default: no transform

1282

1235

variant_level: D-Bus variant level. Default: 1

1283

1236

"""

1284

attrname = "_{}".format(dbus_name)

1285

1237

attrname = "_{0}".format(dbus_name)

1286

1238

def setter(self, value):

1287

1239

if hasattr(self, "dbus_object_path"):

1288

1240

if (not hasattr(self, attrname) or

1289

1241

type_func(getattr(self, attrname, None))

1290

1242

!= type_func(value)):

1291

if invalidate_only:

1292

self.PropertiesChanged(

1293

_interface, dbus.Dictionary(),

1294

dbus.Array((dbus_name, )))

1295

else:

1296

dbus_value = transform_func(

1297

type_func(value),

1298

variant_level = variant_level)

1299

self.PropertyChanged(dbus.String(dbus_name),

1300

dbus_value)

1301

self.PropertiesChanged(

1302

_interface,

1303

dbus.Dictionary({ dbus.String(dbus_name):

1304

dbus_value }),

1305

dbus.Array())

1243

dbus_value = transform_func(type_func(value),

1244

variant_level

1245

=variant_level)

1246

self.PropertyChanged(dbus.String(dbus_name),

1247

dbus_value)

1306

1248

setattr(self, attrname, value)

1307

1249

1308

1250

return property(lambda self: getattr(self, attrname), setter)

1314

1256

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1315

1257

last_enabled = notifychangeproperty(datetime_to_dbus,

1316

1258

"LastEnabled")

1317

checker = notifychangeproperty(

1318

dbus.Boolean, "CheckerRunning",

1319

type_func = lambda checker: checker is not None)

1259

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1260

type_func = lambda checker:

1261

checker is not None)

1320

1262

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1321

1263

"LastCheckedOK")

1322

1264

last_checker_status = notifychangeproperty(dbus.Int16,

1325

1267

datetime_to_dbus, "LastApprovalRequest")

1326

1268

approved_by_default = notifychangeproperty(dbus.Boolean,

1327

1269

"ApprovedByDefault")

1328

approval_delay = notifychangeproperty(

1329

dbus.UInt64, "ApprovalDelay",

1330

type_func = lambda td: td.total_seconds() * 1000)

1270

approval_delay = notifychangeproperty(dbus.UInt64,

1271

"ApprovalDelay",

1272

type_func =

1273

timedelta_to_milliseconds)

1331

1274

approval_duration = notifychangeproperty(

1332

1275

dbus.UInt64, "ApprovalDuration",

1333

type_func = lambda td: td.total_seconds() * 1000)

1276

type_func = timedelta_to_milliseconds)

1334

1277

host = notifychangeproperty(dbus.String, "Host")

1335

timeout = notifychangeproperty(

1336

dbus.UInt64, "Timeout",

1337

type_func = lambda td: td.total_seconds() * 1000)

1278

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1279

type_func =

1280

timedelta_to_milliseconds)

1338

1281

extended_timeout = notifychangeproperty(

1339

1282

dbus.UInt64, "ExtendedTimeout",

1340

type_func = lambda td: td.total_seconds() * 1000)

1341

interval = notifychangeproperty(

1342

dbus.UInt64, "Interval",

1343

type_func = lambda td: td.total_seconds() * 1000)

1283

type_func = timedelta_to_milliseconds)

1284

interval = notifychangeproperty(dbus.UInt64,

1285

"Interval",

1286

type_func =

1287

timedelta_to_milliseconds)

1344

1288

checker_command = notifychangeproperty(dbus.String, "Checker")

1345

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1346

invalidate_only=True)

1347

1289

1348

1290

del notifychangeproperty

1349

1291

1356

1298

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1357

1299

Client.__del__(self, *args, **kwargs)

1358

1300

1359

def checker_callback(self, source, condition,

1360

connection, command, *args, **kwargs):

1361

ret = Client.checker_callback(self, source, condition,

1362

connection, command, *args,

1363

**kwargs)

1364

exitstatus = self.last_checker_status

1365

if exitstatus >= 0:

1301

def checker_callback(self, pid, condition, command,

1302

*args, **kwargs):

1303

self.checker_callback_tag = None

1304

self.checker = None

1305

if os.WIFEXITED(condition):

1306

exitstatus = os.WEXITSTATUS(condition)

1366

1307

# Emit D-Bus signal

1367

1308

self.CheckerCompleted(dbus.Int16(exitstatus),

1368

dbus.Int64(0),

1309

dbus.Int64(condition),

1369

1310

dbus.String(command))

1370

1311

else:

1371

1312

# Emit D-Bus signal

1372

1313

self.CheckerCompleted(dbus.Int16(-1),

1373

dbus.Int64(

1374

self.last_checker_signal),

1314

dbus.Int64(condition),

1375

1315

dbus.String(command))

1376

return ret

1316

1317

return Client.checker_callback(self, pid, condition, command,

1318

*args, **kwargs)

1377

1319

1378

1320

def start_checker(self, *args, **kwargs):

1379

old_checker_pid = getattr(self.checker, "pid", None)

1321

old_checker = self.checker

1322

if self.checker is not None:

1323

old_checker_pid = self.checker.pid

1324

else:

1325

old_checker_pid = None

1380

1326

r = Client.start_checker(self, *args, **kwargs)

1381

1327

# Only if new checker process was started

1382

1328

if (self.checker is not None

1391

1337

1392

1338

def approve(self, value=True):

1393

1339

self.approved = value

1394

gobject.timeout_add(int(self.approval_duration.total_seconds()

1395

* 1000), self._reset_approved)

1340

gobject.timeout_add(timedelta_to_milliseconds

1341

(self.approval_duration),

1342

self._reset_approved)

1396

1343

self.send_changedstate()

1397

1344

1398

1345

## D-Bus methods, signals & properties

1346

_interface = "se.recompile.Mandos.Client"

1399

1347

1400

1348

## Interfaces

1401

1349

1350

@dbus_interface_annotations(_interface)

1351

def _foo(self):

1352

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1353

"false"}

1354

1402

1355

## Signals

1403

1356

1404

1357

# CheckerCompleted - signal

1414

1367

pass

1415

1368

1416

1369

# PropertyChanged - signal

1417

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1418

1370

@dbus.service.signal(_interface, signature="sv")

1419

1371

def PropertyChanged(self, property, value):

1420

1372

"D-Bus signal"

1484

1436

return dbus.Boolean(bool(self.approvals_pending))

1485

1437

1486

1438

# ApprovedByDefault - property

1487

@dbus_service_property(_interface,

1488

signature="b",

1439

@dbus_service_property(_interface, signature="b",

1489

1440

access="readwrite")

1490

1441

def ApprovedByDefault_dbus_property(self, value=None):

1491

1442

if value is None: # get

1493

1444

self.approved_by_default = bool(value)

1494

1445

1495

1446

# ApprovalDelay - property

1496

@dbus_service_property(_interface,

1497

signature="t",

1447

@dbus_service_property(_interface, signature="t",

1498

1448

access="readwrite")

1499

1449

def ApprovalDelay_dbus_property(self, value=None):

1500

1450

if value is None: # get

1501

return dbus.UInt64(self.approval_delay.total_seconds()

1502

* 1000)

1451

return dbus.UInt64(self.approval_delay_milliseconds())

1503

1452

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1504

1453

1505

1454

# ApprovalDuration - property

1506

@dbus_service_property(_interface,

1507

signature="t",

1455

@dbus_service_property(_interface, signature="t",

1508

1456

access="readwrite")

1509

1457

def ApprovalDuration_dbus_property(self, value=None):

1510

1458

if value is None: # get

1511

return dbus.UInt64(self.approval_duration.total_seconds()

1512

* 1000)

1459

return dbus.UInt64(timedelta_to_milliseconds(

1460

self.approval_duration))

1513

1461

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1514

1462

1515

1463

# Name - property

1523

1471

return dbus.String(self.fingerprint)

1524

1472

1525

1473

# Host - property

1526

@dbus_service_property(_interface,

1527

signature="s",

1474

@dbus_service_property(_interface, signature="s",

1528

1475

access="readwrite")

1529

1476

def Host_dbus_property(self, value=None):

1530

1477

if value is None: # get

1531

1478

return dbus.String(self.host)

1532

self.host = str(value)

1479

self.host = unicode(value)

1533

1480

1534

1481

# Created - property

1535

1482

@dbus_service_property(_interface, signature="s", access="read")

1542

1489

return datetime_to_dbus(self.last_enabled)

1543

1490

1544

1491

# Enabled - property

1545

@dbus_service_property(_interface,

1546

signature="b",

1492

@dbus_service_property(_interface, signature="b",

1547

1493

access="readwrite")

1548

1494

def Enabled_dbus_property(self, value=None):

1549

1495

if value is None: # get

1554

1500

self.disable()

1555

1501

1556

1502

# LastCheckedOK - property

1557

@dbus_service_property(_interface,

1558

signature="s",

1503

@dbus_service_property(_interface, signature="s",

1559

1504

access="readwrite")

1560

1505

def LastCheckedOK_dbus_property(self, value=None):

1561

1506

if value is not None:

1564

1509

return datetime_to_dbus(self.last_checked_ok)

1565

1510

1566

1511

# LastCheckerStatus - property

1567

@dbus_service_property(_interface, signature="n", access="read")

1512

@dbus_service_property(_interface, signature="n",

1513

access="read")

1568

1514

def LastCheckerStatus_dbus_property(self):

1569

1515

return dbus.Int16(self.last_checker_status)

1570

1516

1579

1525

return datetime_to_dbus(self.last_approval_request)

1580

1526

1581

1527

# Timeout - property

1582

@dbus_service_property(_interface,

1583

signature="t",

1528

@dbus_service_property(_interface, signature="t",

1584

1529

access="readwrite")

1585

1530

def Timeout_dbus_property(self, value=None):

1586

1531

if value is None: # get

1587

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1532

return dbus.UInt64(self.timeout_milliseconds())

1588

1533

old_timeout = self.timeout

1589

1534

self.timeout = datetime.timedelta(0, 0, 0, value)

1590

1535

# Reschedule disabling

1599

1544

is None):

1600

1545

return

1601

1546

gobject.source_remove(self.disable_initiator_tag)

1602

self.disable_initiator_tag = gobject.timeout_add(

1603

int((self.expires - now).total_seconds() * 1000),

1604

self.disable)

1547

self.disable_initiator_tag = (

1548

gobject.timeout_add(

1549

timedelta_to_milliseconds(self.expires - now),

1550

self.disable))

1605

1551

1606

1552

# ExtendedTimeout - property

1607

@dbus_service_property(_interface,

1608

signature="t",

1553

@dbus_service_property(_interface, signature="t",

1609

1554

access="readwrite")

1610

1555

def ExtendedTimeout_dbus_property(self, value=None):

1611

1556

if value is None: # get

1612

return dbus.UInt64(self.extended_timeout.total_seconds()

1613

* 1000)

1557

return dbus.UInt64(self.extended_timeout_milliseconds())

1614

1558

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1615

1559

1616

1560

# Interval - property

1617

@dbus_service_property(_interface,

1618

signature="t",

1561

@dbus_service_property(_interface, signature="t",

1619

1562

access="readwrite")

1620

1563

def Interval_dbus_property(self, value=None):

1621

1564

if value is None: # get

1622

return dbus.UInt64(self.interval.total_seconds() * 1000)

1565

return dbus.UInt64(self.interval_milliseconds())

1623

1566

self.interval = datetime.timedelta(0, 0, 0, value)

1624

1567

if getattr(self, "checker_initiator_tag", None) is None:

1625

1568

return

1626

1569

if self.enabled:

1627

1570

# Reschedule checker run

1628

1571

gobject.source_remove(self.checker_initiator_tag)

1629

self.checker_initiator_tag = gobject.timeout_add(

1630

value, self.start_checker)

1631

self.start_checker() # Start one now, too

1572

self.checker_initiator_tag = (gobject.timeout_add

1573

(value, self.start_checker))

1574

self.start_checker() # Start one now, too

1632

1575

1633

1576

# Checker - property

1634

@dbus_service_property(_interface,

1635

signature="s",

1577

@dbus_service_property(_interface, signature="s",

1636

1578

access="readwrite")

1637

1579

def Checker_dbus_property(self, value=None):

1638

1580

if value is None: # get

1639

1581

return dbus.String(self.checker_command)

1640

self.checker_command = str(value)

1582

self.checker_command = unicode(value)

1641

1583

1642

1584

# CheckerRunning - property

1643

@dbus_service_property(_interface,

1644

signature="b",

1585

@dbus_service_property(_interface, signature="b",

1645

1586

access="readwrite")

1646

1587

def CheckerRunning_dbus_property(self, value=None):

1647

1588

if value is None: # get

1657

1598

return self.dbus_object_path # is already a dbus.ObjectPath

1658

1599

1659

1600

# Secret = property

1660

@dbus_service_property(_interface,

1661

signature="ay",

1662

access="write",

1663

byte_arrays=True)

1601

@dbus_service_property(_interface, signature="ay",

1602

access="write", byte_arrays=True)

1664

1603

def Secret_dbus_property(self, value):

1665

self.secret = bytes(value)

1604

self.secret = str(value)

1666

1605

1667

1606

del _interface

1668

1607

1672

1611

self._pipe = child_pipe

1673

1612

self._pipe.send(('init', fpr, address))

1674

1613

if not self._pipe.recv():

1675

raise KeyError(fpr)

1614

raise KeyError()

1676

1615

1677

1616

def __getattribute__(self, name):

1678

1617

if name == '_pipe':

1682

1621

if data[0] == 'data':

1683

1622

return data[1]

1684

1623

if data[0] == 'function':

1685

1686

1624

def func(*args, **kwargs):

1687

1625

self._pipe.send(('funcall', name, args, kwargs))

1688

1626

return self._pipe.recv()[1]

1689

1690

1627

return func

1691

1628

1692

1629

def __setattr__(self, name, value):

1704

1641

def handle(self):

1705

1642

with contextlib.closing(self.server.child_pipe) as child_pipe:

1706

1643

logger.info("TCP connection from: %s",

1707

str(self.client_address))

1644

unicode(self.client_address))

1708

1645

logger.debug("Pipe FD: %d",

1709

1646

self.server.child_pipe.fileno())

1710

1647

1711

session = gnutls.connection.ClientSession(

1712

self.request, gnutls.connection .X509Credentials())

1648

session = (gnutls.connection

1649

.ClientSession(self.request,

1650

gnutls.connection

1651

.X509Credentials()))

1713

1652

1714

1653

# Note: gnutls.connection.X509Credentials is really a

1715

1654

# generic GnuTLS certificate credentials object so long as

1724

1663

priority = self.server.gnutls_priority

1725

1664

if priority is None:

1726

1665

priority = "NORMAL"

1727

gnutls.library.functions.gnutls_priority_set_direct(

1728

session._c_object, priority, None)

1666

(gnutls.library.functions

1667

.gnutls_priority_set_direct(session._c_object,

1668

priority, None))

1729

1669

1730

1670

# Start communication using the Mandos protocol

1731

1671

# Get protocol number

1733

1673

logger.debug("Protocol version: %r", line)

1734

1674

try:

1735

1675

if int(line.strip().split()[0]) > 1:

1736

raise RuntimeError(line)

1676

raise RuntimeError

1737

1677

except (ValueError, IndexError, RuntimeError) as error:

1738

1678

logger.error("Unknown protocol version: %s", error)

1739

1679

return

1751

1691

approval_required = False

1752

1692

try:

1753

1693

try:

1754

fpr = self.fingerprint(

1755

self.peer_certificate(session))

1694

fpr = self.fingerprint(self.peer_certificate

1695

(session))

1756

1696

except (TypeError,

1757

1697

gnutls.errors.GNUTLSError) as error:

1758

1698

logger.warning("Bad certificate: %s", error)

1773

1713

while True:

1774

1714

if not client.enabled:

1775

1715

logger.info("Client %s is disabled",

1776

client.name)

1716

client.name)

1777

1717

if self.server.use_dbus:

1778

1718

# Emit D-Bus signal

1779

1719

client.Rejected("Disabled")

1788

1728

if self.server.use_dbus:

1789

1729

# Emit D-Bus signal

1790

1730

client.NeedApproval(

1791

client.approval_delay.total_seconds()

1792

* 1000, client.approved_by_default)

1731

client.approval_delay_milliseconds(),

1732

client.approved_by_default)

1793

1733

else:

1794

1734

logger.warning("Client %s was not approved",

1795

1735

client.name)

1801

1741

#wait until timeout or approved

1802

1742

time = datetime.datetime.now()

1803

1743

client.changedstate.acquire()

1804

client.changedstate.wait(delay.total_seconds())

1744

client.changedstate.wait(

1745

float(timedelta_to_milliseconds(delay)

1746

/ 1000))

1805

1747

client.changedstate.release()

1806

1748

time2 = datetime.datetime.now()

1807

1749

if (time2 - time) >= delay:

1826

1768

logger.warning("gnutls send failed",

1827

1769

exc_info=error)

1828

1770

return

1829

logger.debug("Sent: %d, remaining: %d", sent,

1830

len(client.secret) - (sent_size

1831

+ sent))

1771

logger.debug("Sent: %d, remaining: %d",

1772

sent, len(client.secret)

1773

- (sent_size + sent))

1832

1774

sent_size += sent

1833

1775

1834

1776

logger.info("Sending secret to %s", client.name)

1851

1793

def peer_certificate(session):

1852

1794

"Return the peer's OpenPGP certificate as a bytestring"

1853

1795

# If not an OpenPGP certificate...

1854

if (gnutls.library.functions.gnutls_certificate_type_get(

1855

session._c_object)

1796

if (gnutls.library.functions

1797

.gnutls_certificate_type_get(session._c_object)

1856

1798

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1857

1799

# ...do the normal thing

1858

1800

return session.peer_certificate

1872

1814

def fingerprint(openpgp):

1873

1815

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1874

1816

# New GnuTLS "datum" with the OpenPGP public key

1875

datum = gnutls.library.types.gnutls_datum_t(

1876

ctypes.cast(ctypes.c_char_p(openpgp),

1877

ctypes.POINTER(ctypes.c_ubyte)),

1878

ctypes.c_uint(len(openpgp)))

1817

datum = (gnutls.library.types

1818

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1819

ctypes.POINTER

1820

(ctypes.c_ubyte)),

1821

ctypes.c_uint(len(openpgp))))

1879

1822

# New empty GnuTLS certificate

1880

1823

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1881

gnutls.library.functions.gnutls_openpgp_crt_init(

1882

ctypes.byref(crt))

1824

(gnutls.library.functions

1825

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1883

1826

# Import the OpenPGP public key into the certificate

1884

gnutls.library.functions.gnutls_openpgp_crt_import(

1885

crt, ctypes.byref(datum),

1886

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1827

(gnutls.library.functions

1828

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1829

gnutls.library.constants

1830

.GNUTLS_OPENPGP_FMT_RAW))

1887

1831

# Verify the self signature in the key

1888

1832

crtverify = ctypes.c_uint()

1889

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1890

crt, 0, ctypes.byref(crtverify))

1833

(gnutls.library.functions

1834

.gnutls_openpgp_crt_verify_self(crt, 0,

1835

ctypes.byref(crtverify)))

1891

1836

if crtverify.value != 0:

1892

1837

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1893

raise gnutls.errors.CertificateSecurityError(

1894

"Verify failed")

1838

raise (gnutls.errors.CertificateSecurityError

1839

("Verify failed"))

1895

1840

# New buffer for the fingerprint

1896

1841

buf = ctypes.create_string_buffer(20)

1897

1842

buf_len = ctypes.c_size_t()

1898

1843

# Get the fingerprint from the certificate into the buffer

1899

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1900

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1844

(gnutls.library.functions

1845

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1846

ctypes.byref(buf_len)))

1901

1847

# Deinit the certificate

1902

1848

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1903

1849

# Convert the buffer to a Python bytestring

1909

1855

1910

1856

class MultiprocessingMixIn(object):

1911

1857

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1912

1913

1858

def sub_process_main(self, request, address):

1914

1859

try:

1915

1860

self.finish_request(request, address)

1927

1872

1928

1873

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1929

1874

""" adds a pipe to the MixIn """

1930

1931

1875

def process_request(self, request, client_address):

1932

1876

"""Overrides and wraps the original process_request().

1933

1877

1942

1886

1943

1887

def add_pipe(self, parent_pipe, proc):

1944

1888

"""Dummy function; override as necessary"""

1945

raise NotImplementedError()

1889

raise NotImplementedError

1946

1890

1947

1891

1948

1892

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1954

1898

interface: None or a network interface name (string)

1955

1899

use_ipv6: Boolean; to use IPv6 or not

1956

1900

"""

1957

1958

1901

def __init__(self, server_address, RequestHandlerClass,

1959

interface=None,

1960

use_ipv6=True,

1961

socketfd=None):

1902

interface=None, use_ipv6=True, socketfd=None):

1962

1903

"""If socketfd is set, use that file descriptor instead of

1963

1904

creating a new one with socket.socket().

1964

1905

"""

2005

1946

self.interface)

2006

1947

else:

2007

1948

try:

2008

self.socket.setsockopt(

2009

socket.SOL_SOCKET, SO_BINDTODEVICE,

2010

(self.interface + "\0").encode("utf-8"))

1949

self.socket.setsockopt(socket.SOL_SOCKET,

1950

SO_BINDTODEVICE,

1951

str(self.interface + '\0'))

2011

1952

except socket.error as error:

2012

1953

if error.errno == errno.EPERM:

2013

1954

logger.error("No permission to bind to"

2027

1968

if self.address_family == socket.AF_INET6:

2028

1969

any_address = "::" # in6addr_any

2029

1970

else:

2030

any_address = "0.0.0.0" # INADDR_ANY

1971

any_address = socket.INADDR_ANY

2031

1972

self.server_address = (any_address,

2032

1973

self.server_address[1])

2033

1974

elif not self.server_address[1]:

2034

self.server_address = (self.server_address[0], 0)

1975

self.server_address = (self.server_address[0],

1976

0)

2035

1977

# if self.interface:

2036

1978

# self.server_address = (self.server_address[0],

2037

1979

# 0, # port

2051

1993

2052

1994

Assumes a gobject.MainLoop event loop.

2053

1995

"""

2054

2055

1996

def __init__(self, server_address, RequestHandlerClass,

2056

interface=None,

2057

use_ipv6=True,

2058

clients=None,

2059

gnutls_priority=None,

2060

use_dbus=True,

2061

socketfd=None):

1997

interface=None, use_ipv6=True, clients=None,

1998

gnutls_priority=None, use_dbus=True, socketfd=None):

2062

1999

self.enabled = False

2063

2000

self.clients = clients

2064

2001

if self.clients is None:

2070

2007

interface = interface,

2071

2008

use_ipv6 = use_ipv6,

2072

2009

socketfd = socketfd)

2073

2074

2010

def server_activate(self):

2075

2011

if self.enabled:

2076

2012

return socketserver.TCPServer.server_activate(self)

2080

2016

2081

2017

def add_pipe(self, parent_pipe, proc):

2082

2018

# Call "handle_ipc" for both data and EOF events

2083

gobject.io_add_watch(

2084

parent_pipe.fileno(),

2085

gobject.IO_IN | gobject.IO_HUP,

2086

functools.partial(self.handle_ipc,

2087

parent_pipe = parent_pipe,

2088

proc = proc))

2019

gobject.io_add_watch(parent_pipe.fileno(),

2020

gobject.IO_IN | gobject.IO_HUP,

2021

functools.partial(self.handle_ipc,

2022

parent_pipe =

2023

parent_pipe,

2024

proc = proc))

2089

2025

2090

def handle_ipc(self, source, condition,

2091

parent_pipe=None,

2092

proc = None,

2093

client_object=None):

2026

def handle_ipc(self, source, condition, parent_pipe=None,

2027

proc = None, client_object=None):

2094

2028

# error, or the other end of multiprocessing.Pipe has closed

2095

2029

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2096

2030

# Wait for other process to exit

2119

2053

parent_pipe.send(False)

2120

2054

return False

2121

2055

2122

gobject.io_add_watch(

2123

parent_pipe.fileno(),

2124

gobject.IO_IN | gobject.IO_HUP,

2125

functools.partial(self.handle_ipc,

2126

parent_pipe = parent_pipe,

2127

proc = proc,

2128

client_object = client))

2056

gobject.io_add_watch(parent_pipe.fileno(),

2057

gobject.IO_IN | gobject.IO_HUP,

2058

functools.partial(self.handle_ipc,

2059

parent_pipe =

2060

parent_pipe,

2061

proc = proc,

2062

client_object =

2063

client))

2129

2064

parent_pipe.send(True)

2130

2065

# remove the old hook in favor of the new above hook on

2131

2066

# same fileno

2137

2072

2138

2073

parent_pipe.send(('data', getattr(client_object,

2139

2074

funcname)(*args,

2140

**kwargs)))

2075

**kwargs)))

2141

2076

2142

2077

if command == 'getattr':

2143

2078

attrname = request[1]

2144

if isinstance(client_object.__getattribute__(attrname),

2145

collections.Callable):

2146

parent_pipe.send(('function', ))

2079

if callable(client_object.__getattribute__(attrname)):

2080

parent_pipe.send(('function',))

2147

2081

else:

2148

parent_pipe.send((

2149

'data', client_object.__getattribute__(attrname)))

2082

parent_pipe.send(('data', client_object

2083

.__getattribute__(attrname)))

2150

2084

2151

2085

if command == 'setattr':

2152

2086

attrname = request[1]

2156

2090

return True

2157

2091

2158

2092

2159

def rfc3339_duration_to_delta(duration):

2160

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2161

2162

>>> rfc3339_duration_to_delta("P7D")

2163

datetime.timedelta(7)

2164

>>> rfc3339_duration_to_delta("PT60S")

2165

datetime.timedelta(0, 60)

2166

>>> rfc3339_duration_to_delta("PT60M")

2167

datetime.timedelta(0, 3600)

2168

>>> rfc3339_duration_to_delta("PT24H")

2169

datetime.timedelta(1)

2170

>>> rfc3339_duration_to_delta("P1W")

2171

datetime.timedelta(7)

2172

>>> rfc3339_duration_to_delta("PT5M30S")

2173

datetime.timedelta(0, 330)

2174

>>> rfc3339_duration_to_delta("P1DT3M20S")

2175

datetime.timedelta(1, 200)

2176

"""

2177

2178

# Parsing an RFC 3339 duration with regular expressions is not

2179

# possible - there would have to be multiple places for the same

2180

# values, like seconds. The current code, while more esoteric, is

2181

# cleaner without depending on a parsing library. If Python had a

2182

# built-in library for parsing we would use it, but we'd like to

2183

# avoid excessive use of external libraries.

2184

2185

# New type for defining tokens, syntax, and semantics all-in-one

2186

Token = collections.namedtuple("Token", (

2187

"regexp", # To match token; if "value" is not None, must have

2188

# a "group" containing digits

2189

"value", # datetime.timedelta or None

2190

"followers")) # Tokens valid after this token

2191

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2192

# the "duration" ABNF definition in RFC 3339, Appendix A.

2193

token_end = Token(re.compile(r"$"), None, frozenset())

2194

token_second = Token(re.compile(r"(\d+)S"),

2195

datetime.timedelta(seconds=1),

2196

frozenset((token_end, )))

2197

token_minute = Token(re.compile(r"(\d+)M"),

2198

datetime.timedelta(minutes=1),

2199

frozenset((token_second, token_end)))

2200

token_hour = Token(re.compile(r"(\d+)H"),

2201

datetime.timedelta(hours=1),

2202

frozenset((token_minute, token_end)))

2203

token_time = Token(re.compile(r"T"),

2204

None,

2205

frozenset((token_hour, token_minute,

2206

token_second)))

2207

token_day = Token(re.compile(r"(\d+)D"),

2208

datetime.timedelta(days=1),

2209

frozenset((token_time, token_end)))

2210

token_month = Token(re.compile(r"(\d+)M"),

2211

datetime.timedelta(weeks=4),

2212

frozenset((token_day, token_end)))

2213

token_year = Token(re.compile(r"(\d+)Y"),

2214

datetime.timedelta(weeks=52),

2215

frozenset((token_month, token_end)))

2216

token_week = Token(re.compile(r"(\d+)W"),

2217

datetime.timedelta(weeks=1),

2218

frozenset((token_end, )))

2219

token_duration = Token(re.compile(r"P"), None,

2220

frozenset((token_year, token_month,

2221

token_day, token_time,

2222

token_week)))

2223

# Define starting values

2224

value = datetime.timedelta() # Value so far

2225

found_token = None

2226

followers = frozenset((token_duration, )) # Following valid tokens

2227

s = duration # String left to parse

2228

# Loop until end token is found

2229

while found_token is not token_end:

2230

# Search for any currently valid tokens

2231

for token in followers:

2232

match = token.regexp.match(s)

2233

if match is not None:

2234

# Token found

2235

if token.value is not None:

2236

# Value found, parse digits

2237

factor = int(match.group(1), 10)

2238

# Add to value so far

2239

value += factor * token.value

2240

# Strip token from string

2241

s = token.regexp.sub("", s, 1)

2242

# Go to found token

2243

found_token = token

2244

# Set valid next tokens

2245

followers = found_token.followers

2246

break

2247

else:

2248

# No currently valid tokens were found

2249

raise ValueError("Invalid RFC 3339 duration: {!r}"

2250

.format(duration))

2251

# End token found

2252

return value

2253

2254

2255

2093

def string_to_delta(interval):

2256

2094

"""Parse a string and return a datetime.timedelta

2257

2095

2268

2106

>>> string_to_delta('5m 30s')

2269

2107

datetime.timedelta(0, 330)

2270

2108

"""

2271

2272

try:

2273

return rfc3339_duration_to_delta(interval)

2274

except ValueError:

2275

pass

2276

2277

2109

timevalue = datetime.timedelta(0)

2278

2110

for s in interval.split():

2279

2111

try:

2280

suffix = s[-1]

2112

suffix = unicode(s[-1])

2281

2113

value = int(s[:-1])

2282

2114

if suffix == "d":

2283

2115

delta = datetime.timedelta(value)

2290

2122

elif suffix == "w":

2291

2123

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2292

2124

else:

2293

raise ValueError("Unknown suffix {!r}".format(suffix))

2294

except IndexError as e:

2125

raise ValueError("Unknown suffix {0!r}"

2126

.format(suffix))

2127

except (ValueError, IndexError) as e:

2295

2128

raise ValueError(*(e.args))

2296

2129

timevalue += delta

2297

2130

return timevalue

2313

2146

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2314

2147

if not stat.S_ISCHR(os.fstat(null).st_mode):

2315

2148

raise OSError(errno.ENODEV,

2316

"{} not a character device"

2149

"{0} not a character device"

2317

2150

.format(os.devnull))

2318

2151

os.dup2(null, sys.stdin.fileno())

2319

2152

os.dup2(null, sys.stdout.fileno())

2329

2162

2330

2163

parser = argparse.ArgumentParser()

2331

2164

parser.add_argument("-v", "--version", action="version",

2332

version = "%(prog)s {}".format(version),

2165

version = "%(prog)s {0}".format(version),

2333

2166

help="show version number and exit")

2334

2167

parser.add_argument("-i", "--interface", metavar="IF",

2335

2168

help="Bind to interface IF")

2341

2174

help="Run self-test")

2342

2175

parser.add_argument("--debug", action="store_true",

2343

2176

help="Debug mode; run in foreground and log"

2344

" to terminal", default=None)

2177

" to terminal")

2345

2178

parser.add_argument("--debuglevel", metavar="LEVEL",

2346

2179

help="Debug level for stdout output")

2347

2180

parser.add_argument("--priority", help="GnuTLS"

2354

2187

" files")

2355

2188

parser.add_argument("--no-dbus", action="store_false",

2356

2189

dest="use_dbus", help="Do not provide D-Bus"

2357

" system bus interface", default=None)

2190

" system bus interface")

2358

2191

parser.add_argument("--no-ipv6", action="store_false",

2359

dest="use_ipv6", help="Do not use IPv6",

2360

default=None)

2192

dest="use_ipv6", help="Do not use IPv6")

2361

2193

parser.add_argument("--no-restore", action="store_false",

2362

2194

dest="restore", help="Do not restore stored"

2363

" state", default=None)

2195

" state")

2364

2196

parser.add_argument("--socket", type=int,

2365

2197

help="Specify a file descriptor to a network"

2366

2198

" socket to use instead of creating one")

2367

2199

parser.add_argument("--statedir", metavar="DIR",

2368

2200

help="Directory to save/restore state in")

2369

2201

parser.add_argument("--foreground", action="store_true",

2370

help="Run in foreground", default=None)

2371

parser.add_argument("--no-zeroconf", action="store_false",

2372

dest="zeroconf", help="Do not use Zeroconf",

2373

default=None)

2202

help="Run in foreground")

2374

2203

2375

2204

options = parser.parse_args()

2376

2205

2377

2206

if options.check:

2378

2207

import doctest

2379

fail_count, test_count = doctest.testmod()

2380

sys.exit(os.EX_OK if fail_count == 0 else 1)

2208

doctest.testmod()

2209

sys.exit()

2381

2210

2382

2211

# Default values for config file for server-global settings

2383

2212

server_defaults = { "interface": "",

2385

2214

"port": "",

2386

2215

"debug": "False",

2387

2216

"priority":

2388

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2389

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2217

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2390

2218

"servicename": "Mandos",

2391

2219

"use_dbus": "True",

2392

2220

"use_ipv6": "True",

2395

2223

"socket": "",

2396

2224

"statedir": "/var/lib/mandos",

2397

2225

"foreground": "False",

2398

"zeroconf": "True",

2399

}

2226

}

2400

2227

2401

2228

# Parse config file for server-global settings

2402

2229

server_config = configparser.SafeConfigParser(server_defaults)

2403

2230

del server_defaults

2404

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2231

server_config.read(os.path.join(options.configdir,

2232

"mandos.conf"))

2405

2233

# Convert the SafeConfigParser object to a dict

2406

2234

server_settings = server_config.defaults()

2407

2235

# Use the appropriate methods on the non-string config options

2425

2253

# Override the settings from the config file with command line

2426

2254

# options, if set.

2427

2255

for option in ("interface", "address", "port", "debug",

2428

"priority", "servicename", "configdir", "use_dbus",

2429

"use_ipv6", "debuglevel", "restore", "statedir",

2430

"socket", "foreground", "zeroconf"):

2256

"priority", "servicename", "configdir",

2257

"use_dbus", "use_ipv6", "debuglevel", "restore",

2258

"statedir", "socket", "foreground"):

2431

2259

value = getattr(options, option)

2432

2260

if value is not None:

2433

2261

server_settings[option] = value

2434

2262

del options

2435

2263

# Force all strings to be unicode

2436

2264

for option in server_settings.keys():

2437

if isinstance(server_settings[option], bytes):

2438

server_settings[option] = (server_settings[option]

2439

.decode("utf-8"))

2440

# Force all boolean options to be boolean

2441

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2442

"foreground", "zeroconf"):

2443

server_settings[option] = bool(server_settings[option])

2265

if type(server_settings[option]) is str:

2266

server_settings[option] = unicode(server_settings[option])

2444

2267

# Debug implies foreground

2445

2268

if server_settings["debug"]:

2446

2269

server_settings["foreground"] = True

2448

2271

2449

2272

##################################################################

2450

2273

2451

if (not server_settings["zeroconf"]

2452

and not (server_settings["port"]

2453

or server_settings["socket"] != "")):

2454

parser.error("Needs port or socket to work without Zeroconf")

2455

2456

2274

# For convenience

2457

2275

debug = server_settings["debug"]

2458

2276

debuglevel = server_settings["debuglevel"]

2461

2279

stored_state_path = os.path.join(server_settings["statedir"],

2462

2280

stored_state_file)

2463

2281

foreground = server_settings["foreground"]

2464

zeroconf = server_settings["zeroconf"]

2465

2282

2466

2283

if debug:

2467

2284

initlogger(debug, logging.DEBUG)

2473

2290

initlogger(debug, level)

2474

2291

2475

2292

if server_settings["servicename"] != "Mandos":

2476

syslogger.setFormatter(

2477

logging.Formatter('Mandos ({}) [%(process)d]:'

2478

' %(levelname)s: %(message)s'.format(

2479

server_settings["servicename"])))

2293

syslogger.setFormatter(logging.Formatter

2294

('Mandos ({0}) [%(process)d]:'

2295

' %(levelname)s: %(message)s'

2296

.format(server_settings

2297

["servicename"])))

2480

2298

2481

2299

# Parse config file with clients

2482

2300

client_config = configparser.SafeConfigParser(Client

2487

2305

global mandos_dbus_service

2488

2306

mandos_dbus_service = None

2489

2307

2490

socketfd = None

2491

if server_settings["socket"] != "":

2492

socketfd = server_settings["socket"]

2493

tcp_server = MandosServer(

2494

(server_settings["address"], server_settings["port"]),

2495

ClientHandler,

2496

interface=(server_settings["interface"] or None),

2497

use_ipv6=use_ipv6,

2498

gnutls_priority=server_settings["priority"],

2499

use_dbus=use_dbus,

2500

socketfd=socketfd)

2308

tcp_server = MandosServer((server_settings["address"],

2309

server_settings["port"]),

2310

ClientHandler,

2311

interface=(server_settings["interface"]

2312

or None),

2313

use_ipv6=use_ipv6,

2314

gnutls_priority=

2315

server_settings["priority"],

2316

use_dbus=use_dbus,

2317

socketfd=(server_settings["socket"]

2318

or None))

2501

2319

if not foreground:

2502

pidfilename = "/run/mandos.pid"

2503

if not os.path.isdir("/run/."):

2504

pidfilename = "/var/run/mandos.pid"

2320

pidfilename = "/var/run/mandos.pid"

2505

2321

pidfile = None

2506

2322

try:

2507

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2323

pidfile = open(pidfilename, "w")

2508

2324

except IOError as e:

2509

2325

logger.error("Could not open file %r", pidfilename,

2510

2326

exc_info=e)

2524

2340

os.setuid(uid)

2525

2341

except OSError as error:

2526

2342

if error.errno != errno.EPERM:

2527

raise

2343

raise error

2528

2344

2529

2345

if debug:

2530

2346

# Enable all possible GnuTLS debugging

2537

2353

def debug_gnutls(level, string):

2538

2354

logger.debug("GnuTLS: %s", string[:-1])

2539

2355

2540

gnutls.library.functions.gnutls_global_set_log_function(

2541

debug_gnutls)

2356

(gnutls.library.functions

2357

.gnutls_global_set_log_function(debug_gnutls))

2542

2358

2543

2359

# Redirect stdin so all checkers get /dev/null

2544

2360

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2564

2380

if use_dbus:

2565

2381

try:

2566

2382

bus_name = dbus.service.BusName("se.recompile.Mandos",

2567

bus,

2568

do_not_queue=True)

2569

old_bus_name = dbus.service.BusName(

2570

"se.bsnet.fukt.Mandos", bus,

2571

do_not_queue=True)

2572

except dbus.exceptions.DBusException as e:

2383

bus, do_not_queue=True)

2384

old_bus_name = (dbus.service.BusName

2385

("se.bsnet.fukt.Mandos", bus,

2386

do_not_queue=True))

2387

except dbus.exceptions.NameExistsException as e:

2573

2388

logger.error("Disabling D-Bus:", exc_info=e)

2574

2389

use_dbus = False

2575

2390

server_settings["use_dbus"] = False

2576

2391

tcp_server.use_dbus = False

2577

if zeroconf:

2578

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2579

service = AvahiServiceToSyslog(

2580

name = server_settings["servicename"],

2581

servicetype = "_mandos._tcp",

2582

protocol = protocol,

2583

bus = bus)

2584

if server_settings["interface"]:

2585

service.interface = if_nametoindex(

2586

server_settings["interface"].encode("utf-8"))

2392

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2393

service = AvahiServiceToSyslog(name =

2394

server_settings["servicename"],

2395

servicetype = "_mandos._tcp",

2396

protocol = protocol, bus = bus)

2397

if server_settings["interface"]:

2398

service.interface = (if_nametoindex

2399

(str(server_settings["interface"])))

2587

2400

2588

2401

global multiprocessing_manager

2589

2402

multiprocessing_manager = multiprocessing.Manager()

2596

2409

old_client_settings = {}

2597

2410

clients_data = {}

2598

2411

2599

# This is used to redirect stdout and stderr for checker processes

2600

global wnull

2601

wnull = open(os.devnull, "w") # A writable /dev/null

2602

# Only used if server is running in foreground but not in debug

2603

# mode

2604

if debug or not foreground:

2605

wnull.close()

2606

2607

2412

# Get client data and settings from last running state.

2608

2413

if server_settings["restore"]:

2609

2414

try:

2610

2415

with open(stored_state_path, "rb") as stored_state:

2611

clients_data, old_client_settings = pickle.load(

2612

stored_state)

2416

clients_data, old_client_settings = (pickle.load

2417

(stored_state))

2613

2418

os.remove(stored_state_path)

2614

2419

except IOError as e:

2615

2420

if e.errno == errno.ENOENT:

2616

logger.warning("Could not load persistent state:"

2617

" {}".format(os.strerror(e.errno)))

2421

logger.warning("Could not load persistent state: {0}"

2422

.format(os.strerror(e.errno)))

2618

2423

else:

2619

2424

logger.critical("Could not load persistent state:",

2620

2425

exc_info=e)

2621

2426

raise

2622

2427

except EOFError as e:

2623

2428

logger.warning("Could not load persistent state: "

2624

"EOFError:",

2625

exc_info=e)

2429

"EOFError:", exc_info=e)

2626

2430

2627

2431

with PGPEngine() as pgp:

2628

for client_name, client in clients_data.items():

2629

# Skip removed clients

2630

if client_name not in client_settings:

2631

continue

2632

2432

for client_name, client in clients_data.iteritems():

2633

2433

# Decide which value to use after restoring saved state.

2634

2434

# We have three different values: Old config file,

2635

2435

# new config file, and saved state.

2640

2440

# For each value in new config, check if it

2641

2441

# differs from the old config value (Except for

2642

2442

# the "secret" attribute)

2643

if (name != "secret"

2644

and (value !=

2645

old_client_settings[client_name][name])):

2443

if (name != "secret" and

2444

value != old_client_settings[client_name]

2445

[name]):

2646

2446

client[name] = value

2647

2447

except KeyError:

2648

2448

pass

2649

2449

2650

2450

# Clients who has passed its expire date can still be

2651

# enabled if its last checker was successful. A Client

2451

# enabled if its last checker was successful. Clients

2652

2452

# whose checker succeeded before we stored its state is

2653

2453

# assumed to have successfully run all checkers during

2654

2454

# downtime.

2656

2456

if datetime.datetime.utcnow() >= client["expires"]:

2657

2457

if not client["last_checked_ok"]:

2658

2458

logger.warning(

2659

"disabling client {} - Client never "

2660

"performed a successful checker".format(

2661

client_name))

2459

"disabling client {0} - Client never "

2460

"performed a successful checker"

2461

.format(client_name))

2662

2462

client["enabled"] = False

2663

2463

elif client["last_checker_status"] != 0:

2664

2464

logger.warning(

2665

"disabling client {} - Client last"

2666

" checker failed with error code"

2667

" {}".format(

2668

client_name,

2669

client["last_checker_status"]))

2465

"disabling client {0} - Client "

2466

"last checker failed with error code {1}"

2467

.format(client_name,

2468

client["last_checker_status"]))

2670

2469

client["enabled"] = False

2671

2470

else:

2672

client["expires"] = (

2673

datetime.datetime.utcnow()

2674

+ client["timeout"])

2471

client["expires"] = (datetime.datetime

2472

.utcnow()

2473

+ client["timeout"])

2675

2474

logger.debug("Last checker succeeded,"

2676

" keeping {} enabled".format(

2677

client_name))

2475

" keeping {0} enabled"

2476

.format(client_name))

2678

2477

try:

2679

client["secret"] = pgp.decrypt(

2680

client["encrypted_secret"],

2681

client_settings[client_name]["secret"])

2478

client["secret"] = (

2479

pgp.decrypt(client["encrypted_secret"],

2480

client_settings[client_name]

2481

["secret"]))

2682

2482

except PGPError:

2683

2483

# If decryption fails, we use secret from new settings

2684

logger.debug("Failed to decrypt {} old secret".format(

2685

client_name))

2686

client["secret"] = (client_settings[client_name]

2687

["secret"])

2484

logger.debug("Failed to decrypt {0} old secret"

2485

.format(client_name))

2486

client["secret"] = (

2487

client_settings[client_name]["secret"])

2688

2488

2689

2489

# Add/remove clients based on new changes made to config

2690

2490

for client_name in (set(old_client_settings)

2695

2495

clients_data[client_name] = client_settings[client_name]

2696

2496

2697

2497

# Create all client objects

2698

for client_name, client in clients_data.items():

2498

for client_name, client in clients_data.iteritems():

2699

2499

tcp_server.clients[client_name] = client_class(

2700

name = client_name,

2701

settings = client,

2702

server_settings = server_settings)

2500

name = client_name, settings = client)

2703

2501

2704

2502

if not tcp_server.clients:

2705

2503

logger.warning("No clients defined")

2706

2504

2707

2505

if not foreground:

2708

2506

if pidfile is not None:

2709

pid = os.getpid()

2710

2507

try:

2711

2508

with pidfile:

2712

print(pid, file=pidfile)

2509

pid = os.getpid()

2510

pidfile.write(str(pid) + "\n".encode("utf-8"))

2713

2511

except IOError:

2714

2512

logger.error("Could not write to file %r with PID %d",

2715

2513

pidfilename, pid)

2720

2518

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2721

2519

2722

2520

if use_dbus:

2723

2724

@alternate_dbus_interfaces(

2725

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2521

@alternate_dbus_interfaces({"se.recompile.Mandos":

2522

"se.bsnet.fukt.Mandos"})

2726

2523

class MandosDBusService(DBusObjectWithProperties):

2727

2524

"""A D-Bus proxy object"""

2728

2729

2525

def __init__(self):

2730

2526

dbus.service.Object.__init__(self, bus, "/")

2731

2732

2527

_interface = "se.recompile.Mandos"

2733

2528

2734

2529

@dbus_interface_annotations(_interface)

2735

2530

def _foo(self):

2736

return {

2737

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2738

"false" }

2531

return { "org.freedesktop.DBus.Property"

2532

".EmitsChangedSignal":

2533

"false"}

2739

2534

2740

2535

@dbus.service.signal(_interface, signature="o")

2741

2536

def ClientAdded(self, objpath):

2755

2550

@dbus.service.method(_interface, out_signature="ao")

2756

2551

def GetAllClients(self):

2757

2552

"D-Bus method"

2758

return dbus.Array(c.dbus_object_path for c in

2553

return dbus.Array(c.dbus_object_path

2554

for c in

2759

2555

tcp_server.clients.itervalues())

2760

2556

2761

2557

@dbus.service.method(_interface,

2763

2559

def GetAllClientsWithProperties(self):

2764

2560

"D-Bus method"

2765

2561

return dbus.Dictionary(

2766

{ c.dbus_object_path: c.GetAll("")

2767

for c in tcp_server.clients.itervalues() },

2562

((c.dbus_object_path, c.GetAll(""))

2563

for c in tcp_server.clients.itervalues()),

2768

2564

signature="oa{sv}")

2769

2565

2770

2566

@dbus.service.method(_interface, in_signature="o")

2787

2583

2788

2584

def cleanup():

2789

2585

"Cleanup function; run on exit"

2790

if zeroconf:

2791

service.cleanup()

2586

service.cleanup()

2792

2587

2793

2588

multiprocessing.active_children()

2794

wnull.close()

2795

2589

if not (tcp_server.clients or client_settings):

2796

2590

return

2797

2591

2808

2602

2809

2603

# A list of attributes that can not be pickled

2810

2604

# + secret.

2811

exclude = { "bus", "changedstate", "secret",

2812

"checker", "server_settings" }

2813

for name, typ in inspect.getmembers(dbus.service

2814

.Object):

2605

exclude = set(("bus", "changedstate", "secret",

2606

"checker"))

2607

for name, typ in (inspect.getmembers

2608

(dbus.service.Object)):

2815

2609

exclude.add(name)

2816

2610

2817

2611

client_dict["encrypted_secret"] = (client

2824

2618

del client_settings[client.name]["secret"]

2825

2619

2826

2620

try:

2827

with tempfile.NamedTemporaryFile(

2828

mode='wb',

2829

suffix=".pickle",

2830

prefix='clients-',

2831

dir=os.path.dirname(stored_state_path),

2832

delete=False) as stored_state:

2621

with (tempfile.NamedTemporaryFile

2622

(mode='wb', suffix=".pickle", prefix='clients-',

2623

dir=os.path.dirname(stored_state_path),

2624

delete=False)) as stored_state:

2833

2625

pickle.dump((clients, client_settings), stored_state)

2834

tempname = stored_state.name

2626

tempname=stored_state.name

2835

2627

os.rename(tempname, stored_state_path)

2836

2628

except (IOError, OSError) as e:

2837

2629

if not debug:

2840

2632

except NameError:

2841

2633

pass

2842

2634

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2843

logger.warning("Could not save persistent state: {}"

2635

logger.warning("Could not save persistent state: {0}"

2844

2636

.format(os.strerror(e.errno)))

2845

2637

else:

2846

2638

logger.warning("Could not save persistent state:",

2847

2639

exc_info=e)

2848

raise

2640

raise e

2849

2641

2850

2642

# Delete all clients, and settings from config

2851

2643

while tcp_server.clients:

2856

2648

client.disable(quiet=True)

2857

2649

if use_dbus:

2858

2650

# Emit D-Bus signal

2859

mandos_dbus_service.ClientRemoved(

2860

client.dbus_object_path, client.name)

2651

mandos_dbus_service.ClientRemoved(client

2652

.dbus_object_path,

2653

client.name)

2861

2654

client_settings.clear()

2862

2655

2863

2656

atexit.register(cleanup)

2874

2667

tcp_server.server_activate()

2875

2668

2876

2669

# Find out what port we got

2877

if zeroconf:

2878

service.port = tcp_server.socket.getsockname()[1]

2670

service.port = tcp_server.socket.getsockname()[1]

2879

2671

if use_ipv6:

2880

2672

logger.info("Now listening on address %r, port %d,"

2881

2673

" flowinfo %d, scope_id %d",

2887

2679

#service.interface = tcp_server.socket.getsockname()[3]

2888

2680

2889

2681

try:

2890

if zeroconf:

2891

# From the Avahi example code

2892

try:

2893

service.activate()

2894

except dbus.exceptions.DBusException as error:

2895

logger.critical("D-Bus Exception", exc_info=error)

2896

cleanup()

2897

sys.exit(1)

2898

# End of Avahi example code

2682

# From the Avahi example code

2683

try:

2684

service.activate()

2685

except dbus.exceptions.DBusException as error:

2686

logger.critical("D-Bus Exception", exc_info=error)

2687

cleanup()

2688

sys.exit(1)

2689

# End of Avahi example code

2899

2690

2900

2691

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2901

2692

lambda *args, **kwargs:

2916

2707

# Must run before the D-Bus bus name gets deregistered

2917

2708

cleanup()

2918

2709

2919

2920

2710

if __name__ == '__main__':

2921

2711

main()