/mandos/release : revision 237.7.174

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

88

except ImportError:

89

SO_BINDTODEVICE = None

90

91

if sys.version_info.major == 2:

92

str = unicode

93

94

version = "1.6.9"

91

version = "1.6.1"

95

92

stored_state_file = "clients.pickle"

96

93

97

94

logger = logging.getLogger()

98

syslogger = None

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

99

98

100

99

try:

101

if_nametoindex = ctypes.cdll.LoadLibrary(

102

ctypes.util.find_library("c")).if_nametoindex

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

103

except (OSError, AttributeError):

104

105

104

def if_nametoindex(interface):

106

105

"Get an interface index the hard way, i.e. using fcntl()"

107

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

108

107

with contextlib.closing(socket.socket()) as s:

109

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

110

struct.pack(b"16s16x", interface))

111

interface_index = struct.unpack("I", ifreq[16:20])[0]

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

112

113

return interface_index

113

114

115

116

def initlogger(debug, level=logging.WARNING):

116

117

"""init logger and add loglevel"""

117

118

global syslogger

119

syslogger = (logging.handlers.SysLogHandler(

120

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

121

address = "/dev/log"))

122

119

syslogger.setFormatter(logging.Formatter

123

120

('Mandos [%(process)d]: %(levelname)s:'

124

121

' %(message)s'))

141

138

142

139

class PGPEngine(object):

143

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

144

145

141

def __init__(self):

146

142

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

147

143

self.gnupgargs = ['--batch',

176

172

def password_encode(self, password):

177

173

# Passphrase can not be empty and can not contain newlines or

178

174

# NUL bytes. So we prefix it and hex encode it.

179

encoded = b"mandos" + binascii.hexlify(password)

180

if len(encoded) > 2048:

181

# GnuPG can't handle long passwords, so encode differently

182

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

183

.replace(b"\n", b"\\n")

184

.replace(b"\0", b"\\x00"))

185

return encoded

175

return b"mandos" + binascii.hexlify(password)

186

176

187

177

def encrypt(self, data, password):

188

178

passphrase = self.password_encode(password)

189

with tempfile.NamedTemporaryFile(

190

dir=self.tempdir) as passfile:

179

with tempfile.NamedTemporaryFile(dir=self.tempdir

180

) as passfile:

191

181

passfile.write(passphrase)

192

182

passfile.flush()

193

183

proc = subprocess.Popen(['gpg', '--symmetric',

204

194

205

195

def decrypt(self, data, password):

206

196

passphrase = self.password_encode(password)

207

with tempfile.NamedTemporaryFile(

208

dir = self.tempdir) as passfile:

197

with tempfile.NamedTemporaryFile(dir = self.tempdir

198

) as passfile:

209

199

passfile.write(passphrase)

210

200

passfile.flush()

211

201

proc = subprocess.Popen(['gpg', '--decrypt',

215

205

stdin = subprocess.PIPE,

216

206

stdout = subprocess.PIPE,

217

207

stderr = subprocess.PIPE)

218

decrypted_plaintext, err = proc.communicate(input = data)

208

decrypted_plaintext, err = proc.communicate(input

209

= data)

219

210

if proc.returncode != 0:

220

211

raise PGPError(err)

221

212

return decrypted_plaintext

224

215

class AvahiError(Exception):

225

216

def __init__(self, value, *args, **kwargs):

226

217

self.value = value

227

return super(AvahiError, self).__init__(value, *args,

228

**kwargs)

229

218

super(AvahiError, self).__init__(value, *args, **kwargs)

219

def __unicode__(self):

220

return unicode(repr(self.value))

230

221

231

222

class AvahiServiceError(AvahiError):

232

223

pass

233

224

234

235

225

class AvahiGroupError(AvahiError):

236

226

pass

237

227

257

247

bus: dbus.SystemBus()

258

248

"""

259

249

260

def __init__(self,

261

interface = avahi.IF_UNSPEC,

262

name = None,

263

servicetype = None,

264

port = None,

265

TXT = None,

266

domain = "",

267

host = "",

268

max_renames = 32768,

269

protocol = avahi.PROTO_UNSPEC,

270

bus = None):

250

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

251

servicetype = None, port = None, TXT = None,

252

domain = "", host = "", max_renames = 32768,

253

protocol = avahi.PROTO_UNSPEC, bus = None):

271

254

self.interface = interface

272

255

self.name = name

273

256

self.type = servicetype

283

266

self.bus = bus

284

267

self.entry_group_state_changed_match = None

285

268

286

def rename(self, remove=True):

269

def rename(self):

287

270

"""Derived from the Avahi example code"""

288

271

if self.rename_count >= self.max_renames:

289

272

logger.critical("No suitable Zeroconf service name found"

290

273

" after %i retries, exiting.",

291

274

self.rename_count)

292

275

raise AvahiServiceError("Too many renames")

293

self.name = str(

294

self.server.GetAlternativeServiceName(self.name))

295

self.rename_count += 1

276

self.name = unicode(self.server

277

.GetAlternativeServiceName(self.name))

296

278

logger.info("Changing Zeroconf service name to %r ...",

297

279

self.name)

298

if remove:

299

self.remove()

280

self.remove()

300

281

try:

301

282

self.add()

302

283

except dbus.exceptions.DBusException as error:

303

if (error.get_dbus_name()

304

== "org.freedesktop.Avahi.CollisionError"):

305

logger.info("Local Zeroconf service name collision.")

306

return self.rename(remove=False)

307

else:

308

logger.critical("D-Bus Exception", exc_info=error)

309

self.cleanup()

310

os._exit(1)

284

logger.critical("D-Bus Exception", exc_info=error)

285

self.cleanup()

286

os._exit(1)

287

self.rename_count += 1

311

288

312

289

def remove(self):

313

290

"""Derived from the Avahi example code"""

351

328

self.rename()

352

329

elif state == avahi.ENTRY_GROUP_FAILURE:

353

330

logger.critical("Avahi: Error in group state changed %s",

354

str(error))

355

raise AvahiGroupError("State changed: {!s}".format(error))

331

unicode(error))

332

raise AvahiGroupError("State changed: {0!s}"

333

.format(error))

356

334

357

335

def cleanup(self):

358

336

"""Derived from the Avahi example code"""

368

346

def server_state_changed(self, state, error=None):

369

347

"""Derived from the Avahi example code"""

370

348

logger.debug("Avahi server state change: %i", state)

371

bad_states = {

372

avahi.SERVER_INVALID: "Zeroconf server invalid",

373

avahi.SERVER_REGISTERING: None,

374

avahi.SERVER_COLLISION: "Zeroconf server name collision",

375

avahi.SERVER_FAILURE: "Zeroconf server failure",

376

}

349

bad_states = { avahi.SERVER_INVALID:

350

"Zeroconf server invalid",

351

avahi.SERVER_REGISTERING: None,

352

avahi.SERVER_COLLISION:

353

"Zeroconf server name collision",

354

avahi.SERVER_FAILURE:

355

"Zeroconf server failure" }

377

356

if state in bad_states:

378

357

if bad_states[state] is not None:

379

358

if error is None:

398

377

follow_name_owner_changes=True),

399

378

avahi.DBUS_INTERFACE_SERVER)

400

379

self.server.connect_to_signal("StateChanged",

401

self.server_state_changed)

380

self.server_state_changed)

402

381

self.server_state_changed(self.server.GetState())

403

382

404

383

405

384

class AvahiServiceToSyslog(AvahiService):

406

def rename(self, *args, **kwargs):

385

def rename(self):

407

386

"""Add the new name to the syslog messages"""

408

ret = AvahiService.rename(self, *args, **kwargs)

409

syslogger.setFormatter(logging.Formatter(

410

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

411

.format(self.name)))

387

ret = AvahiService.rename(self)

388

syslogger.setFormatter(logging.Formatter

389

('Mandos ({0}) [%(process)d]:'

390

' %(levelname)s: %(message)s'

391

.format(self.name)))

412

392

return ret

413

393

414

394

395

def timedelta_to_milliseconds(td):

396

"Convert a datetime.timedelta() to milliseconds"

397

return ((td.days * 24 * 60 * 60 * 1000)

398

+ (td.seconds * 1000)

399

+ (td.microseconds // 1000))

400

401

415

402

class Client(object):

416

403

"""A representation of a client host served by this server.

417

404

461

448

"fingerprint", "host", "interval",

462

449

"last_approval_request", "last_checked_ok",

463

450

"last_enabled", "name", "timeout")

464

client_defaults = {

465

"timeout": "PT5M",

466

"extended_timeout": "PT15M",

467

"interval": "PT2M",

468

"checker": "fping -q -- %%(host)s",

469

"host": "",

470

"approval_delay": "PT0S",

471

"approval_duration": "PT1S",

472

"approved_by_default": "True",

473

"enabled": "True",

474

}

451

client_defaults = { "timeout": "PT5M",

452

"extended_timeout": "PT15M",

453

"interval": "PT2M",

454

"checker": "fping -q -- %%(host)s",

455

"host": "",

456

"approval_delay": "PT0S",

457

"approval_duration": "PT1S",

458

"approved_by_default": "True",

459

"enabled": "True",

460

}

461

462

def timeout_milliseconds(self):

463

"Return the 'timeout' attribute in milliseconds"

464

return timedelta_to_milliseconds(self.timeout)

465

466

def extended_timeout_milliseconds(self):

467

"Return the 'extended_timeout' attribute in milliseconds"

468

return timedelta_to_milliseconds(self.extended_timeout)

469

470

def interval_milliseconds(self):

471

"Return the 'interval' attribute in milliseconds"

472

return timedelta_to_milliseconds(self.interval)

473

474

def approval_delay_milliseconds(self):

475

return timedelta_to_milliseconds(self.approval_delay)

475

476

477

@staticmethod

477

478

def config_parser(config):

493

494

client["enabled"] = config.getboolean(client_name,

494

495

"enabled")

495

496

# Uppercase and remove spaces from fingerprint for later

497

# comparison purposes with return value from the

498

# fingerprint() function

499

497

client["fingerprint"] = (section["fingerprint"].upper()

500

498

.replace(" ", ""))

501

499

if "secret" in section:

506

504

"rb") as secfile:

507

505

client["secret"] = secfile.read()

508

506

else:

509

raise TypeError("No secret or secfile for section {}"

507

raise TypeError("No secret or secfile for section {0}"

510

508

.format(section))

511

509

client["timeout"] = string_to_delta(section["timeout"])

512

510

client["extended_timeout"] = string_to_delta(

529

527

server_settings = {}

530

528

self.server_settings = server_settings

531

529

# adding all client settings

532

for setting, value in settings.items():

530

for setting, value in settings.iteritems():

533

531

setattr(self, setting, value)

534

532

535

533

if self.enabled:

543

541

self.expires = None

544

542

545

543

logger.debug("Creating client %r", self.name)

544

# Uppercase and remove spaces from fingerprint for later

545

# comparison purposes with return value from the fingerprint()

546

# function

546

547

logger.debug(" Fingerprint: %s", self.fingerprint)

547

548

self.created = settings.get("created",

548

549

datetime.datetime.utcnow())

555

556

self.current_checker_command = None

556

557

self.approved = None

557

558

self.approvals_pending = 0

558

self.changedstate = multiprocessing_manager.Condition(

559

multiprocessing_manager.Lock())

560

self.client_structure = [attr

561

for attr in self.__dict__.iterkeys()

559

self.changedstate = (multiprocessing_manager

560

.Condition(multiprocessing_manager

561

.Lock()))

562

self.client_structure = [attr for attr in

563

self.__dict__.iterkeys()

562

564

if not attr.startswith("_")]

563

565

self.client_structure.append("client_structure")

564

566

565

for name, t in inspect.getmembers(

566

type(self), lambda obj: isinstance(obj, property)):

567

for name, t in inspect.getmembers(type(self),

568

lambda obj:

569

isinstance(obj,

570

property)):

567

571

if not name.startswith("_"):

568

572

self.client_structure.append(name)

569

573

611

615

# and every interval from then on.

612

616

if self.checker_initiator_tag is not None:

613

617

gobject.source_remove(self.checker_initiator_tag)

614

self.checker_initiator_tag = gobject.timeout_add(

615

int(self.interval.total_seconds() * 1000),

616

self.start_checker)

618

self.checker_initiator_tag = (gobject.timeout_add

619

(self.interval_milliseconds(),

620

self.start_checker))

617

621

# Schedule a disable() when 'timeout' has passed

618

622

if self.disable_initiator_tag is not None:

619

623

gobject.source_remove(self.disable_initiator_tag)

620

self.disable_initiator_tag = gobject.timeout_add(

621

int(self.timeout.total_seconds() * 1000), self.disable)

624

self.disable_initiator_tag = (gobject.timeout_add

625

(self.timeout_milliseconds(),

626

self.disable))

622

627

# Also start a new checker *right now*.

623

628

self.start_checker()

624

629

633

638

vars(self))

634

639

self.checked_ok()

635

640

else:

636

logger.info("Checker for %(name)s failed", vars(self))

641

logger.info("Checker for %(name)s failed",

642

vars(self))

637

643

else:

638

644

self.last_checker_status = -1

639

645

logger.warning("Checker for %(name)s crashed?",

653

659

gobject.source_remove(self.disable_initiator_tag)

654

660

self.disable_initiator_tag = None

655

661

if getattr(self, "enabled", False):

656

self.disable_initiator_tag = gobject.timeout_add(

657

int(timeout.total_seconds() * 1000), self.disable)

662

self.disable_initiator_tag = (gobject.timeout_add

663

(timedelta_to_milliseconds

664

(timeout), self.disable))

658

665

self.expires = datetime.datetime.utcnow() + timeout

659

666

660

667

def need_approval(self):

677

684

# If a checker exists, make sure it is not a zombie

678

685

try:

679

686

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

680

except AttributeError:

681

pass

682

except OSError as error:

683

if error.errno != errno.ECHILD:

684

raise

687

except (AttributeError, OSError) as error:

688

if (isinstance(error, OSError)

689

and error.errno != errno.ECHILD):

690

raise error

685

691

else:

686

692

if pid:

687

693

logger.warning("Checker was a zombie")

691

697

# Start a new checker if needed

692

698

if self.checker is None:

693

699

# Escape attributes for the shell

694

escaped_attrs = {

695

attr: re.escape(str(getattr(self, attr)))

696

for attr in self.runtime_expansions }

700

escaped_attrs = dict(

701

(attr, re.escape(unicode(getattr(self, attr))))

702

for attr in

703

self.runtime_expansions)

697

704

try:

698

705

command = self.checker_command % escaped_attrs

699

706

except TypeError as error:

700

707

logger.error('Could not format string "%s"',

701

self.checker_command,

702

exc_info=error)

703

return True # Try again later

708

self.checker_command, exc_info=error)

709

return True # Try again later

704

710

self.current_checker_command = command

705

711

try:

706

logger.info("Starting checker %r for %s", command,

707

self.name)

712

logger.info("Starting checker %r for %s",

713

command, self.name)

708

714

# We don't need to redirect stdout and stderr, since

709

715

# in normal mode, that is already done by daemon(),

710

716

# and in debug mode we don't want to. (Stdin is

719

725

"stderr": wnull })

720

726

self.checker = subprocess.Popen(command,

721

727

close_fds=True,

722

shell=True,

723

cwd="/",

728

shell=True, cwd="/",

724

729

**popen_args)

725

730

except OSError as error:

726

731

logger.error("Failed to start subprocess",

727

732

exc_info=error)

728

733

return True

729

self.checker_callback_tag = gobject.child_watch_add(

730

self.checker.pid, self.checker_callback, data=command)

734

self.checker_callback_tag = (gobject.child_watch_add

735

(self.checker.pid,

736

self.checker_callback,

737

data=command))

731

738

# The checker may have completed before the gobject

732

739

# watch was added. Check for this.

733

740

try:

764

771

self.checker = None

765

772

766

773

767

def dbus_service_property(dbus_interface,

768

signature="v",

769

access="readwrite",

770

byte_arrays=False):

774

def dbus_service_property(dbus_interface, signature="v",

775

access="readwrite", byte_arrays=False):

771

776

"""Decorators for marking methods of a DBusObjectWithProperties to

772

777

become properties on the D-Bus.

773

778

782

787

# "Set" method, so we fail early here:

783

788

if byte_arrays and signature != "ay":

784

789

raise ValueError("Byte arrays not supported for non-'ay'"

785

" signature {!r}".format(signature))

786

790

" signature {0!r}".format(signature))

787

791

def decorator(func):

788

792

func._dbus_is_property = True

789

793

func._dbus_interface = dbus_interface

794

798

func._dbus_name = func._dbus_name[:-14]

795

799

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

796

800

return func

797

798

801

return decorator

799

802

800

803

809

812

"org.freedesktop.DBus.Property.EmitsChangedSignal":

810

813

"false"}

811

814

"""

812

813

815

def decorator(func):

814

816

func._dbus_is_interface = True

815

817

func._dbus_interface = dbus_interface

816

818

func._dbus_name = dbus_interface

817

819

return func

818

819

820

return decorator

820

821

822

823

824

"""Decorator to annotate D-Bus methods, signals or properties

824

825

Usage:

825

826

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

827

"org.freedesktop.DBus.Property."

828

"EmitsChangedSignal": "false"})

829

827

@dbus_service_property("org.example.Interface", signature="b",

830

828

access="r")

829

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

830

"org.freedesktop.DBus.Property."

831

"EmitsChangedSignal": "false"})

831

832

def Property_dbus_property(self):

832

833

return dbus.Boolean(False)

833

834

"""

834

835

def decorator(func):

836

func._dbus_annotations = annotations

837

return func

838

839

838

return decorator

840

839

841

840

842

841

class DBusPropertyException(dbus.exceptions.DBusException):

843

842

"""A base class for D-Bus property-related exceptions

844

843

"""

845

pass

844

def __unicode__(self):

845

return unicode(str(self))

846

847

848

class DBusPropertyAccessException(DBusPropertyException):

872

If called like _is_dbus_thing("method") it returns a function

873

suitable for use as predicate to inspect.getmembers().

874

"""

875

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

875

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

876

False)

877

878

def _get_all_dbus_things(self, thing):

879

"""Returns a generator of (name, attribute) pairs

880

"""

881

return ((getattr(athing.__get__(self), "_dbus_name", name),

881

return ((getattr(athing.__get__(self), "_dbus_name",

882

name),

882

883

athing.__get__(self))

883

884

for cls in self.__class__.__mro__

884

885

for name, athing in

885

inspect.getmembers(cls, self._is_dbus_thing(thing)))

886

inspect.getmembers(cls,

887

self._is_dbus_thing(thing)))

886

888

887

889

def _get_dbus_property(self, interface_name, property_name):

888

890

"""Returns a bound method if one exists which is a D-Bus

889

891

property with the specified name and interface.

890

892

"""

891

for cls in self.__class__.__mro__:

892

for name, value in inspect.getmembers(

893

cls, self._is_dbus_thing("property")):

893

for cls in self.__class__.__mro__:

894

for name, value in (inspect.getmembers

895

(cls,

896

self._is_dbus_thing("property"))):

894

897

if (value._dbus_name == property_name

895

898

and value._dbus_interface == interface_name):

896

899

return value.__get__(self)

897

900

898

901

# No such property

899

raise DBusPropertyNotFound("{}:{}.{}".format(

900

self.dbus_object_path, interface_name, property_name))

902

raise DBusPropertyNotFound(self.dbus_object_path + ":"

903

+ interface_name + "."

904

+ property_name)

901

905

902

@dbus.service.method(dbus.PROPERTIES_IFACE,

903

in_signature="ss",

906

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

904

907

out_signature="v")

905

908

def Get(self, interface_name, property_name):

906

909

"""Standard D-Bus property Get() method, see D-Bus standard.

924

927

# The byte_arrays option is not supported yet on

925

928

# signatures other than "ay".

926

929

if prop._dbus_signature != "ay":

927

raise ValueError("Byte arrays not supported for non-"

928

"'ay' signature {!r}"

929

.format(prop._dbus_signature))

930

raise ValueError

930

931

value = dbus.ByteArray(b''.join(chr(byte)

931

932

for byte in value))

932

933

prop(value)

933

934

@dbus.service.method(dbus.PROPERTIES_IFACE,

935

in_signature="s",

935

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

936

out_signature="a{sv}")

937

def GetAll(self, interface_name):

938

"""Standard D-Bus property GetAll() method, see D-Bus

953

if not hasattr(value, "variant_level"):

954

properties[name] = value

955

continue

956

properties[name] = type(value)(

957

value, variant_level = value.variant_level + 1)

956

properties[name] = type(value)(value, variant_level=

957

value.variant_level+1)

958

return dbus.Dictionary(properties, signature="sv")

959

960

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

961

def PropertiesChanged(self, interface_name, changed_properties,

962

invalidated_properties):

963

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

964

standard.

965

"""

966

pass

967

968

960

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

969

961

out_signature="s",

970

962

path_keyword='object_path',

978

970

connection)

979

971

try:

980

972

document = xml.dom.minidom.parseString(xmlstring)

981

982

973

def make_tag(document, name, prop):

983

974

e = document.createElement("property")

984

975

e.setAttribute("name", name)

985

976

e.setAttribute("type", prop._dbus_signature)

986

977

e.setAttribute("access", prop._dbus_access)

987

978

return e

988

989

979

for if_tag in document.getElementsByTagName("interface"):

990

980

# Add property tags

991

981

for tag in (make_tag(document, name, prop)

1003

993

if (name == tag.getAttribute("name")

1004

994

and prop._dbus_interface

1005

995

== if_tag.getAttribute("name")):

1006

annots.update(getattr(

1007

prop, "_dbus_annotations", {}))

1008

for name, value in annots.items():

996

annots.update(getattr

997

(prop,

998

"_dbus_annotations",

999

{}))

1000

for name, value in annots.iteritems():

1009

1001

ann_tag = document.createElement(

1010

1002

"annotation")

1011

1003

ann_tag.setAttribute("name", name)

1014

1006

# Add interface annotation tags

1015

1007

for annotation, value in dict(

1016

1008

itertools.chain.from_iterable(

1017

annotations().items()

1018

for name, annotations

1019

in self._get_all_dbus_things("interface")

1009

annotations().iteritems()

1010

for name, annotations in

1011

self._get_all_dbus_things("interface")

1020

1012

if name == if_tag.getAttribute("name")

1021

)).items():

1013

)).iteritems():

1022

1014

ann_tag = document.createElement("annotation")

1023

1015

ann_tag.setAttribute("name", annotation)

1024

1016

ann_tag.setAttribute("value", value)

1051

1043

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1052

1044

if dt is None:

1053

1045

return dbus.String("", variant_level = variant_level)

1054

return dbus.String(dt.isoformat(), variant_level=variant_level)

1046

return dbus.String(dt.isoformat(),

1047

variant_level=variant_level)

1055

1048

1056

1049

1057

1050

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1077

1070

(from DBusObjectWithProperties) and interfaces (from the

1078

1071

dbus_interface_annotations decorator).

1079

1072

"""

1080

1081

1073

def wrapper(cls):

1082

1074

for orig_interface_name, alt_interface_name in (

1083

alt_interface_names.items()):

1075

alt_interface_names.iteritems()):

1084

1076

attr = {}

1085

1077

interface_names = set()

1086

1078

# Go though all attributes of the class

1088

1080

# Ignore non-D-Bus attributes, and D-Bus attributes

1089

1081

# with the wrong interface name

1090

1082

if (not hasattr(attribute, "_dbus_interface")

1091

or not attribute._dbus_interface.startswith(

1092

orig_interface_name)):

1083

or not attribute._dbus_interface

1084

.startswith(orig_interface_name)):

1093

1085

continue

1094

1086

# Create an alternate D-Bus interface name based on

1095

1087

# the current name

1096

alt_interface = attribute._dbus_interface.replace(

1097

orig_interface_name, alt_interface_name)

1088

alt_interface = (attribute._dbus_interface

1089

.replace(orig_interface_name,

1090

alt_interface_name))

1098

1091

interface_names.add(alt_interface)

1099

1092

# Is this a D-Bus signal?

1100

1093

if getattr(attribute, "_dbus_is_signal", False):

1101

1094

# Extract the original non-method undecorated

1102

1095

# function by black magic

1103

1096

nonmethod_func = (dict(

1104

zip(attribute.func_code.co_freevars,

1105

attribute.__closure__))

1106

["func"].cell_contents)

1097

zip(attribute.func_code.co_freevars,

1098

attribute.__closure__))["func"]

1099

.cell_contents)

1107

1100

# Create a new, but exactly alike, function

1108

1101

# object, and decorate it to be a new D-Bus signal

1109

1102

# with the alternate D-Bus interface name

1110

new_function = (dbus.service.signal(

1111

alt_interface, attribute._dbus_signature)

1103

new_function = (dbus.service.signal

1104

(alt_interface,

1105

attribute._dbus_signature)

1112

1106

(types.FunctionType(

1113

nonmethod_func.func_code,

1114

nonmethod_func.func_globals,

1115

nonmethod_func.func_name,

1116

nonmethod_func.func_defaults,

1117

nonmethod_func.func_closure)))

1107

nonmethod_func.func_code,

1108

nonmethod_func.func_globals,

1109

nonmethod_func.func_name,

1110

nonmethod_func.func_defaults,

1111

nonmethod_func.func_closure)))

1118

1112

# Copy annotations, if any

1119

1113

try:

1120

new_function._dbus_annotations = dict(

1121

attribute._dbus_annotations)

1114

new_function._dbus_annotations = (

1115

dict(attribute._dbus_annotations))

1122

1116

except AttributeError:

1123

1117

pass

1124

1118

# Define a creator of a function to call both the

1129

1123

"""This function is a scope container to pass

1130

1124

func1 and func2 to the "call_both" function

1131

1125

outside of its arguments"""

1132

1133

1126

def call_both(*args, **kwargs):

1134

1127

"""This function will emit two D-Bus

1135

1128

signals by calling func1 and func2"""

1136

1129

func1(*args, **kwargs)

1137

1130

func2(*args, **kwargs)

1138

1139

1131

return call_both

1140

1132

# Create the "call_both" function and add it to

1141

1133

# the class

1146

1138

# object. Decorate it to be a new D-Bus method

1147

1139

# with the alternate D-Bus interface name. Add it

1148

1140

# to the class.

1149

attr[attrname] = (

1150

dbus.service.method(

1151

alt_interface,

1152

attribute._dbus_in_signature,

1153

attribute._dbus_out_signature)

1154

(types.FunctionType(attribute.func_code,

1155

attribute.func_globals,

1156

attribute.func_name,

1157

attribute.func_defaults,

1158

attribute.func_closure)))

1141

attr[attrname] = (dbus.service.method

1142

(alt_interface,

1143

attribute._dbus_in_signature,

1144

attribute._dbus_out_signature)

1145

(types.FunctionType

1146

(attribute.func_code,

1147

attribute.func_globals,

1148

attribute.func_name,

1149

attribute.func_defaults,

1150

attribute.func_closure)))

1159

1151

# Copy annotations, if any

1160

1152

try:

1161

attr[attrname]._dbus_annotations = dict(

1162

attribute._dbus_annotations)

1153

attr[attrname]._dbus_annotations = (

1154

dict(attribute._dbus_annotations))

1163

1155

except AttributeError:

1164

1156

pass

1165

1157

# Is this a D-Bus property?

1168

1160

# object, and decorate it to be a new D-Bus

1169

1161

# property with the alternate D-Bus interface

1170

1162

# name. Add it to the class.

1171

attr[attrname] = (dbus_service_property(

1172

alt_interface, attribute._dbus_signature,

1173

attribute._dbus_access,

1174

attribute._dbus_get_args_options

1175

["byte_arrays"])

1176

(types.FunctionType(

1177

attribute.func_code,

1178

attribute.func_globals,

1179

attribute.func_name,

1180

attribute.func_defaults,

1181

attribute.func_closure)))

1163

attr[attrname] = (dbus_service_property

1164

(alt_interface,

1165

attribute._dbus_signature,

1166

attribute._dbus_access,

1167

attribute

1168

._dbus_get_args_options

1169

["byte_arrays"])

1170

(types.FunctionType

1171

(attribute.func_code,

1172

attribute.func_globals,

1173

attribute.func_name,

1174

attribute.func_defaults,

1175

attribute.func_closure)))

1182

1176

# Copy annotations, if any

1183

1177

try:

1184

attr[attrname]._dbus_annotations = dict(

1185

attribute._dbus_annotations)

1178

attr[attrname]._dbus_annotations = (

1179

dict(attribute._dbus_annotations))

1186

1180

except AttributeError:

1187

1181

pass

1188

1182

# Is this a D-Bus interface?

1191

1185

# object. Decorate it to be a new D-Bus interface

1192

1186

# with the alternate D-Bus interface name. Add it

1193

1187

# to the class.

1194

attr[attrname] = (

1195

dbus_interface_annotations(alt_interface)

1196

(types.FunctionType(attribute.func_code,

1197

attribute.func_globals,

1198

attribute.func_name,

1199

attribute.func_defaults,

1200

attribute.func_closure)))

1188

attr[attrname] = (dbus_interface_annotations

1189

(alt_interface)

1190

(types.FunctionType

1191

(attribute.func_code,

1192

attribute.func_globals,

1193

attribute.func_name,

1194

attribute.func_defaults,

1195

attribute.func_closure)))

1201

1196

if deprecate:

1202

1197

# Deprecate all alternate interfaces

1203

iname="_AlternateDBusNames_interface_annotation{}"

1198

iname="_AlternateDBusNames_interface_annotation{0}"

1204

1199

for interface_name in interface_names:

1205

1206

1200

@dbus_interface_annotations(interface_name)

1207

1201

def func(self):

1208

1202

return { "org.freedesktop.DBus.Deprecated":

1209

"true" }

1203

"true" }

1210

1204

# Find an unused name

1211

1205

for aname in (iname.format(i)

1212

1206

for i in itertools.count()):

1216

1210

if interface_names:

1217

1211

# Replace the class with a new subclass of it with

1218

1212

# methods, signals, etc. as created above.

1219

cls = type(b"{}Alternate".format(cls.__name__),

1220

(cls, ), attr)

1213

cls = type(b"{0}Alternate".format(cls.__name__),

1214

(cls,), attr)

1221

1215

return cls

1222

1223

1216

return wrapper

1224

1217

1225

1218

1226

1219

@alternate_dbus_interfaces({"se.recompile.Mandos":

1227

"se.bsnet.fukt.Mandos"})

1220

"se.bsnet.fukt.Mandos"})

1228

1221

class ClientDBus(Client, DBusObjectWithProperties):

1229

1222

"""A Client class using D-Bus

1230

1223

1234

1227

"""

1235

1228

1236

1229

runtime_expansions = (Client.runtime_expansions

1237

+ ("dbus_object_path", ))

1238

1239

_interface = "se.recompile.Mandos.Client"

1230

+ ("dbus_object_path",))

1240

1231

1241

1232

# dbus.service.Object doesn't use super(), so we can't either.

1242

1233

1245

1236

Client.__init__(self, *args, **kwargs)

1246

1237

# Only now, when this client is initialized, can it show up on

1247

1238

# the D-Bus

1248

client_object_name = str(self.name).translate(

1239

client_object_name = unicode(self.name).translate(

1249

1240

{ord("."): ord("_"),

1250

1241

ord("-"): ord("_")})

1251

self.dbus_object_path = dbus.ObjectPath(

1252

"/clients/" + client_object_name)

1242

self.dbus_object_path = (dbus.ObjectPath

1243

("/clients/" + client_object_name))

1253

1244

DBusObjectWithProperties.__init__(self, self.bus,

1254

1245

self.dbus_object_path)

1255

1246

1256

def notifychangeproperty(transform_func, dbus_name,

1257

type_func=lambda x: x,

1258

variant_level=1,

1259

invalidate_only=False,

1260

_interface=_interface):

1247

def notifychangeproperty(transform_func,

1248

dbus_name, type_func=lambda x: x,

1249

variant_level=1):

1261

1250

""" Modify a variable so that it's a property which announces

1262

1251

its changes to DBus.

1263

1252

1268

1257

to the D-Bus. Default: no transform

1269

1258

variant_level: D-Bus variant level. Default: 1

1270

1259

"""

1271

attrname = "_{}".format(dbus_name)

1272

1260

attrname = "_{0}".format(dbus_name)

1273

1261

def setter(self, value):

1274

1262

if hasattr(self, "dbus_object_path"):

1275

1263

if (not hasattr(self, attrname) or

1276

1264

type_func(getattr(self, attrname, None))

1277

1265

!= type_func(value)):

1278

if invalidate_only:

1279

self.PropertiesChanged(

1280

_interface, dbus.Dictionary(),

1281

dbus.Array((dbus_name, )))

1282

else:

1283

dbus_value = transform_func(

1284

type_func(value),

1285

variant_level = variant_level)

1286

self.PropertyChanged(dbus.String(dbus_name),

1287

dbus_value)

1288

self.PropertiesChanged(

1289

_interface,

1290

dbus.Dictionary({ dbus.String(dbus_name):

1291

dbus_value }),

1292

dbus.Array())

1266

dbus_value = transform_func(type_func(value),

1267

variant_level

1268

=variant_level)

1269

self.PropertyChanged(dbus.String(dbus_name),

1270

dbus_value)

1293

1271

setattr(self, attrname, value)

1294

1272

1295

1273

return property(lambda self: getattr(self, attrname), setter)

1301

1279

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1302

1280

last_enabled = notifychangeproperty(datetime_to_dbus,

1303

1281

"LastEnabled")

1304

checker = notifychangeproperty(

1305

dbus.Boolean, "CheckerRunning",

1306

type_func = lambda checker: checker is not None)

1282

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1283

type_func = lambda checker:

1284

checker is not None)

1307

1285

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1308

1286

"LastCheckedOK")

1309

1287

last_checker_status = notifychangeproperty(dbus.Int16,

1312

1290

datetime_to_dbus, "LastApprovalRequest")

1313

1291

approved_by_default = notifychangeproperty(dbus.Boolean,

1314

1292

"ApprovedByDefault")

1315

approval_delay = notifychangeproperty(

1316

dbus.UInt64, "ApprovalDelay",

1317

type_func = lambda td: td.total_seconds() * 1000)

1293

approval_delay = notifychangeproperty(dbus.UInt64,

1294

"ApprovalDelay",

1295

type_func =

1296

timedelta_to_milliseconds)

1318

1297

approval_duration = notifychangeproperty(

1319

1298

dbus.UInt64, "ApprovalDuration",

1320

type_func = lambda td: td.total_seconds() * 1000)

1299

type_func = timedelta_to_milliseconds)

1321

1300

host = notifychangeproperty(dbus.String, "Host")

1322

timeout = notifychangeproperty(

1323

dbus.UInt64, "Timeout",

1324

type_func = lambda td: td.total_seconds() * 1000)

1301

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1302

type_func =

1303

timedelta_to_milliseconds)

1325

1304

extended_timeout = notifychangeproperty(

1326

1305

dbus.UInt64, "ExtendedTimeout",

1327

type_func = lambda td: td.total_seconds() * 1000)

1328

interval = notifychangeproperty(

1329

dbus.UInt64, "Interval",

1330

type_func = lambda td: td.total_seconds() * 1000)

1306

type_func = timedelta_to_milliseconds)

1307

interval = notifychangeproperty(dbus.UInt64,

1308

"Interval",

1309

type_func =

1310

timedelta_to_milliseconds)

1331

1311

checker_command = notifychangeproperty(dbus.String, "Checker")

1332

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1333

invalidate_only=True)

1334

1312

1335

1313

del notifychangeproperty

1336

1314

1363

1341

*args, **kwargs)

1364

1342

1365

1343

def start_checker(self, *args, **kwargs):

1366

old_checker_pid = getattr(self.checker, "pid", None)

1344

old_checker = self.checker

1345

if self.checker is not None:

1346

old_checker_pid = self.checker.pid

1347

else:

1348

old_checker_pid = None

1367

1349

r = Client.start_checker(self, *args, **kwargs)

1368

1350

# Only if new checker process was started

1369

1351

if (self.checker is not None

1378

1360

1379

1361

def approve(self, value=True):

1380

1362

self.approved = value

1381

gobject.timeout_add(int(self.approval_duration.total_seconds()

1382

* 1000), self._reset_approved)

1363

gobject.timeout_add(timedelta_to_milliseconds

1364

(self.approval_duration),

1365

self._reset_approved)

1383

1366

self.send_changedstate()

1384

1367

1385

1368

## D-Bus methods, signals & properties

1369

_interface = "se.recompile.Mandos.Client"

1386

1370

1387

1371

## Interfaces

1388

1372

1373

@dbus_interface_annotations(_interface)

1374

def _foo(self):

1375

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1376

"false"}

1377

1389

1378

## Signals

1390

1379

1391

1380

# CheckerCompleted - signal

1401

1390

pass

1402

1391

1403

1392

# PropertyChanged - signal

1404

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1405

1393

@dbus.service.signal(_interface, signature="sv")

1406

1394

def PropertyChanged(self, property, value):

1407

1395

"D-Bus signal"

1471

1459

return dbus.Boolean(bool(self.approvals_pending))

1472

1460

1473

1461

# ApprovedByDefault - property

1474

@dbus_service_property(_interface,

1475

signature="b",

1462

@dbus_service_property(_interface, signature="b",

1476

1463

access="readwrite")

1477

1464

def ApprovedByDefault_dbus_property(self, value=None):

1478

1465

if value is None: # get

1480

1467

self.approved_by_default = bool(value)

1481

1468

1482

1469

# ApprovalDelay - property

1483

@dbus_service_property(_interface,

1484

signature="t",

1470

@dbus_service_property(_interface, signature="t",

1485

1471

access="readwrite")

1486

1472

def ApprovalDelay_dbus_property(self, value=None):

1487

1473

if value is None: # get

1488

return dbus.UInt64(self.approval_delay.total_seconds()

1489

* 1000)

1474

return dbus.UInt64(self.approval_delay_milliseconds())

1490

1475

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1491

1476

1492

1477

# ApprovalDuration - property

1493

@dbus_service_property(_interface,

1494

signature="t",

1478

@dbus_service_property(_interface, signature="t",

1495

1479

access="readwrite")

1496

1480

def ApprovalDuration_dbus_property(self, value=None):

1497

1481

if value is None: # get

1498

return dbus.UInt64(self.approval_duration.total_seconds()

1499

* 1000)

1482

return dbus.UInt64(timedelta_to_milliseconds(

1483

self.approval_duration))

1500

1484

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1501

1485

1502

1486

# Name - property

1510

1494

return dbus.String(self.fingerprint)

1511

1495

1512

1496

# Host - property

1513

@dbus_service_property(_interface,

1514

signature="s",

1497

@dbus_service_property(_interface, signature="s",

1515

1498

access="readwrite")

1516

1499

def Host_dbus_property(self, value=None):

1517

1500

if value is None: # get

1518

1501

return dbus.String(self.host)

1519

self.host = str(value)

1502

self.host = unicode(value)

1520

1503

1521

1504

# Created - property

1522

1505

@dbus_service_property(_interface, signature="s", access="read")

1529

1512

return datetime_to_dbus(self.last_enabled)

1530

1513

1531

1514

# Enabled - property

1532

@dbus_service_property(_interface,

1533

signature="b",

1515

@dbus_service_property(_interface, signature="b",

1534

1516

access="readwrite")

1535

1517

def Enabled_dbus_property(self, value=None):

1536

1518

if value is None: # get

1541

1523

self.disable()

1542

1524

1543

1525

# LastCheckedOK - property

1544

@dbus_service_property(_interface,

1545

signature="s",

1526

@dbus_service_property(_interface, signature="s",

1546

1527

access="readwrite")

1547

1528

def LastCheckedOK_dbus_property(self, value=None):

1548

1529

if value is not None:

1551

1532

return datetime_to_dbus(self.last_checked_ok)

1552

1533

1553

1534

# LastCheckerStatus - property

1554

@dbus_service_property(_interface, signature="n", access="read")

1535

@dbus_service_property(_interface, signature="n",

1536

access="read")

1555

1537

def LastCheckerStatus_dbus_property(self):

1556

1538

return dbus.Int16(self.last_checker_status)

1557

1539

1566

1548

return datetime_to_dbus(self.last_approval_request)

1567

1549

1568

1550

# Timeout - property

1569

@dbus_service_property(_interface,

1570

signature="t",

1551

@dbus_service_property(_interface, signature="t",

1571

1552

access="readwrite")

1572

1553

def Timeout_dbus_property(self, value=None):

1573

1554

if value is None: # get

1574

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1555

return dbus.UInt64(self.timeout_milliseconds())

1575

1556

old_timeout = self.timeout

1576

1557

self.timeout = datetime.timedelta(0, 0, 0, value)

1577

1558

# Reschedule disabling

1586

1567

is None):

1587

1568

return

1588

1569

gobject.source_remove(self.disable_initiator_tag)

1589

self.disable_initiator_tag = gobject.timeout_add(

1590

int((self.expires - now).total_seconds() * 1000),

1591

self.disable)

1570

self.disable_initiator_tag = (

1571

gobject.timeout_add(

1572

timedelta_to_milliseconds(self.expires - now),

1573

self.disable))

1592

1574

1593

1575

# ExtendedTimeout - property

1594

@dbus_service_property(_interface,

1595

signature="t",

1576

@dbus_service_property(_interface, signature="t",

1596

1577

access="readwrite")

1597

1578

def ExtendedTimeout_dbus_property(self, value=None):

1598

1579

if value is None: # get

1599

return dbus.UInt64(self.extended_timeout.total_seconds()

1600

* 1000)

1580

return dbus.UInt64(self.extended_timeout_milliseconds())

1601

1581

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1602

1582

1603

1583

# Interval - property

1604

@dbus_service_property(_interface,

1605

signature="t",

1584

@dbus_service_property(_interface, signature="t",

1606

1585

access="readwrite")

1607

1586

def Interval_dbus_property(self, value=None):

1608

1587

if value is None: # get

1609

return dbus.UInt64(self.interval.total_seconds() * 1000)

1588

return dbus.UInt64(self.interval_milliseconds())

1610

1589

self.interval = datetime.timedelta(0, 0, 0, value)

1611

1590

if getattr(self, "checker_initiator_tag", None) is None:

1612

1591

return

1613

1592

if self.enabled:

1614

1593

# Reschedule checker run

1615

1594

gobject.source_remove(self.checker_initiator_tag)

1616

self.checker_initiator_tag = gobject.timeout_add(

1617

value, self.start_checker)

1618

self.start_checker() # Start one now, too

1595

self.checker_initiator_tag = (gobject.timeout_add

1596

(value, self.start_checker))

1597

self.start_checker() # Start one now, too

1619

1598

1620

1599

# Checker - property

1621

@dbus_service_property(_interface,

1622

signature="s",

1600

@dbus_service_property(_interface, signature="s",

1623

1601

access="readwrite")

1624

1602

def Checker_dbus_property(self, value=None):

1625

1603

if value is None: # get

1626

1604

return dbus.String(self.checker_command)

1627

self.checker_command = str(value)

1605

self.checker_command = unicode(value)

1628

1606

1629

1607

# CheckerRunning - property

1630

@dbus_service_property(_interface,

1631

signature="b",

1608

@dbus_service_property(_interface, signature="b",

1632

1609

access="readwrite")

1633

1610

def CheckerRunning_dbus_property(self, value=None):

1634

1611

if value is None: # get

1644

1621

return self.dbus_object_path # is already a dbus.ObjectPath

1645

1622

1646

1623

# Secret = property

1647

@dbus_service_property(_interface,

1648

signature="ay",

1649

access="write",

1650

byte_arrays=True)

1624

@dbus_service_property(_interface, signature="ay",

1625

access="write", byte_arrays=True)

1651

1626

def Secret_dbus_property(self, value):

1652

self.secret = bytes(value)

1627

self.secret = str(value)

1653

1628

1654

1629

del _interface

1655

1630

1669

1644

if data[0] == 'data':

1670

1645

return data[1]

1671

1646

if data[0] == 'function':

1672

1673

1647

def func(*args, **kwargs):

1674

1648

self._pipe.send(('funcall', name, args, kwargs))

1675

1649

return self._pipe.recv()[1]

1676

1677

1650

return func

1678

1651

1679

1652

def __setattr__(self, name, value):

1691

1664

def handle(self):

1692

1665

with contextlib.closing(self.server.child_pipe) as child_pipe:

1693

1666

logger.info("TCP connection from: %s",

1694

str(self.client_address))

1667

unicode(self.client_address))

1695

1668

logger.debug("Pipe FD: %d",

1696

1669

self.server.child_pipe.fileno())

1697

1670

1698

session = gnutls.connection.ClientSession(

1699

self.request, gnutls.connection .X509Credentials())

1671

session = (gnutls.connection

1672

.ClientSession(self.request,

1673

gnutls.connection

1674

.X509Credentials()))

1700

1675

1701

1676

# Note: gnutls.connection.X509Credentials is really a

1702

1677

# generic GnuTLS certificate credentials object so long as

1711

1686

priority = self.server.gnutls_priority

1712

1687

if priority is None:

1713

1688

priority = "NORMAL"

1714

gnutls.library.functions.gnutls_priority_set_direct(

1715

session._c_object, priority, None)

1689

(gnutls.library.functions

1690

.gnutls_priority_set_direct(session._c_object,

1691

priority, None))

1716

1692

1717

1693

# Start communication using the Mandos protocol

1718

1694

# Get protocol number

1720

1696

logger.debug("Protocol version: %r", line)

1721

1697

try:

1722

1698

if int(line.strip().split()[0]) > 1:

1723

raise RuntimeError(line)

1699

raise RuntimeError

1724

1700

except (ValueError, IndexError, RuntimeError) as error:

1725

1701

logger.error("Unknown protocol version: %s", error)

1726

1702

return

1738

1714

approval_required = False

1739

1715

try:

1740

1716

try:

1741

fpr = self.fingerprint(

1742

self.peer_certificate(session))

1717

fpr = self.fingerprint(self.peer_certificate

1718

(session))

1743

1719

except (TypeError,

1744

1720

gnutls.errors.GNUTLSError) as error:

1745

1721

logger.warning("Bad certificate: %s", error)

1760

1736

while True:

1761

1737

if not client.enabled:

1762

1738

logger.info("Client %s is disabled",

1763

client.name)

1739

client.name)

1764

1740

if self.server.use_dbus:

1765

1741

# Emit D-Bus signal

1766

1742

client.Rejected("Disabled")

1775

1751

if self.server.use_dbus:

1776

1752

# Emit D-Bus signal

1777

1753

client.NeedApproval(

1778

client.approval_delay.total_seconds()

1779

* 1000, client.approved_by_default)

1754

client.approval_delay_milliseconds(),

1755

client.approved_by_default)

1780

1756

else:

1781

1757

logger.warning("Client %s was not approved",

1782

1758

client.name)

1788

1764

#wait until timeout or approved

1789

1765

time = datetime.datetime.now()

1790

1766

client.changedstate.acquire()

1791

client.changedstate.wait(delay.total_seconds())

1767

client.changedstate.wait(

1768

float(timedelta_to_milliseconds(delay)

1769

/ 1000))

1792

1770

client.changedstate.release()

1793

1771

time2 = datetime.datetime.now()

1794

1772

if (time2 - time) >= delay:

1813

1791

logger.warning("gnutls send failed",

1814

1792

exc_info=error)

1815

1793

return

1816

logger.debug("Sent: %d, remaining: %d", sent,

1817

len(client.secret) - (sent_size

1818

+ sent))

1794

logger.debug("Sent: %d, remaining: %d",

1795

sent, len(client.secret)

1796

- (sent_size + sent))

1819

1797

sent_size += sent

1820

1798

1821

1799

logger.info("Sending secret to %s", client.name)

1838

1816

def peer_certificate(session):

1839

1817

"Return the peer's OpenPGP certificate as a bytestring"

1840

1818

# If not an OpenPGP certificate...

1841

if (gnutls.library.functions.gnutls_certificate_type_get(

1842

session._c_object)

1819

if (gnutls.library.functions

1820

.gnutls_certificate_type_get(session._c_object)

1843

1821

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1844

1822

# ...do the normal thing

1845

1823

return session.peer_certificate

1859

1837

def fingerprint(openpgp):

1860

1838

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1861

1839

# New GnuTLS "datum" with the OpenPGP public key

1862

datum = gnutls.library.types.gnutls_datum_t(

1863

ctypes.cast(ctypes.c_char_p(openpgp),

1864

ctypes.POINTER(ctypes.c_ubyte)),

1865

ctypes.c_uint(len(openpgp)))

1840

datum = (gnutls.library.types

1841

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1842

ctypes.POINTER

1843

(ctypes.c_ubyte)),

1844

ctypes.c_uint(len(openpgp))))

1866

1845

# New empty GnuTLS certificate

1867

1846

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1868

gnutls.library.functions.gnutls_openpgp_crt_init(

1869

ctypes.byref(crt))

1847

(gnutls.library.functions

1848

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1870

1849

# Import the OpenPGP public key into the certificate

1871

gnutls.library.functions.gnutls_openpgp_crt_import(

1872

crt, ctypes.byref(datum),

1873

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1850

(gnutls.library.functions

1851

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1852

gnutls.library.constants

1853

.GNUTLS_OPENPGP_FMT_RAW))

1874

1854

# Verify the self signature in the key

1875

1855

crtverify = ctypes.c_uint()

1876

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1877

crt, 0, ctypes.byref(crtverify))

1856

(gnutls.library.functions

1857

.gnutls_openpgp_crt_verify_self(crt, 0,

1858

ctypes.byref(crtverify)))

1878

1859

if crtverify.value != 0:

1879

1860

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1880

raise gnutls.errors.CertificateSecurityError(

1881

"Verify failed")

1861

raise (gnutls.errors.CertificateSecurityError

1862

("Verify failed"))

1882

1863

# New buffer for the fingerprint

1883

1864

buf = ctypes.create_string_buffer(20)

1884

1865

buf_len = ctypes.c_size_t()

1885

1866

# Get the fingerprint from the certificate into the buffer

1886

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1887

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1867

(gnutls.library.functions

1868

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1869

ctypes.byref(buf_len)))

1888

1870

# Deinit the certificate

1889

1871

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1890

1872

# Convert the buffer to a Python bytestring

1896

1878

1897

1879

class MultiprocessingMixIn(object):

1898

1880

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1899

1900

1881

def sub_process_main(self, request, address):

1901

1882

try:

1902

1883

self.finish_request(request, address)

1914

1895

1915

1896

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1916

1897

""" adds a pipe to the MixIn """

1917

1918

1898

def process_request(self, request, client_address):

1919

1899

"""Overrides and wraps the original process_request().

1920

1900

1929

1909

1930

1910

def add_pipe(self, parent_pipe, proc):

1931

1911

"""Dummy function; override as necessary"""

1932

raise NotImplementedError()

1912

raise NotImplementedError

1933

1913

1934

1914

1935

1915

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1941

1921

interface: None or a network interface name (string)

1942

1922

use_ipv6: Boolean; to use IPv6 or not

1943

1923

"""

1944

1945

1924

def __init__(self, server_address, RequestHandlerClass,

1946

interface=None,

1947

use_ipv6=True,

1948

socketfd=None):

1925

interface=None, use_ipv6=True, socketfd=None):

1949

1926

"""If socketfd is set, use that file descriptor instead of

1950

1927

creating a new one with socket.socket().

1951

1928

"""

1992

1969

self.interface)

1993

1970

else:

1994

1971

try:

1995

self.socket.setsockopt(

1996

socket.SOL_SOCKET, SO_BINDTODEVICE,

1997

(self.interface + "\0").encode("utf-8"))

1972

self.socket.setsockopt(socket.SOL_SOCKET,

1973

SO_BINDTODEVICE,

1974

str(self.interface + '\0'))

1998

1975

except socket.error as error:

1999

1976

if error.errno == errno.EPERM:

2000

1977

logger.error("No permission to bind to"

2018

1995

self.server_address = (any_address,

2019

1996

self.server_address[1])

2020

1997

elif not self.server_address[1]:

2021

self.server_address = (self.server_address[0], 0)

1998

self.server_address = (self.server_address[0],

1999

0)

2022

2000

# if self.interface:

2023

2001

# self.server_address = (self.server_address[0],

2024

2002

# 0, # port

2038

2016

2039

2017

Assumes a gobject.MainLoop event loop.

2040

2018

"""

2041

2042

2019

def __init__(self, server_address, RequestHandlerClass,

2043

interface=None,

2044

use_ipv6=True,

2045

clients=None,

2046

gnutls_priority=None,

2047

use_dbus=True,

2048

socketfd=None):

2020

interface=None, use_ipv6=True, clients=None,

2021

gnutls_priority=None, use_dbus=True, socketfd=None):

2049

2022

self.enabled = False

2050

2023

self.clients = clients

2051

2024

if self.clients is None:

2057

2030

interface = interface,

2058

2031

use_ipv6 = use_ipv6,

2059

2032

socketfd = socketfd)

2060

2061

2033

def server_activate(self):

2062

2034

if self.enabled:

2063

2035

return socketserver.TCPServer.server_activate(self)

2067

2039

2068

2040

def add_pipe(self, parent_pipe, proc):

2069

2041

# Call "handle_ipc" for both data and EOF events

2070

gobject.io_add_watch(

2071

parent_pipe.fileno(),

2072

gobject.IO_IN | gobject.IO_HUP,

2073

functools.partial(self.handle_ipc,

2074

parent_pipe = parent_pipe,

2075

proc = proc))

2042

gobject.io_add_watch(parent_pipe.fileno(),

2043

gobject.IO_IN | gobject.IO_HUP,

2044

functools.partial(self.handle_ipc,

2045

parent_pipe =

2046

parent_pipe,

2047

proc = proc))

2076

2048

2077

def handle_ipc(self, source, condition,

2078

parent_pipe=None,

2079

proc = None,

2080

client_object=None):

2049

def handle_ipc(self, source, condition, parent_pipe=None,

2050

proc = None, client_object=None):

2081

2051

# error, or the other end of multiprocessing.Pipe has closed

2082

2052

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2083

2053

# Wait for other process to exit

2106

2076

parent_pipe.send(False)

2107

2077

return False

2108

2078

2109

gobject.io_add_watch(

2110

parent_pipe.fileno(),

2111

gobject.IO_IN | gobject.IO_HUP,

2112

functools.partial(self.handle_ipc,

2113

parent_pipe = parent_pipe,

2114

proc = proc,

2115

client_object = client))

2079

gobject.io_add_watch(parent_pipe.fileno(),

2080

gobject.IO_IN | gobject.IO_HUP,

2081

functools.partial(self.handle_ipc,

2082

parent_pipe =

2083

parent_pipe,

2084

proc = proc,

2085

client_object =

2086

client))

2116

2087

parent_pipe.send(True)

2117

2088

# remove the old hook in favor of the new above hook on

2118

2089

# same fileno

2124

2095

2125

2096

parent_pipe.send(('data', getattr(client_object,

2126

2097

funcname)(*args,

2127

**kwargs)))

2098

**kwargs)))

2128

2099

2129

2100

if command == 'getattr':

2130

2101

attrname = request[1]

2131

2102

if callable(client_object.__getattribute__(attrname)):

2132

parent_pipe.send(('function', ))

2103

parent_pipe.send(('function',))

2133

2104

else:

2134

parent_pipe.send((

2135

'data', client_object.__getattribute__(attrname)))

2105

parent_pipe.send(('data', client_object

2106

.__getattribute__(attrname)))

2136

2107

2137

2108

if command == 'setattr':

2138

2109

attrname = request[1]

2178

2149

# None

2179

2150

"followers")) # Tokens valid after

2180

2151

# this token

2181

Token = collections.namedtuple("Token", (

2182

"regexp", # To match token; if "value" is not None, must have

2183

# a "group" containing digits

2184

"value", # datetime.timedelta or None

2185

"followers")) # Tokens valid after this token

2186

2152

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2187

2153

# the "duration" ABNF definition in RFC 3339, Appendix A.

2188

2154

token_end = Token(re.compile(r"$"), None, frozenset())

2189

2155

token_second = Token(re.compile(r"(\d+)S"),

2190

2156

datetime.timedelta(seconds=1),

2191

frozenset((token_end, )))

2157

frozenset((token_end,)))

2192

2158

token_minute = Token(re.compile(r"(\d+)M"),

2193

2159

datetime.timedelta(minutes=1),

2194

2160

frozenset((token_second, token_end)))

2210

2176

frozenset((token_month, token_end)))

2211

2177

token_week = Token(re.compile(r"(\d+)W"),

2212

2178

datetime.timedelta(weeks=1),

2213

frozenset((token_end, )))

2179

frozenset((token_end,)))

2214

2180

token_duration = Token(re.compile(r"P"), None,

2215

2181

frozenset((token_year, token_month,

2216

2182

token_day, token_time,

2217

token_week)))

2183

token_week))),

2218

2184

# Define starting values

2219

2185

value = datetime.timedelta() # Value so far

2220

2186

found_token = None

2221

followers = frozenset((token_duration,)) # Following valid tokens

2187

followers = frozenset(token_duration,) # Following valid tokens

2222

2188

s = duration # String left to parse

2223

2189

# Loop until end token is found

2224

2190

while found_token is not token_end:

2271

2237

timevalue = datetime.timedelta(0)

2272

2238

for s in interval.split():

2273

2239

try:

2274

suffix = s[-1]

2240

suffix = unicode(s[-1])

2275

2241

value = int(s[:-1])

2276

2242

if suffix == "d":

2277

2243

delta = datetime.timedelta(value)

2284

2250

elif suffix == "w":

2285

2251

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2286

2252

else:

2287

raise ValueError("Unknown suffix {!r}".format(suffix))

2288

except IndexError as e:

2253

raise ValueError("Unknown suffix {0!r}"

2254

.format(suffix))

2255

except (ValueError, IndexError) as e:

2289

2256

raise ValueError(*(e.args))

2290

2257

timevalue += delta

2291

2258

return timevalue

2307

2274

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2308

2275

if not stat.S_ISCHR(os.fstat(null).st_mode):

2309

2276

raise OSError(errno.ENODEV,

2310

"{} not a character device"

2277

"{0} not a character device"

2311

2278

.format(os.devnull))

2312

2279

os.dup2(null, sys.stdin.fileno())

2313

2280

os.dup2(null, sys.stdout.fileno())

2323

2290

2324

2291

parser = argparse.ArgumentParser()

2325

2292

parser.add_argument("-v", "--version", action="version",

2326

version = "%(prog)s {}".format(version),

2293

version = "%(prog)s {0}".format(version),

2327

2294

help="show version number and exit")

2328

2295

parser.add_argument("-i", "--interface", metavar="IF",

2329

2296

help="Bind to interface IF")

2362

2329

help="Directory to save/restore state in")

2363

2330

parser.add_argument("--foreground", action="store_true",

2364

2331

help="Run in foreground", default=None)

2365

parser.add_argument("--no-zeroconf", action="store_false",

2366

dest="zeroconf", help="Do not use Zeroconf",

2367

default=None)

2368

2332

2369

2333

options = parser.parse_args()

2370

2334

2371

2335

if options.check:

2372

2336

import doctest

2373

fail_count, test_count = doctest.testmod()

2374

sys.exit(os.EX_OK if fail_count == 0 else 1)

2337

doctest.testmod()

2338

sys.exit()

2375

2339

2376

2340

# Default values for config file for server-global settings

2377

2341

server_defaults = { "interface": "",

2379

2343

"port": "",

2380

2344

"debug": "False",

2381

2345

"priority":

2382

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2383

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2346

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224",

2384

2347

"servicename": "Mandos",

2385

2348

"use_dbus": "True",

2386

2349

"use_ipv6": "True",

2389

2352

"socket": "",

2390

2353

"statedir": "/var/lib/mandos",

2391

2354

"foreground": "False",

2392

"zeroconf": "True",

2393

}

2355

}

2394

2356

2395

2357

# Parse config file for server-global settings

2396

2358

server_config = configparser.SafeConfigParser(server_defaults)

2397

2359

del server_defaults

2398

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2360

server_config.read(os.path.join(options.configdir,

2361

"mandos.conf"))

2399

2362

# Convert the SafeConfigParser object to a dict

2400

2363

server_settings = server_config.defaults()

2401

2364

# Use the appropriate methods on the non-string config options

2419

2382

# Override the settings from the config file with command line

2420

2383

# options, if set.

2421

2384

for option in ("interface", "address", "port", "debug",

2422

"priority", "servicename", "configdir", "use_dbus",

2423

"use_ipv6", "debuglevel", "restore", "statedir",

2424

"socket", "foreground", "zeroconf"):

2385

"priority", "servicename", "configdir",

2386

"use_dbus", "use_ipv6", "debuglevel", "restore",

2387

"statedir", "socket", "foreground"):

2425

2388

value = getattr(options, option)

2426

2389

if value is not None:

2427

2390

server_settings[option] = value

2428

2391

del options

2429

2392

# Force all strings to be unicode

2430

2393

for option in server_settings.keys():

2431

if isinstance(server_settings[option], bytes):

2432

server_settings[option] = (server_settings[option]

2433

.decode("utf-8"))

2394

if type(server_settings[option]) is str:

2395

server_settings[option] = unicode(server_settings[option])

2434

2396

# Force all boolean options to be boolean

2435

2397

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2436

"foreground", "zeroconf"):

2398

"foreground"):

2437

2399

server_settings[option] = bool(server_settings[option])

2438

2400

# Debug implies foreground

2439

2401

if server_settings["debug"]:

2442

2404

2443

2405

##################################################################

2444

2406

2445

if (not server_settings["zeroconf"]

2446

and not (server_settings["port"]

2447

or server_settings["socket"] != "")):

2448

parser.error("Needs port or socket to work without Zeroconf")

2449

2450

2407

# For convenience

2451

2408

debug = server_settings["debug"]

2452

2409

debuglevel = server_settings["debuglevel"]

2455

2412

stored_state_path = os.path.join(server_settings["statedir"],

2456

2413

stored_state_file)

2457

2414

foreground = server_settings["foreground"]

2458

zeroconf = server_settings["zeroconf"]

2459

2415

2460

2416

if debug:

2461

2417

initlogger(debug, logging.DEBUG)

2467

2423

initlogger(debug, level)

2468

2424

2469

2425

if server_settings["servicename"] != "Mandos":

2470

syslogger.setFormatter(

2471

logging.Formatter('Mandos ({}) [%(process)d]:'

2472

' %(levelname)s: %(message)s'.format(

2473

server_settings["servicename"])))

2426

syslogger.setFormatter(logging.Formatter

2427

('Mandos ({0}) [%(process)d]:'

2428

' %(levelname)s: %(message)s'

2429

.format(server_settings

2430

["servicename"])))

2474

2431

2475

2432

# Parse config file with clients

2476

2433

client_config = configparser.SafeConfigParser(Client

2481

2438

global mandos_dbus_service

2482

2439

mandos_dbus_service = None

2483

2440

2484

socketfd = None

2485

if server_settings["socket"] != "":

2486

socketfd = server_settings["socket"]

2487

tcp_server = MandosServer(

2488

(server_settings["address"], server_settings["port"]),

2489

ClientHandler,

2490

interface=(server_settings["interface"] or None),

2491

use_ipv6=use_ipv6,

2492

gnutls_priority=server_settings["priority"],

2493

use_dbus=use_dbus,

2494

socketfd=socketfd)

2441

tcp_server = MandosServer((server_settings["address"],

2442

server_settings["port"]),

2443

ClientHandler,

2444

interface=(server_settings["interface"]

2445

or None),

2446

use_ipv6=use_ipv6,

2447

gnutls_priority=

2448

server_settings["priority"],

2449

use_dbus=use_dbus,

2450

socketfd=(server_settings["socket"]

2451

or None))

2495

2452

if not foreground:

2496

2453

pidfilename = "/run/mandos.pid"

2497

if not os.path.isdir("/run/."):

2498

pidfilename = "/var/run/mandos.pid"

2499

2454

pidfile = None

2500

2455

try:

2501

2456

pidfile = open(pidfilename, "w")

2518

2473

os.setuid(uid)

2519

2474

except OSError as error:

2520

2475

if error.errno != errno.EPERM:

2521

raise

2476

raise error

2522

2477

2523

2478

if debug:

2524

2479

# Enable all possible GnuTLS debugging

2531

2486

def debug_gnutls(level, string):

2532

2487

logger.debug("GnuTLS: %s", string[:-1])

2533

2488

2534

gnutls.library.functions.gnutls_global_set_log_function(

2535

debug_gnutls)

2489

(gnutls.library.functions

2490

.gnutls_global_set_log_function(debug_gnutls))

2536

2491

2537

2492

# Redirect stdin so all checkers get /dev/null

2538

2493

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2558

2513

if use_dbus:

2559

2514

try:

2560

2515

bus_name = dbus.service.BusName("se.recompile.Mandos",

2561

bus,

2562

do_not_queue=True)

2563

old_bus_name = dbus.service.BusName(

2564

"se.bsnet.fukt.Mandos", bus,

2565

do_not_queue=True)

2516

bus, do_not_queue=True)

2517

old_bus_name = (dbus.service.BusName

2518

("se.bsnet.fukt.Mandos", bus,

2519

do_not_queue=True))

2566

2520

except dbus.exceptions.NameExistsException as e:

2567

2521

logger.error("Disabling D-Bus:", exc_info=e)

2568

2522

use_dbus = False

2569

2523

server_settings["use_dbus"] = False

2570

2524

tcp_server.use_dbus = False

2571

if zeroconf:

2572

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2573

service = AvahiServiceToSyslog(

2574

name = server_settings["servicename"],

2575

servicetype = "_mandos._tcp",

2576

protocol = protocol,

2577

bus = bus)

2578

if server_settings["interface"]:

2579

service.interface = if_nametoindex(

2580

server_settings["interface"].encode("utf-8"))

2525

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2526

service = AvahiServiceToSyslog(name =

2527

server_settings["servicename"],

2528

servicetype = "_mandos._tcp",

2529

protocol = protocol, bus = bus)

2530

if server_settings["interface"]:

2531

service.interface = (if_nametoindex

2532

(str(server_settings["interface"])))

2581

2533

2582

2534

global multiprocessing_manager

2583

2535

multiprocessing_manager = multiprocessing.Manager()

2602

2554

if server_settings["restore"]:

2603

2555

try:

2604

2556

with open(stored_state_path, "rb") as stored_state:

2605

clients_data, old_client_settings = pickle.load(

2606

stored_state)

2557

clients_data, old_client_settings = (pickle.load

2558

(stored_state))

2607

2559

os.remove(stored_state_path)

2608

2560

except IOError as e:

2609

2561

if e.errno == errno.ENOENT:

2610

logger.warning("Could not load persistent state:"

2611

" {}".format(os.strerror(e.errno)))

2562

logger.warning("Could not load persistent state: {0}"

2563

.format(os.strerror(e.errno)))

2612

2564

else:

2613

2565

logger.critical("Could not load persistent state:",

2614

2566

exc_info=e)

2615

2567

raise

2616

2568

except EOFError as e:

2617

2569

logger.warning("Could not load persistent state: "

2618

"EOFError:",

2619

exc_info=e)

2570

"EOFError:", exc_info=e)

2620

2571

2621

2572

with PGPEngine() as pgp:

2622

for client_name, client in clients_data.items():

2573

for client_name, client in clients_data.iteritems():

2623

2574

# Skip removed clients

2624

2575

if client_name not in client_settings:

2625

2576

continue

2634

2585

# For each value in new config, check if it

2635

2586

# differs from the old config value (Except for

2636

2587

# the "secret" attribute)

2637

if (name != "secret"

2638

and (value !=

2639

old_client_settings[client_name][name])):

2588

if (name != "secret" and

2589

value != old_client_settings[client_name]

2590

[name]):

2640

2591

client[name] = value

2641

2592

except KeyError:

2642

2593

pass

2650

2601

if datetime.datetime.utcnow() >= client["expires"]:

2651

2602

if not client["last_checked_ok"]:

2652

2603

logger.warning(

2653

"disabling client {} - Client never "

2654

"performed a successful checker".format(

2655

client_name))

2604

"disabling client {0} - Client never "

2605

"performed a successful checker"

2606

.format(client_name))

2656

2607

client["enabled"] = False

2657

2608

elif client["last_checker_status"] != 0:

2658

2609

logger.warning(

2659

"disabling client {} - Client last"

2660

" checker failed with error code"

2661

" {}".format(

2662

client_name,

2663

client["last_checker_status"]))

2610

"disabling client {0} - Client "

2611

"last checker failed with error code {1}"

2612

.format(client_name,

2613

client["last_checker_status"]))

2664

2614

client["enabled"] = False

2665

2615

else:

2666

client["expires"] = (

2667

datetime.datetime.utcnow()

2668

+ client["timeout"])

2616

client["expires"] = (datetime.datetime

2617

.utcnow()

2618

+ client["timeout"])

2669

2619

logger.debug("Last checker succeeded,"

2670

" keeping {} enabled".format(

2671

client_name))

2620

" keeping {0} enabled"

2621

.format(client_name))

2672

2622

try:

2673

client["secret"] = pgp.decrypt(

2674

client["encrypted_secret"],

2675

client_settings[client_name]["secret"])

2623

client["secret"] = (

2624

pgp.decrypt(client["encrypted_secret"],

2625

client_settings[client_name]

2626

["secret"]))

2676

2627

except PGPError:

2677

2628

# If decryption fails, we use secret from new settings

2678

logger.debug("Failed to decrypt {} old secret".format(

2679

client_name))

2680

client["secret"] = (client_settings[client_name]

2681

["secret"])

2629

logger.debug("Failed to decrypt {0} old secret"

2630

.format(client_name))

2631

client["secret"] = (

2632

client_settings[client_name]["secret"])

2682

2633

2683

2634

# Add/remove clients based on new changes made to config

2684

2635

for client_name in (set(old_client_settings)

2689

2640

clients_data[client_name] = client_settings[client_name]

2690

2641

2691

2642

# Create all client objects

2692

for client_name, client in clients_data.items():

2643

for client_name, client in clients_data.iteritems():

2693

2644

tcp_server.clients[client_name] = client_class(

2694

name = client_name,

2695

settings = client,

2645

name = client_name, settings = client,

2696

2646

server_settings = server_settings)

2697

2647

2698

2648

if not tcp_server.clients:

2703

2653

try:

2704

2654

with pidfile:

2705

2655

pid = os.getpid()

2706

pidfile.write("{}\n".format(pid).encode("utf-8"))

2656

pidfile.write(str(pid) + "\n".encode("utf-8"))

2707

2657

except IOError:

2708

2658

logger.error("Could not write to file %r with PID %d",

2709

2659

pidfilename, pid)

2714

2664

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2715

2665

2716

2666

if use_dbus:

2717

2718

@alternate_dbus_interfaces(

2719

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2667

@alternate_dbus_interfaces({"se.recompile.Mandos":

2668

"se.bsnet.fukt.Mandos"})

2720

2669

class MandosDBusService(DBusObjectWithProperties):

2721

2670

"""A D-Bus proxy object"""

2722

2723

2671

def __init__(self):

2724

2672

dbus.service.Object.__init__(self, bus, "/")

2725

2726

2673

_interface = "se.recompile.Mandos"

2727

2674

2728

2675

@dbus_interface_annotations(_interface)

2729

2676

def _foo(self):

2730

return {

2731

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2732

"false" }

2677

return { "org.freedesktop.DBus.Property"

2678

".EmitsChangedSignal":

2679

"false"}

2733

2680

2734

2681

@dbus.service.signal(_interface, signature="o")

2735

2682

def ClientAdded(self, objpath):

2749

2696

@dbus.service.method(_interface, out_signature="ao")

2750

2697

def GetAllClients(self):

2751

2698

"D-Bus method"

2752

return dbus.Array(c.dbus_object_path for c in

2699

return dbus.Array(c.dbus_object_path

2700

for c in

2753

2701

tcp_server.clients.itervalues())

2754

2702

2755

2703

@dbus.service.method(_interface,

2757

2705

def GetAllClientsWithProperties(self):

2758

2706

"D-Bus method"

2759

2707

return dbus.Dictionary(

2760

{ c.dbus_object_path: c.GetAll("")

2761

for c in tcp_server.clients.itervalues() },

2708

((c.dbus_object_path, c.GetAll(""))

2709

for c in tcp_server.clients.itervalues()),

2762

2710

signature="oa{sv}")

2763

2711

2764

2712

@dbus.service.method(_interface, in_signature="o")

2781

2729

2782

2730

def cleanup():

2783

2731

"Cleanup function; run on exit"

2784

if zeroconf:

2785

service.cleanup()

2732

service.cleanup()

2786

2733

2787

2734

multiprocessing.active_children()

2788

2735

wnull.close()

2802

2749

2803

2750

# A list of attributes that can not be pickled

2804

2751

# + secret.

2805

exclude = { "bus", "changedstate", "secret",

2806

"checker", "server_settings" }

2807

for name, typ in inspect.getmembers(dbus.service

2808

.Object):

2752

exclude = set(("bus", "changedstate", "secret",

2753

"checker", "server_settings"))

2754

for name, typ in (inspect.getmembers

2755

(dbus.service.Object)):

2809

2756

exclude.add(name)

2810

2757

2811

2758

client_dict["encrypted_secret"] = (client

2818

2765

del client_settings[client.name]["secret"]

2819

2766

2820

2767

try:

2821

with tempfile.NamedTemporaryFile(

2822

mode='wb',

2823

suffix=".pickle",

2824

prefix='clients-',

2825

dir=os.path.dirname(stored_state_path),

2826

delete=False) as stored_state:

2768

with (tempfile.NamedTemporaryFile

2769

(mode='wb', suffix=".pickle", prefix='clients-',

2770

dir=os.path.dirname(stored_state_path),

2771

delete=False)) as stored_state:

2827

2772

pickle.dump((clients, client_settings), stored_state)

2828

tempname = stored_state.name

2773

tempname=stored_state.name

2829

2774

os.rename(tempname, stored_state_path)

2830

2775

except (IOError, OSError) as e:

2831

2776

if not debug:

2834

2779

except NameError:

2835

2780

pass

2836

2781

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2837

logger.warning("Could not save persistent state: {}"

2782

logger.warning("Could not save persistent state: {0}"

2838

2783

.format(os.strerror(e.errno)))

2839

2784

else:

2840

2785

logger.warning("Could not save persistent state:",

2841

2786

exc_info=e)

2842

raise

2787

raise e

2843

2788

2844

2789

# Delete all clients, and settings from config

2845

2790

while tcp_server.clients:

2850

2795

client.disable(quiet=True)

2851

2796

if use_dbus:

2852

2797

# Emit D-Bus signal

2853

mandos_dbus_service.ClientRemoved(

2854

client.dbus_object_path, client.name)

2798

mandos_dbus_service.ClientRemoved(client

2799

.dbus_object_path,

2800

client.name)

2855

2801

client_settings.clear()

2856

2802

2857

2803

atexit.register(cleanup)

2868

2814

tcp_server.server_activate()

2869

2815

2870

2816

# Find out what port we got

2871

if zeroconf:

2872

service.port = tcp_server.socket.getsockname()[1]

2817

service.port = tcp_server.socket.getsockname()[1]

2873

2818

if use_ipv6:

2874

2819

logger.info("Now listening on address %r, port %d,"

2875

2820

" flowinfo %d, scope_id %d",

2881

2826

#service.interface = tcp_server.socket.getsockname()[3]

2882

2827

2883

2828

try:

2884

if zeroconf:

2885

# From the Avahi example code

2886

try:

2887

service.activate()

2888

except dbus.exceptions.DBusException as error:

2889

logger.critical("D-Bus Exception", exc_info=error)

2890

cleanup()

2891

sys.exit(1)

2892

# End of Avahi example code

2829

# From the Avahi example code

2830

try:

2831

service.activate()

2832

except dbus.exceptions.DBusException as error:

2833

logger.critical("D-Bus Exception", exc_info=error)

2834

cleanup()

2835

sys.exit(1)

2836

# End of Avahi example code

2893

2837

2894

2838

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2895

2839

lambda *args, **kwargs:

2910

2854

# Must run before the D-Bus bus name gets deregistered

2911

2855

cleanup()

2912

2856

2913

2914

2857

if __name__ == '__main__':

2915

2858

main()