/mandos/release : revision 237.7.195

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

39

import SocketServer as socketserver

43

40

import socket

44

41

import argparse

45

42

import datetime

46

43

import errno

47

try:

48

import ConfigParser as configparser

49

except ImportError:

50

import configparser

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

51

import sys

52

import re

53

import os

62

import struct

63

import fcntl

64

import functools

65

try:

66

import cPickle as pickle

67

except ImportError:

68

import pickle

65

import cPickle as pickle

69

66

import multiprocessing

70

67

import types

71

68

import binascii

72

69

import tempfile

73

70

import itertools

74

71

import collections

75

import codecs

76

72

77

73

import dbus

78

74

import dbus.service

79

try:

80

from gi.repository import GObject

81

except ImportError:

82

import gobject as GObject

75

import gobject

83

76

import avahi

84

77

from dbus.mainloop.glib import DBusGMainLoop

85

78

import ctypes

95

88

except ImportError:

96

89

SO_BINDTODEVICE = None

97

90

98

if sys.version_info.major == 2:

99

str = unicode

100

101

version = "1.7.4"

91

version = "1.6.2"

102

92

stored_state_file = "clients.pickle"

103

93

104

94

logger = logging.getLogger()

105

syslogger = None

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

106

98

107

99

try:

108

if_nametoindex = ctypes.cdll.LoadLibrary(

109

ctypes.util.find_library("c")).if_nametoindex

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

110

103

except (OSError, AttributeError):

111

112

104

def if_nametoindex(interface):

113

105

"Get an interface index the hard way, i.e. using fcntl()"

114

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

115

107

with contextlib.closing(socket.socket()) as s:

116

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

117

struct.pack(b"16s16x", interface))

118

interface_index = struct.unpack("I", ifreq[16:20])[0]

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

119

113

return interface_index

120

114

121

115

122

116

def initlogger(debug, level=logging.WARNING):

123

117

"""init logger and add loglevel"""

124

118

125

global syslogger

126

syslogger = (logging.handlers.SysLogHandler(

127

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

128

address = "/dev/log"))

129

119

syslogger.setFormatter(logging.Formatter

130

120

('Mandos [%(process)d]: %(levelname)s:'

131

121

' %(message)s'))

148

138

149

139

class PGPEngine(object):

150

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

151

152

141

def __init__(self):

153

142

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

154

self.gpg = "gpg"

155

try:

156

output = subprocess.check_output(["gpgconf"])

157

for line in output.splitlines():

158

name, text, path = line.split(":")

159

if name == "gpg":

160

self.gpg = path

161

break

162

except OSError as e:

163

if e.errno != errno.ENOENT:

164

raise

165

143

self.gnupgargs = ['--batch',

166

'--homedir', self.tempdir,

144

'--home', self.tempdir,

167

145

'--force-mdc',

168

146

'--quiet',

169

147

'--no-use-agent']

204

182

205

183

def encrypt(self, data, password):

206

184

passphrase = self.password_encode(password)

207

with tempfile.NamedTemporaryFile(

208

dir=self.tempdir) as passfile:

185

with tempfile.NamedTemporaryFile(dir=self.tempdir

186

) as passfile:

209

187

passfile.write(passphrase)

210

188

passfile.flush()

211

proc = subprocess.Popen([self.gpg, '--symmetric',

189

proc = subprocess.Popen(['gpg', '--symmetric',

212

190

'--passphrase-file',

213

191

passfile.name]

214

192

+ self.gnupgargs,

222

200

223

201

def decrypt(self, data, password):

224

202

passphrase = self.password_encode(password)

225

with tempfile.NamedTemporaryFile(

226

dir = self.tempdir) as passfile:

203

with tempfile.NamedTemporaryFile(dir = self.tempdir

204

) as passfile:

227

205

passfile.write(passphrase)

228

206

passfile.flush()

229

proc = subprocess.Popen([self.gpg, '--decrypt',

207

proc = subprocess.Popen(['gpg', '--decrypt',

230

208

'--passphrase-file',

231

209

passfile.name]

232

210

+ self.gnupgargs,

233

211

stdin = subprocess.PIPE,

234

212

stdout = subprocess.PIPE,

235

213

stderr = subprocess.PIPE)

236

decrypted_plaintext, err = proc.communicate(input = data)

214

decrypted_plaintext, err = proc.communicate(input

215

= data)

237

216

if proc.returncode != 0:

238

217

raise PGPError(err)

239

218

return decrypted_plaintext

242

221

class AvahiError(Exception):

243

222

def __init__(self, value, *args, **kwargs):

244

223

self.value = value

245

return super(AvahiError, self).__init__(value, *args,

246

**kwargs)

247

224

super(AvahiError, self).__init__(value, *args, **kwargs)

225

def __unicode__(self):

226

return unicode(repr(self.value))

248

227

249

228

class AvahiServiceError(AvahiError):

250

229

pass

251

230

252

253

231

class AvahiGroupError(AvahiError):

254

232

pass

255

233

275

253

bus: dbus.SystemBus()

276

254

"""

277

255

278

def __init__(self,

279

interface = avahi.IF_UNSPEC,

280

name = None,

281

servicetype = None,

282

port = None,

283

TXT = None,

284

domain = "",

285

host = "",

286

max_renames = 32768,

287

protocol = avahi.PROTO_UNSPEC,

288

bus = None):

256

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

257

servicetype = None, port = None, TXT = None,

258

domain = "", host = "", max_renames = 32768,

259

protocol = avahi.PROTO_UNSPEC, bus = None):

289

260

self.interface = interface

290

261

self.name = name

291

262

self.type = servicetype

301

272

self.bus = bus

302

273

self.entry_group_state_changed_match = None

303

274

304

def rename(self, remove=True):

275

def rename(self):

305

276

"""Derived from the Avahi example code"""

306

277

if self.rename_count >= self.max_renames:

307

278

logger.critical("No suitable Zeroconf service name found"

308

279

" after %i retries, exiting.",

309

280

self.rename_count)

310

281

raise AvahiServiceError("Too many renames")

311

self.name = str(

312

self.server.GetAlternativeServiceName(self.name))

313

self.rename_count += 1

282

self.name = unicode(self.server

283

.GetAlternativeServiceName(self.name))

314

284

logger.info("Changing Zeroconf service name to %r ...",

315

285

self.name)

316

if remove:

317

self.remove()

286

self.remove()

318

287

try:

319

288

self.add()

320

289

except dbus.exceptions.DBusException as error:

321

if (error.get_dbus_name()

322

== "org.freedesktop.Avahi.CollisionError"):

323

logger.info("Local Zeroconf service name collision.")

324

return self.rename(remove=False)

325

else:

326

logger.critical("D-Bus Exception", exc_info=error)

327

self.cleanup()

328

os._exit(1)

290

logger.critical("D-Bus Exception", exc_info=error)

291

self.cleanup()

292

os._exit(1)

293

self.rename_count += 1

329

294

330

295

def remove(self):

331

296

"""Derived from the Avahi example code"""

369

334

self.rename()

370

335

elif state == avahi.ENTRY_GROUP_FAILURE:

371

336

logger.critical("Avahi: Error in group state changed %s",

372

str(error))

373

raise AvahiGroupError("State changed: {!s}".format(error))

337

unicode(error))

338

raise AvahiGroupError("State changed: {0!s}"

339

.format(error))

374

340

375

341

def cleanup(self):

376

342

"""Derived from the Avahi example code"""

386

352

def server_state_changed(self, state, error=None):

387

353

"""Derived from the Avahi example code"""

388

354

logger.debug("Avahi server state change: %i", state)

389

bad_states = {

390

avahi.SERVER_INVALID: "Zeroconf server invalid",

391

avahi.SERVER_REGISTERING: None,

392

avahi.SERVER_COLLISION: "Zeroconf server name collision",

393

avahi.SERVER_FAILURE: "Zeroconf server failure",

394

}

355

bad_states = { avahi.SERVER_INVALID:

356

"Zeroconf server invalid",

357

avahi.SERVER_REGISTERING: None,

358

avahi.SERVER_COLLISION:

359

"Zeroconf server name collision",

360

avahi.SERVER_FAILURE:

361

"Zeroconf server failure" }

395

362

if state in bad_states:

396

363

if bad_states[state] is not None:

397

364

if error is None:

400

367

logger.error(bad_states[state] + ": %r", error)

401

368

self.cleanup()

402

369

elif state == avahi.SERVER_RUNNING:

403

try:

404

self.add()

405

except dbus.exceptions.DBusException as error:

406

if (error.get_dbus_name()

407

== "org.freedesktop.Avahi.CollisionError"):

408

logger.info("Local Zeroconf service name"

409

" collision.")

410

return self.rename(remove=False)

411

else:

412

logger.critical("D-Bus Exception", exc_info=error)

413

self.cleanup()

414

os._exit(1)

370

self.add()

415

371

else:

416

372

if error is None:

417

373

logger.debug("Unknown state: %r", state)

427

383

follow_name_owner_changes=True),

428

384

avahi.DBUS_INTERFACE_SERVER)

429

385

self.server.connect_to_signal("StateChanged",

430

self.server_state_changed)

386

self.server_state_changed)

431

387

self.server_state_changed(self.server.GetState())

432

388

433

389

434

390

class AvahiServiceToSyslog(AvahiService):

435

def rename(self, *args, **kwargs):

391

def rename(self):

436

392

"""Add the new name to the syslog messages"""

437

ret = AvahiService.rename(self, *args, **kwargs)

438

syslogger.setFormatter(logging.Formatter(

439

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

440

.format(self.name)))

393

ret = AvahiService.rename(self)

394

syslogger.setFormatter(logging.Formatter

395

('Mandos ({0}) [%(process)d]:'

396

' %(levelname)s: %(message)s'

397

.format(self.name)))

441

398

return ret

442

399

443

# Pretend that we have a GnuTLS module

444

class GnuTLS(object):

445

"""This isn't so much a class as it is a module-like namespace.

446

It is instantiated once, and simulates having a GnuTLS module."""

447

448

_library = ctypes.cdll.LoadLibrary(

449

ctypes.util.find_library("gnutls"))

450

_need_version = "3.3.0"

451

def __init__(self):

452

# Need to use class name "GnuTLS" here, since this method is

453

# called before the assignment to the "gnutls" global variable

454

# happens.

455

if GnuTLS.check_version(self._need_version) is None:

456

raise GnuTLS.Error("Needs GnuTLS {} or later"

457

.format(self._need_version))

458

459

# Unless otherwise indicated, the constants and types below are

460

# all from the gnutls/gnutls.h C header file.

461

462

# Constants

463

E_SUCCESS = 0

464

E_INTERRUPTED = -52

465

E_AGAIN = -28

466

CRT_OPENPGP = 2

467

CLIENT = 2

468

SHUT_RDWR = 0

469

CRD_CERTIFICATE = 1

470

E_NO_CERTIFICATE_FOUND = -49

471

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

472

473

# Types

474

class session_int(ctypes.Structure):

475

_fields_ = []

476

session_t = ctypes.POINTER(session_int)

477

class certificate_credentials_st(ctypes.Structure):

478

_fields_ = []

479

certificate_credentials_t = ctypes.POINTER(

480

certificate_credentials_st)

481

certificate_type_t = ctypes.c_int

482

class datum_t(ctypes.Structure):

483

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

484

('size', ctypes.c_uint)]

485

class openpgp_crt_int(ctypes.Structure):

486

_fields_ = []

487

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

488

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

489

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

490

credentials_type_t = ctypes.c_int

491

transport_ptr_t = ctypes.c_void_p

492

close_request_t = ctypes.c_int

493

494

# Exceptions

495

class Error(Exception):

496

# We need to use the class name "GnuTLS" here, since this

497

# exception might be raised from within GnuTLS.__init__,

498

# which is called before the assignment to the "gnutls"

499

# global variable has happened.

500

def __init__(self, message = None, code = None, args=()):

501

# Default usage is by a message string, but if a return

502

# code is passed, convert it to a string with

503

# gnutls.strerror()

504

self.code = code

505

if message is None and code is not None:

506

message = GnuTLS.strerror(code)

507

return super(GnuTLS.Error, self).__init__(

508

message, *args)

509

510

class CertificateSecurityError(Error):

511

pass

512

513

# Classes

514

class Credentials(object):

515

def __init__(self):

516

self._c_object = gnutls.certificate_credentials_t()

517

gnutls.certificate_allocate_credentials(

518

ctypes.byref(self._c_object))

519

self.type = gnutls.CRD_CERTIFICATE

520

521

def __del__(self):

522

gnutls.certificate_free_credentials(self._c_object)

523

524

class ClientSession(object):

525

def __init__(self, socket, credentials = None):

526

self._c_object = gnutls.session_t()

527

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

528

gnutls.set_default_priority(self._c_object)

529

gnutls.transport_set_ptr(self._c_object, socket.fileno())

530

gnutls.handshake_set_private_extensions(self._c_object,

531

True)

532

self.socket = socket

533

if credentials is None:

534

credentials = gnutls.Credentials()

535

gnutls.credentials_set(self._c_object, credentials.type,

536

ctypes.cast(credentials._c_object,

537

ctypes.c_void_p))

538

self.credentials = credentials

539

540

def __del__(self):

541

gnutls.deinit(self._c_object)

542

543

def handshake(self):

544

return gnutls.handshake(self._c_object)

545

546

def send(self, data):

547

data = bytes(data)

548

data_len = len(data)

549

while data_len > 0:

550

data_len -= gnutls.record_send(self._c_object,

551

data[-data_len:],

552

data_len)

553

554

def bye(self):

555

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

556

557

# Error handling functions

558

def _error_code(result):

559

"""A function to raise exceptions on errors, suitable

560

for the 'restype' attribute on ctypes functions"""

561

if result >= 0:

562

return result

563

if result == gnutls.E_NO_CERTIFICATE_FOUND:

564

raise gnutls.CertificateSecurityError(code = result)

565

raise gnutls.Error(code = result)

566

567

def _retry_on_error(result, func, arguments):

568

"""A function to retry on some errors, suitable

569

for the 'errcheck' attribute on ctypes functions"""

570

while result < 0:

571

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

572

return _error_code(result)

573

result = func(*arguments)

574

return result

575

576

# Unless otherwise indicated, the function declarations below are

577

# all from the gnutls/gnutls.h C header file.

578

579

# Functions

580

priority_set_direct = _library.gnutls_priority_set_direct

581

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

582

ctypes.POINTER(ctypes.c_char_p)]

583

priority_set_direct.restype = _error_code

584

585

init = _library.gnutls_init

586

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

587

init.restype = _error_code

588

589

set_default_priority = _library.gnutls_set_default_priority

590

set_default_priority.argtypes = [session_t]

591

set_default_priority.restype = _error_code

592

593

record_send = _library.gnutls_record_send

594

record_send.argtypes = [session_t, ctypes.c_void_p,

595

ctypes.c_size_t]

596

record_send.restype = ctypes.c_ssize_t

597

record_send.errcheck = _retry_on_error

598

599

certificate_allocate_credentials = (

600

_library.gnutls_certificate_allocate_credentials)

601

certificate_allocate_credentials.argtypes = [

602

ctypes.POINTER(certificate_credentials_t)]

603

certificate_allocate_credentials.restype = _error_code

604

605

certificate_free_credentials = (

606

_library.gnutls_certificate_free_credentials)

607

certificate_free_credentials.argtypes = [certificate_credentials_t]

608

certificate_free_credentials.restype = None

609

610

handshake_set_private_extensions = (

611

_library.gnutls_handshake_set_private_extensions)

612

handshake_set_private_extensions.argtypes = [session_t,

613

ctypes.c_int]

614

handshake_set_private_extensions.restype = None

615

616

credentials_set = _library.gnutls_credentials_set

617

credentials_set.argtypes = [session_t, credentials_type_t,

618

ctypes.c_void_p]

619

credentials_set.restype = _error_code

620

621

strerror = _library.gnutls_strerror

622

strerror.argtypes = [ctypes.c_int]

623

strerror.restype = ctypes.c_char_p

624

625

certificate_type_get = _library.gnutls_certificate_type_get

626

certificate_type_get.argtypes = [session_t]

627

certificate_type_get.restype = _error_code

628

629

certificate_get_peers = _library.gnutls_certificate_get_peers

630

certificate_get_peers.argtypes = [session_t,

631

ctypes.POINTER(ctypes.c_uint)]

632

certificate_get_peers.restype = ctypes.POINTER(datum_t)

633

634

global_set_log_level = _library.gnutls_global_set_log_level

635

global_set_log_level.argtypes = [ctypes.c_int]

636

global_set_log_level.restype = None

637

638

global_set_log_function = _library.gnutls_global_set_log_function

639

global_set_log_function.argtypes = [log_func]

640

global_set_log_function.restype = None

641

642

deinit = _library.gnutls_deinit

643

deinit.argtypes = [session_t]

644

deinit.restype = None

645

646

handshake = _library.gnutls_handshake

647

handshake.argtypes = [session_t]

648

handshake.restype = _error_code

649

handshake.errcheck = _retry_on_error

650

651

transport_set_ptr = _library.gnutls_transport_set_ptr

652

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

653

transport_set_ptr.restype = None

654

655

bye = _library.gnutls_bye

656

bye.argtypes = [session_t, close_request_t]

657

bye.restype = _error_code

658

bye.errcheck = _retry_on_error

659

660

check_version = _library.gnutls_check_version

661

check_version.argtypes = [ctypes.c_char_p]

662

check_version.restype = ctypes.c_char_p

663

664

# All the function declarations below are from gnutls/openpgp.h

665

666

openpgp_crt_init = _library.gnutls_openpgp_crt_init

667

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

668

openpgp_crt_init.restype = _error_code

669

670

openpgp_crt_import = _library.gnutls_openpgp_crt_import

671

openpgp_crt_import.argtypes = [openpgp_crt_t,

672

ctypes.POINTER(datum_t),

673

openpgp_crt_fmt_t]

674

openpgp_crt_import.restype = _error_code

675

676

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

677

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

678

ctypes.POINTER(ctypes.c_uint)]

679

openpgp_crt_verify_self.restype = _error_code

680

681

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

682

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

683

openpgp_crt_deinit.restype = None

684

685

openpgp_crt_get_fingerprint = (

686

_library.gnutls_openpgp_crt_get_fingerprint)

687

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

688

ctypes.c_void_p,

689

ctypes.POINTER(

690

ctypes.c_size_t)]

691

openpgp_crt_get_fingerprint.restype = _error_code

692

693

# Remove non-public functions

694

del _error_code, _retry_on_error

695

# Create the global "gnutls" object, simulating a module

696

gnutls = GnuTLS()

697

698

def call_pipe(connection, # : multiprocessing.Connection

699

func, *args, **kwargs):

700

"""This function is meant to be called by multiprocessing.Process

701

702

This function runs func(*args, **kwargs), and writes the resulting

703

return value on the provided multiprocessing.Connection.

704

"""

705

connection.send(func(*args, **kwargs))

706

connection.close()

400

401

def timedelta_to_milliseconds(td):

402

"Convert a datetime.timedelta() to milliseconds"

403

return ((td.days * 24 * 60 * 60 * 1000)

404

+ (td.seconds * 1000)

405

+ (td.microseconds // 1000))

406

707

407

708

408

class Client(object):

709

409

"""A representation of a client host served by this server.

715

415

checker: subprocess.Popen(); a running checker process used

716

416

to see if the client lives.

717

417

'None' if no process is running.

718

checker_callback_tag: a GObject event source tag, or None

418

checker_callback_tag: a gobject event source tag, or None

719

419

checker_command: string; External command which is run to check

720

420

if client lives. %() expansions are done at

721

421

runtime with vars(self) as dict, so that for

722

422

instance %(name)s can be used in the command.

723

checker_initiator_tag: a GObject event source tag, or None

423

checker_initiator_tag: a gobject event source tag, or None

724

424

created: datetime.datetime(); (UTC) object creation

725

425

client_structure: Object describing what attributes a client has

726

426

and is used for storing the client at exit

727

427

current_checker_command: string; current running checker_command

728

disable_initiator_tag: a GObject event source tag, or None

428

disable_initiator_tag: a gobject event source tag, or None

729

429

enabled: bool()

730

430

fingerprint: string (40 or 32 hexadecimal digits); used to

731

431

uniquely identify the client

736

436

last_checker_status: integer between 0 and 255 reflecting exit

737

437

status of last checker. -1 reflects crashed

738

438

checker, -2 means no checker completed yet.

739

last_checker_signal: The signal which killed the last checker, if

740

last_checker_status is -1

741

439

last_enabled: datetime.datetime(); (UTC) or None

742

440

name: string; from the config file, used in log messages and

743

441

D-Bus identifiers

756

454

"fingerprint", "host", "interval",

757

455

"last_approval_request", "last_checked_ok",

758

456

"last_enabled", "name", "timeout")

759

client_defaults = {

760

"timeout": "PT5M",

761

"extended_timeout": "PT15M",

762

"interval": "PT2M",

763

"checker": "fping -q -- %%(host)s",

764

"host": "",

765

"approval_delay": "PT0S",

766

"approval_duration": "PT1S",

767

"approved_by_default": "True",

768

"enabled": "True",

769

}

457

client_defaults = { "timeout": "PT5M",

458

"extended_timeout": "PT15M",

459

"interval": "PT2M",

460

"checker": "fping -q -- %%(host)s",

461

"host": "",

462

"approval_delay": "PT0S",

463

"approval_duration": "PT1S",

464

"approved_by_default": "True",

465

"enabled": "True",

466

}

467

468

def timeout_milliseconds(self):

469

"Return the 'timeout' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.timeout)

471

472

def extended_timeout_milliseconds(self):

473

"Return the 'extended_timeout' attribute in milliseconds"

474

return timedelta_to_milliseconds(self.extended_timeout)

475

476

def interval_milliseconds(self):

477

"Return the 'interval' attribute in milliseconds"

478

return timedelta_to_milliseconds(self.interval)

479

480

def approval_delay_milliseconds(self):

481

return timedelta_to_milliseconds(self.approval_delay)

770

482

771

483

@staticmethod

772

484

def config_parser(config):

788

500

client["enabled"] = config.getboolean(client_name,

789

501

"enabled")

790

502

791

# Uppercase and remove spaces from fingerprint for later

792

# comparison purposes with return value from the

793

# fingerprint() function

794

503

client["fingerprint"] = (section["fingerprint"].upper()

795

504

.replace(" ", ""))

796

505

if "secret" in section:

801

510

"rb") as secfile:

802

511

client["secret"] = secfile.read()

803

512

else:

804

raise TypeError("No secret or secfile for section {}"

513

raise TypeError("No secret or secfile for section {0}"

805

514

.format(section))

806

515

client["timeout"] = string_to_delta(section["timeout"])

807

516

client["extended_timeout"] = string_to_delta(

824

533

server_settings = {}

825

534

self.server_settings = server_settings

826

535

# adding all client settings

827

for setting, value in settings.items():

536

for setting, value in settings.iteritems():

828

537

setattr(self, setting, value)

829

538

830

539

if self.enabled:

838

547

self.expires = None

839

548

840

549

logger.debug("Creating client %r", self.name)

550

# Uppercase and remove spaces from fingerprint for later

551

# comparison purposes with return value from the fingerprint()

552

# function

841

553

logger.debug(" Fingerprint: %s", self.fingerprint)

842

554

self.created = settings.get("created",

843

555

datetime.datetime.utcnow())

850

562

self.current_checker_command = None

851

563

self.approved = None

852

564

self.approvals_pending = 0

853

self.changedstate = multiprocessing_manager.Condition(

854

multiprocessing_manager.Lock())

855

self.client_structure = [attr

856

for attr in self.__dict__.iterkeys()

565

self.changedstate = (multiprocessing_manager

566

.Condition(multiprocessing_manager

567

.Lock()))

568

self.client_structure = [attr for attr in

569

self.__dict__.iterkeys()

857

570

if not attr.startswith("_")]

858

571

self.client_structure.append("client_structure")

859

572

860

for name, t in inspect.getmembers(

861

type(self), lambda obj: isinstance(obj, property)):

573

for name, t in inspect.getmembers(type(self),

574

lambda obj:

575

isinstance(obj,

576

property)):

862

577

if not name.startswith("_"):

863

578

self.client_structure.append(name)

864

579

885

600

if not quiet:

886

601

logger.info("Disabling client %s", self.name)

887

602

if getattr(self, "disable_initiator_tag", None) is not None:

888

GObject.source_remove(self.disable_initiator_tag)

603

gobject.source_remove(self.disable_initiator_tag)

889

604

self.disable_initiator_tag = None

890

605

self.expires = None

891

606

if getattr(self, "checker_initiator_tag", None) is not None:

892

GObject.source_remove(self.checker_initiator_tag)

607

gobject.source_remove(self.checker_initiator_tag)

893

608

self.checker_initiator_tag = None

894

609

self.stop_checker()

895

610

self.enabled = False

896

611

if not quiet:

897

612

self.send_changedstate()

898

# Do not run this again if called by a GObject.timeout_add

613

# Do not run this again if called by a gobject.timeout_add

899

614

return False

900

615

901

616

def __del__(self):

905

620

# Schedule a new checker to be started an 'interval' from now,

906

621

# and every interval from then on.

907

622

if self.checker_initiator_tag is not None:

908

GObject.source_remove(self.checker_initiator_tag)

909

self.checker_initiator_tag = GObject.timeout_add(

910

int(self.interval.total_seconds() * 1000),

911

self.start_checker)

623

gobject.source_remove(self.checker_initiator_tag)

624

self.checker_initiator_tag = (gobject.timeout_add

625

(self.interval_milliseconds(),

626

self.start_checker))

912

627

# Schedule a disable() when 'timeout' has passed

913

628

if self.disable_initiator_tag is not None:

914

GObject.source_remove(self.disable_initiator_tag)

915

self.disable_initiator_tag = GObject.timeout_add(

916

int(self.timeout.total_seconds() * 1000), self.disable)

629

gobject.source_remove(self.disable_initiator_tag)

630

self.disable_initiator_tag = (gobject.timeout_add

631

(self.timeout_milliseconds(),

632

self.disable))

917

633

# Also start a new checker *right now*.

918

634

self.start_checker()

919

635

920

def checker_callback(self, source, condition, connection,

921

command):

636

def checker_callback(self, pid, condition, command):

922

637

"""The checker has completed, so take appropriate actions."""

923

638

self.checker_callback_tag = None

924

639

self.checker = None

925

# Read return code from connection (see call_pipe)

926

returncode = connection.recv()

927

connection.close()

928

929

if returncode >= 0:

930

self.last_checker_status = returncode

931

self.last_checker_signal = None

640

if os.WIFEXITED(condition):

641

self.last_checker_status = os.WEXITSTATUS(condition)

932

642

if self.last_checker_status == 0:

933

643

logger.info("Checker for %(name)s succeeded",

934

644

vars(self))

935

645

self.checked_ok()

936

646

else:

937

logger.info("Checker for %(name)s failed", vars(self))

647

logger.info("Checker for %(name)s failed",

648

vars(self))

938

649

else:

939

650

self.last_checker_status = -1

940

self.last_checker_signal = -returncode

941

651

logger.warning("Checker for %(name)s crashed?",

942

652

vars(self))

943

return False

944

653

945

654

def checked_ok(self):

946

655

"""Assert that the client has been seen, alive and well."""

947

656

self.last_checked_ok = datetime.datetime.utcnow()

948

657

self.last_checker_status = 0

949

self.last_checker_signal = None

950

658

self.bump_timeout()

951

659

952

660

def bump_timeout(self, timeout=None):

954

662

if timeout is None:

955

663

timeout = self.timeout

956

664

if self.disable_initiator_tag is not None:

957

GObject.source_remove(self.disable_initiator_tag)

665

gobject.source_remove(self.disable_initiator_tag)

958

666

self.disable_initiator_tag = None

959

667

if getattr(self, "enabled", False):

960

self.disable_initiator_tag = GObject.timeout_add(

961

int(timeout.total_seconds() * 1000), self.disable)

668

self.disable_initiator_tag = (gobject.timeout_add

669

(timedelta_to_milliseconds

670

(timeout), self.disable))

962

671

self.expires = datetime.datetime.utcnow() + timeout

963

672

964

673

def need_approval(self):

978

687

# than 'timeout' for the client to be disabled, which is as it

979

688

# should be.

980

689

981

if self.checker is not None and not self.checker.is_alive():

982

logger.warning("Checker was not alive; joining")

983

self.checker.join()

984

self.checker = None

690

# If a checker exists, make sure it is not a zombie

691

try:

692

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

693

except AttributeError:

694

pass

695

except OSError as error:

696

if error.errno != errno.ECHILD:

697

raise

698

else:

699

if pid:

700

logger.warning("Checker was a zombie")

701

gobject.source_remove(self.checker_callback_tag)

702

self.checker_callback(pid, status,

703

self.current_checker_command)

985

704

# Start a new checker if needed

986

705

if self.checker is None:

987

706

# Escape attributes for the shell

988

escaped_attrs = {

989

attr: re.escape(str(getattr(self, attr)))

990

for attr in self.runtime_expansions }

707

escaped_attrs = dict(

708

(attr, re.escape(unicode(getattr(self, attr))))

709

for attr in

710

self.runtime_expansions)

991

711

try:

992

712

command = self.checker_command % escaped_attrs

993

713

except TypeError as error:

994

714

logger.error('Could not format string "%s"',

995

self.checker_command,

715

self.checker_command, exc_info=error)

716

return True # Try again later

717

self.current_checker_command = command

718

try:

719

logger.info("Starting checker %r for %s",

720

command, self.name)

721

# We don't need to redirect stdout and stderr, since

722

# in normal mode, that is already done by daemon(),

723

# and in debug mode we don't want to. (Stdin is

724

# always replaced by /dev/null.)

725

# The exception is when not debugging but nevertheless

726

# running in the foreground; use the previously

727

# created wnull.

728

popen_args = {}

729

if (not self.server_settings["debug"]

730

and self.server_settings["foreground"]):

731

popen_args.update({"stdout": wnull,

732

"stderr": wnull })

733

self.checker = subprocess.Popen(command,

734

close_fds=True,

735

shell=True, cwd="/",

736

**popen_args)

737

except OSError as error:

738

logger.error("Failed to start subprocess",

996

739

exc_info=error)

997

return True # Try again later

998

self.current_checker_command = command

999

logger.info("Starting checker %r for %s", command,

1000

self.name)

1001

# We don't need to redirect stdout and stderr, since

1002

# in normal mode, that is already done by daemon(),

1003

# and in debug mode we don't want to. (Stdin is

1004

# always replaced by /dev/null.)

1005

# The exception is when not debugging but nevertheless

1006

# running in the foreground; use the previously

1007

# created wnull.

1008

popen_args = { "close_fds": True,

1009

"shell": True,

1010

"cwd": "/" }

1011

if (not self.server_settings["debug"]

1012

and self.server_settings["foreground"]):

1013

popen_args.update({"stdout": wnull,

1014

"stderr": wnull })

1015

pipe = multiprocessing.Pipe(duplex = False)

1016

self.checker = multiprocessing.Process(

1017

target = call_pipe,

1018

args = (pipe[1], subprocess.call, command),

1019

kwargs = popen_args)

1020

self.checker.start()

1021

self.checker_callback_tag = GObject.io_add_watch(

1022

pipe[0].fileno(), GObject.IO_IN,

1023

self.checker_callback, pipe[0], command)

1024

# Re-run this periodically if run by GObject.timeout_add

740

return True

741

self.checker_callback_tag = (gobject.child_watch_add

742

(self.checker.pid,

743

self.checker_callback,

744

data=command))

745

# The checker may have completed before the gobject

746

# watch was added. Check for this.

747

try:

748

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

749

except OSError as error:

750

if error.errno == errno.ECHILD:

751

# This should never happen

752

logger.error("Child process vanished",

753

exc_info=error)

754

return True

755

raise

756

if pid:

757

gobject.source_remove(self.checker_callback_tag)

758

self.checker_callback(pid, status, command)

759

# Re-run this periodically if run by gobject.timeout_add

1025

760

return True

1026

761

1027

762

def stop_checker(self):

1028

763

"""Force the checker process, if any, to stop."""

1029

764

if self.checker_callback_tag:

1030

GObject.source_remove(self.checker_callback_tag)

765

gobject.source_remove(self.checker_callback_tag)

1031

766

self.checker_callback_tag = None

1032

767

if getattr(self, "checker", None) is None:

1033

768

return

1034

769

logger.debug("Stopping checker for %(name)s", vars(self))

1035

self.checker.terminate()

770

try:

771

self.checker.terminate()

772

#time.sleep(0.5)

773

#if self.checker.poll() is None:

774

# self.checker.kill()

775

except OSError as error:

776

if error.errno != errno.ESRCH: # No such process

777

raise

1036

778

self.checker = None

1037

779

1038

780

1039

def dbus_service_property(dbus_interface,

1040

signature="v",

1041

access="readwrite",

1042

byte_arrays=False):

781

def dbus_service_property(dbus_interface, signature="v",

782

access="readwrite", byte_arrays=False):

1043

783

"""Decorators for marking methods of a DBusObjectWithProperties to

1044

784

become properties on the D-Bus.

1045

785

1054

794

# "Set" method, so we fail early here:

1055

795

if byte_arrays and signature != "ay":

1056

796

raise ValueError("Byte arrays not supported for non-'ay'"

1057

" signature {!r}".format(signature))

1058

797

" signature {0!r}".format(signature))

1059

798

def decorator(func):

1060

799

func._dbus_is_property = True

1061

800

func._dbus_interface = dbus_interface

1066

805

func._dbus_name = func._dbus_name[:-14]

1067

806

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1068

807

return func

1069

1070

808

return decorator

1071

809

1072

810

1081

819

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1082

820

"false"}

1083

821

"""

1084

1085

822

def decorator(func):

1086

823

func._dbus_is_interface = True

1087

824

func._dbus_interface = dbus_interface

1088

825

func._dbus_name = dbus_interface

1089

826

return func

1090

1091

827

return decorator

1092

828

1093

829

1095

831

"""Decorator to annotate D-Bus methods, signals or properties

1096

832

Usage:

1097

833

1098

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1099

"org.freedesktop.DBus.Property."

1100

"EmitsChangedSignal": "false"})

1101

834

@dbus_service_property("org.example.Interface", signature="b",

1102

835

access="r")

836

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

837

"org.freedesktop.DBus.Property."

838

"EmitsChangedSignal": "false"})

1103

839

def Property_dbus_property(self):

1104

840

return dbus.Boolean(False)

1105

1106

See also the DBusObjectWithAnnotations class.

1107

841

"""

1108

1109

842

def decorator(func):

1110

843

func._dbus_annotations = annotations

1111

844

return func

1112

1113

845

return decorator

1114

846

1115

847

1116

848

class DBusPropertyException(dbus.exceptions.DBusException):

1117

849

"""A base class for D-Bus property-related exceptions

1118

850

"""

1119

pass

851

def __unicode__(self):

852

return unicode(str(self))

1120

853

1121

854

1122

855

class DBusPropertyAccessException(DBusPropertyException):

1131

864

pass

1132

865

1133

866

1134

class DBusObjectWithAnnotations(dbus.service.Object):

1135

"""A D-Bus object with annotations.

867

class DBusObjectWithProperties(dbus.service.Object):

868

"""A D-Bus object with properties.

1136

869

1137

Classes inheriting from this can use the dbus_annotations

1138

decorator to add annotations to methods or signals.

870

Classes inheriting from this can use the dbus_service_property

871

decorator to expose methods as D-Bus properties. It exposes the

872

standard Get(), Set(), and GetAll() methods on the D-Bus.

1139

873

"""

1140

874

1141

875

@staticmethod

1145

879

If called like _is_dbus_thing("method") it returns a function

1146

880

suitable for use as predicate to inspect.getmembers().

1147

881

"""

1148

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

882

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1149

883

False)

1150

884

1151

885

def _get_all_dbus_things(self, thing):

1152

886

"""Returns a generator of (name, attribute) pairs

1153

887

"""

1154

return ((getattr(athing.__get__(self), "_dbus_name", name),

888

return ((getattr(athing.__get__(self), "_dbus_name",

889

name),

1155

890

athing.__get__(self))

1156

891

for cls in self.__class__.__mro__

1157

892

for name, athing in

1158

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1159

1160

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1161

out_signature = "s",

1162

path_keyword = 'object_path',

1163

connection_keyword = 'connection')

1164

def Introspect(self, object_path, connection):

1165

"""Overloading of standard D-Bus method.

1166

1167

Inserts annotation tags on methods and signals.

1168

"""

1169

xmlstring = dbus.service.Object.Introspect(self, object_path,

1170

connection)

1171

try:

1172

document = xml.dom.minidom.parseString(xmlstring)

1173

1174

for if_tag in document.getElementsByTagName("interface"):

1175

# Add annotation tags

1176

for typ in ("method", "signal"):

1177

for tag in if_tag.getElementsByTagName(typ):

1178

annots = dict()

1179

for name, prop in (self.

1180

_get_all_dbus_things(typ)):

1181

if (name == tag.getAttribute("name")

1182

and prop._dbus_interface

1183

== if_tag.getAttribute("name")):

1184

annots.update(getattr(

1185

prop, "_dbus_annotations", {}))

1186

for name, value in annots.items():

1187

ann_tag = document.createElement(

1188

"annotation")

1189

ann_tag.setAttribute("name", name)

1190

ann_tag.setAttribute("value", value)

1191

tag.appendChild(ann_tag)

1192

# Add interface annotation tags

1193

for annotation, value in dict(

1194

itertools.chain.from_iterable(

1195

annotations().items()

1196

for name, annotations

1197

in self._get_all_dbus_things("interface")

1198

if name == if_tag.getAttribute("name")

1199

)).items():

1200

ann_tag = document.createElement("annotation")

1201

ann_tag.setAttribute("name", annotation)

1202

ann_tag.setAttribute("value", value)

1203

if_tag.appendChild(ann_tag)

1204

# Fix argument name for the Introspect method itself

1205

if (if_tag.getAttribute("name")

1206

== dbus.INTROSPECTABLE_IFACE):

1207

for cn in if_tag.getElementsByTagName("method"):

1208

if cn.getAttribute("name") == "Introspect":

1209

for arg in cn.getElementsByTagName("arg"):

1210

if (arg.getAttribute("direction")

1211

== "out"):

1212

arg.setAttribute("name",

1213

"xml_data")

1214

xmlstring = document.toxml("utf-8")

1215

document.unlink()

1216

except (AttributeError, xml.dom.DOMException,

1217

xml.parsers.expat.ExpatError) as error:

1218

logger.error("Failed to override Introspection method",

1219

exc_info=error)

1220

return xmlstring

1221

1222

1223

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1224

"""A D-Bus object with properties.

1225

1226

Classes inheriting from this can use the dbus_service_property

1227

decorator to expose methods as D-Bus properties. It exposes the

1228

standard Get(), Set(), and GetAll() methods on the D-Bus.

1229

"""

893

inspect.getmembers(cls,

894

self._is_dbus_thing(thing)))

1230

895

1231

896

def _get_dbus_property(self, interface_name, property_name):

1232

897

"""Returns a bound method if one exists which is a D-Bus

1233

898

property with the specified name and interface.

1234

899

"""

1235

for cls in self.__class__.__mro__:

1236

for name, value in inspect.getmembers(

1237

cls, self._is_dbus_thing("property")):

900

for cls in self.__class__.__mro__:

901

for name, value in (inspect.getmembers

902

(cls,

903

self._is_dbus_thing("property"))):

1238

904

if (value._dbus_name == property_name

1239

905

and value._dbus_interface == interface_name):

1240

906

return value.__get__(self)

1241

907

1242

908

# No such property

1243

raise DBusPropertyNotFound("{}:{}.{}".format(

1244

self.dbus_object_path, interface_name, property_name))

1245

1246

@classmethod

1247

def _get_all_interface_names(cls):

1248

"""Get a sequence of all interfaces supported by an object"""

1249

return (name for name in set(getattr(getattr(x, attr),

1250

"_dbus_interface", None)

1251

for x in (inspect.getmro(cls))

1252

for attr in dir(x))

1253

if name is not None)

1254

1255

@dbus.service.method(dbus.PROPERTIES_IFACE,

1256

in_signature="ss",

909

raise DBusPropertyNotFound(self.dbus_object_path + ":"

910

+ interface_name + "."

911

+ property_name)

912

913

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1257

914

out_signature="v")

1258

915

def Get(self, interface_name, property_name):

1259

916

"""Standard D-Bus property Get() method, see D-Bus standard.

1277

934

# The byte_arrays option is not supported yet on

1278

935

# signatures other than "ay".

1279

936

if prop._dbus_signature != "ay":

1280

raise ValueError("Byte arrays not supported for non-"

1281

"'ay' signature {!r}"

1282

.format(prop._dbus_signature))

937

raise ValueError

1283

938

value = dbus.ByteArray(b''.join(chr(byte)

1284

939

for byte in value))

1285

940

prop(value)

1286

941

1287

@dbus.service.method(dbus.PROPERTIES_IFACE,

1288

in_signature="s",

942

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1289

943

out_signature="a{sv}")

1290

944

def GetAll(self, interface_name):

1291

945

"""Standard D-Bus property GetAll() method, see D-Bus

1306

960

if not hasattr(value, "variant_level"):

1307

961

properties[name] = value

1308

962

continue

1309

properties[name] = type(value)(

1310

value, variant_level = value.variant_level + 1)

963

properties[name] = type(value)(value, variant_level=

964

value.variant_level+1)

1311

965

return dbus.Dictionary(properties, signature="sv")

1312

966

1313

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1314

def PropertiesChanged(self, interface_name, changed_properties,

1315

invalidated_properties):

1316

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1317

standard.

1318

"""

1319

pass

1320

1321

967

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1322

968

out_signature="s",

1323

969

path_keyword='object_path',

1327

973

1328

974

Inserts property tags and interface annotation tags.

1329

975

"""

1330

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1331

object_path,

1332

connection)

976

xmlstring = dbus.service.Object.Introspect(self, object_path,

977

connection)

1333

978

try:

1334

979

document = xml.dom.minidom.parseString(xmlstring)

1335

1336

980

def make_tag(document, name, prop):

1337

981

e = document.createElement("property")

1338

982

e.setAttribute("name", name)

1339

983

e.setAttribute("type", prop._dbus_signature)

1340

984

e.setAttribute("access", prop._dbus_access)

1341

985

return e

1342

1343

986

for if_tag in document.getElementsByTagName("interface"):

1344

987

# Add property tags

1345

988

for tag in (make_tag(document, name, prop)

1348

991

if prop._dbus_interface

1349

992

== if_tag.getAttribute("name")):

1350

993

if_tag.appendChild(tag)

1351

# Add annotation tags for properties

1352

for tag in if_tag.getElementsByTagName("property"):

1353

annots = dict()

1354

for name, prop in self._get_all_dbus_things(

1355

"property"):

1356

if (name == tag.getAttribute("name")

1357

and prop._dbus_interface

1358

== if_tag.getAttribute("name")):

1359

annots.update(getattr(

1360

prop, "_dbus_annotations", {}))

1361

for name, value in annots.items():

1362

ann_tag = document.createElement(

1363

"annotation")

1364

ann_tag.setAttribute("name", name)

1365

ann_tag.setAttribute("value", value)

1366

tag.appendChild(ann_tag)

994

# Add annotation tags

995

for typ in ("method", "signal", "property"):

996

for tag in if_tag.getElementsByTagName(typ):

997

annots = dict()

998

for name, prop in (self.

999

_get_all_dbus_things(typ)):

1000

if (name == tag.getAttribute("name")

1001

and prop._dbus_interface

1002

== if_tag.getAttribute("name")):

1003

annots.update(getattr

1004

(prop,

1005

"_dbus_annotations",

1006

{}))

1007

for name, value in annots.iteritems():

1008

ann_tag = document.createElement(

1009

"annotation")

1010

ann_tag.setAttribute("name", name)

1011

ann_tag.setAttribute("value", value)

1012

tag.appendChild(ann_tag)

1013

# Add interface annotation tags

1014

for annotation, value in dict(

1015

itertools.chain.from_iterable(

1016

annotations().iteritems()

1017

for name, annotations in

1018

self._get_all_dbus_things("interface")

1019

if name == if_tag.getAttribute("name")

1020

)).iteritems():

1021

ann_tag = document.createElement("annotation")

1022

ann_tag.setAttribute("name", annotation)

1023

ann_tag.setAttribute("value", value)

1024

if_tag.appendChild(ann_tag)

1367

1025

# Add the names to the return values for the

1368

1026

# "org.freedesktop.DBus.Properties" methods

1369

1027

if (if_tag.getAttribute("name")

1387

1045

exc_info=error)

1388

1046

return xmlstring

1389

1047

1390

try:

1391

dbus.OBJECT_MANAGER_IFACE

1392

except AttributeError:

1393

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1394

1395

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1396

"""A D-Bus object with an ObjectManager.

1397

1398

Classes inheriting from this exposes the standard

1399

GetManagedObjects call and the InterfacesAdded and

1400

InterfacesRemoved signals on the standard

1401

"org.freedesktop.DBus.ObjectManager" interface.

1402

1403

Note: No signals are sent automatically; they must be sent

1404

manually.

1405

"""

1406

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1407

out_signature = "a{oa{sa{sv}}}")

1408

def GetManagedObjects(self):

1409

"""This function must be overridden"""

1410

raise NotImplementedError()

1411

1412

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1413

signature = "oa{sa{sv}}")

1414

def InterfacesAdded(self, object_path, interfaces_and_properties):

1415

pass

1416

1417

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1418

def InterfacesRemoved(self, object_path, interfaces):

1419

pass

1420

1421

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1422

out_signature = "s",

1423

path_keyword = 'object_path',

1424

connection_keyword = 'connection')

1425

def Introspect(self, object_path, connection):

1426

"""Overloading of standard D-Bus method.

1427

1428

Override return argument name of GetManagedObjects to be

1429

"objpath_interfaces_and_properties"

1430

"""

1431

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1432

object_path,

1433

connection)

1434

try:

1435

document = xml.dom.minidom.parseString(xmlstring)

1436

1437

for if_tag in document.getElementsByTagName("interface"):

1438

# Fix argument name for the GetManagedObjects method

1439

if (if_tag.getAttribute("name")

1440

== dbus.OBJECT_MANAGER_IFACE):

1441

for cn in if_tag.getElementsByTagName("method"):

1442

if (cn.getAttribute("name")

1443

== "GetManagedObjects"):

1444

for arg in cn.getElementsByTagName("arg"):

1445

if (arg.getAttribute("direction")

1446

== "out"):

1447

arg.setAttribute(

1448

"name",

1449

"objpath_interfaces"

1450

"_and_properties")

1451

xmlstring = document.toxml("utf-8")

1452

document.unlink()

1453

except (AttributeError, xml.dom.DOMException,

1454

xml.parsers.expat.ExpatError) as error:

1455

logger.error("Failed to override Introspection method",

1456

exc_info = error)

1457

return xmlstring

1458

1048

1459

1049

def datetime_to_dbus(dt, variant_level=0):

1460

1050

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1461

1051

if dt is None:

1462

1052

return dbus.String("", variant_level = variant_level)

1463

return dbus.String(dt.isoformat(), variant_level=variant_level)

1053

return dbus.String(dt.isoformat(),

1054

variant_level=variant_level)

1464

1055

1465

1056

1466

1057

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1486

1077

(from DBusObjectWithProperties) and interfaces (from the

1487

1078

dbus_interface_annotations decorator).

1488

1079

"""

1489

1490

1080

def wrapper(cls):

1491

1081

for orig_interface_name, alt_interface_name in (

1492

alt_interface_names.items()):

1082

alt_interface_names.iteritems()):

1493

1083

attr = {}

1494

1084

interface_names = set()

1495

1085

# Go though all attributes of the class

1497

1087

# Ignore non-D-Bus attributes, and D-Bus attributes

1498

1088

# with the wrong interface name

1499

1089

if (not hasattr(attribute, "_dbus_interface")

1500

or not attribute._dbus_interface.startswith(

1501

orig_interface_name)):

1090

or not attribute._dbus_interface

1091

.startswith(orig_interface_name)):

1502

1092

continue

1503

1093

# Create an alternate D-Bus interface name based on

1504

1094

# the current name

1505

alt_interface = attribute._dbus_interface.replace(

1506

orig_interface_name, alt_interface_name)

1095

alt_interface = (attribute._dbus_interface

1096

.replace(orig_interface_name,

1097

alt_interface_name))

1507

1098

interface_names.add(alt_interface)

1508

1099

# Is this a D-Bus signal?

1509

1100

if getattr(attribute, "_dbus_is_signal", False):

1510

if sys.version_info.major == 2:

1511

# Extract the original non-method undecorated

1512

# function by black magic

1513

nonmethod_func = (dict(

1101

# Extract the original non-method undecorated

1102

# function by black magic

1103

nonmethod_func = (dict(

1514

1104

zip(attribute.func_code.co_freevars,

1515

attribute.__closure__))

1516

["func"].cell_contents)

1517

else:

1518

nonmethod_func = attribute

1105

attribute.__closure__))["func"]

1106

.cell_contents)

1519

1107

# Create a new, but exactly alike, function

1520

1108

# object, and decorate it to be a new D-Bus signal

1521

1109

# with the alternate D-Bus interface name

1522

if sys.version_info.major == 2:

1523

new_function = types.FunctionType(

1524

nonmethod_func.func_code,

1525

nonmethod_func.func_globals,

1526

nonmethod_func.func_name,

1527

nonmethod_func.func_defaults,

1528

nonmethod_func.func_closure)

1529

else:

1530

new_function = types.FunctionType(

1531

nonmethod_func.__code__,

1532

nonmethod_func.__globals__,

1533

nonmethod_func.__name__,

1534

nonmethod_func.__defaults__,

1535

nonmethod_func.__closure__)

1536

new_function = (dbus.service.signal(

1537

alt_interface,

1538

attribute._dbus_signature)(new_function))

1110

new_function = (dbus.service.signal

1111

(alt_interface,

1112

attribute._dbus_signature)

1113

(types.FunctionType(

1114

nonmethod_func.func_code,

1115

nonmethod_func.func_globals,

1116

nonmethod_func.func_name,

1117

nonmethod_func.func_defaults,

1118

nonmethod_func.func_closure)))

1539

1119

# Copy annotations, if any

1540

1120

try:

1541

new_function._dbus_annotations = dict(

1542

attribute._dbus_annotations)

1121

new_function._dbus_annotations = (

1122

dict(attribute._dbus_annotations))

1543

1123

except AttributeError:

1544

1124

pass

1545

1125

# Define a creator of a function to call both the

1550

1130

"""This function is a scope container to pass

1551

1131

func1 and func2 to the "call_both" function

1552

1132

outside of its arguments"""

1553

1554

@functools.wraps(func2)

1555

1133

def call_both(*args, **kwargs):

1556

1134

"""This function will emit two D-Bus

1557

1135

signals by calling func1 and func2"""

1558

1136

func1(*args, **kwargs)

1559

1137

func2(*args, **kwargs)

1560

# Make wrapper function look like a D-Bus signal

1561

for name, attr in inspect.getmembers(func2):

1562

if name.startswith("_dbus_"):

1563

setattr(call_both, name, attr)

1564

1565

1138

return call_both

1566

1139

# Create the "call_both" function and add it to

1567

1140

# the class

1572

1145

# object. Decorate it to be a new D-Bus method

1573

1146

# with the alternate D-Bus interface name. Add it

1574

1147

# to the class.

1575

attr[attrname] = (

1576

dbus.service.method(

1577

alt_interface,

1578

attribute._dbus_in_signature,

1579

attribute._dbus_out_signature)

1580

(types.FunctionType(attribute.func_code,

1581

attribute.func_globals,

1582

attribute.func_name,

1583

attribute.func_defaults,

1584

attribute.func_closure)))

1148

attr[attrname] = (dbus.service.method

1149

(alt_interface,

1150

attribute._dbus_in_signature,

1151

attribute._dbus_out_signature)

1152

(types.FunctionType

1153

(attribute.func_code,

1154

attribute.func_globals,

1155

attribute.func_name,

1156

attribute.func_defaults,

1157

attribute.func_closure)))

1585

1158

# Copy annotations, if any

1586

1159

try:

1587

attr[attrname]._dbus_annotations = dict(

1588

attribute._dbus_annotations)

1160

attr[attrname]._dbus_annotations = (

1161

dict(attribute._dbus_annotations))

1589

1162

except AttributeError:

1590

1163

pass

1591

1164

# Is this a D-Bus property?

1594

1167

# object, and decorate it to be a new D-Bus

1595

1168

# property with the alternate D-Bus interface

1596

1169

# name. Add it to the class.

1597

attr[attrname] = (dbus_service_property(

1598

alt_interface, attribute._dbus_signature,

1599

attribute._dbus_access,

1600

attribute._dbus_get_args_options

1601

["byte_arrays"])

1602

(types.FunctionType(

1603

attribute.func_code,

1604

attribute.func_globals,

1605

attribute.func_name,

1606

attribute.func_defaults,

1607

attribute.func_closure)))

1170

attr[attrname] = (dbus_service_property

1171

(alt_interface,

1172

attribute._dbus_signature,

1173

attribute._dbus_access,

1174

attribute

1175

._dbus_get_args_options

1176

["byte_arrays"])

1177

(types.FunctionType

1178

(attribute.func_code,

1179

attribute.func_globals,

1180

attribute.func_name,

1181

attribute.func_defaults,

1182

attribute.func_closure)))

1608

1183

# Copy annotations, if any

1609

1184

try:

1610

attr[attrname]._dbus_annotations = dict(

1611

attribute._dbus_annotations)

1185

attr[attrname]._dbus_annotations = (

1186

dict(attribute._dbus_annotations))

1612

1187

except AttributeError:

1613

1188

pass

1614

1189

# Is this a D-Bus interface?

1617

1192

# object. Decorate it to be a new D-Bus interface

1618

1193

# with the alternate D-Bus interface name. Add it

1619

1194

# to the class.

1620

attr[attrname] = (

1621

dbus_interface_annotations(alt_interface)

1622

(types.FunctionType(attribute.func_code,

1623

attribute.func_globals,

1624

attribute.func_name,

1625

attribute.func_defaults,

1626

attribute.func_closure)))

1195

attr[attrname] = (dbus_interface_annotations

1196

(alt_interface)

1197

(types.FunctionType

1198

(attribute.func_code,

1199

attribute.func_globals,

1200

attribute.func_name,

1201

attribute.func_defaults,

1202

attribute.func_closure)))

1627

1203

if deprecate:

1628

1204

# Deprecate all alternate interfaces

1629

iname="_AlternateDBusNames_interface_annotation{}"

1205

iname="_AlternateDBusNames_interface_annotation{0}"

1630

1206

for interface_name in interface_names:

1631

1632

1207

@dbus_interface_annotations(interface_name)

1633

1208

def func(self):

1634

1209

return { "org.freedesktop.DBus.Deprecated":

1635

"true" }

1210

"true" }

1636

1211

# Find an unused name

1637

1212

for aname in (iname.format(i)

1638

1213

for i in itertools.count()):

1642

1217

if interface_names:

1643

1218

# Replace the class with a new subclass of it with

1644

1219

# methods, signals, etc. as created above.

1645

cls = type(b"{}Alternate".format(cls.__name__),

1646

(cls, ), attr)

1220

cls = type(b"{0}Alternate".format(cls.__name__),

1221

(cls,), attr)

1647

1222

return cls

1648

1649

1223

return wrapper

1650

1224

1651

1225

1652

1226

@alternate_dbus_interfaces({"se.recompile.Mandos":

1653

"se.bsnet.fukt.Mandos"})

1227

"se.bsnet.fukt.Mandos"})

1654

1228

class ClientDBus(Client, DBusObjectWithProperties):

1655

1229

"""A Client class using D-Bus

1656

1230

1660

1234

"""

1661

1235

1662

1236

runtime_expansions = (Client.runtime_expansions

1663

+ ("dbus_object_path", ))

1664

1665

_interface = "se.recompile.Mandos.Client"

1237

+ ("dbus_object_path",))

1666

1238

1667

1239

# dbus.service.Object doesn't use super(), so we can't either.

1668

1240

1671

1243

Client.__init__(self, *args, **kwargs)

1672

1244

# Only now, when this client is initialized, can it show up on

1673

1245

# the D-Bus

1674

client_object_name = str(self.name).translate(

1246

client_object_name = unicode(self.name).translate(

1675

1247

{ord("."): ord("_"),

1676

1248

ord("-"): ord("_")})

1677

self.dbus_object_path = dbus.ObjectPath(

1678

"/clients/" + client_object_name)

1249

self.dbus_object_path = (dbus.ObjectPath

1250

("/clients/" + client_object_name))

1679

1251

DBusObjectWithProperties.__init__(self, self.bus,

1680

1252

self.dbus_object_path)

1681

1253

1682

def notifychangeproperty(transform_func, dbus_name,

1683

type_func=lambda x: x,

1684

variant_level=1,

1685

invalidate_only=False,

1686

_interface=_interface):

1254

def notifychangeproperty(transform_func,

1255

dbus_name, type_func=lambda x: x,

1256

variant_level=1):

1687

1257

""" Modify a variable so that it's a property which announces

1688

1258

its changes to DBus.

1689

1259

1694

1264

to the D-Bus. Default: no transform

1695

1265

variant_level: D-Bus variant level. Default: 1

1696

1266

"""

1697

attrname = "_{}".format(dbus_name)

1698

1267

attrname = "_{0}".format(dbus_name)

1699

1268

def setter(self, value):

1700

1269

if hasattr(self, "dbus_object_path"):

1701

1270

if (not hasattr(self, attrname) or

1702

1271

type_func(getattr(self, attrname, None))

1703

1272

!= type_func(value)):

1704

if invalidate_only:

1705

self.PropertiesChanged(

1706

_interface, dbus.Dictionary(),

1707

dbus.Array((dbus_name, )))

1708

else:

1709

dbus_value = transform_func(

1710

type_func(value),

1711

variant_level = variant_level)

1712

self.PropertyChanged(dbus.String(dbus_name),

1713

dbus_value)

1714

self.PropertiesChanged(

1715

_interface,

1716

dbus.Dictionary({ dbus.String(dbus_name):

1717

dbus_value }),

1718

dbus.Array())

1273

dbus_value = transform_func(type_func(value),

1274

variant_level

1275

=variant_level)

1276

self.PropertyChanged(dbus.String(dbus_name),

1277

dbus_value)

1719

1278

setattr(self, attrname, value)

1720

1279

1721

1280

return property(lambda self: getattr(self, attrname), setter)

1727

1286

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1728

1287

last_enabled = notifychangeproperty(datetime_to_dbus,

1729

1288

"LastEnabled")

1730

checker = notifychangeproperty(

1731

dbus.Boolean, "CheckerRunning",

1732

type_func = lambda checker: checker is not None)

1289

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1290

type_func = lambda checker:

1291

checker is not None)

1733

1292

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1734

1293

"LastCheckedOK")

1735

1294

last_checker_status = notifychangeproperty(dbus.Int16,

1738

1297

datetime_to_dbus, "LastApprovalRequest")

1739

1298

approved_by_default = notifychangeproperty(dbus.Boolean,

1740

1299

"ApprovedByDefault")

1741

approval_delay = notifychangeproperty(

1742

dbus.UInt64, "ApprovalDelay",

1743

type_func = lambda td: td.total_seconds() * 1000)

1300

approval_delay = notifychangeproperty(dbus.UInt64,

1301

"ApprovalDelay",

1302

type_func =

1303

timedelta_to_milliseconds)

1744

1304

approval_duration = notifychangeproperty(

1745

1305

dbus.UInt64, "ApprovalDuration",

1746

type_func = lambda td: td.total_seconds() * 1000)

1306

type_func = timedelta_to_milliseconds)

1747

1307

host = notifychangeproperty(dbus.String, "Host")

1748

timeout = notifychangeproperty(

1749

dbus.UInt64, "Timeout",

1750

type_func = lambda td: td.total_seconds() * 1000)

1308

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1309

type_func =

1310

timedelta_to_milliseconds)

1751

1311

extended_timeout = notifychangeproperty(

1752

1312

dbus.UInt64, "ExtendedTimeout",

1753

type_func = lambda td: td.total_seconds() * 1000)

1754

interval = notifychangeproperty(

1755

dbus.UInt64, "Interval",

1756

type_func = lambda td: td.total_seconds() * 1000)

1313

type_func = timedelta_to_milliseconds)

1314

interval = notifychangeproperty(dbus.UInt64,

1315

"Interval",

1316

type_func =

1317

timedelta_to_milliseconds)

1757

1318

checker_command = notifychangeproperty(dbus.String, "Checker")

1758

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1759

invalidate_only=True)

1760

1319

1761

1320

del notifychangeproperty

1762

1321

1769

1328

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1770

1329

Client.__del__(self, *args, **kwargs)

1771

1330

1772

def checker_callback(self, source, condition,

1773

connection, command, *args, **kwargs):

1774

ret = Client.checker_callback(self, source, condition,

1775

connection, command, *args,

1776

**kwargs)

1777

exitstatus = self.last_checker_status

1778

if exitstatus >= 0:

1331

def checker_callback(self, pid, condition, command,

1332

*args, **kwargs):

1333

self.checker_callback_tag = None

1334

self.checker = None

1335

if os.WIFEXITED(condition):

1336

exitstatus = os.WEXITSTATUS(condition)

1779

1337

# Emit D-Bus signal

1780

1338

self.CheckerCompleted(dbus.Int16(exitstatus),

1781

# This is specific to GNU libC

1782

dbus.Int64(exitstatus << 8),

1339

dbus.Int64(condition),

1783

1340

dbus.String(command))

1784

1341

else:

1785

1342

# Emit D-Bus signal

1786

1343

self.CheckerCompleted(dbus.Int16(-1),

1787

dbus.Int64(

1788

# This is specific to GNU libC

1789

(exitstatus << 8)

1790

| self.last_checker_signal),

1344

dbus.Int64(condition),

1791

1345

dbus.String(command))

1792

return ret

1346

1347

return Client.checker_callback(self, pid, condition, command,

1348

*args, **kwargs)

1793

1349

1794

1350

def start_checker(self, *args, **kwargs):

1795

old_checker_pid = getattr(self.checker, "pid", None)

1351

old_checker = self.checker

1352

if self.checker is not None:

1353

old_checker_pid = self.checker.pid

1354

else:

1355

old_checker_pid = None

1796

1356

r = Client.start_checker(self, *args, **kwargs)

1797

1357

# Only if new checker process was started

1798

1358

if (self.checker is not None

1807

1367

1808

1368

def approve(self, value=True):

1809

1369

self.approved = value

1810

GObject.timeout_add(int(self.approval_duration.total_seconds()

1811

* 1000), self._reset_approved)

1370

gobject.timeout_add(timedelta_to_milliseconds

1371

(self.approval_duration),

1372

self._reset_approved)

1812

1373

self.send_changedstate()

1813

1374

1814

1375

## D-Bus methods, signals & properties

1376

_interface = "se.recompile.Mandos.Client"

1815

1377

1816

1378

## Interfaces

1817

1379

1380

@dbus_interface_annotations(_interface)

1381

def _foo(self):

1382

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1383

"false"}

1384

1818

1385

## Signals

1819

1386

1820

1387

# CheckerCompleted - signal

1830

1397

pass

1831

1398

1832

1399

# PropertyChanged - signal

1833

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1834

1400

@dbus.service.signal(_interface, signature="sv")

1835

1401

def PropertyChanged(self, property, value):

1836

1402

"D-Bus signal"

1870

1436

self.checked_ok()

1871

1437

1872

1438

# Enable - method

1873

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1874

1439

@dbus.service.method(_interface)

1875

1440

def Enable(self):

1876

1441

"D-Bus method"

1877

1442

self.enable()

1878

1443

1879

1444

# StartChecker - method

1880

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1881

1445

@dbus.service.method(_interface)

1882

1446

def StartChecker(self):

1883

1447

"D-Bus method"

1884

1448

self.start_checker()

1885

1449

1886

1450

# Disable - method

1887

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1888

1451

@dbus.service.method(_interface)

1889

1452

def Disable(self):

1890

1453

"D-Bus method"

1891

1454

self.disable()

1892

1455

1893

1456

# StopChecker - method

1894

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1895

1457

@dbus.service.method(_interface)

1896

1458

def StopChecker(self):

1897

1459

self.stop_checker()

1904

1466

return dbus.Boolean(bool(self.approvals_pending))

1905

1467

1906

1468

# ApprovedByDefault - property

1907

@dbus_service_property(_interface,

1908

signature="b",

1469

@dbus_service_property(_interface, signature="b",

1909

1470

access="readwrite")

1910

1471

def ApprovedByDefault_dbus_property(self, value=None):

1911

1472

if value is None: # get

1913

1474

self.approved_by_default = bool(value)

1914

1475

1915

1476

# ApprovalDelay - property

1916

@dbus_service_property(_interface,

1917

signature="t",

1477

@dbus_service_property(_interface, signature="t",

1918

1478

access="readwrite")

1919

1479

def ApprovalDelay_dbus_property(self, value=None):

1920

1480

if value is None: # get

1921

return dbus.UInt64(self.approval_delay.total_seconds()

1922

* 1000)

1481

return dbus.UInt64(self.approval_delay_milliseconds())

1923

1482

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1924

1483

1925

1484

# ApprovalDuration - property

1926

@dbus_service_property(_interface,

1927

signature="t",

1485

@dbus_service_property(_interface, signature="t",

1928

1486

access="readwrite")

1929

1487

def ApprovalDuration_dbus_property(self, value=None):

1930

1488

if value is None: # get

1931

return dbus.UInt64(self.approval_duration.total_seconds()

1932

* 1000)

1489

return dbus.UInt64(timedelta_to_milliseconds(

1490

self.approval_duration))

1933

1491

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1934

1492

1935

1493

# Name - property

1936

@dbus_annotations(

1937

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1938

1494

@dbus_service_property(_interface, signature="s", access="read")

1939

1495

def Name_dbus_property(self):

1940

1496

return dbus.String(self.name)

1941

1497

1942

1498

# Fingerprint - property

1943

@dbus_annotations(

1944

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1945

1499

@dbus_service_property(_interface, signature="s", access="read")

1946

1500

def Fingerprint_dbus_property(self):

1947

1501

return dbus.String(self.fingerprint)

1948

1502

1949

1503

# Host - property

1950

@dbus_service_property(_interface,

1951

signature="s",

1504

@dbus_service_property(_interface, signature="s",

1952

1505

access="readwrite")

1953

1506

def Host_dbus_property(self, value=None):

1954

1507

if value is None: # get

1955

1508

return dbus.String(self.host)

1956

self.host = str(value)

1509

self.host = unicode(value)

1957

1510

1958

1511

# Created - property

1959

@dbus_annotations(

1960

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1961

1512

@dbus_service_property(_interface, signature="s", access="read")

1962

1513

def Created_dbus_property(self):

1963

1514

return datetime_to_dbus(self.created)

1968

1519

return datetime_to_dbus(self.last_enabled)

1969

1520

1970

1521

# Enabled - property

1971

@dbus_service_property(_interface,

1972

signature="b",

1522

@dbus_service_property(_interface, signature="b",

1973

1523

access="readwrite")

1974

1524

def Enabled_dbus_property(self, value=None):

1975

1525

if value is None: # get

1980

1530

self.disable()

1981

1531

1982

1532

# LastCheckedOK - property

1983

@dbus_service_property(_interface,

1984

signature="s",

1533

@dbus_service_property(_interface, signature="s",

1985

1534

access="readwrite")

1986

1535

def LastCheckedOK_dbus_property(self, value=None):

1987

1536

if value is not None:

1990

1539

return datetime_to_dbus(self.last_checked_ok)

1991

1540

1992

1541

# LastCheckerStatus - property

1993

@dbus_service_property(_interface, signature="n", access="read")

1542

@dbus_service_property(_interface, signature="n",

1543

access="read")

1994

1544

def LastCheckerStatus_dbus_property(self):

1995

1545

return dbus.Int16(self.last_checker_status)

1996

1546

2005

1555

return datetime_to_dbus(self.last_approval_request)

2006

1556

2007

1557

# Timeout - property

2008

@dbus_service_property(_interface,

2009

signature="t",

1558

@dbus_service_property(_interface, signature="t",

2010

1559

access="readwrite")

2011

1560

def Timeout_dbus_property(self, value=None):

2012

1561

if value is None: # get

2013

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1562

return dbus.UInt64(self.timeout_milliseconds())

2014

1563

old_timeout = self.timeout

2015

1564

self.timeout = datetime.timedelta(0, 0, 0, value)

2016

1565

# Reschedule disabling

2024

1573

if (getattr(self, "disable_initiator_tag", None)

2025

1574

is None):

2026

1575

return

2027

GObject.source_remove(self.disable_initiator_tag)

2028

self.disable_initiator_tag = GObject.timeout_add(

2029

int((self.expires - now).total_seconds() * 1000),

2030

self.disable)

1576

gobject.source_remove(self.disable_initiator_tag)

1577

self.disable_initiator_tag = (

1578

gobject.timeout_add(

1579

timedelta_to_milliseconds(self.expires - now),

1580

self.disable))

2031

1581

2032

1582

# ExtendedTimeout - property

2033

@dbus_service_property(_interface,

2034

signature="t",

1583

@dbus_service_property(_interface, signature="t",

2035

1584

access="readwrite")

2036

1585

def ExtendedTimeout_dbus_property(self, value=None):

2037

1586

if value is None: # get

2038

return dbus.UInt64(self.extended_timeout.total_seconds()

2039

* 1000)

1587

return dbus.UInt64(self.extended_timeout_milliseconds())

2040

1588

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2041

1589

2042

1590

# Interval - property

2043

@dbus_service_property(_interface,

2044

signature="t",

1591

@dbus_service_property(_interface, signature="t",

2045

1592

access="readwrite")

2046

1593

def Interval_dbus_property(self, value=None):

2047

1594

if value is None: # get

2048

return dbus.UInt64(self.interval.total_seconds() * 1000)

1595

return dbus.UInt64(self.interval_milliseconds())

2049

1596

self.interval = datetime.timedelta(0, 0, 0, value)

2050

1597

if getattr(self, "checker_initiator_tag", None) is None:

2051

1598

return

2052

1599

if self.enabled:

2053

1600

# Reschedule checker run

2054

GObject.source_remove(self.checker_initiator_tag)

2055

self.checker_initiator_tag = GObject.timeout_add(

2056

value, self.start_checker)

2057

self.start_checker() # Start one now, too

1601

gobject.source_remove(self.checker_initiator_tag)

1602

self.checker_initiator_tag = (gobject.timeout_add

1603

(value, self.start_checker))

1604

self.start_checker() # Start one now, too

2058

1605

2059

1606

# Checker - property

2060

@dbus_service_property(_interface,

2061

signature="s",

1607

@dbus_service_property(_interface, signature="s",

2062

1608

access="readwrite")

2063

1609

def Checker_dbus_property(self, value=None):

2064

1610

if value is None: # get

2065

1611

return dbus.String(self.checker_command)

2066

self.checker_command = str(value)

1612

self.checker_command = unicode(value)

2067

1613

2068

1614

# CheckerRunning - property

2069

@dbus_service_property(_interface,

2070

signature="b",

1615

@dbus_service_property(_interface, signature="b",

2071

1616

access="readwrite")

2072

1617

def CheckerRunning_dbus_property(self, value=None):

2073

1618

if value is None: # get

2078

1623

self.stop_checker()

2079

1624

2080

1625

# ObjectPath - property

2081

@dbus_annotations(

2082

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2083

"org.freedesktop.DBus.Deprecated": "true"})

2084

1626

@dbus_service_property(_interface, signature="o", access="read")

2085

1627

def ObjectPath_dbus_property(self):

2086

1628

return self.dbus_object_path # is already a dbus.ObjectPath

2087

1629

2088

1630

# Secret = property

2089

@dbus_annotations(

2090

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2091

"invalidates"})

2092

@dbus_service_property(_interface,

2093

signature="ay",

2094

access="write",

2095

byte_arrays=True)

1631

@dbus_service_property(_interface, signature="ay",

1632

access="write", byte_arrays=True)

2096

1633

def Secret_dbus_property(self, value):

2097

self.secret = bytes(value)

1634

self.secret = str(value)

2098

1635

2099

1636

del _interface

2100

1637

2104

1641

self._pipe = child_pipe

2105

1642

self._pipe.send(('init', fpr, address))

2106

1643

if not self._pipe.recv():

2107

raise KeyError(fpr)

1644

raise KeyError()

2108

1645

2109

1646

def __getattribute__(self, name):

2110

1647

if name == '_pipe':

2114

1651

if data[0] == 'data':

2115

1652

return data[1]

2116

1653

if data[0] == 'function':

2117

2118

1654

def func(*args, **kwargs):

2119

1655

self._pipe.send(('funcall', name, args, kwargs))

2120

1656

return self._pipe.recv()[1]

2121

2122

1657

return func

2123

1658

2124

1659

def __setattr__(self, name, value):

2136

1671

def handle(self):

2137

1672

with contextlib.closing(self.server.child_pipe) as child_pipe:

2138

1673

logger.info("TCP connection from: %s",

2139

str(self.client_address))

1674

unicode(self.client_address))

2140

1675

logger.debug("Pipe FD: %d",

2141

1676

self.server.child_pipe.fileno())

2142

1677

2143

session = gnutls.ClientSession(self.request)

1678

session = (gnutls.connection

1679

.ClientSession(self.request,

1680

gnutls.connection

1681

.X509Credentials()))

1682

1683

# Note: gnutls.connection.X509Credentials is really a

1684

# generic GnuTLS certificate credentials object so long as

1685

# no X.509 keys are added to it. Therefore, we can use it

1686

# here despite using OpenPGP certificates.

2144

1687

2145

1688

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

2146

1689

# "+AES-256-CBC", "+SHA1",

2150

1693

priority = self.server.gnutls_priority

2151

1694

if priority is None:

2152

1695

priority = "NORMAL"

2153

gnutls.priority_set_direct(session._c_object, priority,

2154

None)

1696

(gnutls.library.functions

1697

.gnutls_priority_set_direct(session._c_object,

1698

priority, None))

2155

1699

2156

1700

# Start communication using the Mandos protocol

2157

1701

# Get protocol number

2167

1711

# Start GnuTLS connection

2168

1712

try:

2169

1713

session.handshake()

2170

except gnutls.Error as error:

1714

except gnutls.errors.GNUTLSError as error:

2171

1715

logger.warning("Handshake failed: %s", error)

2172

1716

# Do not run session.bye() here: the session is not

2173

1717

# established. Just abandon the request.

2177

1721

approval_required = False

2178

1722

try:

2179

1723

try:

2180

fpr = self.fingerprint(

2181

self.peer_certificate(session))

2182

except (TypeError, gnutls.Error) as error:

1724

fpr = self.fingerprint(self.peer_certificate

1725

(session))

1726

except (TypeError,

1727

gnutls.errors.GNUTLSError) as error:

2183

1728

logger.warning("Bad certificate: %s", error)

2184

1729

return

2185

1730

logger.debug("Fingerprint: %s", fpr)

2198

1743

while True:

2199

1744

if not client.enabled:

2200

1745

logger.info("Client %s is disabled",

2201

client.name)

1746

client.name)

2202

1747

if self.server.use_dbus:

2203

1748

# Emit D-Bus signal

2204

1749

client.Rejected("Disabled")

2213

1758

if self.server.use_dbus:

2214

1759

# Emit D-Bus signal

2215

1760

client.NeedApproval(

2216

client.approval_delay.total_seconds()

2217

* 1000, client.approved_by_default)

1761

client.approval_delay_milliseconds(),

1762

client.approved_by_default)

2218

1763

else:

2219

1764

logger.warning("Client %s was not approved",

2220

1765

client.name)

2226

1771

#wait until timeout or approved

2227

1772

time = datetime.datetime.now()

2228

1773

client.changedstate.acquire()

2229

client.changedstate.wait(delay.total_seconds())

1774

client.changedstate.wait(

1775

float(timedelta_to_milliseconds(delay)

1776

/ 1000))

2230

1777

client.changedstate.release()

2231

1778

time2 = datetime.datetime.now()

2232

1779

if (time2 - time) >= delay:

2243

1790

else:

2244

1791

delay -= time2 - time

2245

1792

2246

try:

2247

session.send(client.secret)

2248

except gnutls.Error as error:

2249

logger.warning("gnutls send failed",

2250

exc_info = error)

2251

return

1793

sent_size = 0

1794

while sent_size < len(client.secret):

1795

try:

1796

sent = session.send(client.secret[sent_size:])

1797

except gnutls.errors.GNUTLSError as error:

1798

logger.warning("gnutls send failed",

1799

exc_info=error)

1800

return

1801

logger.debug("Sent: %d, remaining: %d",

1802

sent, len(client.secret)

1803

- (sent_size + sent))

1804

sent_size += sent

2252

1805

2253

1806

logger.info("Sending secret to %s", client.name)

2254

1807

# bump the timeout using extended_timeout

2262

1815

client.approvals_pending -= 1

2263

1816

try:

2264

1817

session.bye()

2265

except gnutls.Error as error:

1818

except gnutls.errors.GNUTLSError as error:

2266

1819

logger.warning("GnuTLS bye failed",

2267

1820

exc_info=error)

2268

1821

2270

1823

def peer_certificate(session):

2271

1824

"Return the peer's OpenPGP certificate as a bytestring"

2272

1825

# If not an OpenPGP certificate...

2273

if (gnutls.certificate_type_get(session._c_object)

2274

!= gnutls.CRT_OPENPGP):

2275

# ...return invalid data

2276

return b""

1826

if (gnutls.library.functions

1827

.gnutls_certificate_type_get(session._c_object)

1828

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1829

# ...do the normal thing

1830

return session.peer_certificate

2277

1831

list_size = ctypes.c_uint(1)

2278

cert_list = (gnutls.certificate_get_peers

1832

cert_list = (gnutls.library.functions

1833

.gnutls_certificate_get_peers

2279

1834

(session._c_object, ctypes.byref(list_size)))

2280

1835

if not bool(cert_list) and list_size.value != 0:

2281

raise gnutls.Error("error getting peer certificate")

1836

raise gnutls.errors.GNUTLSError("error getting peer"

1837

" certificate")

2282

1838

if list_size.value == 0:

2283

1839

return None

2284

1840

cert = cert_list[0]

2288

1844

def fingerprint(openpgp):

2289

1845

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2290

1846

# New GnuTLS "datum" with the OpenPGP public key

2291

datum = gnutls.datum_t(

2292

ctypes.cast(ctypes.c_char_p(openpgp),

2293

ctypes.POINTER(ctypes.c_ubyte)),

2294

ctypes.c_uint(len(openpgp)))

1847

datum = (gnutls.library.types

1848

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1849

ctypes.POINTER

1850

(ctypes.c_ubyte)),

1851

ctypes.c_uint(len(openpgp))))

2295

1852

# New empty GnuTLS certificate

2296

crt = gnutls.openpgp_crt_t()

2297

gnutls.openpgp_crt_init(ctypes.byref(crt))

1853

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1854

(gnutls.library.functions

1855

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2298

1856

# Import the OpenPGP public key into the certificate

2299

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2300

gnutls.OPENPGP_FMT_RAW)

1857

(gnutls.library.functions

1858

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1859

gnutls.library.constants

1860

.GNUTLS_OPENPGP_FMT_RAW))

2301

1861

# Verify the self signature in the key

2302

1862

crtverify = ctypes.c_uint()

2303

gnutls.openpgp_crt_verify_self(crt, 0,

2304

ctypes.byref(crtverify))

1863

(gnutls.library.functions

1864

.gnutls_openpgp_crt_verify_self(crt, 0,

1865

ctypes.byref(crtverify)))

2305

1866

if crtverify.value != 0:

2306

gnutls.openpgp_crt_deinit(crt)

2307

raise gnutls.CertificateSecurityError("Verify failed")

1867

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1868

raise (gnutls.errors.CertificateSecurityError

1869

("Verify failed"))

2308

1870

# New buffer for the fingerprint

2309

1871

buf = ctypes.create_string_buffer(20)

2310

1872

buf_len = ctypes.c_size_t()

2311

1873

# Get the fingerprint from the certificate into the buffer

2312

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2313

ctypes.byref(buf_len))

1874

(gnutls.library.functions

1875

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1876

ctypes.byref(buf_len)))

2314

1877

# Deinit the certificate

2315

gnutls.openpgp_crt_deinit(crt)

1878

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2316

1879

# Convert the buffer to a Python bytestring

2317

1880

fpr = ctypes.string_at(buf, buf_len.value)

2318

1881

# Convert the bytestring to hexadecimal notation

2322

1885

2323

1886

class MultiprocessingMixIn(object):

2324

1887

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2325

2326

1888

def sub_process_main(self, request, address):

2327

1889

try:

2328

1890

self.finish_request(request, address)

2340

1902

2341

1903

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2342

1904

""" adds a pipe to the MixIn """

2343

2344

1905

def process_request(self, request, client_address):

2345

1906

"""Overrides and wraps the original process_request().

2346

1907

2367

1928

interface: None or a network interface name (string)

2368

1929

use_ipv6: Boolean; to use IPv6 or not

2369

1930

"""

2370

2371

1931

def __init__(self, server_address, RequestHandlerClass,

2372

interface=None,

2373

use_ipv6=True,

2374

socketfd=None):

1932

interface=None, use_ipv6=True, socketfd=None):

2375

1933

"""If socketfd is set, use that file descriptor instead of

2376

1934

creating a new one with socket.socket().

2377

1935

"""

2418

1976

self.interface)

2419

1977

else:

2420

1978

try:

2421

self.socket.setsockopt(

2422

socket.SOL_SOCKET, SO_BINDTODEVICE,

2423

(self.interface + "\0").encode("utf-8"))

1979

self.socket.setsockopt(socket.SOL_SOCKET,

1980

SO_BINDTODEVICE,

1981

str(self.interface + '\0'))

2424

1982

except socket.error as error:

2425

1983

if error.errno == errno.EPERM:

2426

1984

logger.error("No permission to bind to"

2444

2002

self.server_address = (any_address,

2445

2003

self.server_address[1])

2446

2004

elif not self.server_address[1]:

2447

self.server_address = (self.server_address[0], 0)

2005

self.server_address = (self.server_address[0],

2006

0)

2448

2007

# if self.interface:

2449

2008

# self.server_address = (self.server_address[0],

2450

2009

# 0, # port

2462

2021

gnutls_priority GnuTLS priority string

2463

2022

use_dbus: Boolean; to emit D-Bus signals or not

2464

2023

2465

Assumes a GObject.MainLoop event loop.

2024

Assumes a gobject.MainLoop event loop.

2466

2025

"""

2467

2468

2026

def __init__(self, server_address, RequestHandlerClass,

2469

interface=None,

2470

use_ipv6=True,

2471

clients=None,

2472

gnutls_priority=None,

2473

use_dbus=True,

2474

socketfd=None):

2027

interface=None, use_ipv6=True, clients=None,

2028

gnutls_priority=None, use_dbus=True, socketfd=None):

2475

2029

self.enabled = False

2476

2030

self.clients = clients

2477

2031

if self.clients is None:

2483

2037

interface = interface,

2484

2038

use_ipv6 = use_ipv6,

2485

2039

socketfd = socketfd)

2486

2487

2040

def server_activate(self):

2488

2041

if self.enabled:

2489

2042

return socketserver.TCPServer.server_activate(self)

2493

2046

2494

2047

def add_pipe(self, parent_pipe, proc):

2495

2048

# Call "handle_ipc" for both data and EOF events

2496

GObject.io_add_watch(

2497

parent_pipe.fileno(),

2498

GObject.IO_IN | GObject.IO_HUP,

2499

functools.partial(self.handle_ipc,

2500

parent_pipe = parent_pipe,

2501

proc = proc))

2049

gobject.io_add_watch(parent_pipe.fileno(),

2050

gobject.IO_IN | gobject.IO_HUP,

2051

functools.partial(self.handle_ipc,

2052

parent_pipe =

2053

parent_pipe,

2054

proc = proc))

2502

2055

2503

def handle_ipc(self, source, condition,

2504

parent_pipe=None,

2505

proc = None,

2506

client_object=None):

2056

def handle_ipc(self, source, condition, parent_pipe=None,

2057

proc = None, client_object=None):

2507

2058

# error, or the other end of multiprocessing.Pipe has closed

2508

if condition & (GObject.IO_ERR | GObject.IO_HUP):

2059

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2509

2060

# Wait for other process to exit

2510

2061

proc.join()

2511

2062

return False

2532

2083

parent_pipe.send(False)

2533

2084

return False

2534

2085

2535

GObject.io_add_watch(

2536

parent_pipe.fileno(),

2537

GObject.IO_IN | GObject.IO_HUP,

2538

functools.partial(self.handle_ipc,

2539

parent_pipe = parent_pipe,

2540

proc = proc,

2541

client_object = client))

2086

gobject.io_add_watch(parent_pipe.fileno(),

2087

gobject.IO_IN | gobject.IO_HUP,

2088

functools.partial(self.handle_ipc,

2089

parent_pipe =

2090

parent_pipe,

2091

proc = proc,

2092

client_object =

2093

client))

2542

2094

parent_pipe.send(True)

2543

2095

# remove the old hook in favor of the new above hook on

2544

2096

# same fileno

2550

2102

2551

2103

parent_pipe.send(('data', getattr(client_object,

2552

2104

funcname)(*args,

2553

**kwargs)))

2105

**kwargs)))

2554

2106

2555

2107

if command == 'getattr':

2556

2108

attrname = request[1]

2557

if isinstance(client_object.__getattribute__(attrname),

2558

collections.Callable):

2559

parent_pipe.send(('function', ))

2109

if callable(client_object.__getattribute__(attrname)):

2110

parent_pipe.send(('function',))

2560

2111

else:

2561

parent_pipe.send((

2562

'data', client_object.__getattribute__(attrname)))

2112

parent_pipe.send(('data', client_object

2113

.__getattribute__(attrname)))

2563

2114

2564

2115

if command == 'setattr':

2565

2116

attrname = request[1]

2596

2147

# avoid excessive use of external libraries.

2597

2148

2598

2149

# New type for defining tokens, syntax, and semantics all-in-one

2599

Token = collections.namedtuple("Token", (

2600

"regexp", # To match token; if "value" is not None, must have

2601

# a "group" containing digits

2602

"value", # datetime.timedelta or None

2603

"followers")) # Tokens valid after this token

2150

Token = collections.namedtuple("Token",

2151

("regexp", # To match token; if

2152

# "value" is not None,

2153

# must have a "group"

2154

# containing digits

2155

"value", # datetime.timedelta or

2156

# None

2157

"followers")) # Tokens valid after

2158

# this token

2604

2159

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2605

2160

# the "duration" ABNF definition in RFC 3339, Appendix A.

2606

2161

token_end = Token(re.compile(r"$"), None, frozenset())

2607

2162

token_second = Token(re.compile(r"(\d+)S"),

2608

2163

datetime.timedelta(seconds=1),

2609

frozenset((token_end, )))

2164

frozenset((token_end,)))

2610

2165

token_minute = Token(re.compile(r"(\d+)M"),

2611

2166

datetime.timedelta(minutes=1),

2612

2167

frozenset((token_second, token_end)))

2628

2183

frozenset((token_month, token_end)))

2629

2184

token_week = Token(re.compile(r"(\d+)W"),

2630

2185

datetime.timedelta(weeks=1),

2631

frozenset((token_end, )))

2186

frozenset((token_end,)))

2632

2187

token_duration = Token(re.compile(r"P"), None,

2633

2188

frozenset((token_year, token_month,

2634

2189

token_day, token_time,

2635

token_week)))

2190

token_week))),

2636

2191

# Define starting values

2637

2192

value = datetime.timedelta() # Value so far

2638

2193

found_token = None

2639

followers = frozenset((token_duration, )) # Following valid tokens

2194

followers = frozenset(token_duration,) # Following valid tokens

2640

2195

s = duration # String left to parse

2641

2196

# Loop until end token is found

2642

2197

while found_token is not token_end:

2659

2214

break

2660

2215

else:

2661

2216

# No currently valid tokens were found

2662

raise ValueError("Invalid RFC 3339 duration: {!r}"

2663

.format(duration))

2217

raise ValueError("Invalid RFC 3339 duration")

2664

2218

# End token found

2665

2219

return value

2666

2220

2690

2244

timevalue = datetime.timedelta(0)

2691

2245

for s in interval.split():

2692

2246

try:

2693

suffix = s[-1]

2247

suffix = unicode(s[-1])

2694

2248

value = int(s[:-1])

2695

2249

if suffix == "d":

2696

2250

delta = datetime.timedelta(value)

2703

2257

elif suffix == "w":

2704

2258

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2705

2259

else:

2706

raise ValueError("Unknown suffix {!r}".format(suffix))

2260

raise ValueError("Unknown suffix {0!r}"

2261

.format(suffix))

2707

2262

except IndexError as e:

2708

2263

raise ValueError(*(e.args))

2709

2264

timevalue += delta

2726

2281

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2727

2282

if not stat.S_ISCHR(os.fstat(null).st_mode):

2728

2283

raise OSError(errno.ENODEV,

2729

"{} not a character device"

2284

"{0} not a character device"

2730

2285

.format(os.devnull))

2731

2286

os.dup2(null, sys.stdin.fileno())

2732

2287

os.dup2(null, sys.stdout.fileno())

2742

2297

2743

2298

parser = argparse.ArgumentParser()

2744

2299

parser.add_argument("-v", "--version", action="version",

2745

version = "%(prog)s {}".format(version),

2300

version = "%(prog)s {0}".format(version),

2746

2301

help="show version number and exit")

2747

2302

parser.add_argument("-i", "--interface", metavar="IF",

2748

2303

help="Bind to interface IF")

2781

2336

help="Directory to save/restore state in")

2782

2337

parser.add_argument("--foreground", action="store_true",

2783

2338

help="Run in foreground", default=None)

2784

parser.add_argument("--no-zeroconf", action="store_false",

2785

dest="zeroconf", help="Do not use Zeroconf",

2786

default=None)

2787

2339

2788

2340

options = parser.parse_args()

2789

2341

2790

2342

if options.check:

2791

2343

import doctest

2792

fail_count, test_count = doctest.testmod()

2793

sys.exit(os.EX_OK if fail_count == 0 else 1)

2344

doctest.testmod()

2345

sys.exit()

2794

2346

2795

2347

# Default values for config file for server-global settings

2796

2348

server_defaults = { "interface": "",

2798

2350

"port": "",

2799

2351

"debug": "False",

2800

2352

"priority":

2801

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2802

":+SIGN-DSA-SHA256",

2353

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2803

2354

"servicename": "Mandos",

2804

2355

"use_dbus": "True",

2805

2356

"use_ipv6": "True",

2808

2359

"socket": "",

2809

2360

"statedir": "/var/lib/mandos",

2810

2361

"foreground": "False",

2811

"zeroconf": "True",

2812

}

2362

}

2813

2363

2814

2364

# Parse config file for server-global settings

2815

2365

server_config = configparser.SafeConfigParser(server_defaults)

2816

2366

del server_defaults

2817

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2367

server_config.read(os.path.join(options.configdir,

2368

"mandos.conf"))

2818

2369

# Convert the SafeConfigParser object to a dict

2819

2370

server_settings = server_config.defaults()

2820

2371

# Use the appropriate methods on the non-string config options

2838

2389

# Override the settings from the config file with command line

2839

2390

# options, if set.

2840

2391

for option in ("interface", "address", "port", "debug",

2841

"priority", "servicename", "configdir", "use_dbus",

2842

"use_ipv6", "debuglevel", "restore", "statedir",

2843

"socket", "foreground", "zeroconf"):

2392

"priority", "servicename", "configdir",

2393

"use_dbus", "use_ipv6", "debuglevel", "restore",

2394

"statedir", "socket", "foreground"):

2844

2395

value = getattr(options, option)

2845

2396

if value is not None:

2846

2397

server_settings[option] = value

2847

2398

del options

2848

2399

# Force all strings to be unicode

2849

2400

for option in server_settings.keys():

2850

if isinstance(server_settings[option], bytes):

2851

server_settings[option] = (server_settings[option]

2852

.decode("utf-8"))

2401

if type(server_settings[option]) is str:

2402

server_settings[option] = unicode(server_settings[option])

2853

2403

# Force all boolean options to be boolean

2854

2404

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2855

"foreground", "zeroconf"):

2405

"foreground"):

2856

2406

server_settings[option] = bool(server_settings[option])

2857

2407

# Debug implies foreground

2858

2408

if server_settings["debug"]:

2861

2411

2862

2412

##################################################################

2863

2413

2864

if (not server_settings["zeroconf"]

2865

and not (server_settings["port"]

2866

or server_settings["socket"] != "")):

2867

parser.error("Needs port or socket to work without Zeroconf")

2868

2869

2414

# For convenience

2870

2415

debug = server_settings["debug"]

2871

2416

debuglevel = server_settings["debuglevel"]

2874

2419

stored_state_path = os.path.join(server_settings["statedir"],

2875

2420

stored_state_file)

2876

2421

foreground = server_settings["foreground"]

2877

zeroconf = server_settings["zeroconf"]

2878

2422

2879

2423

if debug:

2880

2424

initlogger(debug, logging.DEBUG)

2886

2430

initlogger(debug, level)

2887

2431

2888

2432

if server_settings["servicename"] != "Mandos":

2889

syslogger.setFormatter(

2890

logging.Formatter('Mandos ({}) [%(process)d]:'

2891

' %(levelname)s: %(message)s'.format(

2892

server_settings["servicename"])))

2433

syslogger.setFormatter(logging.Formatter

2434

('Mandos ({0}) [%(process)d]:'

2435

' %(levelname)s: %(message)s'

2436

.format(server_settings

2437

["servicename"])))

2893

2438

2894

2439

# Parse config file with clients

2895

2440

client_config = configparser.SafeConfigParser(Client

2900

2445

global mandos_dbus_service

2901

2446

mandos_dbus_service = None

2902

2447

2903

socketfd = None

2904

if server_settings["socket"] != "":

2905

socketfd = server_settings["socket"]

2906

tcp_server = MandosServer(

2907

(server_settings["address"], server_settings["port"]),

2908

ClientHandler,

2909

interface=(server_settings["interface"] or None),

2910

use_ipv6=use_ipv6,

2911

gnutls_priority=server_settings["priority"],

2912

use_dbus=use_dbus,

2913

socketfd=socketfd)

2448

tcp_server = MandosServer((server_settings["address"],

2449

server_settings["port"]),

2450

ClientHandler,

2451

interface=(server_settings["interface"]

2452

or None),

2453

use_ipv6=use_ipv6,

2454

gnutls_priority=

2455

server_settings["priority"],

2456

use_dbus=use_dbus,

2457

socketfd=(server_settings["socket"]

2458

or None))

2914

2459

if not foreground:

2915

2460

pidfilename = "/run/mandos.pid"

2916

2461

if not os.path.isdir("/run/."):

2917

2462

pidfilename = "/var/run/mandos.pid"

2918

2463

pidfile = None

2919

2464

try:

2920

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2465

pidfile = open(pidfilename, "w")

2921

2466

except IOError as e:

2922

2467

logger.error("Could not open file %r", pidfilename,

2923

2468

exc_info=e)

2924

2469

2925

for name, group in (("_mandos", "_mandos"),

2926

("mandos", "mandos"),

2927

("nobody", "nogroup")):

2470

for name in ("_mandos", "mandos", "nobody"):

2928

2471

try:

2929

2472

uid = pwd.getpwnam(name).pw_uid

2930

gid = pwd.getpwnam(group).pw_gid

2473

gid = pwd.getpwnam(name).pw_gid

2931

2474

break

2932

2475

except KeyError:

2933

2476

continue

2937

2480

try:

2938

2481

os.setgid(gid)

2939

2482

os.setuid(uid)

2940

if debug:

2941

logger.debug("Did setuid/setgid to {}:{}".format(uid,

2942

gid))

2943

2483

except OSError as error:

2944

logger.warning("Failed to setuid/setgid to {}:{}: {}"

2945

.format(uid, gid, os.strerror(error.errno)))

2946

2484

if error.errno != errno.EPERM:

2947

2485

raise

2948

2486

2951

2489

2952

2490

# "Use a log level over 10 to enable all debugging options."

2953

2491

# - GnuTLS manual

2954

gnutls.global_set_log_level(11)

2492

gnutls.library.functions.gnutls_global_set_log_level(11)

2955

2493

2956

@gnutls.log_func

2494

@gnutls.library.types.gnutls_log_func

2957

2495

def debug_gnutls(level, string):

2958

2496

logger.debug("GnuTLS: %s", string[:-1])

2959

2497

2960

gnutls.global_set_log_function(debug_gnutls)

2498

(gnutls.library.functions

2499

.gnutls_global_set_log_function(debug_gnutls))

2961

2500

2962

2501

# Redirect stdin so all checkers get /dev/null

2963

2502

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2970

2509

# Close all input and output, do double fork, etc.

2971

2510

daemon()

2972

2511

2973

# multiprocessing will use threads, so before we use GObject we

2974

# need to inform GObject that threads will be used.

2975

GObject.threads_init()

2512

# multiprocessing will use threads, so before we use gobject we

2513

# need to inform gobject that threads will be used.

2514

gobject.threads_init()

2976

2515

2977

2516

global main_loop

2978

2517

# From the Avahi example code

2979

2518

DBusGMainLoop(set_as_default=True)

2980

main_loop = GObject.MainLoop()

2519

main_loop = gobject.MainLoop()

2981

2520

bus = dbus.SystemBus()

2982

2521

# End of Avahi example code

2983

2522

if use_dbus:

2984

2523

try:

2985

2524

bus_name = dbus.service.BusName("se.recompile.Mandos",

2986

bus,

2987

do_not_queue=True)

2988

old_bus_name = dbus.service.BusName(

2989

"se.bsnet.fukt.Mandos", bus,

2990

do_not_queue=True)

2991

except dbus.exceptions.DBusException as e:

2525

bus, do_not_queue=True)

2526

old_bus_name = (dbus.service.BusName

2527

("se.bsnet.fukt.Mandos", bus,

2528

do_not_queue=True))

2529

except dbus.exceptions.NameExistsException as e:

2992

2530

logger.error("Disabling D-Bus:", exc_info=e)

2993

2531

use_dbus = False

2994

2532

server_settings["use_dbus"] = False

2995

2533

tcp_server.use_dbus = False

2996

if zeroconf:

2997

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2998

service = AvahiServiceToSyslog(

2999

name = server_settings["servicename"],

3000

servicetype = "_mandos._tcp",

3001

protocol = protocol,

3002

bus = bus)

3003

if server_settings["interface"]:

3004

service.interface = if_nametoindex(

3005

server_settings["interface"].encode("utf-8"))

2534

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2535

service = AvahiServiceToSyslog(name =

2536

server_settings["servicename"],

2537

servicetype = "_mandos._tcp",

2538

protocol = protocol, bus = bus)

2539

if server_settings["interface"]:

2540

service.interface = (if_nametoindex

2541

(str(server_settings["interface"])))

3006

2542

3007

2543

global multiprocessing_manager

3008

2544

multiprocessing_manager = multiprocessing.Manager()

3027

2563

if server_settings["restore"]:

3028

2564

try:

3029

2565

with open(stored_state_path, "rb") as stored_state:

3030

clients_data, old_client_settings = pickle.load(

3031

stored_state)

2566

clients_data, old_client_settings = (pickle.load

2567

(stored_state))

3032

2568

os.remove(stored_state_path)

3033

2569

except IOError as e:

3034

2570

if e.errno == errno.ENOENT:

3035

logger.warning("Could not load persistent state:"

3036

" {}".format(os.strerror(e.errno)))

2571

logger.warning("Could not load persistent state: {0}"

2572

.format(os.strerror(e.errno)))

3037

2573

else:

3038

2574

logger.critical("Could not load persistent state:",

3039

2575

exc_info=e)

3040

2576

raise

3041

2577

except EOFError as e:

3042

2578

logger.warning("Could not load persistent state: "

3043

"EOFError:",

3044

exc_info=e)

2579

"EOFError:", exc_info=e)

3045

2580

3046

2581

with PGPEngine() as pgp:

3047

for client_name, client in clients_data.items():

2582

for client_name, client in clients_data.iteritems():

3048

2583

# Skip removed clients

3049

2584

if client_name not in client_settings:

3050

2585

continue

3059

2594

# For each value in new config, check if it

3060

2595

# differs from the old config value (Except for

3061

2596

# the "secret" attribute)

3062

if (name != "secret"

3063

and (value !=

3064

old_client_settings[client_name][name])):

2597

if (name != "secret" and

2598

value != old_client_settings[client_name]

2599

[name]):

3065

2600

client[name] = value

3066

2601

except KeyError:

3067

2602

pass

3068

2603

3069

2604

# Clients who has passed its expire date can still be

3070

# enabled if its last checker was successful. A Client

2605

# enabled if its last checker was successful. Clients

3071

2606

# whose checker succeeded before we stored its state is

3072

2607

# assumed to have successfully run all checkers during

3073

2608

# downtime.

3075

2610

if datetime.datetime.utcnow() >= client["expires"]:

3076

2611

if not client["last_checked_ok"]:

3077

2612

logger.warning(

3078

"disabling client {} - Client never "

3079

"performed a successful checker".format(

3080

client_name))

2613

"disabling client {0} - Client never "

2614

"performed a successful checker"

2615

.format(client_name))

3081

2616

client["enabled"] = False

3082

2617

elif client["last_checker_status"] != 0:

3083

2618

logger.warning(

3084

"disabling client {} - Client last"

3085

" checker failed with error code"

3086

" {}".format(

3087

client_name,

3088

client["last_checker_status"]))

2619

"disabling client {0} - Client "

2620

"last checker failed with error code {1}"

2621

.format(client_name,

2622

client["last_checker_status"]))

3089

2623

client["enabled"] = False

3090

2624

else:

3091

client["expires"] = (

3092

datetime.datetime.utcnow()

3093

+ client["timeout"])

2625

client["expires"] = (datetime.datetime

2626

.utcnow()

2627

+ client["timeout"])

3094

2628

logger.debug("Last checker succeeded,"

3095

" keeping {} enabled".format(

3096

client_name))

2629

" keeping {0} enabled"

2630

.format(client_name))

3097

2631

try:

3098

client["secret"] = pgp.decrypt(

3099

client["encrypted_secret"],

3100

client_settings[client_name]["secret"])

2632

client["secret"] = (

2633

pgp.decrypt(client["encrypted_secret"],

2634

client_settings[client_name]

2635

["secret"]))

3101

2636

except PGPError:

3102

2637

# If decryption fails, we use secret from new settings

3103

logger.debug("Failed to decrypt {} old secret".format(

3104

client_name))

3105

client["secret"] = (client_settings[client_name]

3106

["secret"])

2638

logger.debug("Failed to decrypt {0} old secret"

2639

.format(client_name))

2640

client["secret"] = (

2641

client_settings[client_name]["secret"])

3107

2642

3108

2643

# Add/remove clients based on new changes made to config

3109

2644

for client_name in (set(old_client_settings)

3114

2649

clients_data[client_name] = client_settings[client_name]

3115

2650

3116

2651

# Create all client objects

3117

for client_name, client in clients_data.items():

2652

for client_name, client in clients_data.iteritems():

3118

2653

tcp_server.clients[client_name] = client_class(

3119

name = client_name,

3120

settings = client,

2654

name = client_name, settings = client,

3121

2655

server_settings = server_settings)

3122

2656

3123

2657

if not tcp_server.clients:

3125

2659

3126

2660

if not foreground:

3127

2661

if pidfile is not None:

3128

pid = os.getpid()

3129

2662

try:

3130

2663

with pidfile:

3131

print(pid, file=pidfile)

2664

pid = os.getpid()

2665

pidfile.write(str(pid) + "\n".encode("utf-8"))

3132

2666

except IOError:

3133

2667

logger.error("Could not write to file %r with PID %d",

3134

2668

pidfilename, pid)

3139

2673

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

3140

2674

3141

2675

if use_dbus:

3142

3143

@alternate_dbus_interfaces(

3144

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3145

class MandosDBusService(DBusObjectWithObjectManager):

2676

@alternate_dbus_interfaces({"se.recompile.Mandos":

2677

"se.bsnet.fukt.Mandos"})

2678

class MandosDBusService(DBusObjectWithProperties):

3146

2679

"""A D-Bus proxy object"""

3147

3148

2680

def __init__(self):

3149

2681

dbus.service.Object.__init__(self, bus, "/")

3150

3151

2682

_interface = "se.recompile.Mandos"

3152

2683

2684

@dbus_interface_annotations(_interface)

2685

def _foo(self):

2686

return { "org.freedesktop.DBus.Property"

2687

".EmitsChangedSignal":

2688

"false"}

2689

3153

2690

@dbus.service.signal(_interface, signature="o")

3154

2691

def ClientAdded(self, objpath):

3155

2692

"D-Bus signal"

3160

2697

"D-Bus signal"

3161

2698

pass

3162

2699

3163

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3164

"true"})

3165

2700

@dbus.service.signal(_interface, signature="os")

3166

2701

def ClientRemoved(self, objpath, name):

3167

2702

"D-Bus signal"

3168

2703

pass

3169

2704

3170

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3171

"true"})

3172

2705

@dbus.service.method(_interface, out_signature="ao")

3173

2706

def GetAllClients(self):

3174

2707

"D-Bus method"

3175

return dbus.Array(c.dbus_object_path for c in

2708

return dbus.Array(c.dbus_object_path

2709

for c in

3176

2710

tcp_server.clients.itervalues())

3177

2711

3178

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3179

"true"})

3180

2712

@dbus.service.method(_interface,

3181

2713

out_signature="a{oa{sv}}")

3182

2714

def GetAllClientsWithProperties(self):

3183

2715

"D-Bus method"

3184

2716

return dbus.Dictionary(

3185

{ c.dbus_object_path: c.GetAll(

3186

"se.recompile.Mandos.Client")

3187

for c in tcp_server.clients.itervalues() },

2717

((c.dbus_object_path, c.GetAll(""))

2718

for c in tcp_server.clients.itervalues()),

3188

2719

signature="oa{sv}")

3189

2720

3190

2721

@dbus.service.method(_interface, in_signature="o")

3194

2725

if c.dbus_object_path == object_path:

3195

2726

del tcp_server.clients[c.name]

3196

2727

c.remove_from_connection()

3197

# Don't signal the disabling

2728

# Don't signal anything except ClientRemoved

3198

2729

c.disable(quiet=True)

3199

# Emit D-Bus signal for removal

3200

self.client_removed_signal(c)

2730

# Emit D-Bus signal

2731

self.ClientRemoved(object_path, c.name)

3201

2732

return

3202

2733

raise KeyError(object_path)

3203

2734

3204

2735

del _interface

3205

3206

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3207

out_signature = "a{oa{sa{sv}}}")

3208

def GetManagedObjects(self):

3209

"""D-Bus method"""

3210

return dbus.Dictionary(

3211

{ client.dbus_object_path:

3212

dbus.Dictionary(

3213

{ interface: client.GetAll(interface)

3214

for interface in

3215

client._get_all_interface_names()})

3216

for client in tcp_server.clients.values()})

3217

3218

def client_added_signal(self, client):

3219

"""Send the new standard signal and the old signal"""

3220

if use_dbus:

3221

# New standard signal

3222

self.InterfacesAdded(

3223

client.dbus_object_path,

3224

dbus.Dictionary(

3225

{ interface: client.GetAll(interface)

3226

for interface in

3227

client._get_all_interface_names()}))

3228

# Old signal

3229

self.ClientAdded(client.dbus_object_path)

3230

3231

def client_removed_signal(self, client):

3232

"""Send the new standard signal and the old signal"""

3233

if use_dbus:

3234

# New standard signal

3235

self.InterfacesRemoved(

3236

client.dbus_object_path,

3237

client._get_all_interface_names())

3238

# Old signal

3239

self.ClientRemoved(client.dbus_object_path,

3240

client.name)

3241

2736

3242

2737

mandos_dbus_service = MandosDBusService()

3243

2738

3244

2739

def cleanup():

3245

2740

"Cleanup function; run on exit"

3246

if zeroconf:

3247

service.cleanup()

2741

service.cleanup()

3248

2742

3249

2743

multiprocessing.active_children()

3250

2744

wnull.close()

3264

2758

3265

2759

# A list of attributes that can not be pickled

3266

2760

# + secret.

3267

exclude = { "bus", "changedstate", "secret",

3268

"checker", "server_settings" }

3269

for name, typ in inspect.getmembers(dbus.service

3270

.Object):

2761

exclude = set(("bus", "changedstate", "secret",

2762

"checker", "server_settings"))

2763

for name, typ in (inspect.getmembers

2764

(dbus.service.Object)):

3271

2765

exclude.add(name)

3272

2766

3273

2767

client_dict["encrypted_secret"] = (client

3280

2774

del client_settings[client.name]["secret"]

3281

2775

3282

2776

try:

3283

with tempfile.NamedTemporaryFile(

3284

mode='wb',

3285

suffix=".pickle",

3286

prefix='clients-',

3287

dir=os.path.dirname(stored_state_path),

3288

delete=False) as stored_state:

2777

with (tempfile.NamedTemporaryFile

2778

(mode='wb', suffix=".pickle", prefix='clients-',

2779

dir=os.path.dirname(stored_state_path),

2780

delete=False)) as stored_state:

3289

2781

pickle.dump((clients, client_settings), stored_state)

3290

tempname = stored_state.name

2782

tempname=stored_state.name

3291

2783

os.rename(tempname, stored_state_path)

3292

2784

except (IOError, OSError) as e:

3293

2785

if not debug:

3296

2788

except NameError:

3297

2789

pass

3298

2790

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3299

logger.warning("Could not save persistent state: {}"

2791

logger.warning("Could not save persistent state: {0}"

3300

2792

.format(os.strerror(e.errno)))

3301

2793

else:

3302

2794

logger.warning("Could not save persistent state:",

3308

2800

name, client = tcp_server.clients.popitem()

3309

2801

if use_dbus:

3310

2802

client.remove_from_connection()

3311

# Don't signal the disabling

2803

# Don't signal anything except ClientRemoved

3312

2804

client.disable(quiet=True)

3313

# Emit D-Bus signal for removal

3314

2805

if use_dbus:

3315

mandos_dbus_service.client_removed_signal(client)

2806

# Emit D-Bus signal

2807

mandos_dbus_service.ClientRemoved(client

2808

.dbus_object_path,

2809

client.name)

3316

2810

client_settings.clear()

3317

2811

3318

2812

atexit.register(cleanup)

3319

2813

3320

2814

for client in tcp_server.clients.itervalues():

3321

2815

if use_dbus:

3322

# Emit D-Bus signal for adding

3323

mandos_dbus_service.client_added_signal(client)

2816

# Emit D-Bus signal

2817

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3324

2818

# Need to initiate checking of clients

3325

2819

if client.enabled:

3326

2820

client.init_checker()

3329

2823

tcp_server.server_activate()

3330

2824

3331

2825

# Find out what port we got

3332

if zeroconf:

3333

service.port = tcp_server.socket.getsockname()[1]

2826

service.port = tcp_server.socket.getsockname()[1]

3334

2827

if use_ipv6:

3335

2828

logger.info("Now listening on address %r, port %d,"

3336

2829

" flowinfo %d, scope_id %d",

3342

2835

#service.interface = tcp_server.socket.getsockname()[3]

3343

2836

3344

2837

try:

3345

if zeroconf:

3346

# From the Avahi example code

3347

try:

3348

service.activate()

3349

except dbus.exceptions.DBusException as error:

3350

logger.critical("D-Bus Exception", exc_info=error)

3351

cleanup()

3352

sys.exit(1)

3353

# End of Avahi example code

2838

# From the Avahi example code

2839

try:

2840

service.activate()

2841

except dbus.exceptions.DBusException as error:

2842

logger.critical("D-Bus Exception", exc_info=error)

2843

cleanup()

2844

sys.exit(1)

2845

# End of Avahi example code

3354

2846

3355

GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,

2847

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

3356

2848

lambda *args, **kwargs:

3357

2849

(tcp_server.handle_request

3358

2850

(*args[2:], **kwargs) or True))

3371

2863

# Must run before the D-Bus bus name gets deregistered

3372

2864

cleanup()

3373

2865

3374

3375

2866

if __name__ == '__main__':

3376

2867

main()