/mandos/release : revision 237.7.179

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

39

import SocketServer as socketserver

43

40

import socket

44

41

import argparse

45

42

import datetime

50

47

import gnutls.library.functions

51

48

import gnutls.library.constants

52

49

import gnutls.library.types

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

50

import ConfigParser as configparser

57

51

import sys

58

52

import re

59

53

import os

68

62

import struct

69

63

import fcntl

70

64

import functools

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

65

import cPickle as pickle

75

66

import multiprocessing

76

67

import types

77

68

import binascii

78

69

import tempfile

79

70

import itertools

80

71

import collections

81

import codecs

82

72

83

73

import dbus

84

74

import dbus.service

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

75

import gobject

89

76

import avahi

90

77

from dbus.mainloop.glib import DBusGMainLoop

91

78

import ctypes

101

88

except ImportError:

102

89

SO_BINDTODEVICE = None

103

90

104

if sys.version_info.major == 2:

105

str = unicode

106

107

version = "1.6.9"

91

version = "1.6.1"

108

92

stored_state_file = "clients.pickle"

109

93

110

94

logger = logging.getLogger()

111

syslogger = None

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

112

98

113

99

try:

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

116

103

except (OSError, AttributeError):

117

118

104

def if_nametoindex(interface):

119

105

"Get an interface index the hard way, i.e. using fcntl()"

120

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

121

107

with contextlib.closing(socket.socket()) as s:

122

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

123

struct.pack(b"16s16x", interface))

124

interface_index = struct.unpack("I", ifreq[16:20])[0]

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

125

113

return interface_index

126

114

127

115

128

116

def initlogger(debug, level=logging.WARNING):

129

117

"""init logger and add loglevel"""

130

118

131

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

135

119

syslogger.setFormatter(logging.Formatter

136

120

('Mandos [%(process)d]: %(levelname)s:'

137

121

' %(message)s'))

154

138

155

139

class PGPEngine(object):

156

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

158

141

def __init__(self):

159

142

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

160

143

self.gnupgargs = ['--batch',

199

182

200

183

def encrypt(self, data, password):

201

184

passphrase = self.password_encode(password)

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

185

with tempfile.NamedTemporaryFile(dir=self.tempdir

186

) as passfile:

204

187

passfile.write(passphrase)

205

188

passfile.flush()

206

189

proc = subprocess.Popen(['gpg', '--symmetric',

217

200

218

201

def decrypt(self, data, password):

219

202

passphrase = self.password_encode(password)

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

203

with tempfile.NamedTemporaryFile(dir = self.tempdir

204

) as passfile:

222

205

passfile.write(passphrase)

223

206

passfile.flush()

224

207

proc = subprocess.Popen(['gpg', '--decrypt',

228

211

stdin = subprocess.PIPE,

229

212

stdout = subprocess.PIPE,

230

213

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

214

decrypted_plaintext, err = proc.communicate(input

215

= data)

232

216

if proc.returncode != 0:

233

217

raise PGPError(err)

234

218

return decrypted_plaintext

237

221

class AvahiError(Exception):

238

222

def __init__(self, value, *args, **kwargs):

239

223

self.value = value

240

return super(AvahiError, self).__init__(value, *args,

241

**kwargs)

242

224

super(AvahiError, self).__init__(value, *args, **kwargs)

225

def __unicode__(self):

226

return unicode(repr(self.value))

243

227

244

228

class AvahiServiceError(AvahiError):

245

229

pass

246

230

247

248

231

class AvahiGroupError(AvahiError):

249

232

pass

250

233

270

253

bus: dbus.SystemBus()

271

254

"""

272

255

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

256

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

257

servicetype = None, port = None, TXT = None,

258

domain = "", host = "", max_renames = 32768,

259

protocol = avahi.PROTO_UNSPEC, bus = None):

284

260

self.interface = interface

285

261

self.name = name

286

262

self.type = servicetype

296

272

self.bus = bus

297

273

self.entry_group_state_changed_match = None

298

274

299

def rename(self, remove=True):

275

def rename(self):

300

276

"""Derived from the Avahi example code"""

301

277

if self.rename_count >= self.max_renames:

302

278

logger.critical("No suitable Zeroconf service name found"

303

279

" after %i retries, exiting.",

304

280

self.rename_count)

305

281

raise AvahiServiceError("Too many renames")

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

282

self.name = unicode(self.server

283

.GetAlternativeServiceName(self.name))

309

284

logger.info("Changing Zeroconf service name to %r ...",

310

285

self.name)

311

if remove:

312

self.remove()

286

self.remove()

313

287

try:

314

288

self.add()

315

289

except dbus.exceptions.DBusException as error:

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

290

logger.critical("D-Bus Exception", exc_info=error)

291

self.cleanup()

292

os._exit(1)

293

self.rename_count += 1

324

294

325

295

def remove(self):

326

296

"""Derived from the Avahi example code"""

364

334

self.rename()

365

335

elif state == avahi.ENTRY_GROUP_FAILURE:

366

336

logger.critical("Avahi: Error in group state changed %s",

367

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

337

unicode(error))

338

raise AvahiGroupError("State changed: {0!s}"

339

.format(error))

369

340

370

341

def cleanup(self):

371

342

"""Derived from the Avahi example code"""

381

352

def server_state_changed(self, state, error=None):

382

353

"""Derived from the Avahi example code"""

383

354

logger.debug("Avahi server state change: %i", state)

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

355

bad_states = { avahi.SERVER_INVALID:

356

"Zeroconf server invalid",

357

avahi.SERVER_REGISTERING: None,

358

avahi.SERVER_COLLISION:

359

"Zeroconf server name collision",

360

avahi.SERVER_FAILURE:

361

"Zeroconf server failure" }

390

362

if state in bad_states:

391

363

if bad_states[state] is not None:

392

364

if error is None:

411

383

follow_name_owner_changes=True),

412

384

avahi.DBUS_INTERFACE_SERVER)

413

385

self.server.connect_to_signal("StateChanged",

414

self.server_state_changed)

386

self.server_state_changed)

415

387

self.server_state_changed(self.server.GetState())

416

388

417

389

418

390

class AvahiServiceToSyslog(AvahiService):

419

def rename(self, *args, **kwargs):

391

def rename(self):

420

392

"""Add the new name to the syslog messages"""

421

ret = AvahiService.rename(self, *args, **kwargs)

422

syslogger.setFormatter(logging.Formatter(

423

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

424

.format(self.name)))

393

ret = AvahiService.rename(self)

394

syslogger.setFormatter(logging.Formatter

395

('Mandos ({0}) [%(process)d]:'

396

' %(levelname)s: %(message)s'

397

.format(self.name)))

425

398

return ret

426

399

427

def call_pipe(connection, # : multiprocessing.Connection

428

func, *args, **kwargs):

429

"""This function is meant to be called by multiprocessing.Process

430

431

This function runs func(*args, **kwargs), and writes the resulting

432

return value on the provided multiprocessing.Connection.

433

"""

434

connection.send(func(*args, **kwargs))

435

connection.close()

400

401

def timedelta_to_milliseconds(td):

402

"Convert a datetime.timedelta() to milliseconds"

403

return ((td.days * 24 * 60 * 60 * 1000)

404

+ (td.seconds * 1000)

405

+ (td.microseconds // 1000))

406

436

407

437

408

class Client(object):

438

409

"""A representation of a client host served by this server.

465

436

last_checker_status: integer between 0 and 255 reflecting exit

466

437

status of last checker. -1 reflects crashed

467

438

checker, -2 means no checker completed yet.

468

last_checker_signal: The signal which killed the last checker, if

469

last_checker_status is -1

470

439

last_enabled: datetime.datetime(); (UTC) or None

471

440

name: string; from the config file, used in log messages and

472

441

D-Bus identifiers

485

454

"fingerprint", "host", "interval",

486

455

"last_approval_request", "last_checked_ok",

487

456

"last_enabled", "name", "timeout")

488

client_defaults = {

489

"timeout": "PT5M",

490

"extended_timeout": "PT15M",

491

"interval": "PT2M",

492

"checker": "fping -q -- %%(host)s",

493

"host": "",

494

"approval_delay": "PT0S",

495

"approval_duration": "PT1S",

496

"approved_by_default": "True",

497

"enabled": "True",

498

}

457

client_defaults = { "timeout": "PT5M",

458

"extended_timeout": "PT15M",

459

"interval": "PT2M",

460

"checker": "fping -q -- %%(host)s",

461

"host": "",

462

"approval_delay": "PT0S",

463

"approval_duration": "PT1S",

464

"approved_by_default": "True",

465

"enabled": "True",

466

}

467

468

def timeout_milliseconds(self):

469

"Return the 'timeout' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.timeout)

471

472

def extended_timeout_milliseconds(self):

473

"Return the 'extended_timeout' attribute in milliseconds"

474

return timedelta_to_milliseconds(self.extended_timeout)

475

476

def interval_milliseconds(self):

477

"Return the 'interval' attribute in milliseconds"

478

return timedelta_to_milliseconds(self.interval)

479

480

def approval_delay_milliseconds(self):

481

return timedelta_to_milliseconds(self.approval_delay)

499

482

500

483

@staticmethod

501

484

def config_parser(config):

517

500

client["enabled"] = config.getboolean(client_name,

518

501

"enabled")

519

502

520

# Uppercase and remove spaces from fingerprint for later

521

# comparison purposes with return value from the

522

# fingerprint() function

523

503

client["fingerprint"] = (section["fingerprint"].upper()

524

504

.replace(" ", ""))

525

505

if "secret" in section:

530

510

"rb") as secfile:

531

511

client["secret"] = secfile.read()

532

512

else:

533

raise TypeError("No secret or secfile for section {}"

513

raise TypeError("No secret or secfile for section {0}"

534

514

.format(section))

535

515

client["timeout"] = string_to_delta(section["timeout"])

536

516

client["extended_timeout"] = string_to_delta(

553

533

server_settings = {}

554

534

self.server_settings = server_settings

555

535

# adding all client settings

556

for setting, value in settings.items():

536

for setting, value in settings.iteritems():

557

537

setattr(self, setting, value)

558

538

559

539

if self.enabled:

567

547

self.expires = None

568

548

569

549

logger.debug("Creating client %r", self.name)

550

# Uppercase and remove spaces from fingerprint for later

551

# comparison purposes with return value from the fingerprint()

552

# function

570

553

logger.debug(" Fingerprint: %s", self.fingerprint)

571

554

self.created = settings.get("created",

572

555

datetime.datetime.utcnow())

579

562

self.current_checker_command = None

580

563

self.approved = None

581

564

self.approvals_pending = 0

582

self.changedstate = multiprocessing_manager.Condition(

583

multiprocessing_manager.Lock())

584

self.client_structure = [attr

585

for attr in self.__dict__.iterkeys()

565

self.changedstate = (multiprocessing_manager

566

.Condition(multiprocessing_manager

567

.Lock()))

568

self.client_structure = [attr for attr in

569

self.__dict__.iterkeys()

586

570

if not attr.startswith("_")]

587

571

self.client_structure.append("client_structure")

588

572

589

for name, t in inspect.getmembers(

590

type(self), lambda obj: isinstance(obj, property)):

573

for name, t in inspect.getmembers(type(self),

574

lambda obj:

575

isinstance(obj,

576

property)):

591

577

if not name.startswith("_"):

592

578

self.client_structure.append(name)

593

579

635

621

# and every interval from then on.

636

622

if self.checker_initiator_tag is not None:

637

623

gobject.source_remove(self.checker_initiator_tag)

638

self.checker_initiator_tag = gobject.timeout_add(

639

int(self.interval.total_seconds() * 1000),

640

self.start_checker)

624

self.checker_initiator_tag = (gobject.timeout_add

625

(self.interval_milliseconds(),

626

self.start_checker))

641

627

# Schedule a disable() when 'timeout' has passed

642

628

if self.disable_initiator_tag is not None:

643

629

gobject.source_remove(self.disable_initiator_tag)

644

self.disable_initiator_tag = gobject.timeout_add(

645

int(self.timeout.total_seconds() * 1000), self.disable)

630

self.disable_initiator_tag = (gobject.timeout_add

631

(self.timeout_milliseconds(),

632

self.disable))

646

633

# Also start a new checker *right now*.

647

634

self.start_checker()

648

635

649

def checker_callback(self, source, condition, connection,

650

command):

636

def checker_callback(self, pid, condition, command):

651

637

"""The checker has completed, so take appropriate actions."""

652

638

self.checker_callback_tag = None

653

639

self.checker = None

654

# Read return code from connection (see call_pipe)

655

returncode = connection.recv()

656

connection.close()

657

658

if returncode >= 0:

659

self.last_checker_status = returncode

660

self.last_checker_signal = None

640

if os.WIFEXITED(condition):

641

self.last_checker_status = os.WEXITSTATUS(condition)

661

642

if self.last_checker_status == 0:

662

643

logger.info("Checker for %(name)s succeeded",

663

644

vars(self))

664

645

self.checked_ok()

665

646

else:

666

logger.info("Checker for %(name)s failed", vars(self))

647

logger.info("Checker for %(name)s failed",

648

vars(self))

667

649

else:

668

650

self.last_checker_status = -1

669

self.last_checker_signal = -returncode

670

651

logger.warning("Checker for %(name)s crashed?",

671

652

vars(self))

672

return False

673

653

674

654

def checked_ok(self):

675

655

"""Assert that the client has been seen, alive and well."""

676

656

self.last_checked_ok = datetime.datetime.utcnow()

677

657

self.last_checker_status = 0

678

self.last_checker_signal = None

679

658

self.bump_timeout()

680

659

681

660

def bump_timeout(self, timeout=None):

686

665

gobject.source_remove(self.disable_initiator_tag)

687

666

self.disable_initiator_tag = None

688

667

if getattr(self, "enabled", False):

689

self.disable_initiator_tag = gobject.timeout_add(

690

int(timeout.total_seconds() * 1000), self.disable)

668

self.disable_initiator_tag = (gobject.timeout_add

669

(timedelta_to_milliseconds

670

(timeout), self.disable))

691

671

self.expires = datetime.datetime.utcnow() + timeout

692

672

693

673

def need_approval(self):

707

687

# than 'timeout' for the client to be disabled, which is as it

708

688

# should be.

709

689

710

if self.checker is not None and not self.checker.is_alive():

711

logger.warning("Checker was not alive; joining")

712

self.checker.join()

713

self.checker = None

690

# If a checker exists, make sure it is not a zombie

691

try:

692

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

693

except (AttributeError, OSError) as error:

694

if (isinstance(error, OSError)

695

and error.errno != errno.ECHILD):

696

raise error

697

else:

698

if pid:

699

logger.warning("Checker was a zombie")

700

gobject.source_remove(self.checker_callback_tag)

701

self.checker_callback(pid, status,

702

self.current_checker_command)

714

703

# Start a new checker if needed

715

704

if self.checker is None:

716

705

# Escape attributes for the shell

717

escaped_attrs = {

718

attr: re.escape(str(getattr(self, attr)))

719

for attr in self.runtime_expansions }

706

escaped_attrs = dict(

707

(attr, re.escape(unicode(getattr(self, attr))))

708

for attr in

709

self.runtime_expansions)

720

710

try:

721

711

command = self.checker_command % escaped_attrs

722

712

except TypeError as error:

723

713

logger.error('Could not format string "%s"',

724

self.checker_command,

714

self.checker_command, exc_info=error)

715

return True # Try again later

716

self.current_checker_command = command

717

try:

718

logger.info("Starting checker %r for %s",

719

command, self.name)

720

# We don't need to redirect stdout and stderr, since

721

# in normal mode, that is already done by daemon(),

722

# and in debug mode we don't want to. (Stdin is

723

# always replaced by /dev/null.)

724

# The exception is when not debugging but nevertheless

725

# running in the foreground; use the previously

726

# created wnull.

727

popen_args = {}

728

if (not self.server_settings["debug"]

729

and self.server_settings["foreground"]):

730

popen_args.update({"stdout": wnull,

731

"stderr": wnull })

732

self.checker = subprocess.Popen(command,

733

close_fds=True,

734

shell=True, cwd="/",

735

**popen_args)

736

except OSError as error:

737

logger.error("Failed to start subprocess",

725

738

exc_info=error)

726

return True # Try again later

727

self.current_checker_command = command

728

logger.info("Starting checker %r for %s", command,

729

self.name)

730

# We don't need to redirect stdout and stderr, since

731

# in normal mode, that is already done by daemon(),

732

# and in debug mode we don't want to. (Stdin is

733

# always replaced by /dev/null.)

734

# The exception is when not debugging but nevertheless

735

# running in the foreground; use the previously

736

# created wnull.

737

popen_args = { "close_fds": True,

738

"shell": True,

739

"cwd": "/" }

740

if (not self.server_settings["debug"]

741

and self.server_settings["foreground"]):

742

popen_args.update({"stdout": wnull,

743

"stderr": wnull })

744

pipe = multiprocessing.Pipe(duplex = False)

745

self.checker = multiprocessing.Process(

746

target = call_pipe,

747

args = (pipe[1], subprocess.call, command),

748

kwargs = popen_args)

749

self.checker.start()

750

self.checker_callback_tag = gobject.io_add_watch(

751

pipe[0].fileno(), gobject.IO_IN,

752

self.checker_callback, pipe[0], command)

739

return True

740

self.checker_callback_tag = (gobject.child_watch_add

741

(self.checker.pid,

742

self.checker_callback,

743

data=command))

744

# The checker may have completed before the gobject

745

# watch was added. Check for this.

746

try:

747

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

748

except OSError as error:

749

if error.errno == errno.ECHILD:

750

# This should never happen

751

logger.error("Child process vanished",

752

exc_info=error)

753

return True

754

raise

755

if pid:

756

gobject.source_remove(self.checker_callback_tag)

757

self.checker_callback(pid, status, command)

753

758

# Re-run this periodically if run by gobject.timeout_add

754

759

return True

755

760

761

766

if getattr(self, "checker", None) is None:

762

767

return

763

768

logger.debug("Stopping checker for %(name)s", vars(self))

764

self.checker.terminate()

769

try:

770

self.checker.terminate()

771

#time.sleep(0.5)

772

#if self.checker.poll() is None:

773

# self.checker.kill()

774

except OSError as error:

775

if error.errno != errno.ESRCH: # No such process

776

raise

765

777

self.checker = None

766

778

767

779

768

def dbus_service_property(dbus_interface,

769

signature="v",

770

access="readwrite",

771

byte_arrays=False):

780

def dbus_service_property(dbus_interface, signature="v",

781

access="readwrite", byte_arrays=False):

772

782

"""Decorators for marking methods of a DBusObjectWithProperties to

773

783

become properties on the D-Bus.

774

784

783

793

# "Set" method, so we fail early here:

784

794

if byte_arrays and signature != "ay":

785

795

raise ValueError("Byte arrays not supported for non-'ay'"

786

" signature {!r}".format(signature))

787

796

" signature {0!r}".format(signature))

788

797

def decorator(func):

789

798

func._dbus_is_property = True

790

799

func._dbus_interface = dbus_interface

795

804

func._dbus_name = func._dbus_name[:-14]

796

805

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

797

806

return func

798

799

807

return decorator

800

808

801

809

810

818

"org.freedesktop.DBus.Property.EmitsChangedSignal":

811

819

"false"}

812

820

"""

813

814

821

def decorator(func):

815

822

func._dbus_is_interface = True

816

823

func._dbus_interface = dbus_interface

817

824

func._dbus_name = dbus_interface

818

825

return func

819

820

826

return decorator

821

827

822

828

824

830

"""Decorator to annotate D-Bus methods, signals or properties

825

831

Usage:

826

832

827

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

828

"org.freedesktop.DBus.Property."

829

"EmitsChangedSignal": "false"})

830

833

@dbus_service_property("org.example.Interface", signature="b",

831

834

access="r")

835

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

836

"org.freedesktop.DBus.Property."

837

"EmitsChangedSignal": "false"})

832

838

def Property_dbus_property(self):

833

839

return dbus.Boolean(False)

834

840

"""

835

836

841

def decorator(func):

837

842

func._dbus_annotations = annotations

838

843

return func

839

840

844

return decorator

841

845

842

846

843

847

class DBusPropertyException(dbus.exceptions.DBusException):

844

848

"""A base class for D-Bus property-related exceptions

845

849

"""

846

pass

850

def __unicode__(self):

851

return unicode(str(self))

847

852

848

853

849

854

class DBusPropertyAccessException(DBusPropertyException):

873

878

If called like _is_dbus_thing("method") it returns a function

874

879

suitable for use as predicate to inspect.getmembers().

875

880

"""

876

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

881

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

877

882

False)

878

883

879

884

def _get_all_dbus_things(self, thing):

880

885

"""Returns a generator of (name, attribute) pairs

881

886

"""

882

return ((getattr(athing.__get__(self), "_dbus_name", name),

887

return ((getattr(athing.__get__(self), "_dbus_name",

888

name),

883

889

athing.__get__(self))

884

890

for cls in self.__class__.__mro__

885

891

for name, athing in

886

inspect.getmembers(cls, self._is_dbus_thing(thing)))

892

inspect.getmembers(cls,

893

self._is_dbus_thing(thing)))

887

894

888

895

def _get_dbus_property(self, interface_name, property_name):

889

896

"""Returns a bound method if one exists which is a D-Bus

890

897

property with the specified name and interface.

891

898

"""

892

for cls in self.__class__.__mro__:

893

for name, value in inspect.getmembers(

894

cls, self._is_dbus_thing("property")):

899

for cls in self.__class__.__mro__:

900

for name, value in (inspect.getmembers

901

(cls,

902

self._is_dbus_thing("property"))):

895

903

if (value._dbus_name == property_name

896

904

and value._dbus_interface == interface_name):

897

905

return value.__get__(self)

898

906

899

907

# No such property

900

raise DBusPropertyNotFound("{}:{}.{}".format(

901

self.dbus_object_path, interface_name, property_name))

908

raise DBusPropertyNotFound(self.dbus_object_path + ":"

909

+ interface_name + "."

910

+ property_name)

902

911

903

@dbus.service.method(dbus.PROPERTIES_IFACE,

904

in_signature="ss",

912

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

905

913

out_signature="v")

906

914

def Get(self, interface_name, property_name):

907

915

"""Standard D-Bus property Get() method, see D-Bus standard.

925

933

# The byte_arrays option is not supported yet on

926

934

# signatures other than "ay".

927

935

if prop._dbus_signature != "ay":

928

raise ValueError("Byte arrays not supported for non-"

929

"'ay' signature {!r}"

930

.format(prop._dbus_signature))

936

raise ValueError

931

937

value = dbus.ByteArray(b''.join(chr(byte)

932

938

for byte in value))

933

939

prop(value)

934

940

935

@dbus.service.method(dbus.PROPERTIES_IFACE,

936

in_signature="s",

941

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

937

942

out_signature="a{sv}")

938

943

def GetAll(self, interface_name):

939

944

"""Standard D-Bus property GetAll() method, see D-Bus

954

959

if not hasattr(value, "variant_level"):

955

960

properties[name] = value

956

961

continue

957

properties[name] = type(value)(

958

value, variant_level = value.variant_level + 1)

962

properties[name] = type(value)(value, variant_level=

963

value.variant_level+1)

959

964

return dbus.Dictionary(properties, signature="sv")

960

965

961

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

962

def PropertiesChanged(self, interface_name, changed_properties,

963

invalidated_properties):

964

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

965

standard.

966

"""

967

pass

968

969

966

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

970

967

out_signature="s",

971

968

path_keyword='object_path',

979

976

connection)

980

977

try:

981

978

document = xml.dom.minidom.parseString(xmlstring)

982

983

979

def make_tag(document, name, prop):

984

980

e = document.createElement("property")

985

981

e.setAttribute("name", name)

986

982

e.setAttribute("type", prop._dbus_signature)

987

983

e.setAttribute("access", prop._dbus_access)

988

984

return e

989

990

985

for if_tag in document.getElementsByTagName("interface"):

991

986

# Add property tags

992

987

for tag in (make_tag(document, name, prop)

1004

999

if (name == tag.getAttribute("name")

1005

1000

and prop._dbus_interface

1006

1001

== if_tag.getAttribute("name")):

1007

annots.update(getattr(

1008

prop, "_dbus_annotations", {}))

1009

for name, value in annots.items():

1002

annots.update(getattr

1003

(prop,

1004

"_dbus_annotations",

1005

{}))

1006

for name, value in annots.iteritems():

1010

1007

ann_tag = document.createElement(

1011

1008

"annotation")

1012

1009

ann_tag.setAttribute("name", name)

1015

1012

# Add interface annotation tags

1016

1013

for annotation, value in dict(

1017

1014

itertools.chain.from_iterable(

1018

annotations().items()

1019

for name, annotations

1020

in self._get_all_dbus_things("interface")

1015

annotations().iteritems()

1016

for name, annotations in

1017

self._get_all_dbus_things("interface")

1021

1018

if name == if_tag.getAttribute("name")

1022

)).items():

1019

)).iteritems():

1023

1020

ann_tag = document.createElement("annotation")

1024

1021

ann_tag.setAttribute("name", annotation)

1025

1022

ann_tag.setAttribute("value", value)

1052

1049

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1053

1050

if dt is None:

1054

1051

return dbus.String("", variant_level = variant_level)

1055

return dbus.String(dt.isoformat(), variant_level=variant_level)

1052

return dbus.String(dt.isoformat(),

1053

variant_level=variant_level)

1056

1054

1057

1055

1058

1056

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1078

1076

(from DBusObjectWithProperties) and interfaces (from the

1079

1077

dbus_interface_annotations decorator).

1080

1078

"""

1081

1082

1079

def wrapper(cls):

1083

1080

for orig_interface_name, alt_interface_name in (

1084

alt_interface_names.items()):

1081

alt_interface_names.iteritems()):

1085

1082

attr = {}

1086

1083

interface_names = set()

1087

1084

# Go though all attributes of the class

1089

1086

# Ignore non-D-Bus attributes, and D-Bus attributes

1090

1087

# with the wrong interface name

1091

1088

if (not hasattr(attribute, "_dbus_interface")

1092

or not attribute._dbus_interface.startswith(

1093

orig_interface_name)):

1089

or not attribute._dbus_interface

1090

.startswith(orig_interface_name)):

1094

1091

continue

1095

1092

# Create an alternate D-Bus interface name based on

1096

1093

# the current name

1097

alt_interface = attribute._dbus_interface.replace(

1098

orig_interface_name, alt_interface_name)

1094

alt_interface = (attribute._dbus_interface

1095

.replace(orig_interface_name,

1096

alt_interface_name))

1099

1097

interface_names.add(alt_interface)

1100

1098

# Is this a D-Bus signal?

1101

1099

if getattr(attribute, "_dbus_is_signal", False):

1102

if sys.version_info.major == 2:

1103

# Extract the original non-method undecorated

1104

# function by black magic

1105

nonmethod_func = (dict(

1100

# Extract the original non-method undecorated

1101

# function by black magic

1102

nonmethod_func = (dict(

1106

1103

zip(attribute.func_code.co_freevars,

1107

attribute.__closure__))

1108

["func"].cell_contents)

1109

else:

1110

nonmethod_func = attribute

1104

attribute.__closure__))["func"]

1105

.cell_contents)

1111

1106

# Create a new, but exactly alike, function

1112

1107

# object, and decorate it to be a new D-Bus signal

1113

1108

# with the alternate D-Bus interface name

1114

if sys.version_info.major == 2:

1115

new_function = types.FunctionType(

1116

nonmethod_func.func_code,

1117

nonmethod_func.func_globals,

1118

nonmethod_func.func_name,

1119

nonmethod_func.func_defaults,

1120

nonmethod_func.func_closure)

1121

else:

1122

new_function = types.FunctionType(

1123

nonmethod_func.__code__,

1124

nonmethod_func.__globals__,

1125

nonmethod_func.__name__,

1126

nonmethod_func.__defaults__,

1127

nonmethod_func.__closure__)

1128

new_function = (dbus.service.signal(

1129

alt_interface,

1130

attribute._dbus_signature)(new_function))

1109

new_function = (dbus.service.signal

1110

(alt_interface,

1111

attribute._dbus_signature)

1112

(types.FunctionType(

1113

nonmethod_func.func_code,

1114

nonmethod_func.func_globals,

1115

nonmethod_func.func_name,

1116

nonmethod_func.func_defaults,

1117

nonmethod_func.func_closure)))

1131

1118

# Copy annotations, if any

1132

1119

try:

1133

new_function._dbus_annotations = dict(

1134

attribute._dbus_annotations)

1120

new_function._dbus_annotations = (

1121

dict(attribute._dbus_annotations))

1135

1122

except AttributeError:

1136

1123

pass

1137

1124

# Define a creator of a function to call both the

1142

1129

"""This function is a scope container to pass

1143

1130

func1 and func2 to the "call_both" function

1144

1131

outside of its arguments"""

1145

1146

1132

def call_both(*args, **kwargs):

1147

1133

"""This function will emit two D-Bus

1148

1134

signals by calling func1 and func2"""

1149

1135

func1(*args, **kwargs)

1150

1136

func2(*args, **kwargs)

1151

1152

1137

return call_both

1153

1138

# Create the "call_both" function and add it to

1154

1139

# the class

1159

1144

# object. Decorate it to be a new D-Bus method

1160

1145

# with the alternate D-Bus interface name. Add it

1161

1146

# to the class.

1162

attr[attrname] = (

1163

dbus.service.method(

1164

alt_interface,

1165

attribute._dbus_in_signature,

1166

attribute._dbus_out_signature)

1167

(types.FunctionType(attribute.func_code,

1168

attribute.func_globals,

1169

attribute.func_name,

1170

attribute.func_defaults,

1171

attribute.func_closure)))

1147

attr[attrname] = (dbus.service.method

1148

(alt_interface,

1149

attribute._dbus_in_signature,

1150

attribute._dbus_out_signature)

1151

(types.FunctionType

1152

(attribute.func_code,

1153

attribute.func_globals,

1154

attribute.func_name,

1155

attribute.func_defaults,

1156

attribute.func_closure)))

1172

1157

# Copy annotations, if any

1173

1158

try:

1174

attr[attrname]._dbus_annotations = dict(

1175

attribute._dbus_annotations)

1159

attr[attrname]._dbus_annotations = (

1160

dict(attribute._dbus_annotations))

1176

1161

except AttributeError:

1177

1162

pass

1178

1163

# Is this a D-Bus property?

1181

1166

# object, and decorate it to be a new D-Bus

1182

1167

# property with the alternate D-Bus interface

1183

1168

# name. Add it to the class.

1184

attr[attrname] = (dbus_service_property(

1185

alt_interface, attribute._dbus_signature,

1186

attribute._dbus_access,

1187

attribute._dbus_get_args_options

1188

["byte_arrays"])

1189

(types.FunctionType(

1190

attribute.func_code,

1191

attribute.func_globals,

1192

attribute.func_name,

1193

attribute.func_defaults,

1194

attribute.func_closure)))

1169

attr[attrname] = (dbus_service_property

1170

(alt_interface,

1171

attribute._dbus_signature,

1172

attribute._dbus_access,

1173

attribute

1174

._dbus_get_args_options

1175

["byte_arrays"])

1176

(types.FunctionType

1177

(attribute.func_code,

1178

attribute.func_globals,

1179

attribute.func_name,

1180

attribute.func_defaults,

1181

attribute.func_closure)))

1195

1182

# Copy annotations, if any

1196

1183

try:

1197

attr[attrname]._dbus_annotations = dict(

1198

attribute._dbus_annotations)

1184

attr[attrname]._dbus_annotations = (

1185

dict(attribute._dbus_annotations))

1199

1186

except AttributeError:

1200

1187

pass

1201

1188

# Is this a D-Bus interface?

1204

1191

# object. Decorate it to be a new D-Bus interface

1205

1192

# with the alternate D-Bus interface name. Add it

1206

1193

# to the class.

1207

attr[attrname] = (

1208

dbus_interface_annotations(alt_interface)

1209

(types.FunctionType(attribute.func_code,

1210

attribute.func_globals,

1211

attribute.func_name,

1212

attribute.func_defaults,

1213

attribute.func_closure)))

1194

attr[attrname] = (dbus_interface_annotations

1195

(alt_interface)

1196

(types.FunctionType

1197

(attribute.func_code,

1198

attribute.func_globals,

1199

attribute.func_name,

1200

attribute.func_defaults,

1201

attribute.func_closure)))

1214

1202

if deprecate:

1215

1203

# Deprecate all alternate interfaces

1216

iname="_AlternateDBusNames_interface_annotation{}"

1204

iname="_AlternateDBusNames_interface_annotation{0}"

1217

1205

for interface_name in interface_names:

1218

1219

1206

@dbus_interface_annotations(interface_name)

1220

1207

def func(self):

1221

1208

return { "org.freedesktop.DBus.Deprecated":

1222

"true" }

1209

"true" }

1223

1210

# Find an unused name

1224

1211

for aname in (iname.format(i)

1225

1212

for i in itertools.count()):

1229

1216

if interface_names:

1230

1217

# Replace the class with a new subclass of it with

1231

1218

# methods, signals, etc. as created above.

1232

cls = type(b"{}Alternate".format(cls.__name__),

1233

(cls, ), attr)

1219

cls = type(b"{0}Alternate".format(cls.__name__),

1220

(cls,), attr)

1234

1221

return cls

1235

1236

1222

return wrapper

1237

1223

1238

1224

1239

1225

@alternate_dbus_interfaces({"se.recompile.Mandos":

1240

"se.bsnet.fukt.Mandos"})

1226

"se.bsnet.fukt.Mandos"})

1241

1227

class ClientDBus(Client, DBusObjectWithProperties):

1242

1228

"""A Client class using D-Bus

1243

1229

1247

1233

"""

1248

1234

1249

1235

runtime_expansions = (Client.runtime_expansions

1250

+ ("dbus_object_path", ))

1251

1252

_interface = "se.recompile.Mandos.Client"

1236

+ ("dbus_object_path",))

1253

1237

1254

1238

# dbus.service.Object doesn't use super(), so we can't either.

1255

1239

1258

1242

Client.__init__(self, *args, **kwargs)

1259

1243

# Only now, when this client is initialized, can it show up on

1260

1244

# the D-Bus

1261

client_object_name = str(self.name).translate(

1245

client_object_name = unicode(self.name).translate(

1262

1246

{ord("."): ord("_"),

1263

1247

ord("-"): ord("_")})

1264

self.dbus_object_path = dbus.ObjectPath(

1265

"/clients/" + client_object_name)

1248

self.dbus_object_path = (dbus.ObjectPath

1249

("/clients/" + client_object_name))

1266

1250

DBusObjectWithProperties.__init__(self, self.bus,

1267

1251

self.dbus_object_path)

1268

1252

1269

def notifychangeproperty(transform_func, dbus_name,

1270

type_func=lambda x: x,

1271

variant_level=1,

1272

invalidate_only=False,

1273

_interface=_interface):

1253

def notifychangeproperty(transform_func,

1254

dbus_name, type_func=lambda x: x,

1255

variant_level=1):

1274

1256

""" Modify a variable so that it's a property which announces

1275

1257

its changes to DBus.

1276

1258

1281

1263

to the D-Bus. Default: no transform

1282

1264

variant_level: D-Bus variant level. Default: 1

1283

1265

"""

1284

attrname = "_{}".format(dbus_name)

1285

1266

attrname = "_{0}".format(dbus_name)

1286

1267

def setter(self, value):

1287

1268

if hasattr(self, "dbus_object_path"):

1288

1269

if (not hasattr(self, attrname) or

1289

1270

type_func(getattr(self, attrname, None))

1290

1271

!= type_func(value)):

1291

if invalidate_only:

1292

self.PropertiesChanged(

1293

_interface, dbus.Dictionary(),

1294

dbus.Array((dbus_name, )))

1295

else:

1296

dbus_value = transform_func(

1297

type_func(value),

1298

variant_level = variant_level)

1299

self.PropertyChanged(dbus.String(dbus_name),

1300

dbus_value)

1301

self.PropertiesChanged(

1302

_interface,

1303

dbus.Dictionary({ dbus.String(dbus_name):

1304

dbus_value }),

1305

dbus.Array())

1272

dbus_value = transform_func(type_func(value),

1273

variant_level

1274

=variant_level)

1275

self.PropertyChanged(dbus.String(dbus_name),

1276

dbus_value)

1306

1277

setattr(self, attrname, value)

1307

1278

1308

1279

return property(lambda self: getattr(self, attrname), setter)

1314

1285

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1315

1286

last_enabled = notifychangeproperty(datetime_to_dbus,

1316

1287

"LastEnabled")

1317

checker = notifychangeproperty(

1318

dbus.Boolean, "CheckerRunning",

1319

type_func = lambda checker: checker is not None)

1288

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1289

type_func = lambda checker:

1290

checker is not None)

1320

1291

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1321

1292

"LastCheckedOK")

1322

1293

last_checker_status = notifychangeproperty(dbus.Int16,

1325

1296

datetime_to_dbus, "LastApprovalRequest")

1326

1297

approved_by_default = notifychangeproperty(dbus.Boolean,

1327

1298

"ApprovedByDefault")

1328

approval_delay = notifychangeproperty(

1329

dbus.UInt64, "ApprovalDelay",

1330

type_func = lambda td: td.total_seconds() * 1000)

1299

approval_delay = notifychangeproperty(dbus.UInt64,

1300

"ApprovalDelay",

1301

type_func =

1302

timedelta_to_milliseconds)

1331

1303

approval_duration = notifychangeproperty(

1332

1304

dbus.UInt64, "ApprovalDuration",

1333

type_func = lambda td: td.total_seconds() * 1000)

1305

type_func = timedelta_to_milliseconds)

1334

1306

host = notifychangeproperty(dbus.String, "Host")

1335

timeout = notifychangeproperty(

1336

dbus.UInt64, "Timeout",

1337

type_func = lambda td: td.total_seconds() * 1000)

1307

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1308

type_func =

1309

timedelta_to_milliseconds)

1338

1310

extended_timeout = notifychangeproperty(

1339

1311

dbus.UInt64, "ExtendedTimeout",

1340

type_func = lambda td: td.total_seconds() * 1000)

1341

interval = notifychangeproperty(

1342

dbus.UInt64, "Interval",

1343

type_func = lambda td: td.total_seconds() * 1000)

1312

type_func = timedelta_to_milliseconds)

1313

interval = notifychangeproperty(dbus.UInt64,

1314

"Interval",

1315

type_func =

1316

timedelta_to_milliseconds)

1344

1317

checker_command = notifychangeproperty(dbus.String, "Checker")

1345

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1346

invalidate_only=True)

1347

1318

1348

1319

del notifychangeproperty

1349

1320

1356

1327

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1357

1328

Client.__del__(self, *args, **kwargs)

1358

1329

1359

def checker_callback(self, source, condition,

1360

connection, command, *args, **kwargs):

1361

ret = Client.checker_callback(self, source, condition,

1362

connection, command, *args,

1363

**kwargs)

1364

exitstatus = self.last_checker_status

1365

if exitstatus >= 0:

1330

def checker_callback(self, pid, condition, command,

1331

*args, **kwargs):

1332

self.checker_callback_tag = None

1333

self.checker = None

1334

if os.WIFEXITED(condition):

1335

exitstatus = os.WEXITSTATUS(condition)

1366

1336

# Emit D-Bus signal

1367

1337

self.CheckerCompleted(dbus.Int16(exitstatus),

1368

dbus.Int64(0),

1338

dbus.Int64(condition),

1369

1339

dbus.String(command))

1370

1340

else:

1371

1341

# Emit D-Bus signal

1372

1342

self.CheckerCompleted(dbus.Int16(-1),

1373

dbus.Int64(

1374

self.last_checker_signal),

1343

dbus.Int64(condition),

1375

1344

dbus.String(command))

1376

return ret

1345

1346

return Client.checker_callback(self, pid, condition, command,

1347

*args, **kwargs)

1377

1348

1378

1349

def start_checker(self, *args, **kwargs):

1379

old_checker_pid = getattr(self.checker, "pid", None)

1350

old_checker = self.checker

1351

if self.checker is not None:

1352

old_checker_pid = self.checker.pid

1353

else:

1354

old_checker_pid = None

1380

1355

r = Client.start_checker(self, *args, **kwargs)

1381

1356

# Only if new checker process was started

1382

1357

if (self.checker is not None

1391

1366

1392

1367

def approve(self, value=True):

1393

1368

self.approved = value

1394

gobject.timeout_add(int(self.approval_duration.total_seconds()

1395

* 1000), self._reset_approved)

1369

gobject.timeout_add(timedelta_to_milliseconds

1370

(self.approval_duration),

1371

self._reset_approved)

1396

1372

self.send_changedstate()

1397

1373

1398

1374

## D-Bus methods, signals & properties

1375

_interface = "se.recompile.Mandos.Client"

1399

1376

1400

1377

## Interfaces

1401

1378

1379

@dbus_interface_annotations(_interface)

1380

def _foo(self):

1381

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1382

"false"}

1383

1402

1384

## Signals

1403

1385

1404

1386

# CheckerCompleted - signal

1414

1396

pass

1415

1397

1416

1398

# PropertyChanged - signal

1417

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1418

1399

@dbus.service.signal(_interface, signature="sv")

1419

1400

def PropertyChanged(self, property, value):

1420

1401

"D-Bus signal"

1484

1465

return dbus.Boolean(bool(self.approvals_pending))

1485

1466

1486

1467

# ApprovedByDefault - property

1487

@dbus_service_property(_interface,

1488

signature="b",

1468

@dbus_service_property(_interface, signature="b",

1489

1469

access="readwrite")

1490

1470

def ApprovedByDefault_dbus_property(self, value=None):

1491

1471

if value is None: # get

1493

1473

self.approved_by_default = bool(value)

1494

1474

1495

1475

# ApprovalDelay - property

1496

@dbus_service_property(_interface,

1497

signature="t",

1476

@dbus_service_property(_interface, signature="t",

1498

1477

access="readwrite")

1499

1478

def ApprovalDelay_dbus_property(self, value=None):

1500

1479

if value is None: # get

1501

return dbus.UInt64(self.approval_delay.total_seconds()

1502

* 1000)

1480

return dbus.UInt64(self.approval_delay_milliseconds())

1503

1481

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1504

1482

1505

1483

# ApprovalDuration - property

1506

@dbus_service_property(_interface,

1507

signature="t",

1484

@dbus_service_property(_interface, signature="t",

1508

1485

access="readwrite")

1509

1486

def ApprovalDuration_dbus_property(self, value=None):

1510

1487

if value is None: # get

1511

return dbus.UInt64(self.approval_duration.total_seconds()

1512

* 1000)

1488

return dbus.UInt64(timedelta_to_milliseconds(

1489

self.approval_duration))

1513

1490

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1514

1491

1515

1492

# Name - property

1523

1500

return dbus.String(self.fingerprint)

1524

1501

1525

1502

# Host - property

1526

@dbus_service_property(_interface,

1527

signature="s",

1503

@dbus_service_property(_interface, signature="s",

1528

1504

access="readwrite")

1529

1505

def Host_dbus_property(self, value=None):

1530

1506

if value is None: # get

1531

1507

return dbus.String(self.host)

1532

self.host = str(value)

1508

self.host = unicode(value)

1533

1509

1534

1510

# Created - property

1535

1511

@dbus_service_property(_interface, signature="s", access="read")

1542

1518

return datetime_to_dbus(self.last_enabled)

1543

1519

1544

1520

# Enabled - property

1545

@dbus_service_property(_interface,

1546

signature="b",

1521

@dbus_service_property(_interface, signature="b",

1547

1522

access="readwrite")

1548

1523

def Enabled_dbus_property(self, value=None):

1549

1524

if value is None: # get

1554

1529

self.disable()

1555

1530

1556

1531

# LastCheckedOK - property

1557

@dbus_service_property(_interface,

1558

signature="s",

1532

@dbus_service_property(_interface, signature="s",

1559

1533

access="readwrite")

1560

1534

def LastCheckedOK_dbus_property(self, value=None):

1561

1535

if value is not None:

1564

1538

return datetime_to_dbus(self.last_checked_ok)

1565

1539

1566

1540

# LastCheckerStatus - property

1567

@dbus_service_property(_interface, signature="n", access="read")

1541

@dbus_service_property(_interface, signature="n",

1542

access="read")

1568

1543

def LastCheckerStatus_dbus_property(self):

1569

1544

return dbus.Int16(self.last_checker_status)

1570

1545

1579

1554

return datetime_to_dbus(self.last_approval_request)

1580

1555

1581

1556

# Timeout - property

1582

@dbus_service_property(_interface,

1583

signature="t",

1557

@dbus_service_property(_interface, signature="t",

1584

1558

access="readwrite")

1585

1559

def Timeout_dbus_property(self, value=None):

1586

1560

if value is None: # get

1587

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1561

return dbus.UInt64(self.timeout_milliseconds())

1588

1562

old_timeout = self.timeout

1589

1563

self.timeout = datetime.timedelta(0, 0, 0, value)

1590

1564

# Reschedule disabling

1599

1573

is None):

1600

1574

return

1601

1575

gobject.source_remove(self.disable_initiator_tag)

1602

self.disable_initiator_tag = gobject.timeout_add(

1603

int((self.expires - now).total_seconds() * 1000),

1604

self.disable)

1576

self.disable_initiator_tag = (

1577

gobject.timeout_add(

1578

timedelta_to_milliseconds(self.expires - now),

1579

self.disable))

1605

1580

1606

1581

# ExtendedTimeout - property

1607

@dbus_service_property(_interface,

1608

signature="t",

1582

@dbus_service_property(_interface, signature="t",

1609

1583

access="readwrite")

1610

1584

def ExtendedTimeout_dbus_property(self, value=None):

1611

1585

if value is None: # get

1612

return dbus.UInt64(self.extended_timeout.total_seconds()

1613

* 1000)

1586

return dbus.UInt64(self.extended_timeout_milliseconds())

1614

1587

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1615

1588

1616

1589

# Interval - property

1617

@dbus_service_property(_interface,

1618

signature="t",

1590

@dbus_service_property(_interface, signature="t",

1619

1591

access="readwrite")

1620

1592

def Interval_dbus_property(self, value=None):

1621

1593

if value is None: # get

1622

return dbus.UInt64(self.interval.total_seconds() * 1000)

1594

return dbus.UInt64(self.interval_milliseconds())

1623

1595

self.interval = datetime.timedelta(0, 0, 0, value)

1624

1596

if getattr(self, "checker_initiator_tag", None) is None:

1625

1597

return

1626

1598

if self.enabled:

1627

1599

# Reschedule checker run

1628

1600

gobject.source_remove(self.checker_initiator_tag)

1629

self.checker_initiator_tag = gobject.timeout_add(

1630

value, self.start_checker)

1631

self.start_checker() # Start one now, too

1601

self.checker_initiator_tag = (gobject.timeout_add

1602

(value, self.start_checker))

1603

self.start_checker() # Start one now, too

1632

1604

1633

1605

# Checker - property

1634

@dbus_service_property(_interface,

1635

signature="s",

1606

@dbus_service_property(_interface, signature="s",

1636

1607

access="readwrite")

1637

1608

def Checker_dbus_property(self, value=None):

1638

1609

if value is None: # get

1639

1610

return dbus.String(self.checker_command)

1640

self.checker_command = str(value)

1611

self.checker_command = unicode(value)

1641

1612

1642

1613

# CheckerRunning - property

1643

@dbus_service_property(_interface,

1644

signature="b",

1614

@dbus_service_property(_interface, signature="b",

1645

1615

access="readwrite")

1646

1616

def CheckerRunning_dbus_property(self, value=None):

1647

1617

if value is None: # get

1657

1627

return self.dbus_object_path # is already a dbus.ObjectPath

1658

1628

1659

1629

# Secret = property

1660

@dbus_service_property(_interface,

1661

signature="ay",

1662

access="write",

1663

byte_arrays=True)

1630

@dbus_service_property(_interface, signature="ay",

1631

access="write", byte_arrays=True)

1664

1632

def Secret_dbus_property(self, value):

1665

self.secret = bytes(value)

1633

self.secret = str(value)

1666

1634

1667

1635

del _interface

1668

1636

1672

1640

self._pipe = child_pipe

1673

1641

self._pipe.send(('init', fpr, address))

1674

1642

if not self._pipe.recv():

1675

raise KeyError(fpr)

1643

raise KeyError()

1676

1644

1677

1645

def __getattribute__(self, name):

1678

1646

if name == '_pipe':

1682

1650

if data[0] == 'data':

1683

1651

return data[1]

1684

1652

if data[0] == 'function':

1685

1686

1653

def func(*args, **kwargs):

1687

1654

self._pipe.send(('funcall', name, args, kwargs))

1688

1655

return self._pipe.recv()[1]

1689

1690

1656

return func

1691

1657

1692

1658

def __setattr__(self, name, value):

1704

1670

def handle(self):

1705

1671

with contextlib.closing(self.server.child_pipe) as child_pipe:

1706

1672

logger.info("TCP connection from: %s",

1707

str(self.client_address))

1673

unicode(self.client_address))

1708

1674

logger.debug("Pipe FD: %d",

1709

1675

self.server.child_pipe.fileno())

1710

1676

1711

session = gnutls.connection.ClientSession(

1712

self.request, gnutls.connection .X509Credentials())

1677

session = (gnutls.connection

1678

.ClientSession(self.request,

1679

gnutls.connection

1680

.X509Credentials()))

1713

1681

1714

1682

# Note: gnutls.connection.X509Credentials is really a

1715

1683

# generic GnuTLS certificate credentials object so long as

1724

1692

priority = self.server.gnutls_priority

1725

1693

if priority is None:

1726

1694

priority = "NORMAL"

1727

gnutls.library.functions.gnutls_priority_set_direct(

1728

session._c_object, priority, None)

1695

(gnutls.library.functions

1696

.gnutls_priority_set_direct(session._c_object,

1697

priority, None))

1729

1698

1730

1699

# Start communication using the Mandos protocol

1731

1700

# Get protocol number

1733

1702

logger.debug("Protocol version: %r", line)

1734

1703

try:

1735

1704

if int(line.strip().split()[0]) > 1:

1736

raise RuntimeError(line)

1705

raise RuntimeError

1737

1706

except (ValueError, IndexError, RuntimeError) as error:

1738

1707

logger.error("Unknown protocol version: %s", error)

1739

1708

return

1751

1720

approval_required = False

1752

1721

try:

1753

1722

try:

1754

fpr = self.fingerprint(

1755

self.peer_certificate(session))

1723

fpr = self.fingerprint(self.peer_certificate

1724

(session))

1756

1725

except (TypeError,

1757

1726

gnutls.errors.GNUTLSError) as error:

1758

1727

logger.warning("Bad certificate: %s", error)

1773

1742

while True:

1774

1743

if not client.enabled:

1775

1744

logger.info("Client %s is disabled",

1776

client.name)

1745

client.name)

1777

1746

if self.server.use_dbus:

1778

1747

# Emit D-Bus signal

1779

1748

client.Rejected("Disabled")

1788

1757

if self.server.use_dbus:

1789

1758

# Emit D-Bus signal

1790

1759

client.NeedApproval(

1791

client.approval_delay.total_seconds()

1792

* 1000, client.approved_by_default)

1760

client.approval_delay_milliseconds(),

1761

client.approved_by_default)

1793

1762

else:

1794

1763

logger.warning("Client %s was not approved",

1795

1764

client.name)

1801

1770

#wait until timeout or approved

1802

1771

time = datetime.datetime.now()

1803

1772

client.changedstate.acquire()

1804

client.changedstate.wait(delay.total_seconds())

1773

client.changedstate.wait(

1774

float(timedelta_to_milliseconds(delay)

1775

/ 1000))

1805

1776

client.changedstate.release()

1806

1777

time2 = datetime.datetime.now()

1807

1778

if (time2 - time) >= delay:

1826

1797

logger.warning("gnutls send failed",

1827

1798

exc_info=error)

1828

1799

return

1829

logger.debug("Sent: %d, remaining: %d", sent,

1830

len(client.secret) - (sent_size

1831

+ sent))

1800

logger.debug("Sent: %d, remaining: %d",

1801

sent, len(client.secret)

1802

- (sent_size + sent))

1832

1803

sent_size += sent

1833

1804

1834

1805

logger.info("Sending secret to %s", client.name)

1851

1822

def peer_certificate(session):

1852

1823

"Return the peer's OpenPGP certificate as a bytestring"

1853

1824

# If not an OpenPGP certificate...

1854

if (gnutls.library.functions.gnutls_certificate_type_get(

1855

session._c_object)

1825

if (gnutls.library.functions

1826

.gnutls_certificate_type_get(session._c_object)

1856

1827

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1857

1828

# ...do the normal thing

1858

1829

return session.peer_certificate

1872

1843

def fingerprint(openpgp):

1873

1844

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1874

1845

# New GnuTLS "datum" with the OpenPGP public key

1875

datum = gnutls.library.types.gnutls_datum_t(

1876

ctypes.cast(ctypes.c_char_p(openpgp),

1877

ctypes.POINTER(ctypes.c_ubyte)),

1878

ctypes.c_uint(len(openpgp)))

1846

datum = (gnutls.library.types

1847

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1848

ctypes.POINTER

1849

(ctypes.c_ubyte)),

1850

ctypes.c_uint(len(openpgp))))

1879

1851

# New empty GnuTLS certificate

1880

1852

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1881

gnutls.library.functions.gnutls_openpgp_crt_init(

1882

ctypes.byref(crt))

1853

(gnutls.library.functions

1854

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1883

1855

# Import the OpenPGP public key into the certificate

1884

gnutls.library.functions.gnutls_openpgp_crt_import(

1885

crt, ctypes.byref(datum),

1886

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1856

(gnutls.library.functions

1857

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1858

gnutls.library.constants

1859

.GNUTLS_OPENPGP_FMT_RAW))

1887

1860

# Verify the self signature in the key

1888

1861

crtverify = ctypes.c_uint()

1889

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1890

crt, 0, ctypes.byref(crtverify))

1862

(gnutls.library.functions

1863

.gnutls_openpgp_crt_verify_self(crt, 0,

1864

ctypes.byref(crtverify)))

1891

1865

if crtverify.value != 0:

1892

1866

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1893

raise gnutls.errors.CertificateSecurityError(

1894

"Verify failed")

1867

raise (gnutls.errors.CertificateSecurityError

1868

("Verify failed"))

1895

1869

# New buffer for the fingerprint

1896

1870

buf = ctypes.create_string_buffer(20)

1897

1871

buf_len = ctypes.c_size_t()

1898

1872

# Get the fingerprint from the certificate into the buffer

1899

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1900

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1873

(gnutls.library.functions

1874

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1875

ctypes.byref(buf_len)))

1901

1876

# Deinit the certificate

1902

1877

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1903

1878

# Convert the buffer to a Python bytestring

1909

1884

1910

1885

class MultiprocessingMixIn(object):

1911

1886

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1912

1913

1887

def sub_process_main(self, request, address):

1914

1888

try:

1915

1889

self.finish_request(request, address)

1927

1901

1928

1902

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1929

1903

""" adds a pipe to the MixIn """

1930

1931

1904

def process_request(self, request, client_address):

1932

1905

"""Overrides and wraps the original process_request().

1933

1906

1942

1915

1943

1916

def add_pipe(self, parent_pipe, proc):

1944

1917

"""Dummy function; override as necessary"""

1945

raise NotImplementedError()

1918

raise NotImplementedError

1946

1919

1947

1920

1948

1921

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1954

1927

interface: None or a network interface name (string)

1955

1928

use_ipv6: Boolean; to use IPv6 or not

1956

1929

"""

1957

1958

1930

def __init__(self, server_address, RequestHandlerClass,

1959

interface=None,

1960

use_ipv6=True,

1961

socketfd=None):

1931

interface=None, use_ipv6=True, socketfd=None):

1962

1932

"""If socketfd is set, use that file descriptor instead of

1963

1933

creating a new one with socket.socket().

1964

1934

"""

2005

1975

self.interface)

2006

1976

else:

2007

1977

try:

2008

self.socket.setsockopt(

2009

socket.SOL_SOCKET, SO_BINDTODEVICE,

2010

(self.interface + "\0").encode("utf-8"))

1978

self.socket.setsockopt(socket.SOL_SOCKET,

1979

SO_BINDTODEVICE,

1980

str(self.interface + '\0'))

2011

1981

except socket.error as error:

2012

1982

if error.errno == errno.EPERM:

2013

1983

logger.error("No permission to bind to"

2031

2001

self.server_address = (any_address,

2032

2002

self.server_address[1])

2033

2003

elif not self.server_address[1]:

2034

self.server_address = (self.server_address[0], 0)

2004

self.server_address = (self.server_address[0],

2005

0)

2035

2006

# if self.interface:

2036

2007

# self.server_address = (self.server_address[0],

2037

2008

# 0, # port

2051

2022

2052

2023

Assumes a gobject.MainLoop event loop.

2053

2024

"""

2054

2055

2025

def __init__(self, server_address, RequestHandlerClass,

2056

interface=None,

2057

use_ipv6=True,

2058

clients=None,

2059

gnutls_priority=None,

2060

use_dbus=True,

2061

socketfd=None):

2026

interface=None, use_ipv6=True, clients=None,

2027

gnutls_priority=None, use_dbus=True, socketfd=None):

2062

2028

self.enabled = False

2063

2029

self.clients = clients

2064

2030

if self.clients is None:

2070

2036

interface = interface,

2071

2037

use_ipv6 = use_ipv6,

2072

2038

socketfd = socketfd)

2073

2074

2039

def server_activate(self):

2075

2040

if self.enabled:

2076

2041

return socketserver.TCPServer.server_activate(self)

2080

2045

2081

2046

def add_pipe(self, parent_pipe, proc):

2082

2047

# Call "handle_ipc" for both data and EOF events

2083

gobject.io_add_watch(

2084

parent_pipe.fileno(),

2085

gobject.IO_IN | gobject.IO_HUP,

2086

functools.partial(self.handle_ipc,

2087

parent_pipe = parent_pipe,

2088

proc = proc))

2048

gobject.io_add_watch(parent_pipe.fileno(),

2049

gobject.IO_IN | gobject.IO_HUP,

2050

functools.partial(self.handle_ipc,

2051

parent_pipe =

2052

parent_pipe,

2053

proc = proc))

2089

2054

2090

def handle_ipc(self, source, condition,

2091

parent_pipe=None,

2092

proc = None,

2093

client_object=None):

2055

def handle_ipc(self, source, condition, parent_pipe=None,

2056

proc = None, client_object=None):

2094

2057

# error, or the other end of multiprocessing.Pipe has closed

2095

2058

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2096

2059

# Wait for other process to exit

2119

2082

parent_pipe.send(False)

2120

2083

return False

2121

2084

2122

gobject.io_add_watch(

2123

parent_pipe.fileno(),

2124

gobject.IO_IN | gobject.IO_HUP,

2125

functools.partial(self.handle_ipc,

2126

parent_pipe = parent_pipe,

2127

proc = proc,

2128

client_object = client))

2085

gobject.io_add_watch(parent_pipe.fileno(),

2086

gobject.IO_IN | gobject.IO_HUP,

2087

functools.partial(self.handle_ipc,

2088

parent_pipe =

2089

parent_pipe,

2090

proc = proc,

2091

client_object =

2092

client))

2129

2093

parent_pipe.send(True)

2130

2094

# remove the old hook in favor of the new above hook on

2131

2095

# same fileno

2137

2101

2138

2102

parent_pipe.send(('data', getattr(client_object,

2139

2103

funcname)(*args,

2140

**kwargs)))

2104

**kwargs)))

2141

2105

2142

2106

if command == 'getattr':

2143

2107

attrname = request[1]

2144

if isinstance(client_object.__getattribute__(attrname),

2145

collections.Callable):

2146

parent_pipe.send(('function', ))

2108

if callable(client_object.__getattribute__(attrname)):

2109

parent_pipe.send(('function',))

2147

2110

else:

2148

parent_pipe.send((

2149

'data', client_object.__getattribute__(attrname)))

2111

parent_pipe.send(('data', client_object

2112

.__getattribute__(attrname)))

2150

2113

2151

2114

if command == 'setattr':

2152

2115

attrname = request[1]

2183

2146

# avoid excessive use of external libraries.

2184

2147

2185

2148

# New type for defining tokens, syntax, and semantics all-in-one

2186

Token = collections.namedtuple("Token", (

2187

"regexp", # To match token; if "value" is not None, must have

2188

# a "group" containing digits

2189

"value", # datetime.timedelta or None

2190

"followers")) # Tokens valid after this token

2149

Token = collections.namedtuple("Token",

2150

("regexp", # To match token; if

2151

# "value" is not None,

2152

# must have a "group"

2153

# containing digits

2154

"value", # datetime.timedelta or

2155

# None

2156

"followers")) # Tokens valid after

2157

# this token

2191

2158

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2192

2159

# the "duration" ABNF definition in RFC 3339, Appendix A.

2193

2160

token_end = Token(re.compile(r"$"), None, frozenset())

2194

2161

token_second = Token(re.compile(r"(\d+)S"),

2195

2162

datetime.timedelta(seconds=1),

2196

frozenset((token_end, )))

2163

frozenset((token_end,)))

2197

2164

token_minute = Token(re.compile(r"(\d+)M"),

2198

2165

datetime.timedelta(minutes=1),

2199

2166

frozenset((token_second, token_end)))

2215

2182

frozenset((token_month, token_end)))

2216

2183

token_week = Token(re.compile(r"(\d+)W"),

2217

2184

datetime.timedelta(weeks=1),

2218

frozenset((token_end, )))

2185

frozenset((token_end,)))

2219

2186

token_duration = Token(re.compile(r"P"), None,

2220

2187

frozenset((token_year, token_month,

2221

2188

token_day, token_time,

2222

token_week)))

2189

token_week))),

2223

2190

# Define starting values

2224

2191

value = datetime.timedelta() # Value so far

2225

2192

found_token = None

2226

followers = frozenset((token_duration, )) # Following valid tokens

2193

followers = frozenset(token_duration,) # Following valid tokens

2227

2194

s = duration # String left to parse

2228

2195

# Loop until end token is found

2229

2196

while found_token is not token_end:

2246

2213

break

2247

2214

else:

2248

2215

# No currently valid tokens were found

2249

raise ValueError("Invalid RFC 3339 duration: {!r}"

2250

.format(duration))

2216

raise ValueError("Invalid RFC 3339 duration")

2251

2217

# End token found

2252

2218

return value

2253

2219

2277

2243

timevalue = datetime.timedelta(0)

2278

2244

for s in interval.split():

2279

2245

try:

2280

suffix = s[-1]

2246

suffix = unicode(s[-1])

2281

2247

value = int(s[:-1])

2282

2248

if suffix == "d":

2283

2249

delta = datetime.timedelta(value)

2290

2256

elif suffix == "w":

2291

2257

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2292

2258

else:

2293

raise ValueError("Unknown suffix {!r}".format(suffix))

2294

except IndexError as e:

2259

raise ValueError("Unknown suffix {0!r}"

2260

.format(suffix))

2261

except (ValueError, IndexError) as e:

2295

2262

raise ValueError(*(e.args))

2296

2263

timevalue += delta

2297

2264

return timevalue

2313

2280

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2314

2281

if not stat.S_ISCHR(os.fstat(null).st_mode):

2315

2282

raise OSError(errno.ENODEV,

2316

"{} not a character device"

2283

"{0} not a character device"

2317

2284

.format(os.devnull))

2318

2285

os.dup2(null, sys.stdin.fileno())

2319

2286

os.dup2(null, sys.stdout.fileno())

2329

2296

2330

2297

parser = argparse.ArgumentParser()

2331

2298

parser.add_argument("-v", "--version", action="version",

2332

version = "%(prog)s {}".format(version),

2299

version = "%(prog)s {0}".format(version),

2333

2300

help="show version number and exit")

2334

2301

parser.add_argument("-i", "--interface", metavar="IF",

2335

2302

help="Bind to interface IF")

2368

2335

help="Directory to save/restore state in")

2369

2336

parser.add_argument("--foreground", action="store_true",

2370

2337

help="Run in foreground", default=None)

2371

parser.add_argument("--no-zeroconf", action="store_false",

2372

dest="zeroconf", help="Do not use Zeroconf",

2373

default=None)

2374

2338

2375

2339

options = parser.parse_args()

2376

2340

2377

2341

if options.check:

2378

2342

import doctest

2379

fail_count, test_count = doctest.testmod()

2380

sys.exit(os.EX_OK if fail_count == 0 else 1)

2343

doctest.testmod()

2344

sys.exit()

2381

2345

2382

2346

# Default values for config file for server-global settings

2383

2347

server_defaults = { "interface": "",

2385

2349

"port": "",

2386

2350

"debug": "False",

2387

2351

"priority":

2388

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2389

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2352

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2390

2353

"servicename": "Mandos",

2391

2354

"use_dbus": "True",

2392

2355

"use_ipv6": "True",

2395

2358

"socket": "",

2396

2359

"statedir": "/var/lib/mandos",

2397

2360

"foreground": "False",

2398

"zeroconf": "True",

2399

}

2361

}

2400

2362

2401

2363

# Parse config file for server-global settings

2402

2364

server_config = configparser.SafeConfigParser(server_defaults)

2403

2365

del server_defaults

2404

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2366

server_config.read(os.path.join(options.configdir,

2367

"mandos.conf"))

2405

2368

# Convert the SafeConfigParser object to a dict

2406

2369

server_settings = server_config.defaults()

2407

2370

# Use the appropriate methods on the non-string config options

2425

2388

# Override the settings from the config file with command line

2426

2389

# options, if set.

2427

2390

for option in ("interface", "address", "port", "debug",

2428

"priority", "servicename", "configdir", "use_dbus",

2429

"use_ipv6", "debuglevel", "restore", "statedir",

2430

"socket", "foreground", "zeroconf"):

2391

"priority", "servicename", "configdir",

2392

"use_dbus", "use_ipv6", "debuglevel", "restore",

2393

"statedir", "socket", "foreground"):

2431

2394

value = getattr(options, option)

2432

2395

if value is not None:

2433

2396

server_settings[option] = value

2434

2397

del options

2435

2398

# Force all strings to be unicode

2436

2399

for option in server_settings.keys():

2437

if isinstance(server_settings[option], bytes):

2438

server_settings[option] = (server_settings[option]

2439

.decode("utf-8"))

2400

if type(server_settings[option]) is str:

2401

server_settings[option] = unicode(server_settings[option])

2440

2402

# Force all boolean options to be boolean

2441

2403

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2442

"foreground", "zeroconf"):

2404

"foreground"):

2443

2405

server_settings[option] = bool(server_settings[option])

2444

2406

# Debug implies foreground

2445

2407

if server_settings["debug"]:

2448

2410

2449

2411

##################################################################

2450

2412

2451

if (not server_settings["zeroconf"]

2452

and not (server_settings["port"]

2453

or server_settings["socket"] != "")):

2454

parser.error("Needs port or socket to work without Zeroconf")

2455

2456

2413

# For convenience

2457

2414

debug = server_settings["debug"]

2458

2415

debuglevel = server_settings["debuglevel"]

2461

2418

stored_state_path = os.path.join(server_settings["statedir"],

2462

2419

stored_state_file)

2463

2420

foreground = server_settings["foreground"]

2464

zeroconf = server_settings["zeroconf"]

2465

2421

2466

2422

if debug:

2467

2423

initlogger(debug, logging.DEBUG)

2473

2429

initlogger(debug, level)

2474

2430

2475

2431

if server_settings["servicename"] != "Mandos":

2476

syslogger.setFormatter(

2477

logging.Formatter('Mandos ({}) [%(process)d]:'

2478

' %(levelname)s: %(message)s'.format(

2479

server_settings["servicename"])))

2432

syslogger.setFormatter(logging.Formatter

2433

('Mandos ({0}) [%(process)d]:'

2434

' %(levelname)s: %(message)s'

2435

.format(server_settings

2436

["servicename"])))

2480

2437

2481

2438

# Parse config file with clients

2482

2439

client_config = configparser.SafeConfigParser(Client

2487

2444

global mandos_dbus_service

2488

2445

mandos_dbus_service = None

2489

2446

2490

socketfd = None

2491

if server_settings["socket"] != "":

2492

socketfd = server_settings["socket"]

2493

tcp_server = MandosServer(

2494

(server_settings["address"], server_settings["port"]),

2495

ClientHandler,

2496

interface=(server_settings["interface"] or None),

2497

use_ipv6=use_ipv6,

2498

gnutls_priority=server_settings["priority"],

2499

use_dbus=use_dbus,

2500

socketfd=socketfd)

2447

tcp_server = MandosServer((server_settings["address"],

2448

server_settings["port"]),

2449

ClientHandler,

2450

interface=(server_settings["interface"]

2451

or None),

2452

use_ipv6=use_ipv6,

2453

gnutls_priority=

2454

server_settings["priority"],

2455

use_dbus=use_dbus,

2456

socketfd=(server_settings["socket"]

2457

or None))

2501

2458

if not foreground:

2502

2459

pidfilename = "/run/mandos.pid"

2503

if not os.path.isdir("/run/."):

2504

pidfilename = "/var/run/mandos.pid"

2505

2460

pidfile = None

2506

2461

try:

2507

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2462

pidfile = open(pidfilename, "w")

2508

2463

except IOError as e:

2509

2464

logger.error("Could not open file %r", pidfilename,

2510

2465

exc_info=e)

2524

2479

os.setuid(uid)

2525

2480

except OSError as error:

2526

2481

if error.errno != errno.EPERM:

2527

raise

2482

raise error

2528

2483

2529

2484

if debug:

2530

2485

# Enable all possible GnuTLS debugging

2537

2492

def debug_gnutls(level, string):

2538

2493

logger.debug("GnuTLS: %s", string[:-1])

2539

2494

2540

gnutls.library.functions.gnutls_global_set_log_function(

2541

debug_gnutls)

2495

(gnutls.library.functions

2496

.gnutls_global_set_log_function(debug_gnutls))

2542

2497

2543

2498

# Redirect stdin so all checkers get /dev/null

2544

2499

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2564

2519

if use_dbus:

2565

2520

try:

2566

2521

bus_name = dbus.service.BusName("se.recompile.Mandos",

2567

bus,

2568

do_not_queue=True)

2569

old_bus_name = dbus.service.BusName(

2570

"se.bsnet.fukt.Mandos", bus,

2571

do_not_queue=True)

2572

except dbus.exceptions.DBusException as e:

2522

bus, do_not_queue=True)

2523

old_bus_name = (dbus.service.BusName

2524

("se.bsnet.fukt.Mandos", bus,

2525

do_not_queue=True))

2526

except dbus.exceptions.NameExistsException as e:

2573

2527

logger.error("Disabling D-Bus:", exc_info=e)

2574

2528

use_dbus = False

2575

2529

server_settings["use_dbus"] = False

2576

2530

tcp_server.use_dbus = False

2577

if zeroconf:

2578

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2579

service = AvahiServiceToSyslog(

2580

name = server_settings["servicename"],

2581

servicetype = "_mandos._tcp",

2582

protocol = protocol,

2583

bus = bus)

2584

if server_settings["interface"]:

2585

service.interface = if_nametoindex(

2586

server_settings["interface"].encode("utf-8"))

2531

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2532

service = AvahiServiceToSyslog(name =

2533

server_settings["servicename"],

2534

servicetype = "_mandos._tcp",

2535

protocol = protocol, bus = bus)

2536

if server_settings["interface"]:

2537

service.interface = (if_nametoindex

2538

(str(server_settings["interface"])))

2587

2539

2588

2540

global multiprocessing_manager

2589

2541

multiprocessing_manager = multiprocessing.Manager()

2608

2560

if server_settings["restore"]:

2609

2561

try:

2610

2562

with open(stored_state_path, "rb") as stored_state:

2611

clients_data, old_client_settings = pickle.load(

2612

stored_state)

2563

clients_data, old_client_settings = (pickle.load

2564

(stored_state))

2613

2565

os.remove(stored_state_path)

2614

2566

except IOError as e:

2615

2567

if e.errno == errno.ENOENT:

2616

logger.warning("Could not load persistent state:"

2617

" {}".format(os.strerror(e.errno)))

2568

logger.warning("Could not load persistent state: {0}"

2569

.format(os.strerror(e.errno)))

2618

2570

else:

2619

2571

logger.critical("Could not load persistent state:",

2620

2572

exc_info=e)

2621

2573

raise

2622

2574

except EOFError as e:

2623

2575

logger.warning("Could not load persistent state: "

2624

"EOFError:",

2625

exc_info=e)

2576

"EOFError:", exc_info=e)

2626

2577

2627

2578

with PGPEngine() as pgp:

2628

for client_name, client in clients_data.items():

2579

for client_name, client in clients_data.iteritems():

2629

2580

# Skip removed clients

2630

2581

if client_name not in client_settings:

2631

2582

continue

2640

2591

# For each value in new config, check if it

2641

2592

# differs from the old config value (Except for

2642

2593

# the "secret" attribute)

2643

if (name != "secret"

2644

and (value !=

2645

old_client_settings[client_name][name])):

2594

if (name != "secret" and

2595

value != old_client_settings[client_name]

2596

[name]):

2646

2597

client[name] = value

2647

2598

except KeyError:

2648

2599

pass

2649

2600

2650

2601

# Clients who has passed its expire date can still be

2651

# enabled if its last checker was successful. A Client

2602

# enabled if its last checker was successful. Clients

2652

2603

# whose checker succeeded before we stored its state is

2653

2604

# assumed to have successfully run all checkers during

2654

2605

# downtime.

2656

2607

if datetime.datetime.utcnow() >= client["expires"]:

2657

2608

if not client["last_checked_ok"]:

2658

2609

logger.warning(

2659

"disabling client {} - Client never "

2660

"performed a successful checker".format(

2661

client_name))

2610

"disabling client {0} - Client never "

2611

"performed a successful checker"

2612

.format(client_name))

2662

2613

client["enabled"] = False

2663

2614

elif client["last_checker_status"] != 0:

2664

2615

logger.warning(

2665

"disabling client {} - Client last"

2666

" checker failed with error code"

2667

" {}".format(

2668

client_name,

2669

client["last_checker_status"]))

2616

"disabling client {0} - Client "

2617

"last checker failed with error code {1}"

2618

.format(client_name,

2619

client["last_checker_status"]))

2670

2620

client["enabled"] = False

2671

2621

else:

2672

client["expires"] = (

2673

datetime.datetime.utcnow()

2674

+ client["timeout"])

2622

client["expires"] = (datetime.datetime

2623

.utcnow()

2624

+ client["timeout"])

2675

2625

logger.debug("Last checker succeeded,"

2676

" keeping {} enabled".format(

2677

client_name))

2626

" keeping {0} enabled"

2627

.format(client_name))

2678

2628

try:

2679

client["secret"] = pgp.decrypt(

2680

client["encrypted_secret"],

2681

client_settings[client_name]["secret"])

2629

client["secret"] = (

2630

pgp.decrypt(client["encrypted_secret"],

2631

client_settings[client_name]

2632

["secret"]))

2682

2633

except PGPError:

2683

2634

# If decryption fails, we use secret from new settings

2684

logger.debug("Failed to decrypt {} old secret".format(

2685

client_name))

2686

client["secret"] = (client_settings[client_name]

2687

["secret"])

2635

logger.debug("Failed to decrypt {0} old secret"

2636

.format(client_name))

2637

client["secret"] = (

2638

client_settings[client_name]["secret"])

2688

2639

2689

2640

# Add/remove clients based on new changes made to config

2690

2641

for client_name in (set(old_client_settings)

2695

2646

clients_data[client_name] = client_settings[client_name]

2696

2647

2697

2648

# Create all client objects

2698

for client_name, client in clients_data.items():

2649

for client_name, client in clients_data.iteritems():

2699

2650

tcp_server.clients[client_name] = client_class(

2700

name = client_name,

2701

settings = client,

2651

name = client_name, settings = client,

2702

2652

server_settings = server_settings)

2703

2653

2704

2654

if not tcp_server.clients:

2706

2656

2707

2657

if not foreground:

2708

2658

if pidfile is not None:

2709

pid = os.getpid()

2710

2659

try:

2711

2660

with pidfile:

2712

print(pid, file=pidfile)

2661

pid = os.getpid()

2662

pidfile.write(str(pid) + "\n".encode("utf-8"))

2713

2663

except IOError:

2714

2664

logger.error("Could not write to file %r with PID %d",

2715

2665

pidfilename, pid)

2720

2670

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2721

2671

2722

2672

if use_dbus:

2723

2724

@alternate_dbus_interfaces(

2725

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2673

@alternate_dbus_interfaces({"se.recompile.Mandos":

2674

"se.bsnet.fukt.Mandos"})

2726

2675

class MandosDBusService(DBusObjectWithProperties):

2727

2676

"""A D-Bus proxy object"""

2728

2729

2677

def __init__(self):

2730

2678

dbus.service.Object.__init__(self, bus, "/")

2731

2732

2679

_interface = "se.recompile.Mandos"

2733

2680

2734

2681

@dbus_interface_annotations(_interface)

2735

2682

def _foo(self):

2736

return {

2737

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2738

"false" }

2683

return { "org.freedesktop.DBus.Property"

2684

".EmitsChangedSignal":

2685

"false"}

2739

2686

2740

2687

@dbus.service.signal(_interface, signature="o")

2741

2688

def ClientAdded(self, objpath):

2755

2702

@dbus.service.method(_interface, out_signature="ao")

2756

2703

def GetAllClients(self):

2757

2704

"D-Bus method"

2758

return dbus.Array(c.dbus_object_path for c in

2705

return dbus.Array(c.dbus_object_path

2706

for c in

2759

2707

tcp_server.clients.itervalues())

2760

2708

2761

2709

@dbus.service.method(_interface,

2763

2711

def GetAllClientsWithProperties(self):

2764

2712

"D-Bus method"

2765

2713

return dbus.Dictionary(

2766

{ c.dbus_object_path: c.GetAll("")

2767

for c in tcp_server.clients.itervalues() },

2714

((c.dbus_object_path, c.GetAll(""))

2715

for c in tcp_server.clients.itervalues()),

2768

2716

signature="oa{sv}")

2769

2717

2770

2718

@dbus.service.method(_interface, in_signature="o")

2787

2735

2788

2736

def cleanup():

2789

2737

"Cleanup function; run on exit"

2790

if zeroconf:

2791

service.cleanup()

2738

service.cleanup()

2792

2739

2793

2740

multiprocessing.active_children()

2794

2741

wnull.close()

2808

2755

2809

2756

# A list of attributes that can not be pickled

2810

2757

# + secret.

2811

exclude = { "bus", "changedstate", "secret",

2812

"checker", "server_settings" }

2813

for name, typ in inspect.getmembers(dbus.service

2814

.Object):

2758

exclude = set(("bus", "changedstate", "secret",

2759

"checker", "server_settings"))

2760

for name, typ in (inspect.getmembers

2761

(dbus.service.Object)):

2815

2762

exclude.add(name)

2816

2763

2817

2764

client_dict["encrypted_secret"] = (client

2824

2771

del client_settings[client.name]["secret"]

2825

2772

2826

2773

try:

2827

with tempfile.NamedTemporaryFile(

2828

mode='wb',

2829

suffix=".pickle",

2830

prefix='clients-',

2831

dir=os.path.dirname(stored_state_path),

2832

delete=False) as stored_state:

2774

with (tempfile.NamedTemporaryFile

2775

(mode='wb', suffix=".pickle", prefix='clients-',

2776

dir=os.path.dirname(stored_state_path),

2777

delete=False)) as stored_state:

2833

2778

pickle.dump((clients, client_settings), stored_state)

2834

tempname = stored_state.name

2779

tempname=stored_state.name

2835

2780

os.rename(tempname, stored_state_path)

2836

2781

except (IOError, OSError) as e:

2837

2782

if not debug:

2840

2785

except NameError:

2841

2786

pass

2842

2787

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2843

logger.warning("Could not save persistent state: {}"

2788

logger.warning("Could not save persistent state: {0}"

2844

2789

.format(os.strerror(e.errno)))

2845

2790

else:

2846

2791

logger.warning("Could not save persistent state:",

2847

2792

exc_info=e)

2848

raise

2793

raise e

2849

2794

2850

2795

# Delete all clients, and settings from config

2851

2796

while tcp_server.clients:

2856

2801

client.disable(quiet=True)

2857

2802

if use_dbus:

2858

2803

# Emit D-Bus signal

2859

mandos_dbus_service.ClientRemoved(

2860

client.dbus_object_path, client.name)

2804

mandos_dbus_service.ClientRemoved(client

2805

.dbus_object_path,

2806

client.name)

2861

2807

client_settings.clear()

2862

2808

2863

2809

atexit.register(cleanup)

2874

2820

tcp_server.server_activate()

2875

2821

2876

2822

# Find out what port we got

2877

if zeroconf:

2878

service.port = tcp_server.socket.getsockname()[1]

2823

service.port = tcp_server.socket.getsockname()[1]

2879

2824

if use_ipv6:

2880

2825

logger.info("Now listening on address %r, port %d,"

2881

2826

" flowinfo %d, scope_id %d",

2887

2832

#service.interface = tcp_server.socket.getsockname()[3]

2888

2833

2889

2834

try:

2890

if zeroconf:

2891

# From the Avahi example code

2892

try:

2893

service.activate()

2894

except dbus.exceptions.DBusException as error:

2895

logger.critical("D-Bus Exception", exc_info=error)

2896

cleanup()

2897

sys.exit(1)

2898

# End of Avahi example code

2835

# From the Avahi example code

2836

try:

2837

service.activate()

2838

except dbus.exceptions.DBusException as error:

2839

logger.critical("D-Bus Exception", exc_info=error)

2840

cleanup()

2841

sys.exit(1)

2842

# End of Avahi example code

2899

2843

2900

2844

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2901

2845

lambda *args, **kwargs:

2916

2860

# Must run before the D-Bus bus name gets deregistered

2917

2861

cleanup()

2918

2862

2919

2920

2863

if __name__ == '__main__':

2921

2864

main()