/mandos/release : revision 237.7.174

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

19

# the Free Software Foundation, either version 3 of the License, or

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

25

# GNU General Public License for more details.

26

#

26

#

27

# You should have received a copy of the GNU General Public License

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

30

#

31

# Contact the authors at <mandos@recompile.se>.

32

#

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

37

from future_builtins import *

41

38

42

try:

43

import SocketServer as socketserver

44

except ImportError:

45

import socketserver

39

import SocketServer as socketserver

46

40

import socket

47

41

import argparse

48

42

import datetime

49

43

import errno

50

try:

51

import ConfigParser as configparser

52

except ImportError:

53

import configparser

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

54

51

import sys

55

52

import re

56

53

import os

65

62

import struct

66

63

import fcntl

67

64

import functools

68

try:

69

import cPickle as pickle

70

except ImportError:

71

import pickle

65

import cPickle as pickle

72

66

import multiprocessing

73

67

import types

74

68

import binascii

75

69

import tempfile

76

70

import itertools

77

71

import collections

78

import codecs

79

72

80

73

import dbus

81

74

import dbus.service

82

from gi.repository import GLib

75

import gobject

76

import avahi

83

77

from dbus.mainloop.glib import DBusGMainLoop

84

78

import ctypes

85

79

import ctypes.util

86

80

import xml.dom.minidom

87

81

import inspect

88

82

89

# Try to find the value of SO_BINDTODEVICE:

90

83

try:

91

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

92

# newer, and it is also the most natural place for it:

93

84

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

94

85

except AttributeError:

95

86

try:

96

# This is where SO_BINDTODEVICE was up to and including Python

97

# 2.6, and also 3.2:

98

87

from IN import SO_BINDTODEVICE

99

88

except ImportError:

100

# In Python 2.7 it seems to have been removed entirely.

101

# Try running the C preprocessor:

102

try:

103

cc = subprocess.Popen(["cc", "--language=c", "-E",

104

"/dev/stdin"],

105

stdin=subprocess.PIPE,

106

stdout=subprocess.PIPE)

107

stdout = cc.communicate(

108

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

109

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

110

except (OSError, ValueError, IndexError):

111

# No value found

112

SO_BINDTODEVICE = None

113

114

if sys.version_info.major == 2:

115

str = unicode

116

117

version = "1.7.13"

89

SO_BINDTODEVICE = None

90

91

version = "1.6.1"

118

92

stored_state_file = "clients.pickle"

119

93

120

94

logger = logging.getLogger()

121

syslogger = None

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

122

98

123

99

try:

124

if_nametoindex = ctypes.cdll.LoadLibrary(

125

ctypes.util.find_library("c")).if_nametoindex

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

126

103

except (OSError, AttributeError):

127

128

104

def if_nametoindex(interface):

129

105

"Get an interface index the hard way, i.e. using fcntl()"

130

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

131

107

with contextlib.closing(socket.socket()) as s:

132

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

133

struct.pack(b"16s16x", interface))

134

interface_index = struct.unpack("I", ifreq[16:20])[0]

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

135

113

return interface_index

136

114

137

115

138

def copy_function(func):

139

"""Make a copy of a function"""

140

if sys.version_info.major == 2:

141

return types.FunctionType(func.func_code,

142

func.func_globals,

143

func.func_name,

144

func.func_defaults,

145

func.func_closure)

146

else:

147

return types.FunctionType(func.__code__,

148

func.__globals__,

149

func.__name__,

150

func.__defaults__,

151

func.__closure__)

152

153

154

116

def initlogger(debug, level=logging.WARNING):

155

117

"""init logger and add loglevel"""

156

157

global syslogger

158

syslogger = (logging.handlers.SysLogHandler(

159

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

160

address="/dev/log"))

118

161

119

syslogger.setFormatter(logging.Formatter

162

120

('Mandos [%(process)d]: %(levelname)s:'

163

121

' %(message)s'))

164

122

logger.addHandler(syslogger)

165

123

166

124

if debug:

167

125

console = logging.StreamHandler()

168

126

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

180

138

181

139

class PGPEngine(object):

182

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

183

184

141

def __init__(self):

185

142

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

186

self.gpg = "gpg"

187

try:

188

output = subprocess.check_output(["gpgconf"])

189

for line in output.splitlines():

190

name, text, path = line.split(b":")

191

if name == "gpg":

192

self.gpg = path

193

break

194

except OSError as e:

195

if e.errno != errno.ENOENT:

196

raise

197

143

self.gnupgargs = ['--batch',

198

'--homedir', self.tempdir,

144

'--home', self.tempdir,

199

145

'--force-mdc',

200

'--quiet']

201

# Only GPG version 1 has the --no-use-agent option.

202

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

203

self.gnupgargs.append("--no-use-agent")

204

146

'--quiet',

147

'--no-use-agent']

148

205

149

def __enter__(self):

206

150

return self

207

151

208

152

def __exit__(self, exc_type, exc_value, traceback):

209

153

self._cleanup()

210

154

return False

211

155

212

156

def __del__(self):

213

157

self._cleanup()

214

158

215

159

def _cleanup(self):

216

160

if self.tempdir is not None:

217

161

# Delete contents of tempdir

218

162

for root, dirs, files in os.walk(self.tempdir,

219

topdown=False):

163

topdown = False):

220

164

for filename in files:

221

165

os.remove(os.path.join(root, filename))

222

166

for dirname in dirs:

224

168

# Remove tempdir

225

169

os.rmdir(self.tempdir)

226

170

self.tempdir = None

227

171

228

172

def password_encode(self, password):

229

173

# Passphrase can not be empty and can not contain newlines or

230

174

# NUL bytes. So we prefix it and hex encode it.

231

encoded = b"mandos" + binascii.hexlify(password)

232

if len(encoded) > 2048:

233

# GnuPG can't handle long passwords, so encode differently

234

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

235

.replace(b"\n", b"\\n")

236

.replace(b"\0", b"\\x00"))

237

return encoded

238

175

return b"mandos" + binascii.hexlify(password)

176

239

177

def encrypt(self, data, password):

240

178

passphrase = self.password_encode(password)

241

with tempfile.NamedTemporaryFile(

242

dir=self.tempdir) as passfile:

179

with tempfile.NamedTemporaryFile(dir=self.tempdir

180

) as passfile:

243

181

passfile.write(passphrase)

244

182

passfile.flush()

245

proc = subprocess.Popen([self.gpg, '--symmetric',

183

proc = subprocess.Popen(['gpg', '--symmetric',

246

184

'--passphrase-file',

247

185

passfile.name]

248

186

+ self.gnupgargs,

249

stdin=subprocess.PIPE,

250

stdout=subprocess.PIPE,

251

stderr=subprocess.PIPE)

252

ciphertext, err = proc.communicate(input=data)

187

stdin = subprocess.PIPE,

188

stdout = subprocess.PIPE,

189

stderr = subprocess.PIPE)

190

ciphertext, err = proc.communicate(input = data)

253

191

if proc.returncode != 0:

254

192

raise PGPError(err)

255

193

return ciphertext

256

194

257

195

def decrypt(self, data, password):

258

196

passphrase = self.password_encode(password)

259

with tempfile.NamedTemporaryFile(

260

dir=self.tempdir) as passfile:

197

with tempfile.NamedTemporaryFile(dir = self.tempdir

198

) as passfile:

261

199

passfile.write(passphrase)

262

200

passfile.flush()

263

proc = subprocess.Popen([self.gpg, '--decrypt',

201

proc = subprocess.Popen(['gpg', '--decrypt',

264

202

'--passphrase-file',

265

203

passfile.name]

266

204

+ self.gnupgargs,

267

stdin=subprocess.PIPE,

268

stdout=subprocess.PIPE,

269

stderr=subprocess.PIPE)

270

decrypted_plaintext, err = proc.communicate(input=data)

205

stdin = subprocess.PIPE,

206

stdout = subprocess.PIPE,

207

stderr = subprocess.PIPE)

208

decrypted_plaintext, err = proc.communicate(input

209

= data)

271

210

if proc.returncode != 0:

272

211

raise PGPError(err)

273

212

return decrypted_plaintext

274

213

275

214

276

# Pretend that we have an Avahi module

277

class Avahi(object):

278

"""This isn't so much a class as it is a module-like namespace.

279

It is instantiated once, and simulates having an Avahi module."""

280

IF_UNSPEC = -1 # avahi-common/address.h

281

PROTO_UNSPEC = -1 # avahi-common/address.h

282

PROTO_INET = 0 # avahi-common/address.h

283

PROTO_INET6 = 1 # avahi-common/address.h

284

DBUS_NAME = "org.freedesktop.Avahi"

285

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

286

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

287

DBUS_PATH_SERVER = "/"

288

289

def string_array_to_txt_array(self, t):

290

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

291

for s in t), signature="ay")

292

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

293

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

294

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

295

SERVER_INVALID = 0 # avahi-common/defs.h

296

SERVER_REGISTERING = 1 # avahi-common/defs.h

297

SERVER_RUNNING = 2 # avahi-common/defs.h

298

SERVER_COLLISION = 3 # avahi-common/defs.h

299

SERVER_FAILURE = 4 # avahi-common/defs.h

300

avahi = Avahi()

301

302

303

215

class AvahiError(Exception):

304

216

def __init__(self, value, *args, **kwargs):

305

217

self.value = value

306

return super(AvahiError, self).__init__(value, *args,

307

**kwargs)

308

218

super(AvahiError, self).__init__(value, *args, **kwargs)

219

def __unicode__(self):

220

return unicode(repr(self.value))

309

221

310

222

class AvahiServiceError(AvahiError):

311

223

pass

312

224

313

314

225

class AvahiGroupError(AvahiError):

315

226

pass

316

227

317

228

318

229

class AvahiService(object):

319

230

"""An Avahi (Zeroconf) service.

320

231

321

232

Attributes:

322

233

interface: integer; avahi.IF_UNSPEC or an interface index.

323

234

Used to optionally bind to the specified interface.

335

246

server: D-Bus Server

336

247

bus: dbus.SystemBus()

337

248

"""

338

339

def __init__(self,

340

interface=avahi.IF_UNSPEC,

341

name=None,

342

servicetype=None,

343

port=None,

344

TXT=None,

345

domain="",

346

host="",

347

max_renames=32768,

348

protocol=avahi.PROTO_UNSPEC,

349

bus=None):

249

250

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

251

servicetype = None, port = None, TXT = None,

252

domain = "", host = "", max_renames = 32768,

253

protocol = avahi.PROTO_UNSPEC, bus = None):

350

254

self.interface = interface

351

255

self.name = name

352

256

self.type = servicetype

361

265

self.server = None

362

266

self.bus = bus

363

267

self.entry_group_state_changed_match = None

364

365

def rename(self, remove=True):

268

269

def rename(self):

366

270

"""Derived from the Avahi example code"""

367

271

if self.rename_count >= self.max_renames:

368

272

logger.critical("No suitable Zeroconf service name found"

369

273

" after %i retries, exiting.",

370

274

self.rename_count)

371

275

raise AvahiServiceError("Too many renames")

372

self.name = str(

373

self.server.GetAlternativeServiceName(self.name))

374

self.rename_count += 1

276

self.name = unicode(self.server

277

.GetAlternativeServiceName(self.name))

375

278

logger.info("Changing Zeroconf service name to %r ...",

376

279

self.name)

377

if remove:

378

self.remove()

280

self.remove()

379

281

try:

380

282

self.add()

381

283

except dbus.exceptions.DBusException as error:

382

if (error.get_dbus_name()

383

== "org.freedesktop.Avahi.CollisionError"):

384

logger.info("Local Zeroconf service name collision.")

385

return self.rename(remove=False)

386

else:

387

logger.critical("D-Bus Exception", exc_info=error)

388

self.cleanup()

389

os._exit(1)

390

284

logger.critical("D-Bus Exception", exc_info=error)

285

self.cleanup()

286

os._exit(1)

287

self.rename_count += 1

288

391

289

def remove(self):

392

290

"""Derived from the Avahi example code"""

393

291

if self.entry_group_state_changed_match is not None:

395

293

self.entry_group_state_changed_match = None

396

294

if self.group is not None:

397

295

self.group.Reset()

398

296

399

297

def add(self):

400

298

"""Derived from the Avahi example code"""

401

299

self.remove()

418

316

dbus.UInt16(self.port),

419

317

avahi.string_array_to_txt_array(self.TXT))

420

318

self.group.Commit()

421

319

422

320

def entry_group_state_changed(self, state, error):

423

321

"""Derived from the Avahi example code"""

424

322

logger.debug("Avahi entry group state change: %i", state)

425

323

426

324

if state == avahi.ENTRY_GROUP_ESTABLISHED:

427

325

logger.debug("Zeroconf service established.")

428

326

elif state == avahi.ENTRY_GROUP_COLLISION:

430

328

self.rename()

431

329

elif state == avahi.ENTRY_GROUP_FAILURE:

432

330

logger.critical("Avahi: Error in group state changed %s",

433

str(error))

434

raise AvahiGroupError("State changed: {!s}".format(error))

435

331

unicode(error))

332

raise AvahiGroupError("State changed: {0!s}"

333

.format(error))

334

436

335

def cleanup(self):

437

336

"""Derived from the Avahi example code"""

438

337

if self.group is not None:

443

342

pass

444

343

self.group = None

445

344

self.remove()

446

345

447

346

def server_state_changed(self, state, error=None):

448

347

"""Derived from the Avahi example code"""

449

348

logger.debug("Avahi server state change: %i", state)

450

bad_states = {

451

avahi.SERVER_INVALID: "Zeroconf server invalid",

452

avahi.SERVER_REGISTERING: None,

453

avahi.SERVER_COLLISION: "Zeroconf server name collision",

454

avahi.SERVER_FAILURE: "Zeroconf server failure",

455

}

349

bad_states = { avahi.SERVER_INVALID:

350

"Zeroconf server invalid",

351

avahi.SERVER_REGISTERING: None,

352

avahi.SERVER_COLLISION:

353

"Zeroconf server name collision",

354

avahi.SERVER_FAILURE:

355

"Zeroconf server failure" }

456

356

if state in bad_states:

457

357

if bad_states[state] is not None:

458

358

if error is None:

461

361

logger.error(bad_states[state] + ": %r", error)

462

362

self.cleanup()

463

363

elif state == avahi.SERVER_RUNNING:

464

try:

465

self.add()

466

except dbus.exceptions.DBusException as error:

467

if (error.get_dbus_name()

468

== "org.freedesktop.Avahi.CollisionError"):

469

logger.info("Local Zeroconf service name"

470

" collision.")

471

return self.rename(remove=False)

472

else:

473

logger.critical("D-Bus Exception", exc_info=error)

474

self.cleanup()

475

os._exit(1)

364

self.add()

476

365

else:

477

366

if error is None:

478

367

logger.debug("Unknown state: %r", state)

479

368

else:

480

369

logger.debug("Unknown state: %r: %r", state, error)

481

370

482

371

def activate(self):

483

372

"""Derived from the Avahi example code"""

484

373

if self.server is None:

488

377

follow_name_owner_changes=True),

489

378

avahi.DBUS_INTERFACE_SERVER)

490

379

self.server.connect_to_signal("StateChanged",

491

self.server_state_changed)

380

self.server_state_changed)

492

381

self.server_state_changed(self.server.GetState())

493

382

494

383

495

384

class AvahiServiceToSyslog(AvahiService):

496

def rename(self, *args, **kwargs):

385

def rename(self):

497

386

"""Add the new name to the syslog messages"""

498

ret = AvahiService.rename(self, *args, **kwargs)

499

syslogger.setFormatter(logging.Formatter(

500

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

501

.format(self.name)))

387

ret = AvahiService.rename(self)

388

syslogger.setFormatter(logging.Formatter

389

('Mandos ({0}) [%(process)d]:'

390

' %(levelname)s: %(message)s'

391

.format(self.name)))

502

392

return ret

503

393

504

394

505

# Pretend that we have a GnuTLS module

506

class GnuTLS(object):

507

"""This isn't so much a class as it is a module-like namespace.

508

It is instantiated once, and simulates having a GnuTLS module."""

509

510

library = ctypes.util.find_library("gnutls")

511

if library is None:

512

library = ctypes.util.find_library("gnutls-deb0")

513

_library = ctypes.cdll.LoadLibrary(library)

514

del library

515

_need_version = b"3.3.0"

516

517

def __init__(self):

518

# Need to use class name "GnuTLS" here, since this method is

519

# called before the assignment to the "gnutls" global variable

520

# happens.

521

if GnuTLS.check_version(self._need_version) is None:

522

raise GnuTLS.Error("Needs GnuTLS {} or later"

523

.format(self._need_version))

524

525

# Unless otherwise indicated, the constants and types below are

526

# all from the gnutls/gnutls.h C header file.

527

528

# Constants

529

E_SUCCESS = 0

530

E_INTERRUPTED = -52

531

E_AGAIN = -28

532

CRT_OPENPGP = 2

533

CLIENT = 2

534

SHUT_RDWR = 0

535

CRD_CERTIFICATE = 1

536

E_NO_CERTIFICATE_FOUND = -49

537

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

538

539

# Types

540

class session_int(ctypes.Structure):

541

_fields_ = []

542

session_t = ctypes.POINTER(session_int)

543

544

class certificate_credentials_st(ctypes.Structure):

545

_fields_ = []

546

certificate_credentials_t = ctypes.POINTER(

547

certificate_credentials_st)

548

certificate_type_t = ctypes.c_int

549

550

class datum_t(ctypes.Structure):

551

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

552

('size', ctypes.c_uint)]

553

554

class openpgp_crt_int(ctypes.Structure):

555

_fields_ = []

556

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

557

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

558

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

559

credentials_type_t = ctypes.c_int

560

transport_ptr_t = ctypes.c_void_p

561

close_request_t = ctypes.c_int

562

563

# Exceptions

564

class Error(Exception):

565

# We need to use the class name "GnuTLS" here, since this

566

# exception might be raised from within GnuTLS.__init__,

567

# which is called before the assignment to the "gnutls"

568

# global variable has happened.

569

def __init__(self, message=None, code=None, args=()):

570

# Default usage is by a message string, but if a return

571

# code is passed, convert it to a string with

572

# gnutls.strerror()

573

self.code = code

574

if message is None and code is not None:

575

message = GnuTLS.strerror(code)

576

return super(GnuTLS.Error, self).__init__(

577

message, *args)

578

579

class CertificateSecurityError(Error):

580

pass

581

582

# Classes

583

class Credentials(object):

584

def __init__(self):

585

self._c_object = gnutls.certificate_credentials_t()

586

gnutls.certificate_allocate_credentials(

587

ctypes.byref(self._c_object))

588

self.type = gnutls.CRD_CERTIFICATE

589

590

def __del__(self):

591

gnutls.certificate_free_credentials(self._c_object)

592

593

class ClientSession(object):

594

def __init__(self, socket, credentials=None):

595

self._c_object = gnutls.session_t()

596

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

597

gnutls.set_default_priority(self._c_object)

598

gnutls.transport_set_ptr(self._c_object, socket.fileno())

599

gnutls.handshake_set_private_extensions(self._c_object,

600

True)

601

self.socket = socket

602

if credentials is None:

603

credentials = gnutls.Credentials()

604

gnutls.credentials_set(self._c_object, credentials.type,

605

ctypes.cast(credentials._c_object,

606

ctypes.c_void_p))

607

self.credentials = credentials

608

609

def __del__(self):

610

gnutls.deinit(self._c_object)

611

612

def handshake(self):

613

return gnutls.handshake(self._c_object)

614

615

def send(self, data):

616

data = bytes(data)

617

data_len = len(data)

618

while data_len > 0:

619

data_len -= gnutls.record_send(self._c_object,

620

data[-data_len:],

621

data_len)

622

623

def bye(self):

624

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

625

626

# Error handling functions

627

def _error_code(result):

628

"""A function to raise exceptions on errors, suitable

629

for the 'restype' attribute on ctypes functions"""

630

if result >= 0:

631

return result

632

if result == gnutls.E_NO_CERTIFICATE_FOUND:

633

raise gnutls.CertificateSecurityError(code=result)

634

raise gnutls.Error(code=result)

635

636

def _retry_on_error(result, func, arguments):

637

"""A function to retry on some errors, suitable

638

for the 'errcheck' attribute on ctypes functions"""

639

while result < 0:

640

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

641

return _error_code(result)

642

result = func(*arguments)

643

return result

644

645

# Unless otherwise indicated, the function declarations below are

646

# all from the gnutls/gnutls.h C header file.

647

648

# Functions

649

priority_set_direct = _library.gnutls_priority_set_direct

650

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

651

ctypes.POINTER(ctypes.c_char_p)]

652

priority_set_direct.restype = _error_code

653

654

init = _library.gnutls_init

655

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

656

init.restype = _error_code

657

658

set_default_priority = _library.gnutls_set_default_priority

659

set_default_priority.argtypes = [session_t]

660

set_default_priority.restype = _error_code

661

662

record_send = _library.gnutls_record_send

663

record_send.argtypes = [session_t, ctypes.c_void_p,

664

ctypes.c_size_t]

665

record_send.restype = ctypes.c_ssize_t

666

record_send.errcheck = _retry_on_error

667

668

certificate_allocate_credentials = (

669

_library.gnutls_certificate_allocate_credentials)

670

certificate_allocate_credentials.argtypes = [

671

ctypes.POINTER(certificate_credentials_t)]

672

certificate_allocate_credentials.restype = _error_code

673

674

certificate_free_credentials = (

675

_library.gnutls_certificate_free_credentials)

676

certificate_free_credentials.argtypes = [

677

certificate_credentials_t]

678

certificate_free_credentials.restype = None

679

680

handshake_set_private_extensions = (

681

_library.gnutls_handshake_set_private_extensions)

682

handshake_set_private_extensions.argtypes = [session_t,

683

ctypes.c_int]

684

handshake_set_private_extensions.restype = None

685

686

credentials_set = _library.gnutls_credentials_set

687

credentials_set.argtypes = [session_t, credentials_type_t,

688

ctypes.c_void_p]

689

credentials_set.restype = _error_code

690

691

strerror = _library.gnutls_strerror

692

strerror.argtypes = [ctypes.c_int]

693

strerror.restype = ctypes.c_char_p

694

695

certificate_type_get = _library.gnutls_certificate_type_get

696

certificate_type_get.argtypes = [session_t]

697

certificate_type_get.restype = _error_code

698

699

certificate_get_peers = _library.gnutls_certificate_get_peers

700

certificate_get_peers.argtypes = [session_t,

701

ctypes.POINTER(ctypes.c_uint)]

702

certificate_get_peers.restype = ctypes.POINTER(datum_t)

703

704

global_set_log_level = _library.gnutls_global_set_log_level

705

global_set_log_level.argtypes = [ctypes.c_int]

706

global_set_log_level.restype = None

707

708

global_set_log_function = _library.gnutls_global_set_log_function

709

global_set_log_function.argtypes = [log_func]

710

global_set_log_function.restype = None

711

712

deinit = _library.gnutls_deinit

713

deinit.argtypes = [session_t]

714

deinit.restype = None

715

716

handshake = _library.gnutls_handshake

717

handshake.argtypes = [session_t]

718

handshake.restype = _error_code

719

handshake.errcheck = _retry_on_error

720

721

transport_set_ptr = _library.gnutls_transport_set_ptr

722

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

723

transport_set_ptr.restype = None

724

725

bye = _library.gnutls_bye

726

bye.argtypes = [session_t, close_request_t]

727

bye.restype = _error_code

728

bye.errcheck = _retry_on_error

729

730

check_version = _library.gnutls_check_version

731

check_version.argtypes = [ctypes.c_char_p]

732

check_version.restype = ctypes.c_char_p

733

734

# All the function declarations below are from gnutls/openpgp.h

735

736

openpgp_crt_init = _library.gnutls_openpgp_crt_init

737

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

738

openpgp_crt_init.restype = _error_code

739

740

openpgp_crt_import = _library.gnutls_openpgp_crt_import

741

openpgp_crt_import.argtypes = [openpgp_crt_t,

742

ctypes.POINTER(datum_t),

743

openpgp_crt_fmt_t]

744

openpgp_crt_import.restype = _error_code

745

746

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

747

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

748

ctypes.POINTER(ctypes.c_uint)]

749

openpgp_crt_verify_self.restype = _error_code

750

751

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

752

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

753

openpgp_crt_deinit.restype = None

754

755

openpgp_crt_get_fingerprint = (

756

_library.gnutls_openpgp_crt_get_fingerprint)

757

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

758

ctypes.c_void_p,

759

ctypes.POINTER(

760

ctypes.c_size_t)]

761

openpgp_crt_get_fingerprint.restype = _error_code

762

763

# Remove non-public functions

764

del _error_code, _retry_on_error

765

# Create the global "gnutls" object, simulating a module

766

gnutls = GnuTLS()

767

768

769

def call_pipe(connection, # : multiprocessing.Connection

770

func, *args, **kwargs):

771

"""This function is meant to be called by multiprocessing.Process

772

773

This function runs func(*args, **kwargs), and writes the resulting

774

return value on the provided multiprocessing.Connection.

775

"""

776

connection.send(func(*args, **kwargs))

777

connection.close()

395

def timedelta_to_milliseconds(td):

396

"Convert a datetime.timedelta() to milliseconds"

397

return ((td.days * 24 * 60 * 60 * 1000)

398

+ (td.seconds * 1000)

399

+ (td.microseconds // 1000))

778

400

779

401

780

402

class Client(object):

781

403

"""A representation of a client host served by this server.

782

404

783

405

Attributes:

784

406

approved: bool(); 'None' if not yet approved/disapproved

785

407

approval_delay: datetime.timedelta(); Time to wait for approval

787

409

checker: subprocess.Popen(); a running checker process used

788

410

to see if the client lives.

789

411

'None' if no process is running.

790

checker_callback_tag: a GLib event source tag, or None

412

checker_callback_tag: a gobject event source tag, or None

791

413

checker_command: string; External command which is run to check

792

414

if client lives. %() expansions are done at

793

415

runtime with vars(self) as dict, so that for

794

416

instance %(name)s can be used in the command.

795

checker_initiator_tag: a GLib event source tag, or None

417

checker_initiator_tag: a gobject event source tag, or None

796

418

created: datetime.datetime(); (UTC) object creation

797

419

client_structure: Object describing what attributes a client has

798

420

and is used for storing the client at exit

799

421

current_checker_command: string; current running checker_command

800

disable_initiator_tag: a GLib event source tag, or None

422

disable_initiator_tag: a gobject event source tag, or None

801

423

enabled: bool()

802

424

fingerprint: string (40 or 32 hexadecimal digits); used to

803

425

uniquely identify the client

808

430

last_checker_status: integer between 0 and 255 reflecting exit

809

431

status of last checker. -1 reflects crashed

810

432

checker, -2 means no checker completed yet.

811

last_checker_signal: The signal which killed the last checker, if

812

last_checker_status is -1

813

433

last_enabled: datetime.datetime(); (UTC) or None

814

434

name: string; from the config file, used in log messages and

815

435

D-Bus identifiers

822

442

disabled, or None

823

443

server_settings: The server_settings dict from main()

824

444

"""

825

445

826

446

runtime_expansions = ("approval_delay", "approval_duration",

827

447

"created", "enabled", "expires",

828

448

"fingerprint", "host", "interval",

829

449

"last_approval_request", "last_checked_ok",

830

450

"last_enabled", "name", "timeout")

831

client_defaults = {

832

"timeout": "PT5M",

833

"extended_timeout": "PT15M",

834

"interval": "PT2M",

835

"checker": "fping -q -- %%(host)s",

836

"host": "",

837

"approval_delay": "PT0S",

838

"approval_duration": "PT1S",

839

"approved_by_default": "True",

840

"enabled": "True",

841

}

842

451

client_defaults = { "timeout": "PT5M",

452

"extended_timeout": "PT15M",

453

"interval": "PT2M",

454

"checker": "fping -q -- %%(host)s",

455

"host": "",

456

"approval_delay": "PT0S",

457

"approval_duration": "PT1S",

458

"approved_by_default": "True",

459

"enabled": "True",

460

}

461

462

def timeout_milliseconds(self):

463

"Return the 'timeout' attribute in milliseconds"

464

return timedelta_to_milliseconds(self.timeout)

465

466

def extended_timeout_milliseconds(self):

467

"Return the 'extended_timeout' attribute in milliseconds"

468

return timedelta_to_milliseconds(self.extended_timeout)

469

470

def interval_milliseconds(self):

471

"Return the 'interval' attribute in milliseconds"

472

return timedelta_to_milliseconds(self.interval)

473

474

def approval_delay_milliseconds(self):

475

return timedelta_to_milliseconds(self.approval_delay)

476

843

477

@staticmethod

844

478

def config_parser(config):

845

479

"""Construct a new dict of client settings of this form:

852

486

for client_name in config.sections():

853

487

section = dict(config.items(client_name))

854

488

client = settings[client_name] = {}

855

489

856

490

client["host"] = section["host"]

857

491

# Reformat values from string types to Python types

858

492

client["approved_by_default"] = config.getboolean(

859

493

client_name, "approved_by_default")

860

494

client["enabled"] = config.getboolean(client_name,

861

495

"enabled")

862

863

# Uppercase and remove spaces from fingerprint for later

864

# comparison purposes with return value from the

865

# fingerprint() function

496

866

497

client["fingerprint"] = (section["fingerprint"].upper()

867

498

.replace(" ", ""))

868

499

if "secret" in section:

869

client["secret"] = codecs.decode(section["secret"]

870

.encode("utf-8"),

871

"base64")

500

client["secret"] = section["secret"].decode("base64")

872

501

elif "secfile" in section:

873

502

with open(os.path.expanduser(os.path.expandvars

874

503

(section["secfile"])),

875

504

"rb") as secfile:

876

505

client["secret"] = secfile.read()

877

506

else:

878

raise TypeError("No secret or secfile for section {}"

507

raise TypeError("No secret or secfile for section {0}"

879

508

.format(section))

880

509

client["timeout"] = string_to_delta(section["timeout"])

881

510

client["extended_timeout"] = string_to_delta(

889

518

client["last_approval_request"] = None

890

519

client["last_checked_ok"] = None

891

520

client["last_checker_status"] = -2

892

521

893

522

return settings

894

895

def __init__(self, settings, name=None, server_settings=None):

523

524

def __init__(self, settings, name = None, server_settings=None):

896

525

self.name = name

897

526

if server_settings is None:

898

527

server_settings = {}

899

528

self.server_settings = server_settings

900

529

# adding all client settings

901

for setting, value in settings.items():

530

for setting, value in settings.iteritems():

902

531

setattr(self, setting, value)

903

532

904

533

if self.enabled:

905

534

if not hasattr(self, "last_enabled"):

906

535

self.last_enabled = datetime.datetime.utcnow()

910

539

else:

911

540

self.last_enabled = None

912

541

self.expires = None

913

542

914

543

logger.debug("Creating client %r", self.name)

544

# Uppercase and remove spaces from fingerprint for later

545

# comparison purposes with return value from the fingerprint()

546

# function

915

547

logger.debug(" Fingerprint: %s", self.fingerprint)

916

548

self.created = settings.get("created",

917

549

datetime.datetime.utcnow())

918

550

919

551

# attributes specific for this server instance

920

552

self.checker = None

921

553

self.checker_initiator_tag = None

924

556

self.current_checker_command = None

925

557

self.approved = None

926

558

self.approvals_pending = 0

927

self.changedstate = multiprocessing_manager.Condition(

928

multiprocessing_manager.Lock())

929

self.client_structure = [attr

930

for attr in self.__dict__.keys()

559

self.changedstate = (multiprocessing_manager

560

.Condition(multiprocessing_manager

561

.Lock()))

562

self.client_structure = [attr for attr in

563

self.__dict__.iterkeys()

931

564

if not attr.startswith("_")]

932

565

self.client_structure.append("client_structure")

933

934

for name, t in inspect.getmembers(

935

type(self), lambda obj: isinstance(obj, property)):

566

567

for name, t in inspect.getmembers(type(self),

568

lambda obj:

569

isinstance(obj,

570

property)):

936

571

if not name.startswith("_"):

937

572

self.client_structure.append(name)

938

573

939

574

# Send notice to process children that client state has changed

940

575

def send_changedstate(self):

941

576

with self.changedstate:

942

577

self.changedstate.notify_all()

943

578

944

579

def enable(self):

945

580

"""Start this client's checker and timeout hooks"""

946

581

if getattr(self, "enabled", False):

951

586

self.last_enabled = datetime.datetime.utcnow()

952

587

self.init_checker()

953

588

self.send_changedstate()

954

589

955

590

def disable(self, quiet=True):

956

591

"""Disable this client."""

957

592

if not getattr(self, "enabled", False):

959

594

if not quiet:

960

595

logger.info("Disabling client %s", self.name)

961

596

if getattr(self, "disable_initiator_tag", None) is not None:

962

GLib.source_remove(self.disable_initiator_tag)

597

gobject.source_remove(self.disable_initiator_tag)

963

598

self.disable_initiator_tag = None

964

599

self.expires = None

965

600

if getattr(self, "checker_initiator_tag", None) is not None:

966

GLib.source_remove(self.checker_initiator_tag)

601

gobject.source_remove(self.checker_initiator_tag)

967

602

self.checker_initiator_tag = None

968

603

self.stop_checker()

969

604

self.enabled = False

970

605

if not quiet:

971

606

self.send_changedstate()

972

# Do not run this again if called by a GLib.timeout_add

607

# Do not run this again if called by a gobject.timeout_add

973

608

return False

974

609

975

610

def __del__(self):

976

611

self.disable()

977

612

978

613

def init_checker(self):

979

614

# Schedule a new checker to be started an 'interval' from now,

980

615

# and every interval from then on.

981

616

if self.checker_initiator_tag is not None:

982

GLib.source_remove(self.checker_initiator_tag)

983

self.checker_initiator_tag = GLib.timeout_add(

984

int(self.interval.total_seconds() * 1000),

985

self.start_checker)

617

gobject.source_remove(self.checker_initiator_tag)

618

self.checker_initiator_tag = (gobject.timeout_add

619

(self.interval_milliseconds(),

620

self.start_checker))

986

621

# Schedule a disable() when 'timeout' has passed

987

622

if self.disable_initiator_tag is not None:

988

GLib.source_remove(self.disable_initiator_tag)

989

self.disable_initiator_tag = GLib.timeout_add(

990

int(self.timeout.total_seconds() * 1000), self.disable)

623

gobject.source_remove(self.disable_initiator_tag)

624

self.disable_initiator_tag = (gobject.timeout_add

625

(self.timeout_milliseconds(),

626

self.disable))

991

627

# Also start a new checker *right now*.

992

628

self.start_checker()

993

994

def checker_callback(self, source, condition, connection,

995

command):

629

630

def checker_callback(self, pid, condition, command):

996

631

"""The checker has completed, so take appropriate actions."""

997

632

self.checker_callback_tag = None

998

633

self.checker = None

999

# Read return code from connection (see call_pipe)

1000

returncode = connection.recv()

1001

connection.close()

1002

1003

if returncode >= 0:

1004

self.last_checker_status = returncode

1005

self.last_checker_signal = None

634

if os.WIFEXITED(condition):

635

self.last_checker_status = os.WEXITSTATUS(condition)

1006

636

if self.last_checker_status == 0:

1007

637

logger.info("Checker for %(name)s succeeded",

1008

638

vars(self))

1009

639

self.checked_ok()

1010

640

else:

1011

logger.info("Checker for %(name)s failed", vars(self))

641

logger.info("Checker for %(name)s failed",

642

vars(self))

1012

643

else:

1013

644

self.last_checker_status = -1

1014

self.last_checker_signal = -returncode

1015

645

logger.warning("Checker for %(name)s crashed?",

1016

646

vars(self))

1017

return False

1018

647

1019

648

def checked_ok(self):

1020

649

"""Assert that the client has been seen, alive and well."""

1021

650

self.last_checked_ok = datetime.datetime.utcnow()

1022

651

self.last_checker_status = 0

1023

self.last_checker_signal = None

1024

652

self.bump_timeout()

1025

653

1026

654

def bump_timeout(self, timeout=None):

1027

655

"""Bump up the timeout for this client."""

1028

656

if timeout is None:

1029

657

timeout = self.timeout

1030

658

if self.disable_initiator_tag is not None:

1031

GLib.source_remove(self.disable_initiator_tag)

659

gobject.source_remove(self.disable_initiator_tag)

1032

660

self.disable_initiator_tag = None

1033

661

if getattr(self, "enabled", False):

1034

self.disable_initiator_tag = GLib.timeout_add(

1035

int(timeout.total_seconds() * 1000), self.disable)

662

self.disable_initiator_tag = (gobject.timeout_add

663

(timedelta_to_milliseconds

664

(timeout), self.disable))

1036

665

self.expires = datetime.datetime.utcnow() + timeout

1037

666

1038

667

def need_approval(self):

1039

668

self.last_approval_request = datetime.datetime.utcnow()

1040

669

1041

670

def start_checker(self):

1042

671

"""Start a new checker subprocess if one is not running.

1043

672

1044

673

If a checker already exists, leave it running and do

1045

674

nothing."""

1046

675

# The reason for not killing a running checker is that if we

1051

680

# checkers alone, the checker would have to take more time

1052

681

# than 'timeout' for the client to be disabled, which is as it

1053

682

# should be.

1054

1055

if self.checker is not None and not self.checker.is_alive():

1056

logger.warning("Checker was not alive; joining")

1057

self.checker.join()

1058

self.checker = None

683

684

# If a checker exists, make sure it is not a zombie

685

try:

686

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

687

except (AttributeError, OSError) as error:

688

if (isinstance(error, OSError)

689

and error.errno != errno.ECHILD):

690

raise error

691

else:

692

if pid:

693

logger.warning("Checker was a zombie")

694

gobject.source_remove(self.checker_callback_tag)

695

self.checker_callback(pid, status,

696

self.current_checker_command)

1059

697

# Start a new checker if needed

1060

698

if self.checker is None:

1061

699

# Escape attributes for the shell

1062

escaped_attrs = {

1063

attr: re.escape(str(getattr(self, attr)))

1064

for attr in self.runtime_expansions}

700

escaped_attrs = dict(

701

(attr, re.escape(unicode(getattr(self, attr))))

702

for attr in

703

self.runtime_expansions)

1065

704

try:

1066

705

command = self.checker_command % escaped_attrs

1067

706

except TypeError as error:

1068

707

logger.error('Could not format string "%s"',

1069

self.checker_command,

708

self.checker_command, exc_info=error)

709

return True # Try again later

710

self.current_checker_command = command

711

try:

712

logger.info("Starting checker %r for %s",

713

command, self.name)

714

# We don't need to redirect stdout and stderr, since

715

# in normal mode, that is already done by daemon(),

716

# and in debug mode we don't want to. (Stdin is

717

# always replaced by /dev/null.)

718

# The exception is when not debugging but nevertheless

719

# running in the foreground; use the previously

720

# created wnull.

721

popen_args = {}

722

if (not self.server_settings["debug"]

723

and self.server_settings["foreground"]):

724

popen_args.update({"stdout": wnull,

725

"stderr": wnull })

726

self.checker = subprocess.Popen(command,

727

close_fds=True,

728

shell=True, cwd="/",

729

**popen_args)

730

except OSError as error:

731

logger.error("Failed to start subprocess",

1070

732

exc_info=error)

1071

return True # Try again later

1072

self.current_checker_command = command

1073

logger.info("Starting checker %r for %s", command,

1074

self.name)

1075

# We don't need to redirect stdout and stderr, since

1076

# in normal mode, that is already done by daemon(),

1077

# and in debug mode we don't want to. (Stdin is

1078

# always replaced by /dev/null.)

1079

# The exception is when not debugging but nevertheless

1080

# running in the foreground; use the previously

1081

# created wnull.

1082

popen_args = {"close_fds": True,

1083

"shell": True,

1084

"cwd": "/"}

1085

if (not self.server_settings["debug"]

1086

and self.server_settings["foreground"]):

1087

popen_args.update({"stdout": wnull,

1088

"stderr": wnull})

1089

pipe = multiprocessing.Pipe(duplex=False)

1090

self.checker = multiprocessing.Process(

1091

target=call_pipe,

1092

args=(pipe[1], subprocess.call, command),

1093

kwargs=popen_args)

1094

self.checker.start()

1095

self.checker_callback_tag = GLib.io_add_watch(

1096

pipe[0].fileno(), GLib.IO_IN,

1097

self.checker_callback, pipe[0], command)

1098

# Re-run this periodically if run by GLib.timeout_add

733

return True

734

self.checker_callback_tag = (gobject.child_watch_add

735

(self.checker.pid,

736

self.checker_callback,

737

data=command))

738

# The checker may have completed before the gobject

739

# watch was added. Check for this.

740

try:

741

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

742

except OSError as error:

743

if error.errno == errno.ECHILD:

744

# This should never happen

745

logger.error("Child process vanished",

746

exc_info=error)

747

return True

748

raise

749

if pid:

750

gobject.source_remove(self.checker_callback_tag)

751

self.checker_callback(pid, status, command)

752

# Re-run this periodically if run by gobject.timeout_add

1099

753

return True

1100

754

1101

755

def stop_checker(self):

1102

756

"""Force the checker process, if any, to stop."""

1103

757

if self.checker_callback_tag:

1104

GLib.source_remove(self.checker_callback_tag)

758

gobject.source_remove(self.checker_callback_tag)

1105

759

self.checker_callback_tag = None

1106

760

if getattr(self, "checker", None) is None:

1107

761

return

1108

762

logger.debug("Stopping checker for %(name)s", vars(self))

1109

self.checker.terminate()

763

try:

764

self.checker.terminate()

765

#time.sleep(0.5)

766

#if self.checker.poll() is None:

767

# self.checker.kill()

768

except OSError as error:

769

if error.errno != errno.ESRCH: # No such process

770

raise

1110

771

self.checker = None

1111

772

1112

773

1113

def dbus_service_property(dbus_interface,

1114

signature="v",

1115

access="readwrite",

1116

byte_arrays=False):

774

def dbus_service_property(dbus_interface, signature="v",

775

access="readwrite", byte_arrays=False):

1117

776

"""Decorators for marking methods of a DBusObjectWithProperties to

1118

777

become properties on the D-Bus.

1119

778

1120

779

The decorated method will be called with no arguments by "Get"

1121

780

and with one argument by "Set".

1122

781

1123

782

The parameters, where they are supported, are the same as

1124

783

dbus.service.method, except there is only "signature", since the

1125

784

type from Get() and the type sent to Set() is the same.

1128

787

# "Set" method, so we fail early here:

1129

788

if byte_arrays and signature != "ay":

1130

789

raise ValueError("Byte arrays not supported for non-'ay'"

1131

" signature {!r}".format(signature))

1132

790

" signature {0!r}".format(signature))

1133

791

def decorator(func):

1134

792

func._dbus_is_property = True

1135

793

func._dbus_interface = dbus_interface

1138

796

func._dbus_name = func.__name__

1139

797

if func._dbus_name.endswith("_dbus_property"):

1140

798

func._dbus_name = func._dbus_name[:-14]

1141

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

799

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1142

800

return func

1143

1144

801

return decorator

1145

802

1146

803

1147

804

def dbus_interface_annotations(dbus_interface):

1148

805

"""Decorator for marking functions returning interface annotations

1149

806

1150

807

Usage:

1151

808

1152

809

@dbus_interface_annotations("org.example.Interface")

1153

810

def _foo(self): # Function name does not matter

1154

811

return {"org.freedesktop.DBus.Deprecated": "true",

1155

812

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1156

813

"false"}

1157

814

"""

1158

1159

815

def decorator(func):

1160

816

func._dbus_is_interface = True

1161

817

func._dbus_interface = dbus_interface

1162

818

func._dbus_name = dbus_interface

1163

819

return func

1164

1165

820

return decorator

1166

821

1167

822

1168

823

def dbus_annotations(annotations):

1169

824

"""Decorator to annotate D-Bus methods, signals or properties

1170

825

Usage:

1171

1172

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1173

"org.freedesktop.DBus.Property."

1174

"EmitsChangedSignal": "false"})

826

1175

827

@dbus_service_property("org.example.Interface", signature="b",

1176

828

access="r")

829

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

830

"org.freedesktop.DBus.Property."

831

"EmitsChangedSignal": "false"})

1177

832

def Property_dbus_property(self):

1178

833

return dbus.Boolean(False)

1179

1180

See also the DBusObjectWithAnnotations class.

1181

834

"""

1182

1183

835

def decorator(func):

1184

836

func._dbus_annotations = annotations

1185

837

return func

1186

1187

838

return decorator

1188

839

1189

840

1190

841

class DBusPropertyException(dbus.exceptions.DBusException):

1191

842

"""A base class for D-Bus property-related exceptions

1192

843

"""

1193

pass

844

def __unicode__(self):

845

return unicode(str(self))

1194

846

1195

847

1196

848

class DBusPropertyAccessException(DBusPropertyException):

1205

857

pass

1206

858

1207

859

1208

class DBusObjectWithAnnotations(dbus.service.Object):

1209

"""A D-Bus object with annotations.

1210

1211

Classes inheriting from this can use the dbus_annotations

1212

decorator to add annotations to methods or signals.

860

class DBusObjectWithProperties(dbus.service.Object):

861

"""A D-Bus object with properties.

862

863

Classes inheriting from this can use the dbus_service_property

864

decorator to expose methods as D-Bus properties. It exposes the

865

standard Get(), Set(), and GetAll() methods on the D-Bus.

1213

866

"""

1214

867

1215

868

@staticmethod

1216

869

def _is_dbus_thing(thing):

1217

870

"""Returns a function testing if an attribute is a D-Bus thing

1218

871

1219

872

If called like _is_dbus_thing("method") it returns a function

1220

873

suitable for use as predicate to inspect.getmembers().

1221

874

"""

1222

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

875

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1223

876

False)

1224

877

1225

878

def _get_all_dbus_things(self, thing):

1226

879

"""Returns a generator of (name, attribute) pairs

1227

880

"""

1228

return ((getattr(athing.__get__(self), "_dbus_name", name),

881

return ((getattr(athing.__get__(self), "_dbus_name",

882

name),

1229

883

athing.__get__(self))

1230

884

for cls in self.__class__.__mro__

1231

885

for name, athing in

1232

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1233

1234

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1235

out_signature="s",

1236

path_keyword='object_path',

1237

connection_keyword='connection')

1238

def Introspect(self, object_path, connection):

1239

"""Overloading of standard D-Bus method.

1240

1241

Inserts annotation tags on methods and signals.

1242

"""

1243

xmlstring = dbus.service.Object.Introspect(self, object_path,

1244

connection)

1245

try:

1246

document = xml.dom.minidom.parseString(xmlstring)

1247

1248

for if_tag in document.getElementsByTagName("interface"):

1249

# Add annotation tags

1250

for typ in ("method", "signal"):

1251

for tag in if_tag.getElementsByTagName(typ):

1252

annots = dict()

1253

for name, prop in (self.

1254

_get_all_dbus_things(typ)):

1255

if (name == tag.getAttribute("name")

1256

and prop._dbus_interface

1257

== if_tag.getAttribute("name")):

1258

annots.update(getattr(

1259

prop, "_dbus_annotations", {}))

1260

for name, value in annots.items():

1261

ann_tag = document.createElement(

1262

"annotation")

1263

ann_tag.setAttribute("name", name)

1264

ann_tag.setAttribute("value", value)

1265

tag.appendChild(ann_tag)

1266

# Add interface annotation tags

1267

for annotation, value in dict(

1268

itertools.chain.from_iterable(

1269

annotations().items()

1270

for name, annotations

1271

in self._get_all_dbus_things("interface")

1272

if name == if_tag.getAttribute("name")

1273

)).items():

1274

ann_tag = document.createElement("annotation")

1275

ann_tag.setAttribute("name", annotation)

1276

ann_tag.setAttribute("value", value)

1277

if_tag.appendChild(ann_tag)

1278

# Fix argument name for the Introspect method itself

1279

if (if_tag.getAttribute("name")

1280

== dbus.INTROSPECTABLE_IFACE):

1281

for cn in if_tag.getElementsByTagName("method"):

1282

if cn.getAttribute("name") == "Introspect":

1283

for arg in cn.getElementsByTagName("arg"):

1284

if (arg.getAttribute("direction")

1285

== "out"):

1286

arg.setAttribute("name",

1287

"xml_data")

1288

xmlstring = document.toxml("utf-8")

1289

document.unlink()

1290

except (AttributeError, xml.dom.DOMException,

1291

xml.parsers.expat.ExpatError) as error:

1292

logger.error("Failed to override Introspection method",

1293

exc_info=error)

1294

return xmlstring

1295

1296

1297

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1298

"""A D-Bus object with properties.

1299

1300

Classes inheriting from this can use the dbus_service_property

1301

decorator to expose methods as D-Bus properties. It exposes the

1302

standard Get(), Set(), and GetAll() methods on the D-Bus.

1303

"""

1304

886

inspect.getmembers(cls,

887

self._is_dbus_thing(thing)))

888

1305

889

def _get_dbus_property(self, interface_name, property_name):

1306

890

"""Returns a bound method if one exists which is a D-Bus

1307

891

property with the specified name and interface.

1308

892

"""

1309

for cls in self.__class__.__mro__:

1310

for name, value in inspect.getmembers(

1311

cls, self._is_dbus_thing("property")):

893

for cls in self.__class__.__mro__:

894

for name, value in (inspect.getmembers

895

(cls,

896

self._is_dbus_thing("property"))):

1312

897

if (value._dbus_name == property_name

1313

898

and value._dbus_interface == interface_name):

1314

899

return value.__get__(self)

1315

900

1316

901

# No such property

1317

raise DBusPropertyNotFound("{}:{}.{}".format(

1318

self.dbus_object_path, interface_name, property_name))

1319

1320

@classmethod

1321

def _get_all_interface_names(cls):

1322

"""Get a sequence of all interfaces supported by an object"""

1323

return (name for name in set(getattr(getattr(x, attr),

1324

"_dbus_interface", None)

1325

for x in (inspect.getmro(cls))

1326

for attr in dir(x))

1327

if name is not None)

1328

1329

@dbus.service.method(dbus.PROPERTIES_IFACE,

1330

in_signature="ss",

902

raise DBusPropertyNotFound(self.dbus_object_path + ":"

903

+ interface_name + "."

904

+ property_name)

905

906

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1331

907

out_signature="v")

1332

908

def Get(self, interface_name, property_name):

1333

909

"""Standard D-Bus property Get() method, see D-Bus standard.

1339

915

if not hasattr(value, "variant_level"):

1340

916

return value

1341

917

return type(value)(value, variant_level=value.variant_level+1)

1342

918

1343

919

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1344

920

def Set(self, interface_name, property_name, value):

1345

921

"""Standard D-Bus property Set() method, see D-Bus standard.

1351

927

# The byte_arrays option is not supported yet on

1352

928

# signatures other than "ay".

1353

929

if prop._dbus_signature != "ay":

1354

raise ValueError("Byte arrays not supported for non-"

1355

"'ay' signature {!r}"

1356

.format(prop._dbus_signature))

930

raise ValueError

1357

931

value = dbus.ByteArray(b''.join(chr(byte)

1358

932

for byte in value))

1359

933

prop(value)

1360

1361

@dbus.service.method(dbus.PROPERTIES_IFACE,

1362

in_signature="s",

934

935

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1363

936

out_signature="a{sv}")

1364

937

def GetAll(self, interface_name):

1365

938

"""Standard D-Bus property GetAll() method, see D-Bus

1366

939

standard.

1367

940

1368

941

Note: Will not include properties with access="write".

1369

942

"""

1370

943

properties = {}

1380

953

if not hasattr(value, "variant_level"):

1381

954

properties[name] = value

1382

955

continue

1383

properties[name] = type(value)(

1384

value, variant_level=value.variant_level + 1)

956

properties[name] = type(value)(value, variant_level=

957

value.variant_level+1)

1385

958

return dbus.Dictionary(properties, signature="sv")

1386

1387

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1388

def PropertiesChanged(self, interface_name, changed_properties,

1389

invalidated_properties):

1390

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1391

standard.

1392

"""

1393

pass

1394

959

1395

960

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1396

961

out_signature="s",

1397

962

path_keyword='object_path',

1398

963

connection_keyword='connection')

1399

964

def Introspect(self, object_path, connection):

1400

965

"""Overloading of standard D-Bus method.

1401

966

1402

967

Inserts property tags and interface annotation tags.

1403

968

"""

1404

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1405

object_path,

1406

connection)

969

xmlstring = dbus.service.Object.Introspect(self, object_path,

970

connection)

1407

971

try:

1408

972

document = xml.dom.minidom.parseString(xmlstring)

1409

1410

973

def make_tag(document, name, prop):

1411

974

e = document.createElement("property")

1412

975

e.setAttribute("name", name)

1413

976

e.setAttribute("type", prop._dbus_signature)

1414

977

e.setAttribute("access", prop._dbus_access)

1415

978

return e

1416

1417

979

for if_tag in document.getElementsByTagName("interface"):

1418

980

# Add property tags

1419

981

for tag in (make_tag(document, name, prop)

1422

984

if prop._dbus_interface

1423

985

== if_tag.getAttribute("name")):

1424

986

if_tag.appendChild(tag)

1425

# Add annotation tags for properties

1426

for tag in if_tag.getElementsByTagName("property"):

1427

annots = dict()

1428

for name, prop in self._get_all_dbus_things(

1429

"property"):

1430

if (name == tag.getAttribute("name")

1431

and prop._dbus_interface

1432

== if_tag.getAttribute("name")):

1433

annots.update(getattr(

1434

prop, "_dbus_annotations", {}))

1435

for name, value in annots.items():

1436

ann_tag = document.createElement(

1437

"annotation")

1438

ann_tag.setAttribute("name", name)

1439

ann_tag.setAttribute("value", value)

1440

tag.appendChild(ann_tag)

987

# Add annotation tags

988

for typ in ("method", "signal", "property"):

989

for tag in if_tag.getElementsByTagName(typ):

990

annots = dict()

991

for name, prop in (self.

992

_get_all_dbus_things(typ)):

993

if (name == tag.getAttribute("name")

994

and prop._dbus_interface

995

== if_tag.getAttribute("name")):

996

annots.update(getattr

997

(prop,

998

"_dbus_annotations",

999

{}))

1000

for name, value in annots.iteritems():

1001

ann_tag = document.createElement(

1002

"annotation")

1003

ann_tag.setAttribute("name", name)

1004

ann_tag.setAttribute("value", value)

1005

tag.appendChild(ann_tag)

1006

# Add interface annotation tags

1007

for annotation, value in dict(

1008

itertools.chain.from_iterable(

1009

annotations().iteritems()

1010

for name, annotations in

1011

self._get_all_dbus_things("interface")

1012

if name == if_tag.getAttribute("name")

1013

)).iteritems():

1014

ann_tag = document.createElement("annotation")

1015

ann_tag.setAttribute("name", annotation)

1016

ann_tag.setAttribute("value", value)

1017

if_tag.appendChild(ann_tag)

1441

1018

# Add the names to the return values for the

1442

1019

# "org.freedesktop.DBus.Properties" methods

1443

1020

if (if_tag.getAttribute("name")

1461

1038

exc_info=error)

1462

1039

return xmlstring

1463

1040

1464

try:

1465

dbus.OBJECT_MANAGER_IFACE

1466

except AttributeError:

1467

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1468

1469

1470

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1471

"""A D-Bus object with an ObjectManager.

1472

1473

Classes inheriting from this exposes the standard

1474

GetManagedObjects call and the InterfacesAdded and

1475

InterfacesRemoved signals on the standard

1476

"org.freedesktop.DBus.ObjectManager" interface.

1477

1478

Note: No signals are sent automatically; they must be sent

1479

manually.

1480

"""

1481

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1482

out_signature="a{oa{sa{sv}}}")

1483

def GetManagedObjects(self):

1484

"""This function must be overridden"""

1485

raise NotImplementedError()

1486

1487

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1488

signature="oa{sa{sv}}")

1489

def InterfacesAdded(self, object_path, interfaces_and_properties):

1490

pass

1491

1492

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1493

def InterfacesRemoved(self, object_path, interfaces):

1494

pass

1495

1496

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1497

out_signature="s",

1498

path_keyword='object_path',

1499

connection_keyword='connection')

1500

def Introspect(self, object_path, connection):

1501

"""Overloading of standard D-Bus method.

1502

1503

Override return argument name of GetManagedObjects to be

1504

"objpath_interfaces_and_properties"

1505

"""

1506

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1507

object_path,

1508

connection)

1509

try:

1510

document = xml.dom.minidom.parseString(xmlstring)

1511

1512

for if_tag in document.getElementsByTagName("interface"):

1513

# Fix argument name for the GetManagedObjects method

1514

if (if_tag.getAttribute("name")

1515

== dbus.OBJECT_MANAGER_IFACE):

1516

for cn in if_tag.getElementsByTagName("method"):

1517

if (cn.getAttribute("name")

1518

== "GetManagedObjects"):

1519

for arg in cn.getElementsByTagName("arg"):

1520

if (arg.getAttribute("direction")

1521

== "out"):

1522

arg.setAttribute(

1523

"name",

1524

"objpath_interfaces"

1525

"_and_properties")

1526

xmlstring = document.toxml("utf-8")

1527

document.unlink()

1528

except (AttributeError, xml.dom.DOMException,

1529

xml.parsers.expat.ExpatError) as error:

1530

logger.error("Failed to override Introspection method",

1531

exc_info=error)

1532

return xmlstring

1533

1534

1041

1535

1042

def datetime_to_dbus(dt, variant_level=0):

1536

1043

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1537

1044

if dt is None:

1538

return dbus.String("", variant_level=variant_level)

1539

return dbus.String(dt.isoformat(), variant_level=variant_level)

1045

return dbus.String("", variant_level = variant_level)

1046

return dbus.String(dt.isoformat(),

1047

variant_level=variant_level)

1540

1048

1541

1049

1542

1050

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1544

1052

dbus.service.Object, it will add alternate D-Bus attributes with

1545

1053

interface names according to the "alt_interface_names" mapping.

1546

1054

Usage:

1547

1055

1548

1056

@alternate_dbus_interfaces({"org.example.Interface":

1549

1057

"net.example.AlternateInterface"})

1550

1058

class SampleDBusObject(dbus.service.Object):

1551

1059

@dbus.service.method("org.example.Interface")

1552

1060

def SampleDBusMethod():

1553

1061

pass

1554

1062

1555

1063

The above "SampleDBusMethod" on "SampleDBusObject" will be

1556

1064

reachable via two interfaces: "org.example.Interface" and

1557

1065

"net.example.AlternateInterface", the latter of which will have

1558

1066

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1559

1067

"true", unless "deprecate" is passed with a False value.

1560

1068

1561

1069

This works for methods and signals, and also for D-Bus properties

1562

1070

(from DBusObjectWithProperties) and interfaces (from the

1563

1071

dbus_interface_annotations decorator).

1564

1072

"""

1565

1566

1073

def wrapper(cls):

1567

1074

for orig_interface_name, alt_interface_name in (

1568

alt_interface_names.items()):

1075

alt_interface_names.iteritems()):

1569

1076

attr = {}

1570

1077

interface_names = set()

1571

1078

# Go though all attributes of the class

1573

1080

# Ignore non-D-Bus attributes, and D-Bus attributes

1574

1081

# with the wrong interface name

1575

1082

if (not hasattr(attribute, "_dbus_interface")

1576

or not attribute._dbus_interface.startswith(

1577

orig_interface_name)):

1083

or not attribute._dbus_interface

1084

.startswith(orig_interface_name)):

1578

1085

continue

1579

1086

# Create an alternate D-Bus interface name based on

1580

1087

# the current name

1581

alt_interface = attribute._dbus_interface.replace(

1582

orig_interface_name, alt_interface_name)

1088

alt_interface = (attribute._dbus_interface

1089

.replace(orig_interface_name,

1090

alt_interface_name))

1583

1091

interface_names.add(alt_interface)

1584

1092

# Is this a D-Bus signal?

1585

1093

if getattr(attribute, "_dbus_is_signal", False):

1586

1094

# Extract the original non-method undecorated

1587

1095

# function by black magic

1588

if sys.version_info.major == 2:

1589

nonmethod_func = (dict(

1096

nonmethod_func = (dict(

1590

1097

zip(attribute.func_code.co_freevars,

1591

attribute.__closure__))

1592

["func"].cell_contents)

1593

else:

1594

nonmethod_func = (dict(

1595

zip(attribute.__code__.co_freevars,

1596

attribute.__closure__))

1597

["func"].cell_contents)

1098

attribute.__closure__))["func"]

1099

.cell_contents)

1598

1100

# Create a new, but exactly alike, function

1599

1101

# object, and decorate it to be a new D-Bus signal

1600

1102

# with the alternate D-Bus interface name

1601

new_function = copy_function(nonmethod_func)

1602

new_function = (dbus.service.signal(

1603

alt_interface,

1604

attribute._dbus_signature)(new_function))

1103

new_function = (dbus.service.signal

1104

(alt_interface,

1105

attribute._dbus_signature)

1106

(types.FunctionType(

1107

nonmethod_func.func_code,

1108

nonmethod_func.func_globals,

1109

nonmethod_func.func_name,

1110

nonmethod_func.func_defaults,

1111

nonmethod_func.func_closure)))

1605

1112

# Copy annotations, if any

1606

1113

try:

1607

new_function._dbus_annotations = dict(

1608

attribute._dbus_annotations)

1114

new_function._dbus_annotations = (

1115

dict(attribute._dbus_annotations))

1609

1116

except AttributeError:

1610

1117

pass

1611

1612

1118

# Define a creator of a function to call both the

1613

1119

# original and alternate functions, so both the

1614

1120

# original and alternate signals gets sent when

1617

1123

"""This function is a scope container to pass

1618

1124

func1 and func2 to the "call_both" function

1619

1125

outside of its arguments"""

1620

1621

@functools.wraps(func2)

1622

1126

def call_both(*args, **kwargs):

1623

1127

"""This function will emit two D-Bus

1624

1128

signals by calling func1 and func2"""

1625

1129

func1(*args, **kwargs)

1626

1130

func2(*args, **kwargs)

1627

# Make wrapper function look like a D-Bus

1628

# signal

1629

for name, attr in inspect.getmembers(func2):

1630

if name.startswith("_dbus_"):

1631

setattr(call_both, name, attr)

1632

1633

1131

return call_both

1634

1132

# Create the "call_both" function and add it to

1635

1133

# the class

1640

1138

# object. Decorate it to be a new D-Bus method

1641

1139

# with the alternate D-Bus interface name. Add it

1642

1140

# to the class.

1643

attr[attrname] = (

1644

dbus.service.method(

1645

alt_interface,

1646

attribute._dbus_in_signature,

1647

attribute._dbus_out_signature)

1648

(copy_function(attribute)))

1141

attr[attrname] = (dbus.service.method

1142

(alt_interface,

1143

attribute._dbus_in_signature,

1144

attribute._dbus_out_signature)

1145

(types.FunctionType

1146

(attribute.func_code,

1147

attribute.func_globals,

1148

attribute.func_name,

1149

attribute.func_defaults,

1150

attribute.func_closure)))

1649

1151

# Copy annotations, if any

1650

1152

try:

1651

attr[attrname]._dbus_annotations = dict(

1652

attribute._dbus_annotations)

1153

attr[attrname]._dbus_annotations = (

1154

dict(attribute._dbus_annotations))

1653

1155

except AttributeError:

1654

1156

pass

1655

1157

# Is this a D-Bus property?

1658

1160

# object, and decorate it to be a new D-Bus

1659

1161

# property with the alternate D-Bus interface

1660

1162

# name. Add it to the class.

1661

attr[attrname] = (dbus_service_property(

1662

alt_interface, attribute._dbus_signature,

1663

attribute._dbus_access,

1664

attribute._dbus_get_args_options

1665

["byte_arrays"])

1666

(copy_function(attribute)))

1163

attr[attrname] = (dbus_service_property

1164

(alt_interface,

1165

attribute._dbus_signature,

1166

attribute._dbus_access,

1167

attribute

1168

._dbus_get_args_options

1169

["byte_arrays"])

1170

(types.FunctionType

1171

(attribute.func_code,

1172

attribute.func_globals,

1173

attribute.func_name,

1174

attribute.func_defaults,

1175

attribute.func_closure)))

1667

1176

# Copy annotations, if any

1668

1177

try:

1669

attr[attrname]._dbus_annotations = dict(

1670

attribute._dbus_annotations)

1178

attr[attrname]._dbus_annotations = (

1179

dict(attribute._dbus_annotations))

1671

1180

except AttributeError:

1672

1181

pass

1673

1182

# Is this a D-Bus interface?

1676

1185

# object. Decorate it to be a new D-Bus interface

1677

1186

# with the alternate D-Bus interface name. Add it

1678

1187

# to the class.

1679

attr[attrname] = (

1680

dbus_interface_annotations(alt_interface)

1681

(copy_function(attribute)))

1188

attr[attrname] = (dbus_interface_annotations

1189

(alt_interface)

1190

(types.FunctionType

1191

(attribute.func_code,

1192

attribute.func_globals,

1193

attribute.func_name,

1194

attribute.func_defaults,

1195

attribute.func_closure)))

1682

1196

if deprecate:

1683

1197

# Deprecate all alternate interfaces

1684

iname = "_AlternateDBusNames_interface_annotation{}"

1198

iname="_AlternateDBusNames_interface_annotation{0}"

1685

1199

for interface_name in interface_names:

1686

1687

1200

@dbus_interface_annotations(interface_name)

1688

1201

def func(self):

1689

return {"org.freedesktop.DBus.Deprecated":

1690

"true"}

1202

return { "org.freedesktop.DBus.Deprecated":

1203

"true" }

1691

1204

# Find an unused name

1692

1205

for aname in (iname.format(i)

1693

1206

for i in itertools.count()):

1697

1210

if interface_names:

1698

1211

# Replace the class with a new subclass of it with

1699

1212

# methods, signals, etc. as created above.

1700

if sys.version_info.major == 2:

1701

cls = type(b"{}Alternate".format(cls.__name__),

1702

(cls, ), attr)

1703

else:

1704

cls = type("{}Alternate".format(cls.__name__),

1705

(cls, ), attr)

1213

cls = type(b"{0}Alternate".format(cls.__name__),

1214

(cls,), attr)

1706

1215

return cls

1707

1708

1216

return wrapper

1709

1217

1710

1218

1711

1219

@alternate_dbus_interfaces({"se.recompile.Mandos":

1712

"se.bsnet.fukt.Mandos"})

1220

"se.bsnet.fukt.Mandos"})

1713

1221

class ClientDBus(Client, DBusObjectWithProperties):

1714

1222

"""A Client class using D-Bus

1715

1223

1716

1224

Attributes:

1717

1225

dbus_object_path: dbus.ObjectPath

1718

1226

bus: dbus.SystemBus()

1719

1227

"""

1720

1228

1721

1229

runtime_expansions = (Client.runtime_expansions

1722

+ ("dbus_object_path", ))

1723

1724

_interface = "se.recompile.Mandos.Client"

1725

1230

+ ("dbus_object_path",))

1231

1726

1232

# dbus.service.Object doesn't use super(), so we can't either.

1727

1728

def __init__(self, bus=None, *args, **kwargs):

1233

1234

def __init__(self, bus = None, *args, **kwargs):

1729

1235

self.bus = bus

1730

1236

Client.__init__(self, *args, **kwargs)

1731

1237

# Only now, when this client is initialized, can it show up on

1732

1238

# the D-Bus

1733

client_object_name = str(self.name).translate(

1239

client_object_name = unicode(self.name).translate(

1734

1240

{ord("."): ord("_"),

1735

1241

ord("-"): ord("_")})

1736

self.dbus_object_path = dbus.ObjectPath(

1737

"/clients/" + client_object_name)

1242

self.dbus_object_path = (dbus.ObjectPath

1243

("/clients/" + client_object_name))

1738

1244

DBusObjectWithProperties.__init__(self, self.bus,

1739

1245

self.dbus_object_path)

1740

1741

def notifychangeproperty(transform_func, dbus_name,

1742

type_func=lambda x: x,

1743

variant_level=1,

1744

invalidate_only=False,

1745

_interface=_interface):

1246

1247

def notifychangeproperty(transform_func,

1248

dbus_name, type_func=lambda x: x,

1249

variant_level=1):

1746

1250

""" Modify a variable so that it's a property which announces

1747

1251

its changes to DBus.

1748

1252

1749

1253

transform_fun: Function that takes a value and a variant_level

1750

1254

and transforms it to a D-Bus type.

1751

1255

dbus_name: D-Bus name of the variable

1753

1257

to the D-Bus. Default: no transform

1754

1258

variant_level: D-Bus variant level. Default: 1

1755

1259

"""

1756

attrname = "_{}".format(dbus_name)

1757

1260

attrname = "_{0}".format(dbus_name)

1758

1261

def setter(self, value):

1759

1262

if hasattr(self, "dbus_object_path"):

1760

1263

if (not hasattr(self, attrname) or

1761

1264

type_func(getattr(self, attrname, None))

1762

1265

!= type_func(value)):

1763

if invalidate_only:

1764

self.PropertiesChanged(

1765

_interface, dbus.Dictionary(),

1766

dbus.Array((dbus_name, )))

1767

else:

1768

dbus_value = transform_func(

1769

type_func(value),

1770

variant_level=variant_level)

1771

self.PropertyChanged(dbus.String(dbus_name),

1772

dbus_value)

1773

self.PropertiesChanged(

1774

_interface,

1775

dbus.Dictionary({dbus.String(dbus_name):

1776

dbus_value}),

1777

dbus.Array())

1266

dbus_value = transform_func(type_func(value),

1267

variant_level

1268

=variant_level)

1269

self.PropertyChanged(dbus.String(dbus_name),

1270

dbus_value)

1778

1271

setattr(self, attrname, value)

1779

1272

1780

1273

return property(lambda self: getattr(self, attrname), setter)

1781

1274

1782

1275

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1783

1276

approvals_pending = notifychangeproperty(dbus.Boolean,

1784

1277

"ApprovalPending",

1785

type_func=bool)

1278

type_func = bool)

1786

1279

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1787

1280

last_enabled = notifychangeproperty(datetime_to_dbus,

1788

1281

"LastEnabled")

1789

checker = notifychangeproperty(

1790

dbus.Boolean, "CheckerRunning",

1791

type_func=lambda checker: checker is not None)

1282

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1283

type_func = lambda checker:

1284

checker is not None)

1792

1285

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1793

1286

"LastCheckedOK")

1794

1287

last_checker_status = notifychangeproperty(dbus.Int16,

1797

1290

datetime_to_dbus, "LastApprovalRequest")

1798

1291

approved_by_default = notifychangeproperty(dbus.Boolean,

1799

1292

"ApprovedByDefault")

1800

approval_delay = notifychangeproperty(

1801

dbus.UInt64, "ApprovalDelay",

1802

type_func=lambda td: td.total_seconds() * 1000)

1293

approval_delay = notifychangeproperty(dbus.UInt64,

1294

"ApprovalDelay",

1295

type_func =

1296

timedelta_to_milliseconds)

1803

1297

approval_duration = notifychangeproperty(

1804

1298

dbus.UInt64, "ApprovalDuration",

1805

type_func=lambda td: td.total_seconds() * 1000)

1299

type_func = timedelta_to_milliseconds)

1806

1300

host = notifychangeproperty(dbus.String, "Host")

1807

timeout = notifychangeproperty(

1808

dbus.UInt64, "Timeout",

1809

type_func=lambda td: td.total_seconds() * 1000)

1301

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1302

type_func =

1303

timedelta_to_milliseconds)

1810

1304

extended_timeout = notifychangeproperty(

1811

1305

dbus.UInt64, "ExtendedTimeout",

1812

type_func=lambda td: td.total_seconds() * 1000)

1813

interval = notifychangeproperty(

1814

dbus.UInt64, "Interval",

1815

type_func=lambda td: td.total_seconds() * 1000)

1306

type_func = timedelta_to_milliseconds)

1307

interval = notifychangeproperty(dbus.UInt64,

1308

"Interval",

1309

type_func =

1310

timedelta_to_milliseconds)

1816

1311

checker_command = notifychangeproperty(dbus.String, "Checker")

1817

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1818

invalidate_only=True)

1819

1312

1820

1313

del notifychangeproperty

1821

1314

1822

1315

def __del__(self, *args, **kwargs):

1823

1316

try:

1824

1317

self.remove_from_connection()

1827

1320

if hasattr(DBusObjectWithProperties, "__del__"):

1828

1321

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1829

1322

Client.__del__(self, *args, **kwargs)

1830

1831

def checker_callback(self, source, condition,

1832

connection, command, *args, **kwargs):

1833

ret = Client.checker_callback(self, source, condition,

1834

connection, command, *args,

1835

**kwargs)

1836

exitstatus = self.last_checker_status

1837

if exitstatus >= 0:

1323

1324

def checker_callback(self, pid, condition, command,

1325

*args, **kwargs):

1326

self.checker_callback_tag = None

1327

self.checker = None

1328

if os.WIFEXITED(condition):

1329

exitstatus = os.WEXITSTATUS(condition)

1838

1330

# Emit D-Bus signal

1839

1331

self.CheckerCompleted(dbus.Int16(exitstatus),

1840

# This is specific to GNU libC

1841

dbus.Int64(exitstatus << 8),

1332

dbus.Int64(condition),

1842

1333

dbus.String(command))

1843

1334

else:

1844

1335

# Emit D-Bus signal

1845

1336

self.CheckerCompleted(dbus.Int16(-1),

1846

dbus.Int64(

1847

# This is specific to GNU libC

1848

(exitstatus << 8)

1849

| self.last_checker_signal),

1337

dbus.Int64(condition),

1850

1338

dbus.String(command))

1851

return ret

1852

1339

1340

return Client.checker_callback(self, pid, condition, command,

1341

*args, **kwargs)

1342

1853

1343

def start_checker(self, *args, **kwargs):

1854

old_checker_pid = getattr(self.checker, "pid", None)

1344

old_checker = self.checker

1345

if self.checker is not None:

1346

old_checker_pid = self.checker.pid

1347

else:

1348

old_checker_pid = None

1855

1349

r = Client.start_checker(self, *args, **kwargs)

1856

1350

# Only if new checker process was started

1857

1351

if (self.checker is not None

1859

1353

# Emit D-Bus signal

1860

1354

self.CheckerStarted(self.current_checker_command)

1861

1355

return r

1862

1356

1863

1357

def _reset_approved(self):

1864

1358

self.approved = None

1865

1359

return False

1866

1360

1867

1361

def approve(self, value=True):

1868

1362

self.approved = value

1869

GLib.timeout_add(int(self.approval_duration.total_seconds()

1870

* 1000), self._reset_approved)

1363

gobject.timeout_add(timedelta_to_milliseconds

1364

(self.approval_duration),

1365

self._reset_approved)

1871

1366

self.send_changedstate()

1872

1873

# D-Bus methods, signals & properties

1874

1875

# Interfaces

1876

1877

# Signals

1878

1367

1368

## D-Bus methods, signals & properties

1369

_interface = "se.recompile.Mandos.Client"

1370

1371

## Interfaces

1372

1373

@dbus_interface_annotations(_interface)

1374

def _foo(self):

1375

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1376

"false"}

1377

1378

## Signals

1379

1879

1380

# CheckerCompleted - signal

1880

1381

@dbus.service.signal(_interface, signature="nxs")

1881

1382

def CheckerCompleted(self, exitcode, waitstatus, command):

1882

1383

"D-Bus signal"

1883

1384

pass

1884

1385

1885

1386

# CheckerStarted - signal

1886

1387

@dbus.service.signal(_interface, signature="s")

1887

1388

def CheckerStarted(self, command):

1888

1389

"D-Bus signal"

1889

1390

pass

1890

1391

1891

1392

# PropertyChanged - signal

1892

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1893

1393

@dbus.service.signal(_interface, signature="sv")

1894

1394

def PropertyChanged(self, property, value):

1895

1395

"D-Bus signal"

1896

1396

pass

1897

1397

1898

1398

# GotSecret - signal

1899

1399

@dbus.service.signal(_interface)

1900

1400

def GotSecret(self):

1903

1403

server to mandos-client

1904

1404

"""

1905

1405

pass

1906

1406

1907

1407

# Rejected - signal

1908

1408

@dbus.service.signal(_interface, signature="s")

1909

1409

def Rejected(self, reason):

1910

1410

"D-Bus signal"

1911

1411

pass

1912

1412

1913

1413

# NeedApproval - signal

1914

1414

@dbus.service.signal(_interface, signature="tb")

1915

1415

def NeedApproval(self, timeout, default):

1916

1416

"D-Bus signal"

1917

1417

return self.need_approval()

1918

1919

# Methods

1920

1418

1419

## Methods

1420

1921

1421

# Approve - method

1922

1422

@dbus.service.method(_interface, in_signature="b")

1923

1423

def Approve(self, value):

1924

1424

self.approve(value)

1925

1425

1926

1426

# CheckedOK - method

1927

1427

@dbus.service.method(_interface)

1928

1428

def CheckedOK(self):

1929

1429

self.checked_ok()

1930

1430

1931

1431

# Enable - method

1932

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1933

1432

@dbus.service.method(_interface)

1934

1433

def Enable(self):

1935

1434

"D-Bus method"

1936

1435

self.enable()

1937

1436

1938

1437

# StartChecker - method

1939

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1940

1438

@dbus.service.method(_interface)

1941

1439

def StartChecker(self):

1942

1440

"D-Bus method"

1943

1441

self.start_checker()

1944

1442

1945

1443

# Disable - method

1946

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1947

1444

@dbus.service.method(_interface)

1948

1445

def Disable(self):

1949

1446

"D-Bus method"

1950

1447

self.disable()

1951

1448

1952

1449

# StopChecker - method

1953

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1954

1450

@dbus.service.method(_interface)

1955

1451

def StopChecker(self):

1956

1452

self.stop_checker()

1957

1958

# Properties

1959

1453

1454

## Properties

1455

1960

1456

# ApprovalPending - property

1961

1457

@dbus_service_property(_interface, signature="b", access="read")

1962

1458

def ApprovalPending_dbus_property(self):

1963

1459

return dbus.Boolean(bool(self.approvals_pending))

1964

1460

1965

1461

# ApprovedByDefault - property

1966

@dbus_service_property(_interface,

1967

signature="b",

1462

@dbus_service_property(_interface, signature="b",

1968

1463

access="readwrite")

1969

1464

def ApprovedByDefault_dbus_property(self, value=None):

1970

1465

if value is None: # get

1971

1466

return dbus.Boolean(self.approved_by_default)

1972

1467

self.approved_by_default = bool(value)

1973

1468

1974

1469

# ApprovalDelay - property

1975

@dbus_service_property(_interface,

1976

signature="t",

1470

@dbus_service_property(_interface, signature="t",

1977

1471

access="readwrite")

1978

1472

def ApprovalDelay_dbus_property(self, value=None):

1979

1473

if value is None: # get

1980

return dbus.UInt64(self.approval_delay.total_seconds()

1981

* 1000)

1474

return dbus.UInt64(self.approval_delay_milliseconds())

1982

1475

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1983

1476

1984

1477

# ApprovalDuration - property

1985

@dbus_service_property(_interface,

1986

signature="t",

1478

@dbus_service_property(_interface, signature="t",

1987

1479

access="readwrite")

1988

1480

def ApprovalDuration_dbus_property(self, value=None):

1989

1481

if value is None: # get

1990

return dbus.UInt64(self.approval_duration.total_seconds()

1991

* 1000)

1482

return dbus.UInt64(timedelta_to_milliseconds(

1483

self.approval_duration))

1992

1484

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1993

1485

1994

1486

# Name - property

1995

@dbus_annotations(

1996

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1997

1487

@dbus_service_property(_interface, signature="s", access="read")

1998

1488

def Name_dbus_property(self):

1999

1489

return dbus.String(self.name)

2000

1490

2001

1491

# Fingerprint - property

2002

@dbus_annotations(

2003

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2004

1492

@dbus_service_property(_interface, signature="s", access="read")

2005

1493

def Fingerprint_dbus_property(self):

2006

1494

return dbus.String(self.fingerprint)

2007

1495

2008

1496

# Host - property

2009

@dbus_service_property(_interface,

2010

signature="s",

1497

@dbus_service_property(_interface, signature="s",

2011

1498

access="readwrite")

2012

1499

def Host_dbus_property(self, value=None):

2013

1500

if value is None: # get

2014

1501

return dbus.String(self.host)

2015

self.host = str(value)

2016

1502

self.host = unicode(value)

1503

2017

1504

# Created - property

2018

@dbus_annotations(

2019

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2020

1505

@dbus_service_property(_interface, signature="s", access="read")

2021

1506

def Created_dbus_property(self):

2022

1507

return datetime_to_dbus(self.created)

2023

1508

2024

1509

# LastEnabled - property

2025

1510

@dbus_service_property(_interface, signature="s", access="read")

2026

1511

def LastEnabled_dbus_property(self):

2027

1512

return datetime_to_dbus(self.last_enabled)

2028

1513

2029

1514

# Enabled - property

2030

@dbus_service_property(_interface,

2031

signature="b",

1515

@dbus_service_property(_interface, signature="b",

2032

1516

access="readwrite")

2033

1517

def Enabled_dbus_property(self, value=None):

2034

1518

if value is None: # get

2037

1521

self.enable()

2038

1522

else:

2039

1523

self.disable()

2040

1524

2041

1525

# LastCheckedOK - property

2042

@dbus_service_property(_interface,

2043

signature="s",

1526

@dbus_service_property(_interface, signature="s",

2044

1527

access="readwrite")

2045

1528

def LastCheckedOK_dbus_property(self, value=None):

2046

1529

if value is not None:

2047

1530

self.checked_ok()

2048

1531

return

2049

1532

return datetime_to_dbus(self.last_checked_ok)

2050

1533

2051

1534

# LastCheckerStatus - property

2052

@dbus_service_property(_interface, signature="n", access="read")

1535

@dbus_service_property(_interface, signature="n",

1536

access="read")

2053

1537

def LastCheckerStatus_dbus_property(self):

2054

1538

return dbus.Int16(self.last_checker_status)

2055

1539

2056

1540

# Expires - property

2057

1541

@dbus_service_property(_interface, signature="s", access="read")

2058

1542

def Expires_dbus_property(self):

2059

1543

return datetime_to_dbus(self.expires)

2060

1544

2061

1545

# LastApprovalRequest - property

2062

1546

@dbus_service_property(_interface, signature="s", access="read")

2063

1547

def LastApprovalRequest_dbus_property(self):

2064

1548

return datetime_to_dbus(self.last_approval_request)

2065

1549

2066

1550

# Timeout - property

2067

@dbus_service_property(_interface,

2068

signature="t",

1551

@dbus_service_property(_interface, signature="t",

2069

1552

access="readwrite")

2070

1553

def Timeout_dbus_property(self, value=None):

2071

1554

if value is None: # get

2072

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1555

return dbus.UInt64(self.timeout_milliseconds())

2073

1556

old_timeout = self.timeout

2074

1557

self.timeout = datetime.timedelta(0, 0, 0, value)

2075

1558

# Reschedule disabling

2083

1566

if (getattr(self, "disable_initiator_tag", None)

2084

1567

is None):

2085

1568

return

2086

GLib.source_remove(self.disable_initiator_tag)

2087

self.disable_initiator_tag = GLib.timeout_add(

2088

int((self.expires - now).total_seconds() * 1000),

2089

self.disable)

2090

1569

gobject.source_remove(self.disable_initiator_tag)

1570

self.disable_initiator_tag = (

1571

gobject.timeout_add(

1572

timedelta_to_milliseconds(self.expires - now),

1573

self.disable))

1574

2091

1575

# ExtendedTimeout - property

2092

@dbus_service_property(_interface,

2093

signature="t",

1576

@dbus_service_property(_interface, signature="t",

2094

1577

access="readwrite")

2095

1578

def ExtendedTimeout_dbus_property(self, value=None):

2096

1579

if value is None: # get

2097

return dbus.UInt64(self.extended_timeout.total_seconds()

2098

* 1000)

1580

return dbus.UInt64(self.extended_timeout_milliseconds())

2099

1581

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2100

1582

2101

1583

# Interval - property

2102

@dbus_service_property(_interface,

2103

signature="t",

1584

@dbus_service_property(_interface, signature="t",

2104

1585

access="readwrite")

2105

1586

def Interval_dbus_property(self, value=None):

2106

1587

if value is None: # get

2107

return dbus.UInt64(self.interval.total_seconds() * 1000)

1588

return dbus.UInt64(self.interval_milliseconds())

2108

1589

self.interval = datetime.timedelta(0, 0, 0, value)

2109

1590

if getattr(self, "checker_initiator_tag", None) is None:

2110

1591

return

2111

1592

if self.enabled:

2112

1593

# Reschedule checker run

2113

GLib.source_remove(self.checker_initiator_tag)

2114

self.checker_initiator_tag = GLib.timeout_add(

2115

value, self.start_checker)

2116

self.start_checker() # Start one now, too

2117

1594

gobject.source_remove(self.checker_initiator_tag)

1595

self.checker_initiator_tag = (gobject.timeout_add

1596

(value, self.start_checker))

1597

self.start_checker() # Start one now, too

1598

2118

1599

# Checker - property

2119

@dbus_service_property(_interface,

2120

signature="s",

1600

@dbus_service_property(_interface, signature="s",

2121

1601

access="readwrite")

2122

1602

def Checker_dbus_property(self, value=None):

2123

1603

if value is None: # get

2124

1604

return dbus.String(self.checker_command)

2125

self.checker_command = str(value)

2126

1605

self.checker_command = unicode(value)

1606

2127

1607

# CheckerRunning - property

2128

@dbus_service_property(_interface,

2129

signature="b",

1608

@dbus_service_property(_interface, signature="b",

2130

1609

access="readwrite")

2131

1610

def CheckerRunning_dbus_property(self, value=None):

2132

1611

if value is None: # get

2135

1614

self.start_checker()

2136

1615

else:

2137

1616

self.stop_checker()

2138

1617

2139

1618

# ObjectPath - property

2140

@dbus_annotations(

2141

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2142

"org.freedesktop.DBus.Deprecated": "true"})

2143

1619

@dbus_service_property(_interface, signature="o", access="read")

2144

1620

def ObjectPath_dbus_property(self):

2145

return self.dbus_object_path # is already a dbus.ObjectPath

2146

1621

return self.dbus_object_path # is already a dbus.ObjectPath

1622

2147

1623

# Secret = property

2148

@dbus_annotations(

2149

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2150

"invalidates"})

2151

@dbus_service_property(_interface,

2152

signature="ay",

2153

access="write",

2154

byte_arrays=True)

1624

@dbus_service_property(_interface, signature="ay",

1625

access="write", byte_arrays=True)

2155

1626

def Secret_dbus_property(self, value):

2156

self.secret = bytes(value)

2157

1627

self.secret = str(value)

1628

2158

1629

del _interface

2159

1630

2160

1631

2163

1634

self._pipe = child_pipe

2164

1635

self._pipe.send(('init', fpr, address))

2165

1636

if not self._pipe.recv():

2166

raise KeyError(fpr)

2167

1637

raise KeyError()

1638

2168

1639

def __getattribute__(self, name):

2169

1640

if name == '_pipe':

2170

1641

return super(ProxyClient, self).__getattribute__(name)

2173

1644

if data[0] == 'data':

2174

1645

return data[1]

2175

1646

if data[0] == 'function':

2176

2177

1647

def func(*args, **kwargs):

2178

1648

self._pipe.send(('funcall', name, args, kwargs))

2179

1649

return self._pipe.recv()[1]

2180

2181

1650

return func

2182

1651

2183

1652

def __setattr__(self, name, value):

2184

1653

if name == '_pipe':

2185

1654

return super(ProxyClient, self).__setattr__(name, value)

2188

1657

2189

1658

class ClientHandler(socketserver.BaseRequestHandler, object):

2190

1659

"""A class to handle client connections.

2191

1660

2192

1661

Instantiated once for each connection to handle it.

2193

1662

Note: This will run in its own forked process."""

2194

1663

2195

1664

def handle(self):

2196

1665

with contextlib.closing(self.server.child_pipe) as child_pipe:

2197

1666

logger.info("TCP connection from: %s",

2198

str(self.client_address))

1667

unicode(self.client_address))

2199

1668

logger.debug("Pipe FD: %d",

2200

1669

self.server.child_pipe.fileno())

2201

2202

session = gnutls.ClientSession(self.request)

2203

2204

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2205

# "+AES-256-CBC", "+SHA1",

2206

# "+COMP-NULL", "+CTYPE-OPENPGP",

2207

# "+DHE-DSS"))

1670

1671

session = (gnutls.connection

1672

.ClientSession(self.request,

1673

gnutls.connection

1674

.X509Credentials()))

1675

1676

# Note: gnutls.connection.X509Credentials is really a

1677

# generic GnuTLS certificate credentials object so long as

1678

# no X.509 keys are added to it. Therefore, we can use it

1679

# here despite using OpenPGP certificates.

1680

1681

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1682

# "+AES-256-CBC", "+SHA1",

1683

# "+COMP-NULL", "+CTYPE-OPENPGP",

1684

# "+DHE-DSS"))

2208

1685

# Use a fallback default, since this MUST be set.

2209

1686

priority = self.server.gnutls_priority

2210

1687

if priority is None:

2211

1688

priority = "NORMAL"

2212

gnutls.priority_set_direct(session._c_object,

2213

priority.encode("utf-8"),

2214

None)

2215

1689

(gnutls.library.functions

1690

.gnutls_priority_set_direct(session._c_object,

1691

priority, None))

1692

2216

1693

# Start communication using the Mandos protocol

2217

1694

# Get protocol number

2218

1695

line = self.request.makefile().readline()

2219

1696

logger.debug("Protocol version: %r", line)

2220

1697

try:

2221

1698

if int(line.strip().split()[0]) > 1:

2222

raise RuntimeError(line)

1699

raise RuntimeError

2223

1700

except (ValueError, IndexError, RuntimeError) as error:

2224

1701

logger.error("Unknown protocol version: %s", error)

2225

1702

return

2226

1703

2227

1704

# Start GnuTLS connection

2228

1705

try:

2229

1706

session.handshake()

2230

except gnutls.Error as error:

1707

except gnutls.errors.GNUTLSError as error:

2231

1708

logger.warning("Handshake failed: %s", error)

2232

1709

# Do not run session.bye() here: the session is not

2233

1710

# established. Just abandon the request.

2234

1711

return

2235

1712

logger.debug("Handshake succeeded")

2236

1713

2237

1714

approval_required = False

2238

1715

try:

2239

1716

try:

2240

fpr = self.fingerprint(

2241

self.peer_certificate(session))

2242

except (TypeError, gnutls.Error) as error:

1717

fpr = self.fingerprint(self.peer_certificate

1718

(session))

1719

except (TypeError,

1720

gnutls.errors.GNUTLSError) as error:

2243

1721

logger.warning("Bad certificate: %s", error)

2244

1722

return

2245

1723

logger.debug("Fingerprint: %s", fpr)

2246

1724

2247

1725

try:

2248

1726

client = ProxyClient(child_pipe, fpr,

2249

1727

self.client_address)

2250

1728

except KeyError:

2251

1729

return

2252

1730

2253

1731

if client.approval_delay:

2254

1732

delay = client.approval_delay

2255

1733

client.approvals_pending += 1

2256

1734

approval_required = True

2257

1735

2258

1736

while True:

2259

1737

if not client.enabled:

2260

1738

logger.info("Client %s is disabled",

2261

client.name)

1739

client.name)

2262

1740

if self.server.use_dbus:

2263

1741

# Emit D-Bus signal

2264

1742

client.Rejected("Disabled")

2265

1743

return

2266

1744

2267

1745

if client.approved or not client.approval_delay:

2268

# We are approved or approval is disabled

1746

#We are approved or approval is disabled

2269

1747

break

2270

1748

elif client.approved is None:

2271

1749

logger.info("Client %s needs approval",

2273

1751

if self.server.use_dbus:

2274

1752

# Emit D-Bus signal

2275

1753

client.NeedApproval(

2276

client.approval_delay.total_seconds()

2277

* 1000, client.approved_by_default)

1754

client.approval_delay_milliseconds(),

1755

client.approved_by_default)

2278

1756

else:

2279

1757

logger.warning("Client %s was not approved",

2280

1758

client.name)

2282

1760

# Emit D-Bus signal

2283

1761

client.Rejected("Denied")

2284

1762

return

2285

2286

# wait until timeout or approved

1763

1764

#wait until timeout or approved

2287

1765

time = datetime.datetime.now()

2288

1766

client.changedstate.acquire()

2289

client.changedstate.wait(delay.total_seconds())

1767

client.changedstate.wait(

1768

float(timedelta_to_milliseconds(delay)

1769

/ 1000))

2290

1770

client.changedstate.release()

2291

1771

time2 = datetime.datetime.now()

2292

1772

if (time2 - time) >= delay:

2302

1782

break

2303

1783

else:

2304

1784

delay -= time2 - time

2305

2306

try:

2307

session.send(client.secret)

2308

except gnutls.Error as error:

2309

logger.warning("gnutls send failed",

2310

exc_info=error)

2311

return

2312

1785

1786

sent_size = 0

1787

while sent_size < len(client.secret):

1788

try:

1789

sent = session.send(client.secret[sent_size:])

1790

except gnutls.errors.GNUTLSError as error:

1791

logger.warning("gnutls send failed",

1792

exc_info=error)

1793

return

1794

logger.debug("Sent: %d, remaining: %d",

1795

sent, len(client.secret)

1796

- (sent_size + sent))

1797

sent_size += sent

1798

2313

1799

logger.info("Sending secret to %s", client.name)

2314

1800

# bump the timeout using extended_timeout

2315

1801

client.bump_timeout(client.extended_timeout)

2316

1802

if self.server.use_dbus:

2317

1803

# Emit D-Bus signal

2318

1804

client.GotSecret()

2319

1805

2320

1806

finally:

2321

1807

if approval_required:

2322

1808

client.approvals_pending -= 1

2323

1809

try:

2324

1810

session.bye()

2325

except gnutls.Error as error:

1811

except gnutls.errors.GNUTLSError as error:

2326

1812

logger.warning("GnuTLS bye failed",

2327

1813

exc_info=error)

2328

1814

2329

1815

@staticmethod

2330

1816

def peer_certificate(session):

2331

1817

"Return the peer's OpenPGP certificate as a bytestring"

2332

1818

# If not an OpenPGP certificate...

2333

if (gnutls.certificate_type_get(session._c_object)

2334

!= gnutls.CRT_OPENPGP):

2335

# ...return invalid data

2336

return b""

1819

if (gnutls.library.functions

1820

.gnutls_certificate_type_get(session._c_object)

1821

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1822

# ...do the normal thing

1823

return session.peer_certificate

2337

1824

list_size = ctypes.c_uint(1)

2338

cert_list = (gnutls.certificate_get_peers

1825

cert_list = (gnutls.library.functions

1826

.gnutls_certificate_get_peers

2339

1827

(session._c_object, ctypes.byref(list_size)))

2340

1828

if not bool(cert_list) and list_size.value != 0:

2341

raise gnutls.Error("error getting peer certificate")

1829

raise gnutls.errors.GNUTLSError("error getting peer"

1830

" certificate")

2342

1831

if list_size.value == 0:

2343

1832

return None

2344

1833

cert = cert_list[0]

2345

1834

return ctypes.string_at(cert.data, cert.size)

2346

1835

2347

1836

@staticmethod

2348

1837

def fingerprint(openpgp):

2349

1838

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2350

1839

# New GnuTLS "datum" with the OpenPGP public key

2351

datum = gnutls.datum_t(

2352

ctypes.cast(ctypes.c_char_p(openpgp),

2353

ctypes.POINTER(ctypes.c_ubyte)),

2354

ctypes.c_uint(len(openpgp)))

1840

datum = (gnutls.library.types

1841

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1842

ctypes.POINTER

1843

(ctypes.c_ubyte)),

1844

ctypes.c_uint(len(openpgp))))

2355

1845

# New empty GnuTLS certificate

2356

crt = gnutls.openpgp_crt_t()

2357

gnutls.openpgp_crt_init(ctypes.byref(crt))

1846

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1847

(gnutls.library.functions

1848

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2358

1849

# Import the OpenPGP public key into the certificate

2359

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2360

gnutls.OPENPGP_FMT_RAW)

1850

(gnutls.library.functions

1851

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1852

gnutls.library.constants

1853

.GNUTLS_OPENPGP_FMT_RAW))

2361

1854

# Verify the self signature in the key

2362

1855

crtverify = ctypes.c_uint()

2363

gnutls.openpgp_crt_verify_self(crt, 0,

2364

ctypes.byref(crtverify))

1856

(gnutls.library.functions

1857

.gnutls_openpgp_crt_verify_self(crt, 0,

1858

ctypes.byref(crtverify)))

2365

1859

if crtverify.value != 0:

2366

gnutls.openpgp_crt_deinit(crt)

2367

raise gnutls.CertificateSecurityError("Verify failed")

1860

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1861

raise (gnutls.errors.CertificateSecurityError

1862

("Verify failed"))

2368

1863

# New buffer for the fingerprint

2369

1864

buf = ctypes.create_string_buffer(20)

2370

1865

buf_len = ctypes.c_size_t()

2371

1866

# Get the fingerprint from the certificate into the buffer

2372

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2373

ctypes.byref(buf_len))

1867

(gnutls.library.functions

1868

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1869

ctypes.byref(buf_len)))

2374

1870

# Deinit the certificate

2375

gnutls.openpgp_crt_deinit(crt)

1871

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2376

1872

# Convert the buffer to a Python bytestring

2377

1873

fpr = ctypes.string_at(buf, buf_len.value)

2378

1874

# Convert the bytestring to hexadecimal notation

2382

1878

2383

1879

class MultiprocessingMixIn(object):

2384

1880

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2385

2386

1881

def sub_process_main(self, request, address):

2387

1882

try:

2388

1883

self.finish_request(request, address)

2389

1884

except Exception:

2390

1885

self.handle_error(request, address)

2391

1886

self.close_request(request)

2392

1887

2393

1888

def process_request(self, request, address):

2394

1889

"""Start a new process to process the request."""

2395

proc = multiprocessing.Process(target=self.sub_process_main,

2396

args=(request, address))

1890

proc = multiprocessing.Process(target = self.sub_process_main,

1891

args = (request, address))

2397

1892

proc.start()

2398

1893

return proc

2399

1894

2400

1895

2401

1896

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2402

1897

""" adds a pipe to the MixIn """

2403

2404

1898

def process_request(self, request, client_address):

2405

1899

"""Overrides and wraps the original process_request().

2406

1900

2407

1901

This function creates a new pipe in self.pipe

2408

1902

"""

2409

1903

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2410

1904

2411

1905

proc = MultiprocessingMixIn.process_request(self, request,

2412

1906

client_address)

2413

1907

self.child_pipe.close()

2414

1908

self.add_pipe(parent_pipe, proc)

2415

1909

2416

1910

def add_pipe(self, parent_pipe, proc):

2417

1911

"""Dummy function; override as necessary"""

2418

raise NotImplementedError()

1912

raise NotImplementedError

2419

1913

2420

1914

2421

1915

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2422

1916

socketserver.TCPServer, object):

2423

1917

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2424

1918

2425

1919

Attributes:

2426

1920

enabled: Boolean; whether this server is activated yet

2427

1921

interface: None or a network interface name (string)

2428

1922

use_ipv6: Boolean; to use IPv6 or not

2429

1923

"""

2430

2431

1924

def __init__(self, server_address, RequestHandlerClass,

2432

interface=None,

2433

use_ipv6=True,

2434

socketfd=None):

1925

interface=None, use_ipv6=True, socketfd=None):

2435

1926

"""If socketfd is set, use that file descriptor instead of

2436

1927

creating a new one with socket.socket().

2437

1928

"""

2443

1934

self.socketfd = socketfd

2444

1935

# Save the original socket.socket() function

2445

1936

self.socket_socket = socket.socket

2446

2447

1937

# To implement --socket, we monkey patch socket.socket.

2448

#

1938

#

2449

1939

# (When socketserver.TCPServer is a new-style class, we

2450

1940

# could make self.socket into a property instead of monkey

2451

1941

# patching socket.socket.)

2452

#

1942

#

2453

1943

# Create a one-time-only replacement for socket.socket()

2454

1944

@functools.wraps(socket.socket)

2455

1945

def socket_wrapper(*args, **kwargs):

2467

1957

# socket_wrapper(), if socketfd was set.

2468

1958

socketserver.TCPServer.__init__(self, server_address,

2469

1959

RequestHandlerClass)

2470

1960

2471

1961

def server_bind(self):

2472

1962

"""This overrides the normal server_bind() function

2473

1963

to bind to an interface if one was specified, and also NOT to

2474

1964

bind to an address or port if they were not specified."""

2475

global SO_BINDTODEVICE

2476

1965

if self.interface is not None:

2477

1966

if SO_BINDTODEVICE is None:

2478

# Fall back to a hard-coded value which seems to be

2479

# common enough.

2480

logger.warning("SO_BINDTODEVICE not found, trying 25")

2481

SO_BINDTODEVICE = 25

2482

try:

2483

self.socket.setsockopt(

2484

socket.SOL_SOCKET, SO_BINDTODEVICE,

2485

(self.interface + "\0").encode("utf-8"))

2486

except socket.error as error:

2487

if error.errno == errno.EPERM:

2488

logger.error("No permission to bind to"

2489

" interface %s", self.interface)

2490

elif error.errno == errno.ENOPROTOOPT:

2491

logger.error("SO_BINDTODEVICE not available;"

2492

" cannot bind to interface %s",

2493

self.interface)

2494

elif error.errno == errno.ENODEV:

2495

logger.error("Interface %s does not exist,"

2496

" cannot bind", self.interface)

2497

else:

2498

raise

1967

logger.error("SO_BINDTODEVICE does not exist;"

1968

" cannot bind to interface %s",

1969

self.interface)

1970

else:

1971

try:

1972

self.socket.setsockopt(socket.SOL_SOCKET,

1973

SO_BINDTODEVICE,

1974

str(self.interface + '\0'))

1975

except socket.error as error:

1976

if error.errno == errno.EPERM:

1977

logger.error("No permission to bind to"

1978

" interface %s", self.interface)

1979

elif error.errno == errno.ENOPROTOOPT:

1980

logger.error("SO_BINDTODEVICE not available;"

1981

" cannot bind to interface %s",

1982

self.interface)

1983

elif error.errno == errno.ENODEV:

1984

logger.error("Interface %s does not exist,"

1985

" cannot bind", self.interface)

1986

else:

1987

raise

2499

1988

# Only bind(2) the socket if we really need to.

2500

1989

if self.server_address[0] or self.server_address[1]:

2501

1990

if not self.server_address[0]:

2502

1991

if self.address_family == socket.AF_INET6:

2503

any_address = "::" # in6addr_any

1992

any_address = "::" # in6addr_any

2504

1993

else:

2505

any_address = "0.0.0.0" # INADDR_ANY

1994

any_address = "0.0.0.0" # INADDR_ANY

2506

1995

self.server_address = (any_address,

2507

1996

self.server_address[1])

2508

1997

elif not self.server_address[1]:

2509

self.server_address = (self.server_address[0], 0)

1998

self.server_address = (self.server_address[0],

1999

0)

2510

2000

# if self.interface:

2511

2001

# self.server_address = (self.server_address[0],

2512

2002

# 0, # port

2518

2008

2519

2009

class MandosServer(IPv6_TCPServer):

2520

2010

"""Mandos server.

2521

2011

2522

2012

Attributes:

2523

2013

clients: set of Client objects

2524

2014

gnutls_priority GnuTLS priority string

2525

2015

use_dbus: Boolean; to emit D-Bus signals or not

2526

2527

Assumes a GLib.MainLoop event loop.

2016

2017

Assumes a gobject.MainLoop event loop.

2528

2018

"""

2529

2530

2019

def __init__(self, server_address, RequestHandlerClass,

2531

interface=None,

2532

use_ipv6=True,

2533

clients=None,

2534

gnutls_priority=None,

2535

use_dbus=True,

2536

socketfd=None):

2020

interface=None, use_ipv6=True, clients=None,

2021

gnutls_priority=None, use_dbus=True, socketfd=None):

2537

2022

self.enabled = False

2538

2023

self.clients = clients

2539

2024

if self.clients is None:

2542

2027

self.gnutls_priority = gnutls_priority

2543

2028

IPv6_TCPServer.__init__(self, server_address,

2544

2029

RequestHandlerClass,

2545

interface=interface,

2546

use_ipv6=use_ipv6,

2547

socketfd=socketfd)

2548

2030

interface = interface,

2031

use_ipv6 = use_ipv6,

2032

socketfd = socketfd)

2549

2033

def server_activate(self):

2550

2034

if self.enabled:

2551

2035

return socketserver.TCPServer.server_activate(self)

2552

2036

2553

2037

def enable(self):

2554

2038

self.enabled = True

2555

2039

2556

2040

def add_pipe(self, parent_pipe, proc):

2557

2041

# Call "handle_ipc" for both data and EOF events

2558

GLib.io_add_watch(

2559

parent_pipe.fileno(),

2560

GLib.IO_IN | GLib.IO_HUP,

2561

functools.partial(self.handle_ipc,

2562

parent_pipe=parent_pipe,

2563

proc=proc))

2564

2565

def handle_ipc(self, source, condition,

2566

parent_pipe=None,

2567

proc=None,

2568

client_object=None):

2042

gobject.io_add_watch(parent_pipe.fileno(),

2043

gobject.IO_IN | gobject.IO_HUP,

2044

functools.partial(self.handle_ipc,

2045

parent_pipe =

2046

parent_pipe,

2047

proc = proc))

2048

2049

def handle_ipc(self, source, condition, parent_pipe=None,

2050

proc = None, client_object=None):

2569

2051

# error, or the other end of multiprocessing.Pipe has closed

2570

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2052

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2571

2053

# Wait for other process to exit

2572

2054

proc.join()

2573

2055

return False

2574

2056

2575

2057

# Read a request from the child

2576

2058

request = parent_pipe.recv()

2577

2059

command = request[0]

2578

2060

2579

2061

if command == 'init':

2580

2062

fpr = request[1]

2581

2063

address = request[2]

2582

2583

for c in self.clients.values():

2064

2065

for c in self.clients.itervalues():

2584

2066

if c.fingerprint == fpr:

2585

2067

client = c

2586

2068

break

2593

2075

address[0])

2594

2076

parent_pipe.send(False)

2595

2077

return False

2596

2597

GLib.io_add_watch(

2598

parent_pipe.fileno(),

2599

GLib.IO_IN | GLib.IO_HUP,

2600

functools.partial(self.handle_ipc,

2601

parent_pipe=parent_pipe,

2602

proc=proc,

2603

client_object=client))

2078

2079

gobject.io_add_watch(parent_pipe.fileno(),

2080

gobject.IO_IN | gobject.IO_HUP,

2081

functools.partial(self.handle_ipc,

2082

parent_pipe =

2083

parent_pipe,

2084

proc = proc,

2085

client_object =

2086

client))

2604

2087

parent_pipe.send(True)

2605

2088

# remove the old hook in favor of the new above hook on

2606

2089

# same fileno

2609

2092

funcname = request[1]

2610

2093

args = request[2]

2611

2094

kwargs = request[3]

2612

2095

2613

2096

parent_pipe.send(('data', getattr(client_object,

2614

2097

funcname)(*args,

2615

**kwargs)))

2616

2098

**kwargs)))

2099

2617

2100

if command == 'getattr':

2618

2101

attrname = request[1]

2619

if isinstance(client_object.__getattribute__(attrname),

2620

collections.Callable):

2621

parent_pipe.send(('function', ))

2102

if callable(client_object.__getattribute__(attrname)):

2103

parent_pipe.send(('function',))

2622

2104

else:

2623

parent_pipe.send((

2624

'data', client_object.__getattribute__(attrname)))

2625

2105

parent_pipe.send(('data', client_object

2106

.__getattribute__(attrname)))

2107

2626

2108

if command == 'setattr':

2627

2109

attrname = request[1]

2628

2110

value = request[2]

2629

2111

setattr(client_object, attrname, value)

2630

2112

2631

2113

return True

2632

2114

2633

2115

2634

2116

def rfc3339_duration_to_delta(duration):

2635

2117

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2636

2118

2637

2119

>>> rfc3339_duration_to_delta("P7D")

2638

2120

datetime.timedelta(7)

2639

2121

>>> rfc3339_duration_to_delta("PT60S")

2649

2131

>>> rfc3339_duration_to_delta("P1DT3M20S")

2650

2132

datetime.timedelta(1, 200)

2651

2133

"""

2652

2134

2653

2135

# Parsing an RFC 3339 duration with regular expressions is not

2654

2136

# possible - there would have to be multiple places for the same

2655

2137

# values, like seconds. The current code, while more esoteric, is

2656

2138

# cleaner without depending on a parsing library. If Python had a

2657

2139

# built-in library for parsing we would use it, but we'd like to

2658

2140

# avoid excessive use of external libraries.

2659

2141

2660

2142

# New type for defining tokens, syntax, and semantics all-in-one

2661

Token = collections.namedtuple("Token", (

2662

"regexp", # To match token; if "value" is not None, must have

2663

# a "group" containing digits

2664

"value", # datetime.timedelta or None

2665

"followers")) # Tokens valid after this token

2143

Token = collections.namedtuple("Token",

2144

("regexp", # To match token; if

2145

# "value" is not None,

2146

# must have a "group"

2147

# containing digits

2148

"value", # datetime.timedelta or

2149

# None

2150

"followers")) # Tokens valid after

2151

# this token

2666

2152

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2667

2153

# the "duration" ABNF definition in RFC 3339, Appendix A.

2668

2154

token_end = Token(re.compile(r"$"), None, frozenset())

2669

2155

token_second = Token(re.compile(r"(\d+)S"),

2670

2156

datetime.timedelta(seconds=1),

2671

frozenset((token_end, )))

2157

frozenset((token_end,)))

2672

2158

token_minute = Token(re.compile(r"(\d+)M"),

2673

2159

datetime.timedelta(minutes=1),

2674

2160

frozenset((token_second, token_end)))

2690

2176

frozenset((token_month, token_end)))

2691

2177

token_week = Token(re.compile(r"(\d+)W"),

2692

2178

datetime.timedelta(weeks=1),

2693

frozenset((token_end, )))

2179

frozenset((token_end,)))

2694

2180

token_duration = Token(re.compile(r"P"), None,

2695

2181

frozenset((token_year, token_month,

2696

2182

token_day, token_time,

2697

token_week)))

2698

# Define starting values:

2699

# Value so far

2700

value = datetime.timedelta()

2183

token_week))),

2184

# Define starting values

2185

value = datetime.timedelta() # Value so far

2701

2186

found_token = None

2702

# Following valid tokens

2703

followers = frozenset((token_duration, ))

2704

# String left to parse

2705

s = duration

2187

followers = frozenset(token_duration,) # Following valid tokens

2188

s = duration # String left to parse

2706

2189

# Loop until end token is found

2707

2190

while found_token is not token_end:

2708

2191

# Search for any currently valid tokens

2724

2207

break

2725

2208

else:

2726

2209

# No currently valid tokens were found

2727

raise ValueError("Invalid RFC 3339 duration: {!r}"

2728

.format(duration))

2210

raise ValueError("Invalid RFC 3339 duration")

2729

2211

# End token found

2730

2212

return value

2731

2213

2732

2214

2733

2215

def string_to_delta(interval):

2734

2216

"""Parse a string and return a datetime.timedelta

2735

2217

2736

2218

>>> string_to_delta('7d')

2737

2219

datetime.timedelta(7)

2738

2220

>>> string_to_delta('60s')

2746

2228

>>> string_to_delta('5m 30s')

2747

2229

datetime.timedelta(0, 330)

2748

2230

"""

2749

2231

2750

2232

try:

2751

2233

return rfc3339_duration_to_delta(interval)

2752

2234

except ValueError:

2753

2235

pass

2754

2236

2755

2237

timevalue = datetime.timedelta(0)

2756

2238

for s in interval.split():

2757

2239

try:

2758

suffix = s[-1]

2240

suffix = unicode(s[-1])

2759

2241

value = int(s[:-1])

2760

2242

if suffix == "d":

2761

2243

delta = datetime.timedelta(value)

2768

2250

elif suffix == "w":

2769

2251

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2770

2252

else:

2771

raise ValueError("Unknown suffix {!r}".format(suffix))

2772

except IndexError as e:

2253

raise ValueError("Unknown suffix {0!r}"

2254

.format(suffix))

2255

except (ValueError, IndexError) as e:

2773

2256

raise ValueError(*(e.args))

2774

2257

timevalue += delta

2775

2258

return timevalue

2776

2259

2777

2260

2778

def daemon(nochdir=False, noclose=False):

2261

def daemon(nochdir = False, noclose = False):

2779

2262

"""See daemon(3). Standard BSD Unix function.

2780

2263

2781

2264

This should really exist as os.daemon, but it doesn't (yet)."""

2782

2265

if os.fork():

2783

2266

sys.exit()

2791

2274

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2792

2275

if not stat.S_ISCHR(os.fstat(null).st_mode):

2793

2276

raise OSError(errno.ENODEV,

2794

"{} not a character device"

2277

"{0} not a character device"

2795

2278

.format(os.devnull))

2796

2279

os.dup2(null, sys.stdin.fileno())

2797

2280

os.dup2(null, sys.stdout.fileno())

2801

2284

2802

2285

2803

2286

def main():

2804

2287

2805

2288

##################################################################

2806

2289

# Parsing of options, both command line and config file

2807

2290

2808

2291

parser = argparse.ArgumentParser()

2809

2292

parser.add_argument("-v", "--version", action="version",

2810

version="%(prog)s {}".format(version),

2293

version = "%(prog)s {0}".format(version),

2811

2294

help="show version number and exit")

2812

2295

parser.add_argument("-i", "--interface", metavar="IF",

2813

2296

help="Bind to interface IF")

2846

2329

help="Directory to save/restore state in")

2847

2330

parser.add_argument("--foreground", action="store_true",

2848

2331

help="Run in foreground", default=None)

2849

parser.add_argument("--no-zeroconf", action="store_false",

2850

dest="zeroconf", help="Do not use Zeroconf",

2851

default=None)

2852

2332

2853

2333

options = parser.parse_args()

2854

2334

2855

2335

if options.check:

2856

2336

import doctest

2857

fail_count, test_count = doctest.testmod()

2858

sys.exit(os.EX_OK if fail_count == 0 else 1)

2859

2337

doctest.testmod()

2338

sys.exit()

2339

2860

2340

# Default values for config file for server-global settings

2861

server_defaults = {"interface": "",

2862

"address": "",

2863

"port": "",

2864

"debug": "False",

2865

"priority":

2866

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2867

":+SIGN-DSA-SHA256",

2868

"servicename": "Mandos",

2869

"use_dbus": "True",

2870

"use_ipv6": "True",

2871

"debuglevel": "",

2872

"restore": "True",

2873

"socket": "",

2874

"statedir": "/var/lib/mandos",

2875

"foreground": "False",

2876

"zeroconf": "True",

2877

}

2878

2341

server_defaults = { "interface": "",

2342

"address": "",

2343

"port": "",

2344

"debug": "False",

2345

"priority":

2346

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224",

2347

"servicename": "Mandos",

2348

"use_dbus": "True",

2349

"use_ipv6": "True",

2350

"debuglevel": "",

2351

"restore": "True",

2352

"socket": "",

2353

"statedir": "/var/lib/mandos",

2354

"foreground": "False",

2355

}

2356

2879

2357

# Parse config file for server-global settings

2880

2358

server_config = configparser.SafeConfigParser(server_defaults)

2881

2359

del server_defaults

2882

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2360

server_config.read(os.path.join(options.configdir,

2361

"mandos.conf"))

2883

2362

# Convert the SafeConfigParser object to a dict

2884

2363

server_settings = server_config.defaults()

2885

2364

# Use the appropriate methods on the non-string config options

2899

2378

server_settings["socket"] = os.dup(server_settings

2900

2379

["socket"])

2901

2380

del server_config

2902

2381

2903

2382

# Override the settings from the config file with command line

2904

2383

# options, if set.

2905

2384

for option in ("interface", "address", "port", "debug",

2906

"priority", "servicename", "configdir", "use_dbus",

2907

"use_ipv6", "debuglevel", "restore", "statedir",

2908

"socket", "foreground", "zeroconf"):

2385

"priority", "servicename", "configdir",

2386

"use_dbus", "use_ipv6", "debuglevel", "restore",

2387

"statedir", "socket", "foreground"):

2909

2388

value = getattr(options, option)

2910

2389

if value is not None:

2911

2390

server_settings[option] = value

2912

2391

del options

2913

2392

# Force all strings to be unicode

2914

2393

for option in server_settings.keys():

2915

if isinstance(server_settings[option], bytes):

2916

server_settings[option] = (server_settings[option]

2917

.decode("utf-8"))

2394

if type(server_settings[option]) is str:

2395

server_settings[option] = unicode(server_settings[option])

2918

2396

# Force all boolean options to be boolean

2919

2397

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2920

"foreground", "zeroconf"):

2398

"foreground"):

2921

2399

server_settings[option] = bool(server_settings[option])

2922

2400

# Debug implies foreground

2923

2401

if server_settings["debug"]:

2924

2402

server_settings["foreground"] = True

2925

2403

# Now we have our good server settings in "server_settings"

2926

2404

2927

2405

##################################################################

2928

2929

if (not server_settings["zeroconf"]

2930

and not (server_settings["port"]

2931

or server_settings["socket"] != "")):

2932

parser.error("Needs port or socket to work without Zeroconf")

2933

2406

2934

2407

# For convenience

2935

2408

debug = server_settings["debug"]

2936

2409

debuglevel = server_settings["debuglevel"]

2939

2412

stored_state_path = os.path.join(server_settings["statedir"],

2940

2413

stored_state_file)

2941

2414

foreground = server_settings["foreground"]

2942

zeroconf = server_settings["zeroconf"]

2943

2415

2944

2416

if debug:

2945

2417

initlogger(debug, logging.DEBUG)

2946

2418

else:

2949

2421

else:

2950

2422

level = getattr(logging, debuglevel.upper())

2951

2423

initlogger(debug, level)

2952

2424

2953

2425

if server_settings["servicename"] != "Mandos":

2954

syslogger.setFormatter(

2955

logging.Formatter('Mandos ({}) [%(process)d]:'

2956

' %(levelname)s: %(message)s'.format(

2957

server_settings["servicename"])))

2958

2426

syslogger.setFormatter(logging.Formatter

2427

('Mandos ({0}) [%(process)d]:'

2428

' %(levelname)s: %(message)s'

2429

.format(server_settings

2430

["servicename"])))

2431

2959

2432

# Parse config file with clients

2960

2433

client_config = configparser.SafeConfigParser(Client

2961

2434

.client_defaults)

2962

2435

client_config.read(os.path.join(server_settings["configdir"],

2963

2436

"clients.conf"))

2964

2437

2965

2438

global mandos_dbus_service

2966

2439

mandos_dbus_service = None

2967

2968

socketfd = None

2969

if server_settings["socket"] != "":

2970

socketfd = server_settings["socket"]

2971

tcp_server = MandosServer(

2972

(server_settings["address"], server_settings["port"]),

2973

ClientHandler,

2974

interface=(server_settings["interface"] or None),

2975

use_ipv6=use_ipv6,

2976

gnutls_priority=server_settings["priority"],

2977

use_dbus=use_dbus,

2978

socketfd=socketfd)

2440

2441

tcp_server = MandosServer((server_settings["address"],

2442

server_settings["port"]),

2443

ClientHandler,

2444

interface=(server_settings["interface"]

2445

or None),

2446

use_ipv6=use_ipv6,

2447

gnutls_priority=

2448

server_settings["priority"],

2449

use_dbus=use_dbus,

2450

socketfd=(server_settings["socket"]

2451

or None))

2979

2452

if not foreground:

2980

2453

pidfilename = "/run/mandos.pid"

2981

if not os.path.isdir("/run/."):

2982

pidfilename = "/var/run/mandos.pid"

2983

2454

pidfile = None

2984

2455

try:

2985

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2456

pidfile = open(pidfilename, "w")

2986

2457

except IOError as e:

2987

2458

logger.error("Could not open file %r", pidfilename,

2988

2459

exc_info=e)

2989

2990

for name, group in (("_mandos", "_mandos"),

2991

("mandos", "mandos"),

2992

("nobody", "nogroup")):

2460

2461

for name in ("_mandos", "mandos", "nobody"):

2993

2462

try:

2994

2463

uid = pwd.getpwnam(name).pw_uid

2995

gid = pwd.getpwnam(group).pw_gid

2464

gid = pwd.getpwnam(name).pw_gid

2996

2465

break

2997

2466

except KeyError:

2998

2467

continue

3002

2471

try:

3003

2472

os.setgid(gid)

3004

2473

os.setuid(uid)

3005

if debug:

3006

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3007

gid))

3008

2474

except OSError as error:

3009

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3010

.format(uid, gid, os.strerror(error.errno)))

3011

2475

if error.errno != errno.EPERM:

3012

raise

3013

2476

raise error

2477

3014

2478

if debug:

3015

2479

# Enable all possible GnuTLS debugging

3016

2480

3017

2481

# "Use a log level over 10 to enable all debugging options."

3018

2482

# - GnuTLS manual

3019

gnutls.global_set_log_level(11)

3020

3021

@gnutls.log_func

2483

gnutls.library.functions.gnutls_global_set_log_level(11)

2484

2485

@gnutls.library.types.gnutls_log_func

3022

2486

def debug_gnutls(level, string):

3023

2487

logger.debug("GnuTLS: %s", string[:-1])

3024

3025

gnutls.global_set_log_function(debug_gnutls)

3026

2488

2489

(gnutls.library.functions

2490

.gnutls_global_set_log_function(debug_gnutls))

2491

3027

2492

# Redirect stdin so all checkers get /dev/null

3028

2493

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3029

2494

os.dup2(null, sys.stdin.fileno())

3030

2495

if null > 2:

3031

2496

os.close(null)

3032

2497

3033

2498

# Need to fork before connecting to D-Bus

3034

2499

if not foreground:

3035

2500

# Close all input and output, do double fork, etc.

3036

2501

daemon()

3037

3038

# multiprocessing will use threads, so before we use GLib we need

3039

# to inform GLib that threads will be used.

3040

GLib.threads_init()

3041

2502

2503

# multiprocessing will use threads, so before we use gobject we

2504

# need to inform gobject that threads will be used.

2505

gobject.threads_init()

2506

3042

2507

global main_loop

3043

2508

# From the Avahi example code

3044

2509

DBusGMainLoop(set_as_default=True)

3045

main_loop = GLib.MainLoop()

2510

main_loop = gobject.MainLoop()

3046

2511

bus = dbus.SystemBus()

3047

2512

# End of Avahi example code

3048

2513

if use_dbus:

3049

2514

try:

3050

2515

bus_name = dbus.service.BusName("se.recompile.Mandos",

3051

bus,

3052

do_not_queue=True)

3053

old_bus_name = dbus.service.BusName(

3054

"se.bsnet.fukt.Mandos", bus,

3055

do_not_queue=True)

3056

except dbus.exceptions.DBusException as e:

2516

bus, do_not_queue=True)

2517

old_bus_name = (dbus.service.BusName

2518

("se.bsnet.fukt.Mandos", bus,

2519

do_not_queue=True))

2520

except dbus.exceptions.NameExistsException as e:

3057

2521

logger.error("Disabling D-Bus:", exc_info=e)

3058

2522

use_dbus = False

3059

2523

server_settings["use_dbus"] = False

3060

2524

tcp_server.use_dbus = False

3061

if zeroconf:

3062

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3063

service = AvahiServiceToSyslog(

3064

name=server_settings["servicename"],

3065

servicetype="_mandos._tcp",

3066

protocol=protocol,

3067

bus=bus)

3068

if server_settings["interface"]:

3069

service.interface = if_nametoindex(

3070

server_settings["interface"].encode("utf-8"))

3071

2525

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2526

service = AvahiServiceToSyslog(name =

2527

server_settings["servicename"],

2528

servicetype = "_mandos._tcp",

2529

protocol = protocol, bus = bus)

2530

if server_settings["interface"]:

2531

service.interface = (if_nametoindex

2532

(str(server_settings["interface"])))

2533

3072

2534

global multiprocessing_manager

3073

2535

multiprocessing_manager = multiprocessing.Manager()

3074

2536

3075

2537

client_class = Client

3076

2538

if use_dbus:

3077

client_class = functools.partial(ClientDBus, bus=bus)

3078

2539

client_class = functools.partial(ClientDBus, bus = bus)

2540

3079

2541

client_settings = Client.config_parser(client_config)

3080

2542

old_client_settings = {}

3081

2543

clients_data = {}

3082

2544

3083

2545

# This is used to redirect stdout and stderr for checker processes

3084

2546

global wnull

3085

wnull = open(os.devnull, "w") # A writable /dev/null

2547

wnull = open(os.devnull, "w") # A writable /dev/null

3086

2548

# Only used if server is running in foreground but not in debug

3087

2549

# mode

3088

2550

if debug or not foreground:

3089

2551

wnull.close()

3090

2552

3091

2553

# Get client data and settings from last running state.

3092

2554

if server_settings["restore"]:

3093

2555

try:

3094

2556

with open(stored_state_path, "rb") as stored_state:

3095

if sys.version_info.major == 2:

3096

clients_data, old_client_settings = pickle.load(

3097

stored_state)

3098

else:

3099

bytes_clients_data, bytes_old_client_settings = (

3100

pickle.load(stored_state, encoding="bytes"))

3101

# Fix bytes to strings

3102

# clients_data

3103

# .keys()

3104

clients_data = {(key.decode("utf-8")

3105

if isinstance(key, bytes)

3106

else key): value

3107

for key, value in

3108

bytes_clients_data.items()}

3109

del bytes_clients_data

3110

for key in clients_data:

3111

value = {(k.decode("utf-8")

3112

if isinstance(k, bytes) else k): v

3113

for k, v in

3114

clients_data[key].items()}

3115

clients_data[key] = value

3116

# .client_structure

3117

value["client_structure"] = [

3118

(s.decode("utf-8")

3119

if isinstance(s, bytes)

3120

else s) for s in

3121

value["client_structure"]]

3122

# .name & .host

3123

for k in ("name", "host"):

3124

if isinstance(value[k], bytes):

3125

value[k] = value[k].decode("utf-8")

3126

# old_client_settings

3127

# .keys()

3128

old_client_settings = {

3129

(key.decode("utf-8")

3130

if isinstance(key, bytes)

3131

else key): value

3132

for key, value in

3133

bytes_old_client_settings.items()}

3134

del bytes_old_client_settings

3135

# .host

3136

for value in old_client_settings.values():

3137

if isinstance(value["host"], bytes):

3138

value["host"] = (value["host"]

3139

.decode("utf-8"))

2557

clients_data, old_client_settings = (pickle.load

2558

(stored_state))

3140

2559

os.remove(stored_state_path)

3141

2560

except IOError as e:

3142

2561

if e.errno == errno.ENOENT:

3143

logger.warning("Could not load persistent state:"

3144

" {}".format(os.strerror(e.errno)))

2562

logger.warning("Could not load persistent state: {0}"

2563

.format(os.strerror(e.errno)))

3145

2564

else:

3146

2565

logger.critical("Could not load persistent state:",

3147

2566

exc_info=e)

3148

2567

raise

3149

2568

except EOFError as e:

3150

2569

logger.warning("Could not load persistent state: "

3151

"EOFError:",

3152

exc_info=e)

3153

2570

"EOFError:", exc_info=e)

2571

3154

2572

with PGPEngine() as pgp:

3155

for client_name, client in clients_data.items():

2573

for client_name, client in clients_data.iteritems():

3156

2574

# Skip removed clients

3157

2575

if client_name not in client_settings:

3158

2576

continue

3159

2577

3160

2578

# Decide which value to use after restoring saved state.

3161

2579

# We have three different values: Old config file,

3162

2580

# new config file, and saved state.

3167

2585

# For each value in new config, check if it

3168

2586

# differs from the old config value (Except for

3169

2587

# the "secret" attribute)

3170

if (name != "secret"

3171

and (value !=

3172

old_client_settings[client_name][name])):

2588

if (name != "secret" and

2589

value != old_client_settings[client_name]

2590

[name]):

3173

2591

client[name] = value

3174

2592

except KeyError:

3175

2593

pass

3176

2594

3177

2595

# Clients who has passed its expire date can still be

3178

# enabled if its last checker was successful. A Client

2596

# enabled if its last checker was successful. Clients

3179

2597

# whose checker succeeded before we stored its state is

3180

2598

# assumed to have successfully run all checkers during

3181

2599

# downtime.

3183

2601

if datetime.datetime.utcnow() >= client["expires"]:

3184

2602

if not client["last_checked_ok"]:

3185

2603

logger.warning(

3186

"disabling client {} - Client never "

3187

"performed a successful checker".format(

3188

client_name))

2604

"disabling client {0} - Client never "

2605

"performed a successful checker"

2606

.format(client_name))

3189

2607

client["enabled"] = False

3190

2608

elif client["last_checker_status"] != 0:

3191

2609

logger.warning(

3192

"disabling client {} - Client last"

3193

" checker failed with error code"

3194

" {}".format(

3195

client_name,

3196

client["last_checker_status"]))

2610

"disabling client {0} - Client "

2611

"last checker failed with error code {1}"

2612

.format(client_name,

2613

client["last_checker_status"]))

3197

2614

client["enabled"] = False

3198

2615

else:

3199

client["expires"] = (

3200

datetime.datetime.utcnow()

3201

+ client["timeout"])

2616

client["expires"] = (datetime.datetime

2617

.utcnow()

2618

+ client["timeout"])

3202

2619

logger.debug("Last checker succeeded,"

3203

" keeping {} enabled".format(

3204

client_name))

2620

" keeping {0} enabled"

2621

.format(client_name))

3205

2622

try:

3206

client["secret"] = pgp.decrypt(

3207

client["encrypted_secret"],

3208

client_settings[client_name]["secret"])

2623

client["secret"] = (

2624

pgp.decrypt(client["encrypted_secret"],

2625

client_settings[client_name]

2626

["secret"]))

3209

2627

except PGPError:

3210

2628

# If decryption fails, we use secret from new settings

3211

logger.debug("Failed to decrypt {} old secret".format(

3212

client_name))

3213

client["secret"] = (client_settings[client_name]

3214

["secret"])

3215

2629

logger.debug("Failed to decrypt {0} old secret"

2630

.format(client_name))

2631

client["secret"] = (

2632

client_settings[client_name]["secret"])

2633

3216

2634

# Add/remove clients based on new changes made to config

3217

2635

for client_name in (set(old_client_settings)

3218

2636

- set(client_settings)):

3220

2638

for client_name in (set(client_settings)

3221

2639

- set(old_client_settings)):

3222

2640

clients_data[client_name] = client_settings[client_name]

3223

2641

3224

2642

# Create all client objects

3225

for client_name, client in clients_data.items():

2643

for client_name, client in clients_data.iteritems():

3226

2644

tcp_server.clients[client_name] = client_class(

3227

name=client_name,

3228

settings=client,

3229

server_settings=server_settings)

3230

2645

name = client_name, settings = client,

2646

server_settings = server_settings)

2647

3231

2648

if not tcp_server.clients:

3232

2649

logger.warning("No clients defined")

3233

2650

3234

2651

if not foreground:

3235

2652

if pidfile is not None:

3236

pid = os.getpid()

3237

2653

try:

3238

2654

with pidfile:

3239

print(pid, file=pidfile)

2655

pid = os.getpid()

2656

pidfile.write(str(pid) + "\n".encode("utf-8"))

3240

2657

except IOError:

3241

2658

logger.error("Could not write to file %r with PID %d",

3242

2659

pidfilename, pid)

3243

2660

del pidfile

3244

2661

del pidfilename

3245

3246

for termsig in (signal.SIGHUP, signal.SIGTERM):

3247

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3248

lambda: main_loop.quit() and False)

3249

2662

2663

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2664

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2665

3250

2666

if use_dbus:

3251

3252

@alternate_dbus_interfaces(

3253

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3254

class MandosDBusService(DBusObjectWithObjectManager):

2667

@alternate_dbus_interfaces({"se.recompile.Mandos":

2668

"se.bsnet.fukt.Mandos"})

2669

class MandosDBusService(DBusObjectWithProperties):

3255

2670

"""A D-Bus proxy object"""

3256

3257

2671

def __init__(self):

3258

2672

dbus.service.Object.__init__(self, bus, "/")

3259

3260

2673

_interface = "se.recompile.Mandos"

3261

2674

2675

@dbus_interface_annotations(_interface)

2676

def _foo(self):

2677

return { "org.freedesktop.DBus.Property"

2678

".EmitsChangedSignal":

2679

"false"}

2680

3262

2681

@dbus.service.signal(_interface, signature="o")

3263

2682

def ClientAdded(self, objpath):

3264

2683

"D-Bus signal"

3265

2684

pass

3266

2685

3267

2686

@dbus.service.signal(_interface, signature="ss")

3268

2687

def ClientNotFound(self, fingerprint, address):

3269

2688

"D-Bus signal"

3270

2689

pass

3271

3272

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3273

"true"})

2690

3274

2691

@dbus.service.signal(_interface, signature="os")

3275

2692

def ClientRemoved(self, objpath, name):

3276

2693

"D-Bus signal"

3277

2694

pass

3278

3279

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3280

"true"})

2695

3281

2696

@dbus.service.method(_interface, out_signature="ao")

3282

2697

def GetAllClients(self):

3283

2698

"D-Bus method"

3284

return dbus.Array(c.dbus_object_path for c in

3285

tcp_server.clients.values())

3286

3287

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3288

"true"})

2699

return dbus.Array(c.dbus_object_path

2700

for c in

2701

tcp_server.clients.itervalues())

2702

3289

2703

@dbus.service.method(_interface,

3290

2704

out_signature="a{oa{sv}}")

3291

2705

def GetAllClientsWithProperties(self):

3292

2706

"D-Bus method"

3293

2707

return dbus.Dictionary(

3294

{c.dbus_object_path: c.GetAll(

3295

"se.recompile.Mandos.Client")

3296

for c in tcp_server.clients.values()},

2708

((c.dbus_object_path, c.GetAll(""))

2709

for c in tcp_server.clients.itervalues()),

3297

2710

signature="oa{sv}")

3298

2711

3299

2712

@dbus.service.method(_interface, in_signature="o")

3300

2713

def RemoveClient(self, object_path):

3301

2714

"D-Bus method"

3302

for c in tcp_server.clients.values():

2715

for c in tcp_server.clients.itervalues():

3303

2716

if c.dbus_object_path == object_path:

3304

2717

del tcp_server.clients[c.name]

3305

2718

c.remove_from_connection()

3306

# Don't signal the disabling

2719

# Don't signal anything except ClientRemoved

3307

2720

c.disable(quiet=True)

3308

# Emit D-Bus signal for removal

3309

self.client_removed_signal(c)

2721

# Emit D-Bus signal

2722

self.ClientRemoved(object_path, c.name)

3310

2723

return

3311

2724

raise KeyError(object_path)

3312

2725

3313

2726

del _interface

3314

3315

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3316

out_signature="a{oa{sa{sv}}}")

3317

def GetManagedObjects(self):

3318

"""D-Bus method"""

3319

return dbus.Dictionary(

3320

{client.dbus_object_path:

3321

dbus.Dictionary(

3322

{interface: client.GetAll(interface)

3323

for interface in

3324

client._get_all_interface_names()})

3325

for client in tcp_server.clients.values()})

3326

3327

def client_added_signal(self, client):

3328

"""Send the new standard signal and the old signal"""

3329

if use_dbus:

3330

# New standard signal

3331

self.InterfacesAdded(

3332

client.dbus_object_path,

3333

dbus.Dictionary(

3334

{interface: client.GetAll(interface)

3335

for interface in

3336

client._get_all_interface_names()}))

3337

# Old signal

3338

self.ClientAdded(client.dbus_object_path)

3339

3340

def client_removed_signal(self, client):

3341

"""Send the new standard signal and the old signal"""

3342

if use_dbus:

3343

# New standard signal

3344

self.InterfacesRemoved(

3345

client.dbus_object_path,

3346

client._get_all_interface_names())

3347

# Old signal

3348

self.ClientRemoved(client.dbus_object_path,

3349

client.name)

3350

2727

3351

2728

mandos_dbus_service = MandosDBusService()

3352

3353

# Save modules to variables to exempt the modules from being

3354

# unloaded before the function registered with atexit() is run.

3355

mp = multiprocessing

3356

wn = wnull

3357

2729

3358

2730

def cleanup():

3359

2731

"Cleanup function; run on exit"

3360

if zeroconf:

3361

service.cleanup()

3362

3363

mp.active_children()

3364

wn.close()

2732

service.cleanup()

2733

2734

multiprocessing.active_children()

2735

wnull.close()

3365

2736

if not (tcp_server.clients or client_settings):

3366

2737

return

3367

2738

3368

2739

# Store client before exiting. Secrets are encrypted with key

3369

2740

# based on what config file has. If config file is

3370

2741

# removed/edited, old secret will thus be unrecovable.

3371

2742

clients = {}

3372

2743

with PGPEngine() as pgp:

3373

for client in tcp_server.clients.values():

2744

for client in tcp_server.clients.itervalues():

3374

2745

key = client_settings[client.name]["secret"]

3375

2746

client.encrypted_secret = pgp.encrypt(client.secret,

3376

2747

key)

3377

2748

client_dict = {}

3378

2749

3379

2750

# A list of attributes that can not be pickled

3380

2751

# + secret.

3381

exclude = {"bus", "changedstate", "secret",

3382

"checker", "server_settings"}

3383

for name, typ in inspect.getmembers(dbus.service

3384

.Object):

2752

exclude = set(("bus", "changedstate", "secret",

2753

"checker", "server_settings"))

2754

for name, typ in (inspect.getmembers

2755

(dbus.service.Object)):

3385

2756

exclude.add(name)

3386

2757

3387

2758

client_dict["encrypted_secret"] = (client

3388

2759

.encrypted_secret)

3389

2760

for attr in client.client_structure:

3390

2761

if attr not in exclude:

3391

2762

client_dict[attr] = getattr(client, attr)

3392

2763

3393

2764

clients[client.name] = client_dict

3394

2765

del client_settings[client.name]["secret"]

3395

2766

3396

2767

try:

3397

with tempfile.NamedTemporaryFile(

3398

mode='wb',

3399

suffix=".pickle",

3400

prefix='clients-',

3401

dir=os.path.dirname(stored_state_path),

3402

delete=False) as stored_state:

3403

pickle.dump((clients, client_settings), stored_state,

3404

protocol=2)

3405

tempname = stored_state.name

2768

with (tempfile.NamedTemporaryFile

2769

(mode='wb', suffix=".pickle", prefix='clients-',

2770

dir=os.path.dirname(stored_state_path),

2771

delete=False)) as stored_state:

2772

pickle.dump((clients, client_settings), stored_state)

2773

tempname=stored_state.name

3406

2774

os.rename(tempname, stored_state_path)

3407

2775

except (IOError, OSError) as e:

3408

2776

if not debug:

3411

2779

except NameError:

3412

2780

pass

3413

2781

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3414

logger.warning("Could not save persistent state: {}"

2782

logger.warning("Could not save persistent state: {0}"

3415

2783

.format(os.strerror(e.errno)))

3416

2784

else:

3417

2785

logger.warning("Could not save persistent state:",

3418

2786

exc_info=e)

3419

raise

3420

2787

raise e

2788

3421

2789

# Delete all clients, and settings from config

3422

2790

while tcp_server.clients:

3423

2791

name, client = tcp_server.clients.popitem()

3424

2792

if use_dbus:

3425

2793

client.remove_from_connection()

3426

# Don't signal the disabling

2794

# Don't signal anything except ClientRemoved

3427

2795

client.disable(quiet=True)

3428

# Emit D-Bus signal for removal

3429

2796

if use_dbus:

3430

mandos_dbus_service.client_removed_signal(client)

2797

# Emit D-Bus signal

2798

mandos_dbus_service.ClientRemoved(client

2799

.dbus_object_path,

2800

client.name)

3431

2801

client_settings.clear()

3432

2802

3433

2803

atexit.register(cleanup)

3434

3435

for client in tcp_server.clients.values():

2804

2805

for client in tcp_server.clients.itervalues():

3436

2806

if use_dbus:

3437

# Emit D-Bus signal for adding

3438

mandos_dbus_service.client_added_signal(client)

2807

# Emit D-Bus signal

2808

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3439

2809

# Need to initiate checking of clients

3440

2810

if client.enabled:

3441

2811

client.init_checker()

3442

2812

3443

2813

tcp_server.enable()

3444

2814

tcp_server.server_activate()

3445

2815

3446

2816

# Find out what port we got

3447

if zeroconf:

3448

service.port = tcp_server.socket.getsockname()[1]

2817

service.port = tcp_server.socket.getsockname()[1]

3449

2818

if use_ipv6:

3450

2819

logger.info("Now listening on address %r, port %d,"

3451

2820

" flowinfo %d, scope_id %d",

3453

2822

else: # IPv4

3454

2823

logger.info("Now listening on address %r, port %d",

3455

2824

*tcp_server.socket.getsockname())

3456

3457

# service.interface = tcp_server.socket.getsockname()[3]

3458

2825

2826

#service.interface = tcp_server.socket.getsockname()[3]

2827

3459

2828

try:

3460

if zeroconf:

3461

# From the Avahi example code

3462

try:

3463

service.activate()

3464

except dbus.exceptions.DBusException as error:

3465

logger.critical("D-Bus Exception", exc_info=error)

3466

cleanup()

3467

sys.exit(1)

3468

# End of Avahi example code

3469

3470

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3471

lambda *args, **kwargs:

3472

(tcp_server.handle_request

3473

(*args[2:], **kwargs) or True))

3474

2829

# From the Avahi example code

2830

try:

2831

service.activate()

2832

except dbus.exceptions.DBusException as error:

2833

logger.critical("D-Bus Exception", exc_info=error)

2834

cleanup()

2835

sys.exit(1)

2836

# End of Avahi example code

2837

2838

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2839

lambda *args, **kwargs:

2840

(tcp_server.handle_request

2841

(*args[2:], **kwargs) or True))

2842

3475

2843

logger.debug("Starting main loop")

3476

2844

main_loop.run()

3477

2845

except AvahiError as error:

3486

2854

# Must run before the D-Bus bus name gets deregistered

3487

2855

cleanup()

3488

2856

3489

3490

2857

if __name__ == '__main__':

3491

2858

main()