/mandos/release : revision 237.7.199

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

88

except ImportError:

89

SO_BINDTODEVICE = None

90

91

if sys.version_info.major == 2:

92

str = unicode

93

94

version = "1.6.9"

91

version = "1.6.2"

95

92

stored_state_file = "clients.pickle"

96

93

97

94

logger = logging.getLogger()

98

syslogger = None

95

syslogger = (logging.handlers.SysLogHandler

96

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

97

address = str("/dev/log")))

99

98

100

99

try:

101

if_nametoindex = ctypes.cdll.LoadLibrary(

102

ctypes.util.find_library("c")).if_nametoindex

100

if_nametoindex = (ctypes.cdll.LoadLibrary

101

(ctypes.util.find_library("c"))

102

.if_nametoindex)

103

except (OSError, AttributeError):

104

105

104

def if_nametoindex(interface):

106

105

"Get an interface index the hard way, i.e. using fcntl()"

107

106

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

108

107

with contextlib.closing(socket.socket()) as s:

109

108

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

110

struct.pack(b"16s16x", interface))

111

interface_index = struct.unpack("I", ifreq[16:20])[0]

109

struct.pack(str("16s16x"),

110

interface))

111

interface_index = struct.unpack(str("I"),

112

ifreq[16:20])[0]

112

113

return interface_index

113

114

115

116

def initlogger(debug, level=logging.WARNING):

116

117

"""init logger and add loglevel"""

117

118

global syslogger

119

syslogger = (logging.handlers.SysLogHandler(

120

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

121

address = "/dev/log"))

122

119

syslogger.setFormatter(logging.Formatter

123

120

('Mandos [%(process)d]: %(levelname)s:'

124

121

' %(message)s'))

141

138

142

139

class PGPEngine(object):

143

140

"""A simple class for OpenPGP symmetric encryption & decryption"""

144

145

141

def __init__(self):

146

142

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

147

143

self.gnupgargs = ['--batch',

186

182

187

183

def encrypt(self, data, password):

188

184

passphrase = self.password_encode(password)

189

with tempfile.NamedTemporaryFile(

190

dir=self.tempdir) as passfile:

185

with tempfile.NamedTemporaryFile(dir=self.tempdir

186

) as passfile:

191

187

passfile.write(passphrase)

192

188

passfile.flush()

193

189

proc = subprocess.Popen(['gpg', '--symmetric',

204

200

205

201

def decrypt(self, data, password):

206

202

passphrase = self.password_encode(password)

207

with tempfile.NamedTemporaryFile(

208

dir = self.tempdir) as passfile:

203

with tempfile.NamedTemporaryFile(dir = self.tempdir

204

) as passfile:

209

205

passfile.write(passphrase)

210

206

passfile.flush()

211

207

proc = subprocess.Popen(['gpg', '--decrypt',

215

211

stdin = subprocess.PIPE,

216

212

stdout = subprocess.PIPE,

217

213

stderr = subprocess.PIPE)

218

decrypted_plaintext, err = proc.communicate(input = data)

214

decrypted_plaintext, err = proc.communicate(input

215

= data)

219

216

if proc.returncode != 0:

220

217

raise PGPError(err)

221

218

return decrypted_plaintext

224

221

class AvahiError(Exception):

225

222

def __init__(self, value, *args, **kwargs):

226

223

self.value = value

227

return super(AvahiError, self).__init__(value, *args,

228

**kwargs)

229

224

super(AvahiError, self).__init__(value, *args, **kwargs)

225

def __unicode__(self):

226

return unicode(repr(self.value))

230

227

231

228

class AvahiServiceError(AvahiError):

232

229

pass

233

230

234

235

231

class AvahiGroupError(AvahiError):

236

232

pass

237

233

257

253

bus: dbus.SystemBus()

258

254

"""

259

255

260

def __init__(self,

261

interface = avahi.IF_UNSPEC,

262

name = None,

263

servicetype = None,

264

port = None,

265

TXT = None,

266

domain = "",

267

host = "",

268

max_renames = 32768,

269

protocol = avahi.PROTO_UNSPEC,

270

bus = None):

256

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

257

servicetype = None, port = None, TXT = None,

258

domain = "", host = "", max_renames = 32768,

259

protocol = avahi.PROTO_UNSPEC, bus = None):

271

260

self.interface = interface

272

261

self.name = name

273

262

self.type = servicetype

283

272

self.bus = bus

284

273

self.entry_group_state_changed_match = None

285

274

286

def rename(self, remove=True):

275

def rename(self):

287

276

"""Derived from the Avahi example code"""

288

277

if self.rename_count >= self.max_renames:

289

278

logger.critical("No suitable Zeroconf service name found"

290

279

" after %i retries, exiting.",

291

280

self.rename_count)

292

281

raise AvahiServiceError("Too many renames")

293

self.name = str(

294

self.server.GetAlternativeServiceName(self.name))

295

self.rename_count += 1

282

self.name = unicode(self.server

283

.GetAlternativeServiceName(self.name))

296

284

logger.info("Changing Zeroconf service name to %r ...",

297

285

self.name)

298

if remove:

299

self.remove()

286

self.remove()

300

287

try:

301

288

self.add()

302

289

except dbus.exceptions.DBusException as error:

303

if (error.get_dbus_name()

304

== "org.freedesktop.Avahi.CollisionError"):

305

logger.info("Local Zeroconf service name collision.")

306

return self.rename(remove=False)

307

else:

308

logger.critical("D-Bus Exception", exc_info=error)

309

self.cleanup()

310

os._exit(1)

290

logger.critical("D-Bus Exception", exc_info=error)

291

self.cleanup()

292

os._exit(1)

293

self.rename_count += 1

311

294

312

295

def remove(self):

313

296

"""Derived from the Avahi example code"""

351

334

self.rename()

352

335

elif state == avahi.ENTRY_GROUP_FAILURE:

353

336

logger.critical("Avahi: Error in group state changed %s",

354

str(error))

355

raise AvahiGroupError("State changed: {!s}".format(error))

337

unicode(error))

338

raise AvahiGroupError("State changed: {0!s}"

339

.format(error))

356

340

357

341

def cleanup(self):

358

342

"""Derived from the Avahi example code"""

368

352

def server_state_changed(self, state, error=None):

369

353

"""Derived from the Avahi example code"""

370

354

logger.debug("Avahi server state change: %i", state)

371

bad_states = {

372

avahi.SERVER_INVALID: "Zeroconf server invalid",

373

avahi.SERVER_REGISTERING: None,

374

avahi.SERVER_COLLISION: "Zeroconf server name collision",

375

avahi.SERVER_FAILURE: "Zeroconf server failure",

376

}

355

bad_states = { avahi.SERVER_INVALID:

356

"Zeroconf server invalid",

357

avahi.SERVER_REGISTERING: None,

358

avahi.SERVER_COLLISION:

359

"Zeroconf server name collision",

360

avahi.SERVER_FAILURE:

361

"Zeroconf server failure" }

377

362

if state in bad_states:

378

363

if bad_states[state] is not None:

379

364

if error is None:

398

383

follow_name_owner_changes=True),

399

384

avahi.DBUS_INTERFACE_SERVER)

400

385

self.server.connect_to_signal("StateChanged",

401

self.server_state_changed)

386

self.server_state_changed)

402

387

self.server_state_changed(self.server.GetState())

403

388

404

389

405

390

class AvahiServiceToSyslog(AvahiService):

406

def rename(self, *args, **kwargs):

391

def rename(self):

407

392

"""Add the new name to the syslog messages"""

408

ret = AvahiService.rename(self, *args, **kwargs)

409

syslogger.setFormatter(logging.Formatter(

410

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

411

.format(self.name)))

393

ret = AvahiService.rename(self)

394

syslogger.setFormatter(logging.Formatter

395

('Mandos ({0}) [%(process)d]:'

396

' %(levelname)s: %(message)s'

397

.format(self.name)))

412

398

return ret

413

399

414

400

401

def timedelta_to_milliseconds(td):

402

"Convert a datetime.timedelta() to milliseconds"

403

return ((td.days * 24 * 60 * 60 * 1000)

404

+ (td.seconds * 1000)

405

+ (td.microseconds // 1000))

406

407

415

408

class Client(object):

416

409

"""A representation of a client host served by this server.

417

410

461

454

"fingerprint", "host", "interval",

462

455

"last_approval_request", "last_checked_ok",

463

456

"last_enabled", "name", "timeout")

464

client_defaults = {

465

"timeout": "PT5M",

466

"extended_timeout": "PT15M",

467

"interval": "PT2M",

468

"checker": "fping -q -- %%(host)s",

469

"host": "",

470

"approval_delay": "PT0S",

471

"approval_duration": "PT1S",

472

"approved_by_default": "True",

473

"enabled": "True",

474

}

457

client_defaults = { "timeout": "PT5M",

458

"extended_timeout": "PT15M",

459

"interval": "PT2M",

460

"checker": "fping -q -- %%(host)s",

461

"host": "",

462

"approval_delay": "PT0S",

463

"approval_duration": "PT1S",

464

"approved_by_default": "True",

465

"enabled": "True",

466

}

467

468

def timeout_milliseconds(self):

469

"Return the 'timeout' attribute in milliseconds"

470

return timedelta_to_milliseconds(self.timeout)

471

472

def extended_timeout_milliseconds(self):

473

"Return the 'extended_timeout' attribute in milliseconds"

474

return timedelta_to_milliseconds(self.extended_timeout)

475

476

def interval_milliseconds(self):

477

"Return the 'interval' attribute in milliseconds"

478

return timedelta_to_milliseconds(self.interval)

479

480

def approval_delay_milliseconds(self):

481

return timedelta_to_milliseconds(self.approval_delay)

475

482

476

483

@staticmethod

477

484

def config_parser(config):

493

500

client["enabled"] = config.getboolean(client_name,

494

501

"enabled")

495

502

496

# Uppercase and remove spaces from fingerprint for later

497

# comparison purposes with return value from the

498

# fingerprint() function

499

503

client["fingerprint"] = (section["fingerprint"].upper()

500

504

.replace(" ", ""))

501

505

if "secret" in section:

506

510

"rb") as secfile:

507

511

client["secret"] = secfile.read()

508

512

else:

509

raise TypeError("No secret or secfile for section {}"

513

raise TypeError("No secret or secfile for section {0}"

510

514

.format(section))

511

515

client["timeout"] = string_to_delta(section["timeout"])

512

516

client["extended_timeout"] = string_to_delta(

529

533

server_settings = {}

530

534

self.server_settings = server_settings

531

535

# adding all client settings

532

for setting, value in settings.items():

536

for setting, value in settings.iteritems():

533

537

setattr(self, setting, value)

534

538

535

539

if self.enabled:

543

547

self.expires = None

544

548

545

549

logger.debug("Creating client %r", self.name)

550

# Uppercase and remove spaces from fingerprint for later

551

# comparison purposes with return value from the fingerprint()

552

# function

546

553

logger.debug(" Fingerprint: %s", self.fingerprint)

547

554

self.created = settings.get("created",

548

555

datetime.datetime.utcnow())

555

562

self.current_checker_command = None

556

563

self.approved = None

557

564

self.approvals_pending = 0

558

self.changedstate = multiprocessing_manager.Condition(

559

multiprocessing_manager.Lock())

560

self.client_structure = [attr

561

for attr in self.__dict__.iterkeys()

565

self.changedstate = (multiprocessing_manager

566

.Condition(multiprocessing_manager

567

.Lock()))

568

self.client_structure = [attr for attr in

569

self.__dict__.iterkeys()

562

570

if not attr.startswith("_")]

563

571

self.client_structure.append("client_structure")

564

572

565

for name, t in inspect.getmembers(

566

type(self), lambda obj: isinstance(obj, property)):

573

for name, t in inspect.getmembers(type(self),

574

lambda obj:

575

isinstance(obj,

576

property)):

567

577

if not name.startswith("_"):

568

578

self.client_structure.append(name)

569

579

611

621

# and every interval from then on.

612

622

if self.checker_initiator_tag is not None:

613

623

gobject.source_remove(self.checker_initiator_tag)

614

self.checker_initiator_tag = gobject.timeout_add(

615

int(self.interval.total_seconds() * 1000),

616

self.start_checker)

624

self.checker_initiator_tag = (gobject.timeout_add

625

(self.interval_milliseconds(),

626

self.start_checker))

617

627

# Schedule a disable() when 'timeout' has passed

618

628

if self.disable_initiator_tag is not None:

619

629

gobject.source_remove(self.disable_initiator_tag)

620

self.disable_initiator_tag = gobject.timeout_add(

621

int(self.timeout.total_seconds() * 1000), self.disable)

630

self.disable_initiator_tag = (gobject.timeout_add

631

(self.timeout_milliseconds(),

632

self.disable))

622

633

# Also start a new checker *right now*.

623

634

self.start_checker()

624

635

633

644

vars(self))

634

645

self.checked_ok()

635

646

else:

636

logger.info("Checker for %(name)s failed", vars(self))

647

logger.info("Checker for %(name)s failed",

648

vars(self))

637

649

else:

638

650

self.last_checker_status = -1

639

651

logger.warning("Checker for %(name)s crashed?",

653

665

gobject.source_remove(self.disable_initiator_tag)

654

666

self.disable_initiator_tag = None

655

667

if getattr(self, "enabled", False):

656

self.disable_initiator_tag = gobject.timeout_add(

657

int(timeout.total_seconds() * 1000), self.disable)

668

self.disable_initiator_tag = (gobject.timeout_add

669

(timedelta_to_milliseconds

670

(timeout), self.disable))

658

671

self.expires = datetime.datetime.utcnow() + timeout

659

672

660

673

def need_approval(self):

691

704

# Start a new checker if needed

692

705

if self.checker is None:

693

706

# Escape attributes for the shell

694

escaped_attrs = {

695

attr: re.escape(str(getattr(self, attr)))

696

for attr in self.runtime_expansions }

707

escaped_attrs = dict(

708

(attr, re.escape(unicode(getattr(self, attr))))

709

for attr in

710

self.runtime_expansions)

697

711

try:

698

712

command = self.checker_command % escaped_attrs

699

713

except TypeError as error:

700

714

logger.error('Could not format string "%s"',

701

self.checker_command,

702

exc_info=error)

703

return True # Try again later

715

self.checker_command, exc_info=error)

716

return True # Try again later

704

717

self.current_checker_command = command

705

718

try:

706

logger.info("Starting checker %r for %s", command,

707

self.name)

719

logger.info("Starting checker %r for %s",

720

command, self.name)

708

721

# We don't need to redirect stdout and stderr, since

709

722

# in normal mode, that is already done by daemon(),

710

723

# and in debug mode we don't want to. (Stdin is

719

732

"stderr": wnull })

720

733

self.checker = subprocess.Popen(command,

721

734

close_fds=True,

722

shell=True,

723

cwd="/",

735

shell=True, cwd="/",

724

736

**popen_args)

725

737

except OSError as error:

726

738

logger.error("Failed to start subprocess",

727

739

exc_info=error)

728

740

return True

729

self.checker_callback_tag = gobject.child_watch_add(

730

self.checker.pid, self.checker_callback, data=command)

741

self.checker_callback_tag = (gobject.child_watch_add

742

(self.checker.pid,

743

self.checker_callback,

744

data=command))

731

745

# The checker may have completed before the gobject

732

746

# watch was added. Check for this.

733

747

try:

764

778

self.checker = None

765

779

766

780

767

def dbus_service_property(dbus_interface,

768

signature="v",

769

access="readwrite",

770

byte_arrays=False):

781

def dbus_service_property(dbus_interface, signature="v",

782

access="readwrite", byte_arrays=False):

771

783

"""Decorators for marking methods of a DBusObjectWithProperties to

772

784

become properties on the D-Bus.

773

785

782

794

# "Set" method, so we fail early here:

783

795

if byte_arrays and signature != "ay":

784

796

raise ValueError("Byte arrays not supported for non-'ay'"

785

" signature {!r}".format(signature))

786

797

" signature {0!r}".format(signature))

787

798

def decorator(func):

788

799

func._dbus_is_property = True

789

800

func._dbus_interface = dbus_interface

794

805

func._dbus_name = func._dbus_name[:-14]

795

806

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

796

807

return func

797

798

808

return decorator

799

809

800

810

809

819

"org.freedesktop.DBus.Property.EmitsChangedSignal":

810

820

"false"}

811

821

"""

812

813

822

def decorator(func):

814

823

func._dbus_is_interface = True

815

824

func._dbus_interface = dbus_interface

816

825

func._dbus_name = dbus_interface

817

826

return func

818

819

827

return decorator

820

828

821

829

823

831

"""Decorator to annotate D-Bus methods, signals or properties

824

832

Usage:

825

833

826

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

827

"org.freedesktop.DBus.Property."

828

"EmitsChangedSignal": "false"})

829

834

@dbus_service_property("org.example.Interface", signature="b",

830

835

access="r")

836

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

837

"org.freedesktop.DBus.Property."

838

"EmitsChangedSignal": "false"})

831

839

def Property_dbus_property(self):

832

840

return dbus.Boolean(False)

833

841

"""

834

835

842

def decorator(func):

836

843

func._dbus_annotations = annotations

837

844

return func

838

839

845

return decorator

840

846

841

847

842

848

class DBusPropertyException(dbus.exceptions.DBusException):

843

849

"""A base class for D-Bus property-related exceptions

844

850

"""

845

pass

851

def __unicode__(self):

852

return unicode(str(self))

846

853

847

854

848

855

class DBusPropertyAccessException(DBusPropertyException):

872

879

If called like _is_dbus_thing("method") it returns a function

873

880

suitable for use as predicate to inspect.getmembers().

874

881

"""

875

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

882

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

876

883

False)

877

884

878

885

def _get_all_dbus_things(self, thing):

879

886

"""Returns a generator of (name, attribute) pairs

880

887

"""

881

return ((getattr(athing.__get__(self), "_dbus_name", name),

888

return ((getattr(athing.__get__(self), "_dbus_name",

889

name),

882

890

athing.__get__(self))

883

891

for cls in self.__class__.__mro__

884

892

for name, athing in

885

inspect.getmembers(cls, self._is_dbus_thing(thing)))

893

inspect.getmembers(cls,

894

self._is_dbus_thing(thing)))

886

895

887

896

def _get_dbus_property(self, interface_name, property_name):

888

897

"""Returns a bound method if one exists which is a D-Bus

889

898

property with the specified name and interface.

890

899

"""

891

for cls in self.__class__.__mro__:

892

for name, value in inspect.getmembers(

893

cls, self._is_dbus_thing("property")):

900

for cls in self.__class__.__mro__:

901

for name, value in (inspect.getmembers

902

(cls,

903

self._is_dbus_thing("property"))):

894

904

if (value._dbus_name == property_name

895

905

and value._dbus_interface == interface_name):

896

906

return value.__get__(self)

897

907

898

908

# No such property

899

raise DBusPropertyNotFound("{}:{}.{}".format(

900

self.dbus_object_path, interface_name, property_name))

909

raise DBusPropertyNotFound(self.dbus_object_path + ":"

910

+ interface_name + "."

911

+ property_name)

901

912

902

@dbus.service.method(dbus.PROPERTIES_IFACE,

903

in_signature="ss",

913

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

904

914

out_signature="v")

905

915

def Get(self, interface_name, property_name):

906

916

"""Standard D-Bus property Get() method, see D-Bus standard.

925

935

# signatures other than "ay".

926

936

if prop._dbus_signature != "ay":

927

937

raise ValueError("Byte arrays not supported for non-"

928

"'ay' signature {!r}"

938

"'ay' signature {0!r}"

929

939

.format(prop._dbus_signature))

930

940

value = dbus.ByteArray(b''.join(chr(byte)

931

941

for byte in value))

932

942

prop(value)

933

943

934

@dbus.service.method(dbus.PROPERTIES_IFACE,

935

in_signature="s",

944

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

936

945

out_signature="a{sv}")

937

946

def GetAll(self, interface_name):

938

947

"""Standard D-Bus property GetAll() method, see D-Bus

953

962

if not hasattr(value, "variant_level"):

954

963

properties[name] = value

955

964

continue

956

properties[name] = type(value)(

957

value, variant_level = value.variant_level + 1)

965

properties[name] = type(value)(value, variant_level=

966

value.variant_level+1)

958

967

return dbus.Dictionary(properties, signature="sv")

959

968

960

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

961

def PropertiesChanged(self, interface_name, changed_properties,

962

invalidated_properties):

963

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

964

standard.

965

"""

966

pass

967

968

969

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

969

970

out_signature="s",

970

971

path_keyword='object_path',

978

979

connection)

979

980

try:

980

981

document = xml.dom.minidom.parseString(xmlstring)

981

982

def make_tag(document, name, prop):

983

e = document.createElement("property")

984

e.setAttribute("name", name)

985

e.setAttribute("type", prop._dbus_signature)

986

e.setAttribute("access", prop._dbus_access)

987

return e

988

989

988

for if_tag in document.getElementsByTagName("interface"):

990

989

# Add property tags

991

990

for tag in (make_tag(document, name, prop)

1003

1002

if (name == tag.getAttribute("name")

1004

1003

and prop._dbus_interface

1005

1004

== if_tag.getAttribute("name")):

1006

annots.update(getattr(

1007

prop, "_dbus_annotations", {}))

1008

for name, value in annots.items():

1005

annots.update(getattr

1006

(prop,

1007

"_dbus_annotations",

1008

{}))

1009

for name, value in annots.iteritems():

1009

1010

ann_tag = document.createElement(

1010

1011

"annotation")

1011

1012

ann_tag.setAttribute("name", name)

1014

1015

# Add interface annotation tags

1015

1016

for annotation, value in dict(

1016

1017

itertools.chain.from_iterable(

1017

annotations().items()

1018

for name, annotations

1019

in self._get_all_dbus_things("interface")

1018

annotations().iteritems()

1019

for name, annotations in

1020

self._get_all_dbus_things("interface")

1020

1021

if name == if_tag.getAttribute("name")

1021

)).items():

1022

)).iteritems():

1022

1023

ann_tag = document.createElement("annotation")

1023

1024

ann_tag.setAttribute("name", annotation)

1024

1025

ann_tag.setAttribute("value", value)

1051

1052

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1052

1053

if dt is None:

1053

1054

return dbus.String("", variant_level = variant_level)

1054

return dbus.String(dt.isoformat(), variant_level=variant_level)

1055

return dbus.String(dt.isoformat(),

1056

variant_level=variant_level)

1055

1057

1056

1058

1057

1059

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1077

1079

(from DBusObjectWithProperties) and interfaces (from the

1078

1080

dbus_interface_annotations decorator).

1079

1081

"""

1080

1081

1082

def wrapper(cls):

1082

1083

for orig_interface_name, alt_interface_name in (

1083

alt_interface_names.items()):

1084

alt_interface_names.iteritems()):

1084

1085

attr = {}

1085

1086

interface_names = set()

1086

1087

# Go though all attributes of the class

1088

1089

# Ignore non-D-Bus attributes, and D-Bus attributes

1089

1090

# with the wrong interface name

1090

1091

if (not hasattr(attribute, "_dbus_interface")

1091

or not attribute._dbus_interface.startswith(

1092

orig_interface_name)):

1092

or not attribute._dbus_interface

1093

.startswith(orig_interface_name)):

1093

1094

continue

1094

1095

# Create an alternate D-Bus interface name based on

1095

1096

# the current name

1096

alt_interface = attribute._dbus_interface.replace(

1097

orig_interface_name, alt_interface_name)

1097

alt_interface = (attribute._dbus_interface

1098

.replace(orig_interface_name,

1099

alt_interface_name))

1098

1100

interface_names.add(alt_interface)

1099

1101

# Is this a D-Bus signal?

1100

1102

if getattr(attribute, "_dbus_is_signal", False):

1101

1103

# Extract the original non-method undecorated

1102

1104

# function by black magic

1103

1105

nonmethod_func = (dict(

1104

zip(attribute.func_code.co_freevars,

1105

attribute.__closure__))

1106

["func"].cell_contents)

1106

zip(attribute.func_code.co_freevars,

1107

attribute.__closure__))["func"]

1108

.cell_contents)

1107

1109

# Create a new, but exactly alike, function

1108

1110

# object, and decorate it to be a new D-Bus signal

1109

1111

# with the alternate D-Bus interface name

1110

new_function = (dbus.service.signal(

1111

alt_interface, attribute._dbus_signature)

1112

new_function = (dbus.service.signal

1113

(alt_interface,

1114

attribute._dbus_signature)

1112

1115

(types.FunctionType(

1113

nonmethod_func.func_code,

1114

nonmethod_func.func_globals,

1115

nonmethod_func.func_name,

1116

nonmethod_func.func_defaults,

1117

nonmethod_func.func_closure)))

1116

nonmethod_func.func_code,

1117

nonmethod_func.func_globals,

1118

nonmethod_func.func_name,

1119

nonmethod_func.func_defaults,

1120

nonmethod_func.func_closure)))

1118

1121

# Copy annotations, if any

1119

1122

try:

1120

new_function._dbus_annotations = dict(

1121

attribute._dbus_annotations)

1123

new_function._dbus_annotations = (

1124

dict(attribute._dbus_annotations))

1122

1125

except AttributeError:

1123

1126

pass

1124

1127

# Define a creator of a function to call both the

1129

1132

"""This function is a scope container to pass

1130

1133

func1 and func2 to the "call_both" function

1131

1134

outside of its arguments"""

1132

1133

1135

def call_both(*args, **kwargs):

1134

1136

"""This function will emit two D-Bus

1135

1137

signals by calling func1 and func2"""

1136

1138

func1(*args, **kwargs)

1137

1139

func2(*args, **kwargs)

1138

1139

1140

return call_both

1140

1141

# Create the "call_both" function and add it to

1141

1142

# the class

1146

1147

# object. Decorate it to be a new D-Bus method

1147

1148

# with the alternate D-Bus interface name. Add it

1148

1149

# to the class.

1149

attr[attrname] = (

1150

dbus.service.method(

1151

alt_interface,

1152

attribute._dbus_in_signature,

1153

attribute._dbus_out_signature)

1154

(types.FunctionType(attribute.func_code,

1155

attribute.func_globals,

1156

attribute.func_name,

1157

attribute.func_defaults,

1158

attribute.func_closure)))

1150

attr[attrname] = (dbus.service.method

1151

(alt_interface,

1152

attribute._dbus_in_signature,

1153

attribute._dbus_out_signature)

1154

(types.FunctionType

1155

(attribute.func_code,

1156

attribute.func_globals,

1157

attribute.func_name,

1158

attribute.func_defaults,

1159

attribute.func_closure)))

1159

1160

# Copy annotations, if any

1160

1161

try:

1161

attr[attrname]._dbus_annotations = dict(

1162

attribute._dbus_annotations)

1162

attr[attrname]._dbus_annotations = (

1163

dict(attribute._dbus_annotations))

1163

1164

except AttributeError:

1164

1165

pass

1165

1166

# Is this a D-Bus property?

1168

1169

# object, and decorate it to be a new D-Bus

1169

1170

# property with the alternate D-Bus interface

1170

1171

# name. Add it to the class.

1171

attr[attrname] = (dbus_service_property(

1172

alt_interface, attribute._dbus_signature,

1173

attribute._dbus_access,

1174

attribute._dbus_get_args_options

1175

["byte_arrays"])

1176

(types.FunctionType(

1177

attribute.func_code,

1178

attribute.func_globals,

1179

attribute.func_name,

1180

attribute.func_defaults,

1181

attribute.func_closure)))

1172

attr[attrname] = (dbus_service_property

1173

(alt_interface,

1174

attribute._dbus_signature,

1175

attribute._dbus_access,

1176

attribute

1177

._dbus_get_args_options

1178

["byte_arrays"])

1179

(types.FunctionType

1180

(attribute.func_code,

1181

attribute.func_globals,

1182

attribute.func_name,

1183

attribute.func_defaults,

1184

attribute.func_closure)))

1182

1185

# Copy annotations, if any

1183

1186

try:

1184

attr[attrname]._dbus_annotations = dict(

1185

attribute._dbus_annotations)

1187

attr[attrname]._dbus_annotations = (

1188

dict(attribute._dbus_annotations))

1186

1189

except AttributeError:

1187

1190

pass

1188

1191

# Is this a D-Bus interface?

1191

1194

# object. Decorate it to be a new D-Bus interface

1192

1195

# with the alternate D-Bus interface name. Add it

1193

1196

# to the class.

1194

attr[attrname] = (

1195

dbus_interface_annotations(alt_interface)

1196

(types.FunctionType(attribute.func_code,

1197

attribute.func_globals,

1198

attribute.func_name,

1199

attribute.func_defaults,

1200

attribute.func_closure)))

1197

attr[attrname] = (dbus_interface_annotations

1198

(alt_interface)

1199

(types.FunctionType

1200

(attribute.func_code,

1201

attribute.func_globals,

1202

attribute.func_name,

1203

attribute.func_defaults,

1204

attribute.func_closure)))

1201

1205

if deprecate:

1202

1206

# Deprecate all alternate interfaces

1203

iname="_AlternateDBusNames_interface_annotation{}"

1207

iname="_AlternateDBusNames_interface_annotation{0}"

1204

1208

for interface_name in interface_names:

1205

1206

1209

@dbus_interface_annotations(interface_name)

1207

1210

def func(self):

1208

1211

return { "org.freedesktop.DBus.Deprecated":

1209

"true" }

1212

"true" }

1210

1213

# Find an unused name

1211

1214

for aname in (iname.format(i)

1212

1215

for i in itertools.count()):

1216

1219

if interface_names:

1217

1220

# Replace the class with a new subclass of it with

1218

1221

# methods, signals, etc. as created above.

1219

cls = type(b"{}Alternate".format(cls.__name__),

1220

(cls, ), attr)

1222

cls = type(b"{0}Alternate".format(cls.__name__),

1223

(cls,), attr)

1221

1224

return cls

1222

1223

1225

return wrapper

1224

1226

1225

1227

1226

1228

@alternate_dbus_interfaces({"se.recompile.Mandos":

1227

"se.bsnet.fukt.Mandos"})

1229

"se.bsnet.fukt.Mandos"})

1228

1230

class ClientDBus(Client, DBusObjectWithProperties):

1229

1231

"""A Client class using D-Bus

1230

1232

1234

1236

"""

1235

1237

1236

1238

runtime_expansions = (Client.runtime_expansions

1237

+ ("dbus_object_path", ))

1238

1239

_interface = "se.recompile.Mandos.Client"

1239

+ ("dbus_object_path",))

1240

1241

# dbus.service.Object doesn't use super(), so we can't either.

1242

1245

Client.__init__(self, *args, **kwargs)

1246

# Only now, when this client is initialized, can it show up on

1247

# the D-Bus

1248

client_object_name = str(self.name).translate(

1248

client_object_name = unicode(self.name).translate(

1249

{ord("."): ord("_"),

1250

ord("-"): ord("_")})

1251

self.dbus_object_path = dbus.ObjectPath(

1252

"/clients/" + client_object_name)

1251

self.dbus_object_path = (dbus.ObjectPath

1252

("/clients/" + client_object_name))

1253

DBusObjectWithProperties.__init__(self, self.bus,

1254

self.dbus_object_path)

1255

1256

def notifychangeproperty(transform_func, dbus_name,

1257

type_func=lambda x: x,

1258

variant_level=1,

1259

invalidate_only=False,

1260

_interface=_interface):

1256

def notifychangeproperty(transform_func,

1257

dbus_name, type_func=lambda x: x,

1258

variant_level=1):

1261

1259

""" Modify a variable so that it's a property which announces

1262

1260

its changes to DBus.

1263

1261

1268

1266

to the D-Bus. Default: no transform

1269

1267

variant_level: D-Bus variant level. Default: 1

1270

1268

"""

1271

attrname = "_{}".format(dbus_name)

1272

1269

attrname = "_{0}".format(dbus_name)

1273

1270

def setter(self, value):

1274

1271

if hasattr(self, "dbus_object_path"):

1275

1272

if (not hasattr(self, attrname) or

1276

1273

type_func(getattr(self, attrname, None))

1277

1274

!= type_func(value)):

1278

if invalidate_only:

1279

self.PropertiesChanged(

1280

_interface, dbus.Dictionary(),

1281

dbus.Array((dbus_name, )))

1282

else:

1283

dbus_value = transform_func(

1284

type_func(value),

1285

variant_level = variant_level)

1286

self.PropertyChanged(dbus.String(dbus_name),

1287

dbus_value)

1288

self.PropertiesChanged(

1289

_interface,

1290

dbus.Dictionary({ dbus.String(dbus_name):

1291

dbus_value }),

1292

dbus.Array())

1275

dbus_value = transform_func(type_func(value),

1276

variant_level

1277

=variant_level)

1278

self.PropertyChanged(dbus.String(dbus_name),

1279

dbus_value)

1293

1280

setattr(self, attrname, value)

1294

1281

1295

1282

return property(lambda self: getattr(self, attrname), setter)

1301

1288

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1302

1289

last_enabled = notifychangeproperty(datetime_to_dbus,

1303

1290

"LastEnabled")

1304

checker = notifychangeproperty(

1305

dbus.Boolean, "CheckerRunning",

1306

type_func = lambda checker: checker is not None)

1291

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1292

type_func = lambda checker:

1293

checker is not None)

1307

1294

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1308

1295

"LastCheckedOK")

1309

1296

last_checker_status = notifychangeproperty(dbus.Int16,

1312

1299

datetime_to_dbus, "LastApprovalRequest")

1313

1300

approved_by_default = notifychangeproperty(dbus.Boolean,

1314

1301

"ApprovedByDefault")

1315

approval_delay = notifychangeproperty(

1316

dbus.UInt64, "ApprovalDelay",

1317

type_func = lambda td: td.total_seconds() * 1000)

1302

approval_delay = notifychangeproperty(dbus.UInt64,

1303

"ApprovalDelay",

1304

type_func =

1305

timedelta_to_milliseconds)

1318

1306

approval_duration = notifychangeproperty(

1319

1307

dbus.UInt64, "ApprovalDuration",

1320

type_func = lambda td: td.total_seconds() * 1000)

1308

type_func = timedelta_to_milliseconds)

1321

1309

host = notifychangeproperty(dbus.String, "Host")

1322

timeout = notifychangeproperty(

1323

dbus.UInt64, "Timeout",

1324

type_func = lambda td: td.total_seconds() * 1000)

1310

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1311

type_func =

1312

timedelta_to_milliseconds)

1325

1313

extended_timeout = notifychangeproperty(

1326

1314

dbus.UInt64, "ExtendedTimeout",

1327

type_func = lambda td: td.total_seconds() * 1000)

1328

interval = notifychangeproperty(

1329

dbus.UInt64, "Interval",

1330

type_func = lambda td: td.total_seconds() * 1000)

1315

type_func = timedelta_to_milliseconds)

1316

interval = notifychangeproperty(dbus.UInt64,

1317

"Interval",

1318

type_func =

1319

timedelta_to_milliseconds)

1331

1320

checker_command = notifychangeproperty(dbus.String, "Checker")

1332

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1333

invalidate_only=True)

1334

1321

1335

1322

del notifychangeproperty

1336

1323

1363

1350

*args, **kwargs)

1364

1351

1365

1352

def start_checker(self, *args, **kwargs):

1366

old_checker_pid = getattr(self.checker, "pid", None)

1353

old_checker = self.checker

1354

if self.checker is not None:

1355

old_checker_pid = self.checker.pid

1356

else:

1357

old_checker_pid = None

1367

1358

r = Client.start_checker(self, *args, **kwargs)

1368

1359

# Only if new checker process was started

1369

1360

if (self.checker is not None

1378

1369

1379

1370

def approve(self, value=True):

1380

1371

self.approved = value

1381

gobject.timeout_add(int(self.approval_duration.total_seconds()

1382

* 1000), self._reset_approved)

1372

gobject.timeout_add(timedelta_to_milliseconds

1373

(self.approval_duration),

1374

self._reset_approved)

1383

1375

self.send_changedstate()

1384

1376

1385

1377

## D-Bus methods, signals & properties

1378

_interface = "se.recompile.Mandos.Client"

1386

1379

1387

1380

## Interfaces

1388

1381

1382

@dbus_interface_annotations(_interface)

1383

def _foo(self):

1384

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1385

"false"}

1386

1389

1387

## Signals

1390

1388

1391

1389

# CheckerCompleted - signal

1401

1399

pass

1402

1400

1403

1401

# PropertyChanged - signal

1404

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1405

1402

@dbus.service.signal(_interface, signature="sv")

1406

1403

def PropertyChanged(self, property, value):

1407

1404

"D-Bus signal"

1471

1468

return dbus.Boolean(bool(self.approvals_pending))

1472

1469

1473

1470

# ApprovedByDefault - property

1474

@dbus_service_property(_interface,

1475

signature="b",

1471

@dbus_service_property(_interface, signature="b",

1476

1472

access="readwrite")

1477

1473

def ApprovedByDefault_dbus_property(self, value=None):

1478

1474

if value is None: # get

1480

1476

self.approved_by_default = bool(value)

1481

1477

1482

1478

# ApprovalDelay - property

1483

@dbus_service_property(_interface,

1484

signature="t",

1479

@dbus_service_property(_interface, signature="t",

1485

1480

access="readwrite")

1486

1481

def ApprovalDelay_dbus_property(self, value=None):

1487

1482

if value is None: # get

1488

return dbus.UInt64(self.approval_delay.total_seconds()

1489

* 1000)

1483

return dbus.UInt64(self.approval_delay_milliseconds())

1490

1484

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1491

1485

1492

1486

# ApprovalDuration - property

1493

@dbus_service_property(_interface,

1494

signature="t",

1487

@dbus_service_property(_interface, signature="t",

1495

1488

access="readwrite")

1496

1489

def ApprovalDuration_dbus_property(self, value=None):

1497

1490

if value is None: # get

1498

return dbus.UInt64(self.approval_duration.total_seconds()

1499

* 1000)

1491

return dbus.UInt64(timedelta_to_milliseconds(

1492

self.approval_duration))

1500

1493

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1501

1494

1502

1495

# Name - property

1510

1503

return dbus.String(self.fingerprint)

1511

1504

1512

1505

# Host - property

1513

@dbus_service_property(_interface,

1514

signature="s",

1506

@dbus_service_property(_interface, signature="s",

1515

1507

access="readwrite")

1516

1508

def Host_dbus_property(self, value=None):

1517

1509

if value is None: # get

1518

1510

return dbus.String(self.host)

1519

self.host = str(value)

1511

self.host = unicode(value)

1520

1512

1521

1513

# Created - property

1522

1514

@dbus_service_property(_interface, signature="s", access="read")

1529

1521

return datetime_to_dbus(self.last_enabled)

1530

1522

1531

1523

# Enabled - property

1532

@dbus_service_property(_interface,

1533

signature="b",

1524

@dbus_service_property(_interface, signature="b",

1534

1525

access="readwrite")

1535

1526

def Enabled_dbus_property(self, value=None):

1536

1527

if value is None: # get

1541

1532

self.disable()

1542

1533

1543

1534

# LastCheckedOK - property

1544

@dbus_service_property(_interface,

1545

signature="s",

1535

@dbus_service_property(_interface, signature="s",

1546

1536

access="readwrite")

1547

1537

def LastCheckedOK_dbus_property(self, value=None):

1548

1538

if value is not None:

1551

1541

return datetime_to_dbus(self.last_checked_ok)

1552

1542

1553

1543

# LastCheckerStatus - property

1554

@dbus_service_property(_interface, signature="n", access="read")

1544

@dbus_service_property(_interface, signature="n",

1545

access="read")

1555

1546

def LastCheckerStatus_dbus_property(self):

1556

1547

return dbus.Int16(self.last_checker_status)

1557

1548

1566

1557

return datetime_to_dbus(self.last_approval_request)

1567

1558

1568

1559

# Timeout - property

1569

@dbus_service_property(_interface,

1570

signature="t",

1560

@dbus_service_property(_interface, signature="t",

1571

1561

access="readwrite")

1572

1562

def Timeout_dbus_property(self, value=None):

1573

1563

if value is None: # get

1574

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1564

return dbus.UInt64(self.timeout_milliseconds())

1575

1565

old_timeout = self.timeout

1576

1566

self.timeout = datetime.timedelta(0, 0, 0, value)

1577

1567

# Reschedule disabling

1586

1576

is None):

1587

1577

return

1588

1578

gobject.source_remove(self.disable_initiator_tag)

1589

self.disable_initiator_tag = gobject.timeout_add(

1590

int((self.expires - now).total_seconds() * 1000),

1591

self.disable)

1579

self.disable_initiator_tag = (

1580

gobject.timeout_add(

1581

timedelta_to_milliseconds(self.expires - now),

1582

self.disable))

1592

1583

1593

1584

# ExtendedTimeout - property

1594

@dbus_service_property(_interface,

1595

signature="t",

1585

@dbus_service_property(_interface, signature="t",

1596

1586

access="readwrite")

1597

1587

def ExtendedTimeout_dbus_property(self, value=None):

1598

1588

if value is None: # get

1599

return dbus.UInt64(self.extended_timeout.total_seconds()

1600

* 1000)

1589

return dbus.UInt64(self.extended_timeout_milliseconds())

1601

1590

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1602

1591

1603

1592

# Interval - property

1604

@dbus_service_property(_interface,

1605

signature="t",

1593

@dbus_service_property(_interface, signature="t",

1606

1594

access="readwrite")

1607

1595

def Interval_dbus_property(self, value=None):

1608

1596

if value is None: # get

1609

return dbus.UInt64(self.interval.total_seconds() * 1000)

1597

return dbus.UInt64(self.interval_milliseconds())

1610

1598

self.interval = datetime.timedelta(0, 0, 0, value)

1611

1599

if getattr(self, "checker_initiator_tag", None) is None:

1612

1600

return

1613

1601

if self.enabled:

1614

1602

# Reschedule checker run

1615

1603

gobject.source_remove(self.checker_initiator_tag)

1616

self.checker_initiator_tag = gobject.timeout_add(

1617

value, self.start_checker)

1618

self.start_checker() # Start one now, too

1604

self.checker_initiator_tag = (gobject.timeout_add

1605

(value, self.start_checker))

1606

self.start_checker() # Start one now, too

1619

1607

1620

1608

# Checker - property

1621

@dbus_service_property(_interface,

1622

signature="s",

1609

@dbus_service_property(_interface, signature="s",

1623

1610

access="readwrite")

1624

1611

def Checker_dbus_property(self, value=None):

1625

1612

if value is None: # get

1626

1613

return dbus.String(self.checker_command)

1627

self.checker_command = str(value)

1614

self.checker_command = unicode(value)

1628

1615

1629

1616

# CheckerRunning - property

1630

@dbus_service_property(_interface,

1631

signature="b",

1617

@dbus_service_property(_interface, signature="b",

1632

1618

access="readwrite")

1633

1619

def CheckerRunning_dbus_property(self, value=None):

1634

1620

if value is None: # get

1644

1630

return self.dbus_object_path # is already a dbus.ObjectPath

1645

1631

1646

1632

# Secret = property

1647

@dbus_service_property(_interface,

1648

signature="ay",

1649

access="write",

1650

byte_arrays=True)

1633

@dbus_service_property(_interface, signature="ay",

1634

access="write", byte_arrays=True)

1651

1635

def Secret_dbus_property(self, value):

1652

self.secret = bytes(value)

1636

self.secret = str(value)

1653

1637

1654

1638

del _interface

1655

1639

1669

1653

if data[0] == 'data':

1670

1654

return data[1]

1671

1655

if data[0] == 'function':

1672

1673

1656

def func(*args, **kwargs):

1674

1657

self._pipe.send(('funcall', name, args, kwargs))

1675

1658

return self._pipe.recv()[1]

1676

1677

1659

return func

1678

1660

1679

1661

def __setattr__(self, name, value):

1691

1673

def handle(self):

1692

1674

with contextlib.closing(self.server.child_pipe) as child_pipe:

1693

1675

logger.info("TCP connection from: %s",

1694

str(self.client_address))

1676

unicode(self.client_address))

1695

1677

logger.debug("Pipe FD: %d",

1696

1678

self.server.child_pipe.fileno())

1697

1679

1698

session = gnutls.connection.ClientSession(

1699

self.request, gnutls.connection .X509Credentials())

1680

session = (gnutls.connection

1681

.ClientSession(self.request,

1682

gnutls.connection

1683

.X509Credentials()))

1700

1684

1701

1685

# Note: gnutls.connection.X509Credentials is really a

1702

1686

# generic GnuTLS certificate credentials object so long as

1711

1695

priority = self.server.gnutls_priority

1712

1696

if priority is None:

1713

1697

priority = "NORMAL"

1714

gnutls.library.functions.gnutls_priority_set_direct(

1715

session._c_object, priority, None)

1698

(gnutls.library.functions

1699

.gnutls_priority_set_direct(session._c_object,

1700

priority, None))

1716

1701

1717

1702

# Start communication using the Mandos protocol

1718

1703

# Get protocol number

1738

1723

approval_required = False

1739

1724

try:

1740

1725

try:

1741

fpr = self.fingerprint(

1742

self.peer_certificate(session))

1726

fpr = self.fingerprint(self.peer_certificate

1727

(session))

1743

1728

except (TypeError,

1744

1729

gnutls.errors.GNUTLSError) as error:

1745

1730

logger.warning("Bad certificate: %s", error)

1760

1745

while True:

1761

1746

if not client.enabled:

1762

1747

logger.info("Client %s is disabled",

1763

client.name)

1748

client.name)

1764

1749

if self.server.use_dbus:

1765

1750

# Emit D-Bus signal

1766

1751

client.Rejected("Disabled")

1775

1760

if self.server.use_dbus:

1776

1761

# Emit D-Bus signal

1777

1762

client.NeedApproval(

1778

client.approval_delay.total_seconds()

1779

* 1000, client.approved_by_default)

1763

client.approval_delay_milliseconds(),

1764

client.approved_by_default)

1780

1765

else:

1781

1766

logger.warning("Client %s was not approved",

1782

1767

client.name)

1788

1773

#wait until timeout or approved

1789

1774

time = datetime.datetime.now()

1790

1775

client.changedstate.acquire()

1791

client.changedstate.wait(delay.total_seconds())

1776

client.changedstate.wait(

1777

float(timedelta_to_milliseconds(delay)

1778

/ 1000))

1792

1779

client.changedstate.release()

1793

1780

time2 = datetime.datetime.now()

1794

1781

if (time2 - time) >= delay:

1813

1800

logger.warning("gnutls send failed",

1814

1801

exc_info=error)

1815

1802

return

1816

logger.debug("Sent: %d, remaining: %d", sent,

1817

len(client.secret) - (sent_size

1818

+ sent))

1803

logger.debug("Sent: %d, remaining: %d",

1804

sent, len(client.secret)

1805

- (sent_size + sent))

1819

1806

sent_size += sent

1820

1807

1821

1808

logger.info("Sending secret to %s", client.name)

1838

1825

def peer_certificate(session):

1839

1826

"Return the peer's OpenPGP certificate as a bytestring"

1840

1827

# If not an OpenPGP certificate...

1841

if (gnutls.library.functions.gnutls_certificate_type_get(

1842

session._c_object)

1828

if (gnutls.library.functions

1829

.gnutls_certificate_type_get(session._c_object)

1843

1830

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1844

1831

# ...do the normal thing

1845

1832

return session.peer_certificate

1859

1846

def fingerprint(openpgp):

1860

1847

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1861

1848

# New GnuTLS "datum" with the OpenPGP public key

1862

datum = gnutls.library.types.gnutls_datum_t(

1863

ctypes.cast(ctypes.c_char_p(openpgp),

1864

ctypes.POINTER(ctypes.c_ubyte)),

1865

ctypes.c_uint(len(openpgp)))

1849

datum = (gnutls.library.types

1850

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1851

ctypes.POINTER

1852

(ctypes.c_ubyte)),

1853

ctypes.c_uint(len(openpgp))))

1866

1854

# New empty GnuTLS certificate

1867

1855

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1868

gnutls.library.functions.gnutls_openpgp_crt_init(

1869

ctypes.byref(crt))

1856

(gnutls.library.functions

1857

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1870

1858

# Import the OpenPGP public key into the certificate

1871

gnutls.library.functions.gnutls_openpgp_crt_import(

1872

crt, ctypes.byref(datum),

1873

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1859

(gnutls.library.functions

1860

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1861

gnutls.library.constants

1862

.GNUTLS_OPENPGP_FMT_RAW))

1874

1863

# Verify the self signature in the key

1875

1864

crtverify = ctypes.c_uint()

1876

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1877

crt, 0, ctypes.byref(crtverify))

1865

(gnutls.library.functions

1866

.gnutls_openpgp_crt_verify_self(crt, 0,

1867

ctypes.byref(crtverify)))

1878

1868

if crtverify.value != 0:

1879

1869

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1880

raise gnutls.errors.CertificateSecurityError(

1881

"Verify failed")

1870

raise (gnutls.errors.CertificateSecurityError

1871

("Verify failed"))

1882

1872

# New buffer for the fingerprint

1883

1873

buf = ctypes.create_string_buffer(20)

1884

1874

buf_len = ctypes.c_size_t()

1885

1875

# Get the fingerprint from the certificate into the buffer

1886

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1887

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1876

(gnutls.library.functions

1877

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1878

ctypes.byref(buf_len)))

1888

1879

# Deinit the certificate

1889

1880

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1890

1881

# Convert the buffer to a Python bytestring

1896

1887

1897

1888

class MultiprocessingMixIn(object):

1898

1889

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1899

1900

1890

def sub_process_main(self, request, address):

1901

1891

try:

1902

1892

self.finish_request(request, address)

1914

1904

1915

1905

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1916

1906

""" adds a pipe to the MixIn """

1917

1918

1907

def process_request(self, request, client_address):

1919

1908

"""Overrides and wraps the original process_request().

1920

1909

1941

1930

interface: None or a network interface name (string)

1942

1931

use_ipv6: Boolean; to use IPv6 or not

1943

1932

"""

1944

1945

1933

def __init__(self, server_address, RequestHandlerClass,

1946

interface=None,

1947

use_ipv6=True,

1948

socketfd=None):

1934

interface=None, use_ipv6=True, socketfd=None):

1949

1935

"""If socketfd is set, use that file descriptor instead of

1950

1936

creating a new one with socket.socket().

1951

1937

"""

1992

1978

self.interface)

1993

1979

else:

1994

1980

try:

1995

self.socket.setsockopt(

1996

socket.SOL_SOCKET, SO_BINDTODEVICE,

1997

(self.interface + "\0").encode("utf-8"))

1981

self.socket.setsockopt(socket.SOL_SOCKET,

1982

SO_BINDTODEVICE,

1983

str(self.interface + '\0'))

1998

1984

except socket.error as error:

1999

1985

if error.errno == errno.EPERM:

2000

1986

logger.error("No permission to bind to"

2018

2004

self.server_address = (any_address,

2019

2005

self.server_address[1])

2020

2006

elif not self.server_address[1]:

2021

self.server_address = (self.server_address[0], 0)

2007

self.server_address = (self.server_address[0],

2008

0)

2022

2009

# if self.interface:

2023

2010

# self.server_address = (self.server_address[0],

2024

2011

# 0, # port

2038

2025

2039

2026

Assumes a gobject.MainLoop event loop.

2040

2027

"""

2041

2042

2028

def __init__(self, server_address, RequestHandlerClass,

2043

interface=None,

2044

use_ipv6=True,

2045

clients=None,

2046

gnutls_priority=None,

2047

use_dbus=True,

2048

socketfd=None):

2029

interface=None, use_ipv6=True, clients=None,

2030

gnutls_priority=None, use_dbus=True, socketfd=None):

2049

2031

self.enabled = False

2050

2032

self.clients = clients

2051

2033

if self.clients is None:

2057

2039

interface = interface,

2058

2040

use_ipv6 = use_ipv6,

2059

2041

socketfd = socketfd)

2060

2061

2042

def server_activate(self):

2062

2043

if self.enabled:

2063

2044

return socketserver.TCPServer.server_activate(self)

2067

2048

2068

2049

def add_pipe(self, parent_pipe, proc):

2069

2050

# Call "handle_ipc" for both data and EOF events

2070

gobject.io_add_watch(

2071

parent_pipe.fileno(),

2072

gobject.IO_IN | gobject.IO_HUP,

2073

functools.partial(self.handle_ipc,

2074

parent_pipe = parent_pipe,

2075

proc = proc))

2051

gobject.io_add_watch(parent_pipe.fileno(),

2052

gobject.IO_IN | gobject.IO_HUP,

2053

functools.partial(self.handle_ipc,

2054

parent_pipe =

2055

parent_pipe,

2056

proc = proc))

2076

2057

2077

def handle_ipc(self, source, condition,

2078

parent_pipe=None,

2079

proc = None,

2080

client_object=None):

2058

def handle_ipc(self, source, condition, parent_pipe=None,

2059

proc = None, client_object=None):

2081

2060

# error, or the other end of multiprocessing.Pipe has closed

2082

2061

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2083

2062

# Wait for other process to exit

2106

2085

parent_pipe.send(False)

2107

2086

return False

2108

2087

2109

gobject.io_add_watch(

2110

parent_pipe.fileno(),

2111

gobject.IO_IN | gobject.IO_HUP,

2112

functools.partial(self.handle_ipc,

2113

parent_pipe = parent_pipe,

2114

proc = proc,

2115

client_object = client))

2088

gobject.io_add_watch(parent_pipe.fileno(),

2089

gobject.IO_IN | gobject.IO_HUP,

2090

functools.partial(self.handle_ipc,

2091

parent_pipe =

2092

parent_pipe,

2093

proc = proc,

2094

client_object =

2095

client))

2116

2096

parent_pipe.send(True)

2117

2097

# remove the old hook in favor of the new above hook on

2118

2098

# same fileno

2124

2104

2125

2105

parent_pipe.send(('data', getattr(client_object,

2126

2106

funcname)(*args,

2127

**kwargs)))

2107

**kwargs)))

2128

2108

2129

2109

if command == 'getattr':

2130

2110

attrname = request[1]

2131

2111

if callable(client_object.__getattribute__(attrname)):

2132

parent_pipe.send(('function', ))

2112

parent_pipe.send(('function',))

2133

2113

else:

2134

parent_pipe.send((

2135

'data', client_object.__getattribute__(attrname)))

2114

parent_pipe.send(('data', client_object

2115

.__getattribute__(attrname)))

2136

2116

2137

2117

if command == 'setattr':

2138

2118

attrname = request[1]

2178

2158

# None

2179

2159

"followers")) # Tokens valid after

2180

2160

# this token

2181

Token = collections.namedtuple("Token", (

2182

"regexp", # To match token; if "value" is not None, must have

2183

# a "group" containing digits

2184

"value", # datetime.timedelta or None

2185

"followers")) # Tokens valid after this token

2186

2161

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2187

2162

# the "duration" ABNF definition in RFC 3339, Appendix A.

2188

2163

token_end = Token(re.compile(r"$"), None, frozenset())

2189

2164

token_second = Token(re.compile(r"(\d+)S"),

2190

2165

datetime.timedelta(seconds=1),

2191

frozenset((token_end, )))

2166

frozenset((token_end,)))

2192

2167

token_minute = Token(re.compile(r"(\d+)M"),

2193

2168

datetime.timedelta(minutes=1),

2194

2169

frozenset((token_second, token_end)))

2210

2185

frozenset((token_month, token_end)))

2211

2186

token_week = Token(re.compile(r"(\d+)W"),

2212

2187

datetime.timedelta(weeks=1),

2213

frozenset((token_end, )))

2188

frozenset((token_end,)))

2214

2189

token_duration = Token(re.compile(r"P"), None,

2215

2190

frozenset((token_year, token_month,

2216

2191

token_day, token_time,

2217

token_week)))

2192

token_week))),

2218

2193

# Define starting values

2219

2194

value = datetime.timedelta() # Value so far

2220

2195

found_token = None

2221

followers = frozenset((token_duration,)) # Following valid tokens

2196

followers = frozenset(token_duration,) # Following valid tokens

2222

2197

s = duration # String left to parse

2223

2198

# Loop until end token is found

2224

2199

while found_token is not token_end:

2271

2246

timevalue = datetime.timedelta(0)

2272

2247

for s in interval.split():

2273

2248

try:

2274

suffix = s[-1]

2249

suffix = unicode(s[-1])

2275

2250

value = int(s[:-1])

2276

2251

if suffix == "d":

2277

2252

delta = datetime.timedelta(value)

2284

2259

elif suffix == "w":

2285

2260

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2286

2261

else:

2287

raise ValueError("Unknown suffix {!r}".format(suffix))

2262

raise ValueError("Unknown suffix {0!r}"

2263

.format(suffix))

2288

2264

except IndexError as e:

2289

2265

raise ValueError(*(e.args))

2290

2266

timevalue += delta

2307

2283

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2308

2284

if not stat.S_ISCHR(os.fstat(null).st_mode):

2309

2285

raise OSError(errno.ENODEV,

2310

"{} not a character device"

2286

"{0} not a character device"

2311

2287

.format(os.devnull))

2312

2288

os.dup2(null, sys.stdin.fileno())

2313

2289

os.dup2(null, sys.stdout.fileno())

2323

2299

2324

2300

parser = argparse.ArgumentParser()

2325

2301

parser.add_argument("-v", "--version", action="version",

2326

version = "%(prog)s {}".format(version),

2302

version = "%(prog)s {0}".format(version),

2327

2303

help="show version number and exit")

2328

2304

parser.add_argument("-i", "--interface", metavar="IF",

2329

2305

help="Bind to interface IF")

2362

2338

help="Directory to save/restore state in")

2363

2339

parser.add_argument("--foreground", action="store_true",

2364

2340

help="Run in foreground", default=None)

2365

parser.add_argument("--no-zeroconf", action="store_false",

2366

dest="zeroconf", help="Do not use Zeroconf",

2367

default=None)

2368

2341

2369

2342

options = parser.parse_args()

2370

2343

2371

2344

if options.check:

2372

2345

import doctest

2373

fail_count, test_count = doctest.testmod()

2374

sys.exit(os.EX_OK if fail_count == 0 else 1)

2346

doctest.testmod()

2347

sys.exit()

2375

2348

2376

2349

# Default values for config file for server-global settings

2377

2350

server_defaults = { "interface": "",

2379

2352

"port": "",

2380

2353

"debug": "False",

2381

2354

"priority":

2382

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2383

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2355

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2384

2356

"servicename": "Mandos",

2385

2357

"use_dbus": "True",

2386

2358

"use_ipv6": "True",

2389

2361

"socket": "",

2390

2362

"statedir": "/var/lib/mandos",

2391

2363

"foreground": "False",

2392

"zeroconf": "True",

2393

}

2364

}

2394

2365

2395

2366

# Parse config file for server-global settings

2396

2367

server_config = configparser.SafeConfigParser(server_defaults)

2397

2368

del server_defaults

2398

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2369

server_config.read(os.path.join(options.configdir,

2370

"mandos.conf"))

2399

2371

# Convert the SafeConfigParser object to a dict

2400

2372

server_settings = server_config.defaults()

2401

2373

# Use the appropriate methods on the non-string config options

2419

2391

# Override the settings from the config file with command line

2420

2392

# options, if set.

2421

2393

for option in ("interface", "address", "port", "debug",

2422

"priority", "servicename", "configdir", "use_dbus",

2423

"use_ipv6", "debuglevel", "restore", "statedir",

2424

"socket", "foreground", "zeroconf"):

2394

"priority", "servicename", "configdir",

2395

"use_dbus", "use_ipv6", "debuglevel", "restore",

2396

"statedir", "socket", "foreground"):

2425

2397

value = getattr(options, option)

2426

2398

if value is not None:

2427

2399

server_settings[option] = value

2428

2400

del options

2429

2401

# Force all strings to be unicode

2430

2402

for option in server_settings.keys():

2431

if isinstance(server_settings[option], bytes):

2432

server_settings[option] = (server_settings[option]

2433

.decode("utf-8"))

2403

if type(server_settings[option]) is str:

2404

server_settings[option] = unicode(server_settings[option])

2434

2405

# Force all boolean options to be boolean

2435

2406

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2436

"foreground", "zeroconf"):

2407

"foreground"):

2437

2408

server_settings[option] = bool(server_settings[option])

2438

2409

# Debug implies foreground

2439

2410

if server_settings["debug"]:

2442

2413

2443

2414

##################################################################

2444

2415

2445

if (not server_settings["zeroconf"]

2446

and not (server_settings["port"]

2447

or server_settings["socket"] != "")):

2448

parser.error("Needs port or socket to work without Zeroconf")

2449

2450

2416

# For convenience

2451

2417

debug = server_settings["debug"]

2452

2418

debuglevel = server_settings["debuglevel"]

2455

2421

stored_state_path = os.path.join(server_settings["statedir"],

2456

2422

stored_state_file)

2457

2423

foreground = server_settings["foreground"]

2458

zeroconf = server_settings["zeroconf"]

2459

2424

2460

2425

if debug:

2461

2426

initlogger(debug, logging.DEBUG)

2467

2432

initlogger(debug, level)

2468

2433

2469

2434

if server_settings["servicename"] != "Mandos":

2470

syslogger.setFormatter(

2471

logging.Formatter('Mandos ({}) [%(process)d]:'

2472

' %(levelname)s: %(message)s'.format(

2473

server_settings["servicename"])))

2435

syslogger.setFormatter(logging.Formatter

2436

('Mandos ({0}) [%(process)d]:'

2437

' %(levelname)s: %(message)s'

2438

.format(server_settings

2439

["servicename"])))

2474

2440

2475

2441

# Parse config file with clients

2476

2442

client_config = configparser.SafeConfigParser(Client

2481

2447

global mandos_dbus_service

2482

2448

mandos_dbus_service = None

2483

2449

2484

socketfd = None

2485

if server_settings["socket"] != "":

2486

socketfd = server_settings["socket"]

2487

tcp_server = MandosServer(

2488

(server_settings["address"], server_settings["port"]),

2489

ClientHandler,

2490

interface=(server_settings["interface"] or None),

2491

use_ipv6=use_ipv6,

2492

gnutls_priority=server_settings["priority"],

2493

use_dbus=use_dbus,

2494

socketfd=socketfd)

2450

tcp_server = MandosServer((server_settings["address"],

2451

server_settings["port"]),

2452

ClientHandler,

2453

interface=(server_settings["interface"]

2454

or None),

2455

use_ipv6=use_ipv6,

2456

gnutls_priority=

2457

server_settings["priority"],

2458

use_dbus=use_dbus,

2459

socketfd=(server_settings["socket"]

2460

or None))

2495

2461

if not foreground:

2496

2462

pidfilename = "/run/mandos.pid"

2497

2463

if not os.path.isdir("/run/."):

2531

2497

def debug_gnutls(level, string):

2532

2498

logger.debug("GnuTLS: %s", string[:-1])

2533

2499

2534

gnutls.library.functions.gnutls_global_set_log_function(

2535

debug_gnutls)

2500

(gnutls.library.functions

2501

.gnutls_global_set_log_function(debug_gnutls))

2536

2502

2537

2503

# Redirect stdin so all checkers get /dev/null

2538

2504

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2558

2524

if use_dbus:

2559

2525

try:

2560

2526

bus_name = dbus.service.BusName("se.recompile.Mandos",

2561

bus,

2562

do_not_queue=True)

2563

old_bus_name = dbus.service.BusName(

2564

"se.bsnet.fukt.Mandos", bus,

2565

do_not_queue=True)

2527

bus, do_not_queue=True)

2528

old_bus_name = (dbus.service.BusName

2529

("se.bsnet.fukt.Mandos", bus,

2530

do_not_queue=True))

2566

2531

except dbus.exceptions.NameExistsException as e:

2567

2532

logger.error("Disabling D-Bus:", exc_info=e)

2568

2533

use_dbus = False

2569

2534

server_settings["use_dbus"] = False

2570

2535

tcp_server.use_dbus = False

2571

if zeroconf:

2572

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2573

service = AvahiServiceToSyslog(

2574

name = server_settings["servicename"],

2575

servicetype = "_mandos._tcp",

2576

protocol = protocol,

2577

bus = bus)

2578

if server_settings["interface"]:

2579

service.interface = if_nametoindex(

2580

server_settings["interface"].encode("utf-8"))

2536

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2537

service = AvahiServiceToSyslog(name =

2538

server_settings["servicename"],

2539

servicetype = "_mandos._tcp",

2540

protocol = protocol, bus = bus)

2541

if server_settings["interface"]:

2542

service.interface = (if_nametoindex

2543

(str(server_settings["interface"])))

2581

2544

2582

2545

global multiprocessing_manager

2583

2546

multiprocessing_manager = multiprocessing.Manager()

2602

2565

if server_settings["restore"]:

2603

2566

try:

2604

2567

with open(stored_state_path, "rb") as stored_state:

2605

clients_data, old_client_settings = pickle.load(

2606

stored_state)

2568

clients_data, old_client_settings = (pickle.load

2569

(stored_state))

2607

2570

os.remove(stored_state_path)

2608

2571

except IOError as e:

2609

2572

if e.errno == errno.ENOENT:

2610

logger.warning("Could not load persistent state:"

2611

" {}".format(os.strerror(e.errno)))

2573

logger.warning("Could not load persistent state: {0}"

2574

.format(os.strerror(e.errno)))

2612

2575

else:

2613

2576

logger.critical("Could not load persistent state:",

2614

2577

exc_info=e)

2615

2578

raise

2616

2579

except EOFError as e:

2617

2580

logger.warning("Could not load persistent state: "

2618

"EOFError:",

2619

exc_info=e)

2581

"EOFError:", exc_info=e)

2620

2582

2621

2583

with PGPEngine() as pgp:

2622

for client_name, client in clients_data.items():

2584

for client_name, client in clients_data.iteritems():

2623

2585

# Skip removed clients

2624

2586

if client_name not in client_settings:

2625

2587

continue

2634

2596

# For each value in new config, check if it

2635

2597

# differs from the old config value (Except for

2636

2598

# the "secret" attribute)

2637

if (name != "secret"

2638

and (value !=

2639

old_client_settings[client_name][name])):

2599

if (name != "secret" and

2600

value != old_client_settings[client_name]

2601

[name]):

2640

2602

client[name] = value

2641

2603

except KeyError:

2642

2604

pass

2650

2612

if datetime.datetime.utcnow() >= client["expires"]:

2651

2613

if not client["last_checked_ok"]:

2652

2614

logger.warning(

2653

"disabling client {} - Client never "

2654

"performed a successful checker".format(

2655

client_name))

2615

"disabling client {0} - Client never "

2616

"performed a successful checker"

2617

.format(client_name))

2656

2618

client["enabled"] = False

2657

2619

elif client["last_checker_status"] != 0:

2658

2620

logger.warning(

2659

"disabling client {} - Client last"

2660

" checker failed with error code"

2661

" {}".format(

2662

client_name,

2663

client["last_checker_status"]))

2621

"disabling client {0} - Client "

2622

"last checker failed with error code {1}"

2623

.format(client_name,

2624

client["last_checker_status"]))

2664

2625

client["enabled"] = False

2665

2626

else:

2666

client["expires"] = (

2667

datetime.datetime.utcnow()

2668

+ client["timeout"])

2627

client["expires"] = (datetime.datetime

2628

.utcnow()

2629

+ client["timeout"])

2669

2630

logger.debug("Last checker succeeded,"

2670

" keeping {} enabled".format(

2671

client_name))

2631

" keeping {0} enabled"

2632

.format(client_name))

2672

2633

try:

2673

client["secret"] = pgp.decrypt(

2674

client["encrypted_secret"],

2675

client_settings[client_name]["secret"])

2634

client["secret"] = (

2635

pgp.decrypt(client["encrypted_secret"],

2636

client_settings[client_name]

2637

["secret"]))

2676

2638

except PGPError:

2677

2639

# If decryption fails, we use secret from new settings

2678

logger.debug("Failed to decrypt {} old secret".format(

2679

client_name))

2680

client["secret"] = (client_settings[client_name]

2681

["secret"])

2640

logger.debug("Failed to decrypt {0} old secret"

2641

.format(client_name))

2642

client["secret"] = (

2643

client_settings[client_name]["secret"])

2682

2644

2683

2645

# Add/remove clients based on new changes made to config

2684

2646

for client_name in (set(old_client_settings)

2689

2651

clients_data[client_name] = client_settings[client_name]

2690

2652

2691

2653

# Create all client objects

2692

for client_name, client in clients_data.items():

2654

for client_name, client in clients_data.iteritems():

2693

2655

tcp_server.clients[client_name] = client_class(

2694

name = client_name,

2695

settings = client,

2656

name = client_name, settings = client,

2696

2657

server_settings = server_settings)

2697

2658

2698

2659

if not tcp_server.clients:

2703

2664

try:

2704

2665

with pidfile:

2705

2666

pid = os.getpid()

2706

pidfile.write("{}\n".format(pid).encode("utf-8"))

2667

pidfile.write(str(pid) + "\n".encode("utf-8"))

2707

2668

except IOError:

2708

2669

logger.error("Could not write to file %r with PID %d",

2709

2670

pidfilename, pid)

2714

2675

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2715

2676

2716

2677

if use_dbus:

2717

2718

@alternate_dbus_interfaces(

2719

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2678

@alternate_dbus_interfaces({"se.recompile.Mandos":

2679

"se.bsnet.fukt.Mandos"})

2720

2680

class MandosDBusService(DBusObjectWithProperties):

2721

2681

"""A D-Bus proxy object"""

2722

2723

2682

def __init__(self):

2724

2683

dbus.service.Object.__init__(self, bus, "/")

2725

2726

2684

_interface = "se.recompile.Mandos"

2727

2685

2728

2686

@dbus_interface_annotations(_interface)

2729

2687

def _foo(self):

2730

return {

2731

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2732

"false" }

2688

return { "org.freedesktop.DBus.Property"

2689

".EmitsChangedSignal":

2690

"false"}

2733

2691

2734

2692

@dbus.service.signal(_interface, signature="o")

2735

2693

def ClientAdded(self, objpath):

2749

2707

@dbus.service.method(_interface, out_signature="ao")

2750

2708

def GetAllClients(self):

2751

2709

"D-Bus method"

2752

return dbus.Array(c.dbus_object_path for c in

2710

return dbus.Array(c.dbus_object_path

2711

for c in

2753

2712

tcp_server.clients.itervalues())

2754

2713

2755

2714

@dbus.service.method(_interface,

2757

2716

def GetAllClientsWithProperties(self):

2758

2717

"D-Bus method"

2759

2718

return dbus.Dictionary(

2760

{ c.dbus_object_path: c.GetAll("")

2761

for c in tcp_server.clients.itervalues() },

2719

((c.dbus_object_path, c.GetAll(""))

2720

for c in tcp_server.clients.itervalues()),

2762

2721

signature="oa{sv}")

2763

2722

2764

2723

@dbus.service.method(_interface, in_signature="o")

2781

2740

2782

2741

def cleanup():

2783

2742

"Cleanup function; run on exit"

2784

if zeroconf:

2785

service.cleanup()

2743

service.cleanup()

2786

2744

2787

2745

multiprocessing.active_children()

2788

2746

wnull.close()

2802

2760

2803

2761

# A list of attributes that can not be pickled

2804

2762

# + secret.

2805

exclude = { "bus", "changedstate", "secret",

2806

"checker", "server_settings" }

2807

for name, typ in inspect.getmembers(dbus.service

2808

.Object):

2763

exclude = set(("bus", "changedstate", "secret",

2764

"checker", "server_settings"))

2765

for name, typ in (inspect.getmembers

2766

(dbus.service.Object)):

2809

2767

exclude.add(name)

2810

2768

2811

2769

client_dict["encrypted_secret"] = (client

2818

2776

del client_settings[client.name]["secret"]

2819

2777

2820

2778

try:

2821

with tempfile.NamedTemporaryFile(

2822

mode='wb',

2823

suffix=".pickle",

2824

prefix='clients-',

2825

dir=os.path.dirname(stored_state_path),

2826

delete=False) as stored_state:

2779

with (tempfile.NamedTemporaryFile

2780

(mode='wb', suffix=".pickle", prefix='clients-',

2781

dir=os.path.dirname(stored_state_path),

2782

delete=False)) as stored_state:

2827

2783

pickle.dump((clients, client_settings), stored_state)

2828

tempname = stored_state.name

2784

tempname=stored_state.name

2829

2785

os.rename(tempname, stored_state_path)

2830

2786

except (IOError, OSError) as e:

2831

2787

if not debug:

2834

2790

except NameError:

2835

2791

pass

2836

2792

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2837

logger.warning("Could not save persistent state: {}"

2793

logger.warning("Could not save persistent state: {0}"

2838

2794

.format(os.strerror(e.errno)))

2839

2795

else:

2840

2796

logger.warning("Could not save persistent state:",

2850

2806

client.disable(quiet=True)

2851

2807

if use_dbus:

2852

2808

# Emit D-Bus signal

2853

mandos_dbus_service.ClientRemoved(

2854

client.dbus_object_path, client.name)

2809

mandos_dbus_service.ClientRemoved(client

2810

.dbus_object_path,

2811

client.name)

2855

2812

client_settings.clear()

2856

2813

2857

2814

atexit.register(cleanup)

2868

2825

tcp_server.server_activate()

2869

2826

2870

2827

# Find out what port we got

2871

if zeroconf:

2872

service.port = tcp_server.socket.getsockname()[1]

2828

service.port = tcp_server.socket.getsockname()[1]

2873

2829

if use_ipv6:

2874

2830

logger.info("Now listening on address %r, port %d,"

2875

2831

" flowinfo %d, scope_id %d",

2881

2837

#service.interface = tcp_server.socket.getsockname()[3]

2882

2838

2883

2839

try:

2884

if zeroconf:

2885

# From the Avahi example code

2886

try:

2887

service.activate()

2888

except dbus.exceptions.DBusException as error:

2889

logger.critical("D-Bus Exception", exc_info=error)

2890

cleanup()

2891

sys.exit(1)

2892

# End of Avahi example code

2840

# From the Avahi example code

2841

try:

2842

service.activate()

2843

except dbus.exceptions.DBusException as error:

2844

logger.critical("D-Bus Exception", exc_info=error)

2845

cleanup()

2846

sys.exit(1)

2847

# End of Avahi example code

2893

2848

2894

2849

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2895

2850

lambda *args, **kwargs:

2910

2865

# Must run before the D-Bus bus name gets deregistered

2911

2866

cleanup()

2912

2867

2913

2914

2868

if __name__ == '__main__':

2915

2869

main()