/mandos/release : revision 237.7.255

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

88

except ImportError:

89

SO_BINDTODEVICE = None

90

91

if sys.version_info.major == 2:

92

str = unicode

93

94

version = "1.6.9"

91

version = "1.6.5"

95

92

stored_state_file = "clients.pickle"

96

93

97

94

logger = logging.getLogger()

98

95

syslogger = None

99

96

100

97

try:

101

if_nametoindex = ctypes.cdll.LoadLibrary(

102

ctypes.util.find_library("c")).if_nametoindex

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

103

101

except (OSError, AttributeError):

104

105

102

def if_nametoindex(interface):

106

103

"Get an interface index the hard way, i.e. using fcntl()"

107

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

108

105

with contextlib.closing(socket.socket()) as s:

109

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

110

struct.pack(b"16s16x", interface))

111

interface_index = struct.unpack("I", ifreq[16:20])[0]

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

112

111

return interface_index

113

112

114

113

116

115

"""init logger and add loglevel"""

117

116

118

117

global syslogger

119

syslogger = (logging.handlers.SysLogHandler(

120

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

121

address = "/dev/log"))

118

syslogger = (logging.handlers.SysLogHandler

119

(facility =

120

logging.handlers.SysLogHandler.LOG_DAEMON,

121

address = str("/dev/log")))

122

syslogger.setFormatter(logging.Formatter

123

('Mandos [%(process)d]: %(levelname)s:'

124

' %(message)s'))

141

142

class PGPEngine(object):

143

"""A simple class for OpenPGP symmetric encryption & decryption"""

144

145

144

def __init__(self):

146

145

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

147

146

self.gnupgargs = ['--batch',

186

185

187

186

def encrypt(self, data, password):

188

187

passphrase = self.password_encode(password)

189

with tempfile.NamedTemporaryFile(

190

dir=self.tempdir) as passfile:

188

with tempfile.NamedTemporaryFile(dir=self.tempdir

189

) as passfile:

191

190

passfile.write(passphrase)

192

191

passfile.flush()

193

192

proc = subprocess.Popen(['gpg', '--symmetric',

204

203

205

204

def decrypt(self, data, password):

206

205

passphrase = self.password_encode(password)

207

with tempfile.NamedTemporaryFile(

208

dir = self.tempdir) as passfile:

206

with tempfile.NamedTemporaryFile(dir = self.tempdir

207

) as passfile:

209

208

passfile.write(passphrase)

210

209

passfile.flush()

211

210

proc = subprocess.Popen(['gpg', '--decrypt',

215

214

stdin = subprocess.PIPE,

216

215

stdout = subprocess.PIPE,

217

216

stderr = subprocess.PIPE)

218

decrypted_plaintext, err = proc.communicate(input = data)

217

decrypted_plaintext, err = proc.communicate(input

218

= data)

219

if proc.returncode != 0:

220

raise PGPError(err)

221

return decrypted_plaintext

224

class AvahiError(Exception):

225

def __init__(self, value, *args, **kwargs):

226

self.value = value

227

return super(AvahiError, self).__init__(value, *args,

228

**kwargs)

229

227

super(AvahiError, self).__init__(value, *args, **kwargs)

228

def __unicode__(self):

229

return unicode(repr(self.value))

230

231

class AvahiServiceError(AvahiError):

232

pass

233

234

235

234

class AvahiGroupError(AvahiError):

236

235

pass

237

236

257

256

bus: dbus.SystemBus()

258

257

"""

259

258

260

def __init__(self,

261

interface = avahi.IF_UNSPEC,

262

name = None,

263

servicetype = None,

264

port = None,

265

TXT = None,

266

domain = "",

267

host = "",

268

max_renames = 32768,

269

protocol = avahi.PROTO_UNSPEC,

270

bus = None):

259

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

260

servicetype = None, port = None, TXT = None,

261

domain = "", host = "", max_renames = 32768,

262

protocol = avahi.PROTO_UNSPEC, bus = None):

271

263

self.interface = interface

272

264

self.name = name

273

265

self.type = servicetype

283

275

self.bus = bus

284

276

self.entry_group_state_changed_match = None

285

277

286

def rename(self, remove=True):

278

def rename(self):

287

279

"""Derived from the Avahi example code"""

288

280

if self.rename_count >= self.max_renames:

289

281

logger.critical("No suitable Zeroconf service name found"

290

282

" after %i retries, exiting.",

291

283

self.rename_count)

292

284

raise AvahiServiceError("Too many renames")

293

self.name = str(

294

self.server.GetAlternativeServiceName(self.name))

295

self.rename_count += 1

285

self.name = unicode(self.server

286

.GetAlternativeServiceName(self.name))

296

287

logger.info("Changing Zeroconf service name to %r ...",

297

288

self.name)

298

if remove:

299

self.remove()

289

self.remove()

300

290

try:

301

291

self.add()

302

292

except dbus.exceptions.DBusException as error:

303

if (error.get_dbus_name()

304

== "org.freedesktop.Avahi.CollisionError"):

305

logger.info("Local Zeroconf service name collision.")

306

return self.rename(remove=False)

307

else:

308

logger.critical("D-Bus Exception", exc_info=error)

309

self.cleanup()

310

os._exit(1)

293

logger.critical("D-Bus Exception", exc_info=error)

294

self.cleanup()

295

os._exit(1)

296

self.rename_count += 1

311

297

312

298

def remove(self):

313

299

"""Derived from the Avahi example code"""

351

337

self.rename()

352

338

elif state == avahi.ENTRY_GROUP_FAILURE:

353

339

logger.critical("Avahi: Error in group state changed %s",

354

str(error))

355

raise AvahiGroupError("State changed: {!s}".format(error))

340

unicode(error))

341

raise AvahiGroupError("State changed: {0!s}"

342

.format(error))

356

343

357

344

def cleanup(self):

358

345

"""Derived from the Avahi example code"""

368

355

def server_state_changed(self, state, error=None):

369

356

"""Derived from the Avahi example code"""

370

357

logger.debug("Avahi server state change: %i", state)

371

bad_states = {

372

avahi.SERVER_INVALID: "Zeroconf server invalid",

373

avahi.SERVER_REGISTERING: None,

374

avahi.SERVER_COLLISION: "Zeroconf server name collision",

375

avahi.SERVER_FAILURE: "Zeroconf server failure",

376

}

358

bad_states = { avahi.SERVER_INVALID:

359

"Zeroconf server invalid",

360

avahi.SERVER_REGISTERING: None,

361

avahi.SERVER_COLLISION:

362

"Zeroconf server name collision",

363

avahi.SERVER_FAILURE:

364

"Zeroconf server failure" }

377

365

if state in bad_states:

378

366

if bad_states[state] is not None:

379

367

if error is None:

398

386

follow_name_owner_changes=True),

399

387

avahi.DBUS_INTERFACE_SERVER)

400

388

self.server.connect_to_signal("StateChanged",

401

self.server_state_changed)

389

self.server_state_changed)

402

390

self.server_state_changed(self.server.GetState())

403

391

404

392

405

393

class AvahiServiceToSyslog(AvahiService):

406

def rename(self, *args, **kwargs):

394

def rename(self):

407

395

"""Add the new name to the syslog messages"""

408

ret = AvahiService.rename(self, *args, **kwargs)

409

syslogger.setFormatter(logging.Formatter(

410

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

411

.format(self.name)))

396

ret = AvahiService.rename(self)

397

syslogger.setFormatter(logging.Formatter

398

('Mandos ({0}) [%(process)d]:'

399

' %(levelname)s: %(message)s'

400

.format(self.name)))

412

401

return ret

413

402

414

403

404

def timedelta_to_milliseconds(td):

405

"Convert a datetime.timedelta() to milliseconds"

406

return ((td.days * 24 * 60 * 60 * 1000)

407

+ (td.seconds * 1000)

408

+ (td.microseconds // 1000))

409

410

415

411

class Client(object):

416

412

"""A representation of a client host served by this server.

417

413

461

457

"fingerprint", "host", "interval",

462

458

"last_approval_request", "last_checked_ok",

463

459

"last_enabled", "name", "timeout")

464

client_defaults = {

465

"timeout": "PT5M",

466

"extended_timeout": "PT15M",

467

"interval": "PT2M",

468

"checker": "fping -q -- %%(host)s",

469

"host": "",

470

"approval_delay": "PT0S",

471

"approval_duration": "PT1S",

472

"approved_by_default": "True",

473

"enabled": "True",

474

}

460

client_defaults = { "timeout": "PT5M",

461

"extended_timeout": "PT15M",

462

"interval": "PT2M",

463

"checker": "fping -q -- %%(host)s",

464

"host": "",

465

"approval_delay": "PT0S",

466

"approval_duration": "PT1S",

467

"approved_by_default": "True",

468

"enabled": "True",

469

}

470

471

def timeout_milliseconds(self):

472

"Return the 'timeout' attribute in milliseconds"

473

return timedelta_to_milliseconds(self.timeout)

474

475

def extended_timeout_milliseconds(self):

476

"Return the 'extended_timeout' attribute in milliseconds"

477

return timedelta_to_milliseconds(self.extended_timeout)

478

479

def interval_milliseconds(self):

480

"Return the 'interval' attribute in milliseconds"

481

return timedelta_to_milliseconds(self.interval)

482

483

def approval_delay_milliseconds(self):

484

return timedelta_to_milliseconds(self.approval_delay)

475

485

476

486

@staticmethod

477

487

def config_parser(config):

493

503

client["enabled"] = config.getboolean(client_name,

494

504

"enabled")

495

505

496

# Uppercase and remove spaces from fingerprint for later

497

# comparison purposes with return value from the

498

# fingerprint() function

499

506

client["fingerprint"] = (section["fingerprint"].upper()

500

507

.replace(" ", ""))

501

508

if "secret" in section:

506

513

"rb") as secfile:

507

514

client["secret"] = secfile.read()

508

515

else:

509

raise TypeError("No secret or secfile for section {}"

516

raise TypeError("No secret or secfile for section {0}"

510

517

.format(section))

511

518

client["timeout"] = string_to_delta(section["timeout"])

512

519

client["extended_timeout"] = string_to_delta(

529

536

server_settings = {}

530

537

self.server_settings = server_settings

531

538

# adding all client settings

532

for setting, value in settings.items():

539

for setting, value in settings.iteritems():

533

540

setattr(self, setting, value)

534

541

535

542

if self.enabled:

543

550

self.expires = None

544

551

545

552

logger.debug("Creating client %r", self.name)

553

# Uppercase and remove spaces from fingerprint for later

554

# comparison purposes with return value from the fingerprint()

555

# function

546

556

logger.debug(" Fingerprint: %s", self.fingerprint)

547

557

self.created = settings.get("created",

548

558

datetime.datetime.utcnow())

555

565

self.current_checker_command = None

556

566

self.approved = None

557

567

self.approvals_pending = 0

558

self.changedstate = multiprocessing_manager.Condition(

559

multiprocessing_manager.Lock())

560

self.client_structure = [attr

561

for attr in self.__dict__.iterkeys()

568

self.changedstate = (multiprocessing_manager

569

.Condition(multiprocessing_manager

570

.Lock()))

571

self.client_structure = [attr for attr in

572

self.__dict__.iterkeys()

562

573

if not attr.startswith("_")]

563

574

self.client_structure.append("client_structure")

564

575

565

for name, t in inspect.getmembers(

566

type(self), lambda obj: isinstance(obj, property)):

576

for name, t in inspect.getmembers(type(self),

577

lambda obj:

578

isinstance(obj,

579

property)):

567

580

if not name.startswith("_"):

568

581

self.client_structure.append(name)

569

582

611

624

# and every interval from then on.

612

625

if self.checker_initiator_tag is not None:

613

626

gobject.source_remove(self.checker_initiator_tag)

614

self.checker_initiator_tag = gobject.timeout_add(

615

int(self.interval.total_seconds() * 1000),

616

self.start_checker)

627

self.checker_initiator_tag = (gobject.timeout_add

628

(self.interval_milliseconds(),

629

self.start_checker))

617

630

# Schedule a disable() when 'timeout' has passed

618

631

if self.disable_initiator_tag is not None:

619

632

gobject.source_remove(self.disable_initiator_tag)

620

self.disable_initiator_tag = gobject.timeout_add(

621

int(self.timeout.total_seconds() * 1000), self.disable)

633

self.disable_initiator_tag = (gobject.timeout_add

634

(self.timeout_milliseconds(),

635

self.disable))

622

636

# Also start a new checker *right now*.

623

637

self.start_checker()

624

638

633

647

vars(self))

634

648

self.checked_ok()

635

649

else:

636

logger.info("Checker for %(name)s failed", vars(self))

650

logger.info("Checker for %(name)s failed",

651

vars(self))

637

652

else:

638

653

self.last_checker_status = -1

639

654

logger.warning("Checker for %(name)s crashed?",

653

668

gobject.source_remove(self.disable_initiator_tag)

654

669

self.disable_initiator_tag = None

655

670

if getattr(self, "enabled", False):

656

self.disable_initiator_tag = gobject.timeout_add(

657

int(timeout.total_seconds() * 1000), self.disable)

671

self.disable_initiator_tag = (gobject.timeout_add

672

(timedelta_to_milliseconds

673

(timeout), self.disable))

658

674

self.expires = datetime.datetime.utcnow() + timeout

659

675

660

676

def need_approval(self):

691

707

# Start a new checker if needed

692

708

if self.checker is None:

693

709

# Escape attributes for the shell

694

escaped_attrs = {

695

attr: re.escape(str(getattr(self, attr)))

696

for attr in self.runtime_expansions }

710

escaped_attrs = dict(

711

(attr, re.escape(unicode(getattr(self, attr))))

712

for attr in

713

self.runtime_expansions)

697

714

try:

698

715

command = self.checker_command % escaped_attrs

699

716

except TypeError as error:

700

717

logger.error('Could not format string "%s"',

701

self.checker_command,

702

exc_info=error)

703

return True # Try again later

718

self.checker_command, exc_info=error)

719

return True # Try again later

704

720

self.current_checker_command = command

705

721

try:

706

logger.info("Starting checker %r for %s", command,

707

self.name)

722

logger.info("Starting checker %r for %s",

723

command, self.name)

708

724

# We don't need to redirect stdout and stderr, since

709

725

# in normal mode, that is already done by daemon(),

710

726

# and in debug mode we don't want to. (Stdin is

719

735

"stderr": wnull })

720

736

self.checker = subprocess.Popen(command,

721

737

close_fds=True,

722

shell=True,

723

cwd="/",

738

shell=True, cwd="/",

724

739

**popen_args)

725

740

except OSError as error:

726

741

logger.error("Failed to start subprocess",

727

742

exc_info=error)

728

743

return True

729

self.checker_callback_tag = gobject.child_watch_add(

730

self.checker.pid, self.checker_callback, data=command)

744

self.checker_callback_tag = (gobject.child_watch_add

745

(self.checker.pid,

746

self.checker_callback,

747

data=command))

731

748

# The checker may have completed before the gobject

732

749

# watch was added. Check for this.

733

750

try:

764

781

self.checker = None

765

782

766

783

767

def dbus_service_property(dbus_interface,

768

signature="v",

769

access="readwrite",

770

byte_arrays=False):

784

def dbus_service_property(dbus_interface, signature="v",

785

access="readwrite", byte_arrays=False):

771

786

"""Decorators for marking methods of a DBusObjectWithProperties to

772

787

become properties on the D-Bus.

773

788

782

797

# "Set" method, so we fail early here:

783

798

if byte_arrays and signature != "ay":

784

799

raise ValueError("Byte arrays not supported for non-'ay'"

785

" signature {!r}".format(signature))

786

800

" signature {0!r}".format(signature))

787

801

def decorator(func):

788

802

func._dbus_is_property = True

789

803

func._dbus_interface = dbus_interface

794

808

func._dbus_name = func._dbus_name[:-14]

795

809

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

796

810

return func

797

798

811

return decorator

799

812

800

813

809

822

"org.freedesktop.DBus.Property.EmitsChangedSignal":

810

823

"false"}

811

824

"""

812

813

825

def decorator(func):

814

826

func._dbus_is_interface = True

815

827

func._dbus_interface = dbus_interface

816

828

func._dbus_name = dbus_interface

817

829

return func

818

819

830

return decorator

820

831

821

832

823

834

"""Decorator to annotate D-Bus methods, signals or properties

824

835

Usage:

825

836

826

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

827

"org.freedesktop.DBus.Property."

828

"EmitsChangedSignal": "false"})

829

837

@dbus_service_property("org.example.Interface", signature="b",

830

838

access="r")

839

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

840

"org.freedesktop.DBus.Property."

841

"EmitsChangedSignal": "false"})

831

842

def Property_dbus_property(self):

832

843

return dbus.Boolean(False)

833

844

"""

834

835

845

def decorator(func):

836

846

func._dbus_annotations = annotations

837

847

return func

838

839

848

return decorator

840

849

841

850

842

851

class DBusPropertyException(dbus.exceptions.DBusException):

843

852

"""A base class for D-Bus property-related exceptions

844

853

"""

845

pass

854

def __unicode__(self):

855

return unicode(str(self))

846

856

847

857

848

858

class DBusPropertyAccessException(DBusPropertyException):

872

882

If called like _is_dbus_thing("method") it returns a function

873

883

suitable for use as predicate to inspect.getmembers().

874

884

"""

875

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

885

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

876

886

False)

877

887

878

888

def _get_all_dbus_things(self, thing):

879

889

"""Returns a generator of (name, attribute) pairs

880

890

"""

881

return ((getattr(athing.__get__(self), "_dbus_name", name),

891

return ((getattr(athing.__get__(self), "_dbus_name",

892

name),

882

893

athing.__get__(self))

883

894

for cls in self.__class__.__mro__

884

895

for name, athing in

885

inspect.getmembers(cls, self._is_dbus_thing(thing)))

896

inspect.getmembers(cls,

897

self._is_dbus_thing(thing)))

886

898

887

899

def _get_dbus_property(self, interface_name, property_name):

888

900

"""Returns a bound method if one exists which is a D-Bus

889

901

property with the specified name and interface.

890

902

"""

891

for cls in self.__class__.__mro__:

892

for name, value in inspect.getmembers(

893

cls, self._is_dbus_thing("property")):

903

for cls in self.__class__.__mro__:

904

for name, value in (inspect.getmembers

905

(cls,

906

self._is_dbus_thing("property"))):

894

907

if (value._dbus_name == property_name

895

908

and value._dbus_interface == interface_name):

896

909

return value.__get__(self)

897

910

898

911

# No such property

899

raise DBusPropertyNotFound("{}:{}.{}".format(

900

self.dbus_object_path, interface_name, property_name))

912

raise DBusPropertyNotFound(self.dbus_object_path + ":"

913

+ interface_name + "."

914

+ property_name)

901

915

902

@dbus.service.method(dbus.PROPERTIES_IFACE,

903

in_signature="ss",

916

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

904

917

out_signature="v")

905

918

def Get(self, interface_name, property_name):

906

919

"""Standard D-Bus property Get() method, see D-Bus standard.

925

938

# signatures other than "ay".

926

939

if prop._dbus_signature != "ay":

927

940

raise ValueError("Byte arrays not supported for non-"

928

"'ay' signature {!r}"

941

"'ay' signature {0!r}"

929

942

.format(prop._dbus_signature))

930

943

value = dbus.ByteArray(b''.join(chr(byte)

931

944

for byte in value))

932

945

prop(value)

933

946

934

@dbus.service.method(dbus.PROPERTIES_IFACE,

935

in_signature="s",

947

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

936

948

out_signature="a{sv}")

937

949

def GetAll(self, interface_name):

938

950

"""Standard D-Bus property GetAll() method, see D-Bus

953

965

if not hasattr(value, "variant_level"):

954

966

properties[name] = value

955

967

continue

956

properties[name] = type(value)(

957

value, variant_level = value.variant_level + 1)

968

properties[name] = type(value)(value, variant_level=

969

value.variant_level+1)

958

970

return dbus.Dictionary(properties, signature="sv")

959

971

960

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

961

def PropertiesChanged(self, interface_name, changed_properties,

962

invalidated_properties):

963

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

964

standard.

965

"""

966

pass

967

968

972

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

969

973

out_signature="s",

970

974

path_keyword='object_path',

978

982

connection)

979

983

try:

980

984

document = xml.dom.minidom.parseString(xmlstring)

981

982

985

def make_tag(document, name, prop):

983

986

e = document.createElement("property")

984

987

e.setAttribute("name", name)

985

988

e.setAttribute("type", prop._dbus_signature)

986

989

e.setAttribute("access", prop._dbus_access)

987

990

return e

988

989

991

for if_tag in document.getElementsByTagName("interface"):

990

992

# Add property tags

991

993

for tag in (make_tag(document, name, prop)

1003

1005

if (name == tag.getAttribute("name")

1004

1006

and prop._dbus_interface

1005

1007

== if_tag.getAttribute("name")):

1006

annots.update(getattr(

1007

prop, "_dbus_annotations", {}))

1008

for name, value in annots.items():

1008

annots.update(getattr

1009

(prop,

1010

"_dbus_annotations",

1011

{}))

1012

for name, value in annots.iteritems():

1009

1013

ann_tag = document.createElement(

1010

1014

"annotation")

1011

1015

ann_tag.setAttribute("name", name)

1014

1018

# Add interface annotation tags

1015

1019

for annotation, value in dict(

1016

1020

itertools.chain.from_iterable(

1017

annotations().items()

1018

for name, annotations

1019

in self._get_all_dbus_things("interface")

1021

annotations().iteritems()

1022

for name, annotations in

1023

self._get_all_dbus_things("interface")

1020

1024

if name == if_tag.getAttribute("name")

1021

)).items():

1025

)).iteritems():

1022

1026

ann_tag = document.createElement("annotation")

1023

1027

ann_tag.setAttribute("name", annotation)

1024

1028

ann_tag.setAttribute("value", value)

1051

1055

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1052

1056

if dt is None:

1053

1057

return dbus.String("", variant_level = variant_level)

1054

return dbus.String(dt.isoformat(), variant_level=variant_level)

1058

return dbus.String(dt.isoformat(),

1059

variant_level=variant_level)

1055

1060

1056

1061

1057

1062

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1077

1082

(from DBusObjectWithProperties) and interfaces (from the

1078

1083

dbus_interface_annotations decorator).

1079

1084

"""

1080

1081

1085

def wrapper(cls):

1082

1086

for orig_interface_name, alt_interface_name in (

1083

alt_interface_names.items()):

1087

alt_interface_names.iteritems()):

1084

1088

attr = {}

1085

1089

interface_names = set()

1086

1090

# Go though all attributes of the class

1088

1092

# Ignore non-D-Bus attributes, and D-Bus attributes

1089

1093

# with the wrong interface name

1090

1094

if (not hasattr(attribute, "_dbus_interface")

1091

or not attribute._dbus_interface.startswith(

1092

orig_interface_name)):

1095

or not attribute._dbus_interface

1096

.startswith(orig_interface_name)):

1093

1097

continue

1094

1098

# Create an alternate D-Bus interface name based on

1095

1099

# the current name

1096

alt_interface = attribute._dbus_interface.replace(

1097

orig_interface_name, alt_interface_name)

1100

alt_interface = (attribute._dbus_interface

1101

.replace(orig_interface_name,

1102

alt_interface_name))

1098

1103

interface_names.add(alt_interface)

1099

1104

# Is this a D-Bus signal?

1100

1105

if getattr(attribute, "_dbus_is_signal", False):

1101

1106

# Extract the original non-method undecorated

1102

1107

# function by black magic

1103

1108

nonmethod_func = (dict(

1104

zip(attribute.func_code.co_freevars,

1105

attribute.__closure__))

1106

["func"].cell_contents)

1109

zip(attribute.func_code.co_freevars,

1110

attribute.__closure__))["func"]

1111

.cell_contents)

1107

1112

# Create a new, but exactly alike, function

1108

1113

# object, and decorate it to be a new D-Bus signal

1109

1114

# with the alternate D-Bus interface name

1110

new_function = (dbus.service.signal(

1111

alt_interface, attribute._dbus_signature)

1115

new_function = (dbus.service.signal

1116

(alt_interface,

1117

attribute._dbus_signature)

1112

1118

(types.FunctionType(

1113

nonmethod_func.func_code,

1114

nonmethod_func.func_globals,

1115

nonmethod_func.func_name,

1116

nonmethod_func.func_defaults,

1117

nonmethod_func.func_closure)))

1119

nonmethod_func.func_code,

1120

nonmethod_func.func_globals,

1121

nonmethod_func.func_name,

1122

nonmethod_func.func_defaults,

1123

nonmethod_func.func_closure)))

1118

1124

# Copy annotations, if any

1119

1125

try:

1120

new_function._dbus_annotations = dict(

1121

attribute._dbus_annotations)

1126

new_function._dbus_annotations = (

1127

dict(attribute._dbus_annotations))

1122

1128

except AttributeError:

1123

1129

pass

1124

1130

# Define a creator of a function to call both the

1129

1135

"""This function is a scope container to pass

1130

1136

func1 and func2 to the "call_both" function

1131

1137

outside of its arguments"""

1132

1133

1138

def call_both(*args, **kwargs):

1134

1139

"""This function will emit two D-Bus

1135

1140

signals by calling func1 and func2"""

1136

1141

func1(*args, **kwargs)

1137

1142

func2(*args, **kwargs)

1138

1139

1143

return call_both

1140

1144

# Create the "call_both" function and add it to

1141

1145

# the class

1146

1150

# object. Decorate it to be a new D-Bus method

1147

1151

# with the alternate D-Bus interface name. Add it

1148

1152

# to the class.

1149

attr[attrname] = (

1150

dbus.service.method(

1151

alt_interface,

1152

attribute._dbus_in_signature,

1153

attribute._dbus_out_signature)

1154

(types.FunctionType(attribute.func_code,

1155

attribute.func_globals,

1156

attribute.func_name,

1157

attribute.func_defaults,

1158

attribute.func_closure)))

1153

attr[attrname] = (dbus.service.method

1154

(alt_interface,

1155

attribute._dbus_in_signature,

1156

attribute._dbus_out_signature)

1157

(types.FunctionType

1158

(attribute.func_code,

1159

attribute.func_globals,

1160

attribute.func_name,

1161

attribute.func_defaults,

1162

attribute.func_closure)))

1159

1163

# Copy annotations, if any

1160

1164

try:

1161

attr[attrname]._dbus_annotations = dict(

1162

attribute._dbus_annotations)

1165

attr[attrname]._dbus_annotations = (

1166

dict(attribute._dbus_annotations))

1163

1167

except AttributeError:

1164

1168

pass

1165

1169

# Is this a D-Bus property?

1168

1172

# object, and decorate it to be a new D-Bus

1169

1173

# property with the alternate D-Bus interface

1170

1174

# name. Add it to the class.

1171

attr[attrname] = (dbus_service_property(

1172

alt_interface, attribute._dbus_signature,

1173

attribute._dbus_access,

1174

attribute._dbus_get_args_options

1175

["byte_arrays"])

1176

(types.FunctionType(

1177

attribute.func_code,

1178

attribute.func_globals,

1179

attribute.func_name,

1180

attribute.func_defaults,

1181

attribute.func_closure)))

1175

attr[attrname] = (dbus_service_property

1176

(alt_interface,

1177

attribute._dbus_signature,

1178

attribute._dbus_access,

1179

attribute

1180

._dbus_get_args_options

1181

["byte_arrays"])

1182

(types.FunctionType

1183

(attribute.func_code,

1184

attribute.func_globals,

1185

attribute.func_name,

1186

attribute.func_defaults,

1187

attribute.func_closure)))

1182

1188

# Copy annotations, if any

1183

1189

try:

1184

attr[attrname]._dbus_annotations = dict(

1185

attribute._dbus_annotations)

1190

attr[attrname]._dbus_annotations = (

1191

dict(attribute._dbus_annotations))

1186

1192

except AttributeError:

1187

1193

pass

1188

1194

# Is this a D-Bus interface?

1191

1197

# object. Decorate it to be a new D-Bus interface

1192

1198

# with the alternate D-Bus interface name. Add it

1193

1199

# to the class.

1194

attr[attrname] = (

1195

dbus_interface_annotations(alt_interface)

1196

(types.FunctionType(attribute.func_code,

1197

attribute.func_globals,

1198

attribute.func_name,

1199

attribute.func_defaults,

1200

attribute.func_closure)))

1200

attr[attrname] = (dbus_interface_annotations

1201

(alt_interface)

1202

(types.FunctionType

1203

(attribute.func_code,

1204

attribute.func_globals,

1205

attribute.func_name,

1206

attribute.func_defaults,

1207

attribute.func_closure)))

1201

1208

if deprecate:

1202

1209

# Deprecate all alternate interfaces

1203

iname="_AlternateDBusNames_interface_annotation{}"

1210

iname="_AlternateDBusNames_interface_annotation{0}"

1204

1211

for interface_name in interface_names:

1205

1206

1212

@dbus_interface_annotations(interface_name)

1207

1213

def func(self):

1208

1214

return { "org.freedesktop.DBus.Deprecated":

1209

"true" }

1215

"true" }

1210

1216

# Find an unused name

1211

1217

for aname in (iname.format(i)

1212

1218

for i in itertools.count()):

1216

1222

if interface_names:

1217

1223

# Replace the class with a new subclass of it with

1218

1224

# methods, signals, etc. as created above.

1219

cls = type(b"{}Alternate".format(cls.__name__),

1220

(cls, ), attr)

1225

cls = type(b"{0}Alternate".format(cls.__name__),

1226

(cls,), attr)

1221

1227

return cls

1222

1223

1228

return wrapper

1224

1229

1225

1230

1226

1231

@alternate_dbus_interfaces({"se.recompile.Mandos":

1227

"se.bsnet.fukt.Mandos"})

1232

"se.bsnet.fukt.Mandos"})

1228

1233

class ClientDBus(Client, DBusObjectWithProperties):

1229

1234

"""A Client class using D-Bus

1230

1235

1234

1239

"""

1235

1240

1236

1241

runtime_expansions = (Client.runtime_expansions

1237

+ ("dbus_object_path", ))

1238

1239

_interface = "se.recompile.Mandos.Client"

1242

+ ("dbus_object_path",))

1240

1243

1241

1244

# dbus.service.Object doesn't use super(), so we can't either.

1242

1245

1248

Client.__init__(self, *args, **kwargs)

1246

1249

# Only now, when this client is initialized, can it show up on

1247

1250

# the D-Bus

1248

client_object_name = str(self.name).translate(

1251

client_object_name = unicode(self.name).translate(

1249

1252

{ord("."): ord("_"),

1250

1253

ord("-"): ord("_")})

1251

self.dbus_object_path = dbus.ObjectPath(

1252

"/clients/" + client_object_name)

1254

self.dbus_object_path = (dbus.ObjectPath

1255

("/clients/" + client_object_name))

1253

1256

DBusObjectWithProperties.__init__(self, self.bus,

1254

1257

self.dbus_object_path)

1255

1258

1256

def notifychangeproperty(transform_func, dbus_name,

1257

type_func=lambda x: x,

1258

variant_level=1,

1259

invalidate_only=False,

1260

_interface=_interface):

1259

def notifychangeproperty(transform_func,

1260

dbus_name, type_func=lambda x: x,

1261

variant_level=1):

1261

1262

""" Modify a variable so that it's a property which announces

1262

1263

its changes to DBus.

1263

1264

1268

1269

to the D-Bus. Default: no transform

1269

1270

variant_level: D-Bus variant level. Default: 1

1270

1271

"""

1271

attrname = "_{}".format(dbus_name)

1272

attrname = "_{0}".format(dbus_name)

1273

def setter(self, value):

1274

if hasattr(self, "dbus_object_path"):

1275

if (not hasattr(self, attrname) or

1276

type_func(getattr(self, attrname, None))

1277

!= type_func(value)):

1278

if invalidate_only:

1279

self.PropertiesChanged(

1280

_interface, dbus.Dictionary(),

1281

dbus.Array((dbus_name, )))

1282

else:

1283

dbus_value = transform_func(

1284

type_func(value),

1285

variant_level = variant_level)

1286

self.PropertyChanged(dbus.String(dbus_name),

1287

dbus_value)

1288

self.PropertiesChanged(

1289

_interface,

1290

dbus.Dictionary({ dbus.String(dbus_name):

1291

dbus_value }),

1292

dbus.Array())

1278

dbus_value = transform_func(type_func(value),

1279

variant_level

1280

=variant_level)

1281

self.PropertyChanged(dbus.String(dbus_name),

1282

dbus_value)

1293

1283

setattr(self, attrname, value)

1294

1284

1295

1285

return property(lambda self: getattr(self, attrname), setter)

1301

1291

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1302

1292

last_enabled = notifychangeproperty(datetime_to_dbus,

1303

1293

"LastEnabled")

1304

checker = notifychangeproperty(

1305

dbus.Boolean, "CheckerRunning",

1306

type_func = lambda checker: checker is not None)

1294

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1295

type_func = lambda checker:

1296

checker is not None)

1307

1297

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1308

1298

"LastCheckedOK")

1309

1299

last_checker_status = notifychangeproperty(dbus.Int16,

1312

1302

datetime_to_dbus, "LastApprovalRequest")

1313

1303

approved_by_default = notifychangeproperty(dbus.Boolean,

1314

1304

"ApprovedByDefault")

1315

approval_delay = notifychangeproperty(

1316

dbus.UInt64, "ApprovalDelay",

1317

type_func = lambda td: td.total_seconds() * 1000)

1305

approval_delay = notifychangeproperty(dbus.UInt64,

1306

"ApprovalDelay",

1307

type_func =

1308

timedelta_to_milliseconds)

1318

1309

approval_duration = notifychangeproperty(

1319

1310

dbus.UInt64, "ApprovalDuration",

1320

type_func = lambda td: td.total_seconds() * 1000)

1311

type_func = timedelta_to_milliseconds)

1321

1312

host = notifychangeproperty(dbus.String, "Host")

1322

timeout = notifychangeproperty(

1323

dbus.UInt64, "Timeout",

1324

type_func = lambda td: td.total_seconds() * 1000)

1313

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1314

type_func =

1315

timedelta_to_milliseconds)

1325

1316

extended_timeout = notifychangeproperty(

1326

1317

dbus.UInt64, "ExtendedTimeout",

1327

type_func = lambda td: td.total_seconds() * 1000)

1328

interval = notifychangeproperty(

1329

dbus.UInt64, "Interval",

1330

type_func = lambda td: td.total_seconds() * 1000)

1318

type_func = timedelta_to_milliseconds)

1319

interval = notifychangeproperty(dbus.UInt64,

1320

"Interval",

1321

type_func =

1322

timedelta_to_milliseconds)

1331

1323

checker_command = notifychangeproperty(dbus.String, "Checker")

1332

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1333

invalidate_only=True)

1334

1324

1335

1325

del notifychangeproperty

1336

1326

1378

1368

1379

1369

def approve(self, value=True):

1380

1370

self.approved = value

1381

gobject.timeout_add(int(self.approval_duration.total_seconds()

1382

* 1000), self._reset_approved)

1371

gobject.timeout_add(timedelta_to_milliseconds

1372

(self.approval_duration),

1373

self._reset_approved)

1383

1374

self.send_changedstate()

1384

1375

1385

1376

## D-Bus methods, signals & properties

1377

_interface = "se.recompile.Mandos.Client"

1386

1378

1387

1379

## Interfaces

1388

1380

1381

@dbus_interface_annotations(_interface)

1382

def _foo(self):

1383

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1384

"false"}

1385

1389

1386

## Signals

1390

1387

1391

1388

# CheckerCompleted - signal

1401

1398

pass

1402

1399

1403

1400

# PropertyChanged - signal

1404

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1405

1401

@dbus.service.signal(_interface, signature="sv")

1406

1402

def PropertyChanged(self, property, value):

1407

1403

"D-Bus signal"

1471

1467

return dbus.Boolean(bool(self.approvals_pending))

1472

1468

1473

1469

# ApprovedByDefault - property

1474

@dbus_service_property(_interface,

1475

signature="b",

1470

@dbus_service_property(_interface, signature="b",

1476

1471

access="readwrite")

1477

1472

def ApprovedByDefault_dbus_property(self, value=None):

1478

1473

if value is None: # get

1480

1475

self.approved_by_default = bool(value)

1481

1476

1482

1477

# ApprovalDelay - property

1483

@dbus_service_property(_interface,

1484

signature="t",

1478

@dbus_service_property(_interface, signature="t",

1485

1479

access="readwrite")

1486

1480

def ApprovalDelay_dbus_property(self, value=None):

1487

1481

if value is None: # get

1488

return dbus.UInt64(self.approval_delay.total_seconds()

1489

* 1000)

1482

return dbus.UInt64(self.approval_delay_milliseconds())

1490

1483

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1491

1484

1492

1485

# ApprovalDuration - property

1493

@dbus_service_property(_interface,

1494

signature="t",

1486

@dbus_service_property(_interface, signature="t",

1495

1487

access="readwrite")

1496

1488

def ApprovalDuration_dbus_property(self, value=None):

1497

1489

if value is None: # get

1498

return dbus.UInt64(self.approval_duration.total_seconds()

1499

* 1000)

1490

return dbus.UInt64(timedelta_to_milliseconds(

1491

self.approval_duration))

1500

1492

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1501

1493

1502

1494

# Name - property

1510

1502

return dbus.String(self.fingerprint)

1511

1503

1512

1504

# Host - property

1513

@dbus_service_property(_interface,

1514

signature="s",

1505

@dbus_service_property(_interface, signature="s",

1515

1506

access="readwrite")

1516

1507

def Host_dbus_property(self, value=None):

1517

1508

if value is None: # get

1518

1509

return dbus.String(self.host)

1519

self.host = str(value)

1510

self.host = unicode(value)

1520

1511

1521

1512

# Created - property

1522

1513

@dbus_service_property(_interface, signature="s", access="read")

1529

1520

return datetime_to_dbus(self.last_enabled)

1530

1521

1531

1522

# Enabled - property

1532

@dbus_service_property(_interface,

1533

signature="b",

1523

@dbus_service_property(_interface, signature="b",

1534

1524

access="readwrite")

1535

1525

def Enabled_dbus_property(self, value=None):

1536

1526

if value is None: # get

1541

1531

self.disable()

1542

1532

1543

1533

# LastCheckedOK - property

1544

@dbus_service_property(_interface,

1545

signature="s",

1534

@dbus_service_property(_interface, signature="s",

1546

1535

access="readwrite")

1547

1536

def LastCheckedOK_dbus_property(self, value=None):

1548

1537

if value is not None:

1551

1540

return datetime_to_dbus(self.last_checked_ok)

1552

1541

1553

1542

# LastCheckerStatus - property

1554

@dbus_service_property(_interface, signature="n", access="read")

1543

@dbus_service_property(_interface, signature="n",

1544

access="read")

1555

1545

def LastCheckerStatus_dbus_property(self):

1556

1546

return dbus.Int16(self.last_checker_status)

1557

1547

1566

1556

return datetime_to_dbus(self.last_approval_request)

1567

1557

1568

1558

# Timeout - property

1569

@dbus_service_property(_interface,

1570

signature="t",

1559

@dbus_service_property(_interface, signature="t",

1571

1560

access="readwrite")

1572

1561

def Timeout_dbus_property(self, value=None):

1573

1562

if value is None: # get

1574

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1563

return dbus.UInt64(self.timeout_milliseconds())

1575

1564

old_timeout = self.timeout

1576

1565

self.timeout = datetime.timedelta(0, 0, 0, value)

1577

1566

# Reschedule disabling

1586

1575

is None):

1587

1576

return

1588

1577

gobject.source_remove(self.disable_initiator_tag)

1589

self.disable_initiator_tag = gobject.timeout_add(

1590

int((self.expires - now).total_seconds() * 1000),

1591

self.disable)

1578

self.disable_initiator_tag = (

1579

gobject.timeout_add(

1580

timedelta_to_milliseconds(self.expires - now),

1581

self.disable))

1592

1582

1593

1583

# ExtendedTimeout - property

1594

@dbus_service_property(_interface,

1595

signature="t",

1584

@dbus_service_property(_interface, signature="t",

1596

1585

access="readwrite")

1597

1586

def ExtendedTimeout_dbus_property(self, value=None):

1598

1587

if value is None: # get

1599

return dbus.UInt64(self.extended_timeout.total_seconds()

1600

* 1000)

1588

return dbus.UInt64(self.extended_timeout_milliseconds())

1601

1589

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1602

1590

1603

1591

# Interval - property

1604

@dbus_service_property(_interface,

1605

signature="t",

1592

@dbus_service_property(_interface, signature="t",

1606

1593

access="readwrite")

1607

1594

def Interval_dbus_property(self, value=None):

1608

1595

if value is None: # get

1609

return dbus.UInt64(self.interval.total_seconds() * 1000)

1596

return dbus.UInt64(self.interval_milliseconds())

1610

1597

self.interval = datetime.timedelta(0, 0, 0, value)

1611

1598

if getattr(self, "checker_initiator_tag", None) is None:

1612

1599

return

1613

1600

if self.enabled:

1614

1601

# Reschedule checker run

1615

1602

gobject.source_remove(self.checker_initiator_tag)

1616

self.checker_initiator_tag = gobject.timeout_add(

1617

value, self.start_checker)

1618

self.start_checker() # Start one now, too

1603

self.checker_initiator_tag = (gobject.timeout_add

1604

(value, self.start_checker))

1605

self.start_checker() # Start one now, too

1619

1606

1620

1607

# Checker - property

1621

@dbus_service_property(_interface,

1622

signature="s",

1608

@dbus_service_property(_interface, signature="s",

1623

1609

access="readwrite")

1624

1610

def Checker_dbus_property(self, value=None):

1625

1611

if value is None: # get

1626

1612

return dbus.String(self.checker_command)

1627

self.checker_command = str(value)

1613

self.checker_command = unicode(value)

1628

1614

1629

1615

# CheckerRunning - property

1630

@dbus_service_property(_interface,

1631

signature="b",

1616

@dbus_service_property(_interface, signature="b",

1632

1617

access="readwrite")

1633

1618

def CheckerRunning_dbus_property(self, value=None):

1634

1619

if value is None: # get

1644

1629

return self.dbus_object_path # is already a dbus.ObjectPath

1645

1630

1646

1631

# Secret = property

1647

@dbus_service_property(_interface,

1648

signature="ay",

1649

access="write",

1650

byte_arrays=True)

1632

@dbus_service_property(_interface, signature="ay",

1633

access="write", byte_arrays=True)

1651

1634

def Secret_dbus_property(self, value):

1652

self.secret = bytes(value)

1635

self.secret = str(value)

1653

1636

1654

1637

del _interface

1655

1638

1669

1652

if data[0] == 'data':

1670

1653

return data[1]

1671

1654

if data[0] == 'function':

1672

1673

1655

def func(*args, **kwargs):

1674

1656

self._pipe.send(('funcall', name, args, kwargs))

1675

1657

return self._pipe.recv()[1]

1676

1677

1658

return func

1678

1659

1679

1660

def __setattr__(self, name, value):

1691

1672

def handle(self):

1692

1673

with contextlib.closing(self.server.child_pipe) as child_pipe:

1693

1674

logger.info("TCP connection from: %s",

1694

str(self.client_address))

1675

unicode(self.client_address))

1695

1676

logger.debug("Pipe FD: %d",

1696

1677

self.server.child_pipe.fileno())

1697

1678

1698

session = gnutls.connection.ClientSession(

1699

self.request, gnutls.connection .X509Credentials())

1679

session = (gnutls.connection

1680

.ClientSession(self.request,

1681

gnutls.connection

1682

.X509Credentials()))

1700

1683

1701

1684

# Note: gnutls.connection.X509Credentials is really a

1702

1685

# generic GnuTLS certificate credentials object so long as

1711

1694

priority = self.server.gnutls_priority

1712

1695

if priority is None:

1713

1696

priority = "NORMAL"

1714

gnutls.library.functions.gnutls_priority_set_direct(

1715

session._c_object, priority, None)

1697

(gnutls.library.functions

1698

.gnutls_priority_set_direct(session._c_object,

1699

priority, None))

1716

1700

1717

1701

# Start communication using the Mandos protocol

1718

1702

# Get protocol number

1738

1722

approval_required = False

1739

1723

try:

1740

1724

try:

1741

fpr = self.fingerprint(

1742

self.peer_certificate(session))

1725

fpr = self.fingerprint(self.peer_certificate

1726

(session))

1743

1727

except (TypeError,

1744

1728

gnutls.errors.GNUTLSError) as error:

1745

1729

logger.warning("Bad certificate: %s", error)

1760

1744

while True:

1761

1745

if not client.enabled:

1762

1746

logger.info("Client %s is disabled",

1763

client.name)

1747

client.name)

1764

1748

if self.server.use_dbus:

1765

1749

# Emit D-Bus signal

1766

1750

client.Rejected("Disabled")

1775

1759

if self.server.use_dbus:

1776

1760

# Emit D-Bus signal

1777

1761

client.NeedApproval(

1778

client.approval_delay.total_seconds()

1779

* 1000, client.approved_by_default)

1762

client.approval_delay_milliseconds(),

1763

client.approved_by_default)

1780

1764

else:

1781

1765

logger.warning("Client %s was not approved",

1782

1766

client.name)

1788

1772

#wait until timeout or approved

1789

1773

time = datetime.datetime.now()

1790

1774

client.changedstate.acquire()

1791

client.changedstate.wait(delay.total_seconds())

1775

client.changedstate.wait(

1776

float(timedelta_to_milliseconds(delay)

1777

/ 1000))

1792

1778

client.changedstate.release()

1793

1779

time2 = datetime.datetime.now()

1794

1780

if (time2 - time) >= delay:

1813

1799

logger.warning("gnutls send failed",

1814

1800

exc_info=error)

1815

1801

return

1816

logger.debug("Sent: %d, remaining: %d", sent,

1817

len(client.secret) - (sent_size

1818

+ sent))

1802

logger.debug("Sent: %d, remaining: %d",

1803

sent, len(client.secret)

1804

- (sent_size + sent))

1819

1805

sent_size += sent

1820

1806

1821

1807

logger.info("Sending secret to %s", client.name)

1838

1824

def peer_certificate(session):

1839

1825

"Return the peer's OpenPGP certificate as a bytestring"

1840

1826

# If not an OpenPGP certificate...

1841

if (gnutls.library.functions.gnutls_certificate_type_get(

1842

session._c_object)

1827

if (gnutls.library.functions

1828

.gnutls_certificate_type_get(session._c_object)

1843

1829

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1844

1830

# ...do the normal thing

1845

1831

return session.peer_certificate

1859

1845

def fingerprint(openpgp):

1860

1846

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1861

1847

# New GnuTLS "datum" with the OpenPGP public key

1862

datum = gnutls.library.types.gnutls_datum_t(

1863

ctypes.cast(ctypes.c_char_p(openpgp),

1864

ctypes.POINTER(ctypes.c_ubyte)),

1865

ctypes.c_uint(len(openpgp)))

1848

datum = (gnutls.library.types

1849

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1850

ctypes.POINTER

1851

(ctypes.c_ubyte)),

1852

ctypes.c_uint(len(openpgp))))

1866

1853

# New empty GnuTLS certificate

1867

1854

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1868

gnutls.library.functions.gnutls_openpgp_crt_init(

1869

ctypes.byref(crt))

1855

(gnutls.library.functions

1856

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1870

1857

# Import the OpenPGP public key into the certificate

1871

gnutls.library.functions.gnutls_openpgp_crt_import(

1872

crt, ctypes.byref(datum),

1873

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1858

(gnutls.library.functions

1859

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1860

gnutls.library.constants

1861

.GNUTLS_OPENPGP_FMT_RAW))

1874

1862

# Verify the self signature in the key

1875

1863

crtverify = ctypes.c_uint()

1876

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1877

crt, 0, ctypes.byref(crtverify))

1864

(gnutls.library.functions

1865

.gnutls_openpgp_crt_verify_self(crt, 0,

1866

ctypes.byref(crtverify)))

1878

1867

if crtverify.value != 0:

1879

1868

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1880

raise gnutls.errors.CertificateSecurityError(

1881

"Verify failed")

1869

raise (gnutls.errors.CertificateSecurityError

1870

("Verify failed"))

1882

1871

# New buffer for the fingerprint

1883

1872

buf = ctypes.create_string_buffer(20)

1884

1873

buf_len = ctypes.c_size_t()

1885

1874

# Get the fingerprint from the certificate into the buffer

1886

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1887

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1875

(gnutls.library.functions

1876

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1877

ctypes.byref(buf_len)))

1888

1878

# Deinit the certificate

1889

1879

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1890

1880

# Convert the buffer to a Python bytestring

1896

1886

1897

1887

class MultiprocessingMixIn(object):

1898

1888

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1899

1900

1889

def sub_process_main(self, request, address):

1901

1890

try:

1902

1891

self.finish_request(request, address)

1914

1903

1915

1904

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1916

1905

""" adds a pipe to the MixIn """

1917

1918

1906

def process_request(self, request, client_address):

1919

1907

"""Overrides and wraps the original process_request().

1920

1908

1941

1929

interface: None or a network interface name (string)

1942

1930

use_ipv6: Boolean; to use IPv6 or not

1943

1931

"""

1944

1945

1932

def __init__(self, server_address, RequestHandlerClass,

1946

interface=None,

1947

use_ipv6=True,

1948

socketfd=None):

1933

interface=None, use_ipv6=True, socketfd=None):

1949

1934

"""If socketfd is set, use that file descriptor instead of

1950

1935

creating a new one with socket.socket().

1951

1936

"""

1992

1977

self.interface)

1993

1978

else:

1994

1979

try:

1995

self.socket.setsockopt(

1996

socket.SOL_SOCKET, SO_BINDTODEVICE,

1997

(self.interface + "\0").encode("utf-8"))

1980

self.socket.setsockopt(socket.SOL_SOCKET,

1981

SO_BINDTODEVICE,

1982

str(self.interface + '\0'))

1998

1983

except socket.error as error:

1999

1984

if error.errno == errno.EPERM:

2000

1985

logger.error("No permission to bind to"

2018

2003

self.server_address = (any_address,

2019

2004

self.server_address[1])

2020

2005

elif not self.server_address[1]:

2021

self.server_address = (self.server_address[0], 0)

2006

self.server_address = (self.server_address[0],

2007

0)

2022

2008

# if self.interface:

2023

2009

# self.server_address = (self.server_address[0],

2024

2010

# 0, # port

2038

2024

2039

2025

Assumes a gobject.MainLoop event loop.

2040

2026

"""

2041

2042

2027

def __init__(self, server_address, RequestHandlerClass,

2043

interface=None,

2044

use_ipv6=True,

2045

clients=None,

2046

gnutls_priority=None,

2047

use_dbus=True,

2048

socketfd=None):

2028

interface=None, use_ipv6=True, clients=None,

2029

gnutls_priority=None, use_dbus=True, socketfd=None):

2049

2030

self.enabled = False

2050

2031

self.clients = clients

2051

2032

if self.clients is None:

2057

2038

interface = interface,

2058

2039

use_ipv6 = use_ipv6,

2059

2040

socketfd = socketfd)

2060

2061

2041

def server_activate(self):

2062

2042

if self.enabled:

2063

2043

return socketserver.TCPServer.server_activate(self)

2067

2047

2068

2048

def add_pipe(self, parent_pipe, proc):

2069

2049

# Call "handle_ipc" for both data and EOF events

2070

gobject.io_add_watch(

2071

parent_pipe.fileno(),

2072

gobject.IO_IN | gobject.IO_HUP,

2073

functools.partial(self.handle_ipc,

2074

parent_pipe = parent_pipe,

2075

proc = proc))

2050

gobject.io_add_watch(parent_pipe.fileno(),

2051

gobject.IO_IN | gobject.IO_HUP,

2052

functools.partial(self.handle_ipc,

2053

parent_pipe =

2054

parent_pipe,

2055

proc = proc))

2076

2056

2077

def handle_ipc(self, source, condition,

2078

parent_pipe=None,

2079

proc = None,

2080

client_object=None):

2057

def handle_ipc(self, source, condition, parent_pipe=None,

2058

proc = None, client_object=None):

2081

2059

# error, or the other end of multiprocessing.Pipe has closed

2082

2060

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2083

2061

# Wait for other process to exit

2106

2084

parent_pipe.send(False)

2107

2085

return False

2108

2086

2109

gobject.io_add_watch(

2110

parent_pipe.fileno(),

2111

gobject.IO_IN | gobject.IO_HUP,

2112

functools.partial(self.handle_ipc,

2113

parent_pipe = parent_pipe,

2114

proc = proc,

2115

client_object = client))

2087

gobject.io_add_watch(parent_pipe.fileno(),

2088

gobject.IO_IN | gobject.IO_HUP,

2089

functools.partial(self.handle_ipc,

2090

parent_pipe =

2091

parent_pipe,

2092

proc = proc,

2093

client_object =

2094

client))

2116

2095

parent_pipe.send(True)

2117

2096

# remove the old hook in favor of the new above hook on

2118

2097

# same fileno

2124

2103

2125

2104

parent_pipe.send(('data', getattr(client_object,

2126

2105

funcname)(*args,

2127

**kwargs)))

2106

**kwargs)))

2128

2107

2129

2108

if command == 'getattr':

2130

2109

attrname = request[1]

2131

2110

if callable(client_object.__getattribute__(attrname)):

2132

parent_pipe.send(('function', ))

2111

parent_pipe.send(('function',))

2133

2112

else:

2134

parent_pipe.send((

2135

'data', client_object.__getattribute__(attrname)))

2113

parent_pipe.send(('data', client_object

2114

.__getattribute__(attrname)))

2136

2115

2137

2116

if command == 'setattr':

2138

2117

attrname = request[1]

2178

2157

# None

2179

2158

"followers")) # Tokens valid after

2180

2159

# this token

2181

Token = collections.namedtuple("Token", (

2182

"regexp", # To match token; if "value" is not None, must have

2183

# a "group" containing digits

2184

"value", # datetime.timedelta or None

2185

"followers")) # Tokens valid after this token

2186

2160

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2187

2161

# the "duration" ABNF definition in RFC 3339, Appendix A.

2188

2162

token_end = Token(re.compile(r"$"), None, frozenset())

2189

2163

token_second = Token(re.compile(r"(\d+)S"),

2190

2164

datetime.timedelta(seconds=1),

2191

frozenset((token_end, )))

2165

frozenset((token_end,)))

2192

2166

token_minute = Token(re.compile(r"(\d+)M"),

2193

2167

datetime.timedelta(minutes=1),

2194

2168

frozenset((token_second, token_end)))

2210

2184

frozenset((token_month, token_end)))

2211

2185

token_week = Token(re.compile(r"(\d+)W"),

2212

2186

datetime.timedelta(weeks=1),

2213

frozenset((token_end, )))

2187

frozenset((token_end,)))

2214

2188

token_duration = Token(re.compile(r"P"), None,

2215

2189

frozenset((token_year, token_month,

2216

2190

token_day, token_time,

2217

token_week)))

2191

token_week))),

2218

2192

# Define starting values

2219

2193

value = datetime.timedelta() # Value so far

2220

2194

found_token = None

2221

followers = frozenset((token_duration,)) # Following valid tokens

2195

followers = frozenset(token_duration,) # Following valid tokens

2222

2196

s = duration # String left to parse

2223

2197

# Loop until end token is found

2224

2198

while found_token is not token_end:

2271

2245

timevalue = datetime.timedelta(0)

2272

2246

for s in interval.split():

2273

2247

try:

2274

suffix = s[-1]

2248

suffix = unicode(s[-1])

2275

2249

value = int(s[:-1])

2276

2250

if suffix == "d":

2277

2251

delta = datetime.timedelta(value)

2284

2258

elif suffix == "w":

2285

2259

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2286

2260

else:

2287

raise ValueError("Unknown suffix {!r}".format(suffix))

2261

raise ValueError("Unknown suffix {0!r}"

2262

.format(suffix))

2288

2263

except IndexError as e:

2289

2264

raise ValueError(*(e.args))

2290

2265

timevalue += delta

2307

2282

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2308

2283

if not stat.S_ISCHR(os.fstat(null).st_mode):

2309

2284

raise OSError(errno.ENODEV,

2310

"{} not a character device"

2285

"{0} not a character device"

2311

2286

.format(os.devnull))

2312

2287

os.dup2(null, sys.stdin.fileno())

2313

2288

os.dup2(null, sys.stdout.fileno())

2323

2298

2324

2299

parser = argparse.ArgumentParser()

2325

2300

parser.add_argument("-v", "--version", action="version",

2326

version = "%(prog)s {}".format(version),

2301

version = "%(prog)s {0}".format(version),

2327

2302

help="show version number and exit")

2328

2303

parser.add_argument("-i", "--interface", metavar="IF",

2329

2304

help="Bind to interface IF")

2379

2354

"port": "",

2380

2355

"debug": "False",

2381

2356

"priority":

2382

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2383

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2357

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2384

2358

"servicename": "Mandos",

2385

2359

"use_dbus": "True",

2386

2360

"use_ipv6": "True",

2390

2364

"statedir": "/var/lib/mandos",

2391

2365

"foreground": "False",

2392

2366

"zeroconf": "True",

2393

}

2367

}

2394

2368

2395

2369

# Parse config file for server-global settings

2396

2370

server_config = configparser.SafeConfigParser(server_defaults)

2397

2371

del server_defaults

2398

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2372

server_config.read(os.path.join(options.configdir,

2373

"mandos.conf"))

2399

2374

# Convert the SafeConfigParser object to a dict

2400

2375

server_settings = server_config.defaults()

2401

2376

# Use the appropriate methods on the non-string config options

2419

2394

# Override the settings from the config file with command line

2420

2395

# options, if set.

2421

2396

for option in ("interface", "address", "port", "debug",

2422

"priority", "servicename", "configdir", "use_dbus",

2423

"use_ipv6", "debuglevel", "restore", "statedir",

2424

"socket", "foreground", "zeroconf"):

2397

"priority", "servicename", "configdir",

2398

"use_dbus", "use_ipv6", "debuglevel", "restore",

2399

"statedir", "socket", "foreground", "zeroconf"):

2425

2400

value = getattr(options, option)

2426

2401

if value is not None:

2427

2402

server_settings[option] = value

2428

2403

del options

2429

2404

# Force all strings to be unicode

2430

2405

for option in server_settings.keys():

2431

if isinstance(server_settings[option], bytes):

2432

server_settings[option] = (server_settings[option]

2433

.decode("utf-8"))

2406

if type(server_settings[option]) is str:

2407

server_settings[option] = unicode(server_settings[option])

2434

2408

# Force all boolean options to be boolean

2435

2409

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2436

2410

"foreground", "zeroconf"):

2442

2416

2443

2417

##################################################################

2444

2418

2445

if (not server_settings["zeroconf"]

2446

and not (server_settings["port"]

2447

or server_settings["socket"] != "")):

2448

parser.error("Needs port or socket to work without Zeroconf")

2419

if (not server_settings["zeroconf"] and

2420

not (server_settings["port"]

2421

or server_settings["socket"] != "")):

2422

parser.error("Needs port or socket to work without"

2423

" Zeroconf")

2449

2424

2450

2425

# For convenience

2451

2426

debug = server_settings["debug"]

2467

2442

initlogger(debug, level)

2468

2443

2469

2444

if server_settings["servicename"] != "Mandos":

2470

syslogger.setFormatter(

2471

logging.Formatter('Mandos ({}) [%(process)d]:'

2472

' %(levelname)s: %(message)s'.format(

2473

server_settings["servicename"])))

2445

syslogger.setFormatter(logging.Formatter

2446

('Mandos ({0}) [%(process)d]:'

2447

' %(levelname)s: %(message)s'

2448

.format(server_settings

2449

["servicename"])))

2474

2450

2475

2451

# Parse config file with clients

2476

2452

client_config = configparser.SafeConfigParser(Client

2484

2460

socketfd = None

2485

2461

if server_settings["socket"] != "":

2486

2462

socketfd = server_settings["socket"]

2487

tcp_server = MandosServer(

2488

(server_settings["address"], server_settings["port"]),

2489

ClientHandler,

2490

interface=(server_settings["interface"] or None),

2491

use_ipv6=use_ipv6,

2492

gnutls_priority=server_settings["priority"],

2493

use_dbus=use_dbus,

2494

socketfd=socketfd)

2463

tcp_server = MandosServer((server_settings["address"],

2464

server_settings["port"]),

2465

ClientHandler,

2466

interface=(server_settings["interface"]

2467

or None),

2468

use_ipv6=use_ipv6,

2469

gnutls_priority=

2470

server_settings["priority"],

2471

use_dbus=use_dbus,

2472

socketfd=socketfd)

2495

2473

if not foreground:

2496

2474

pidfilename = "/run/mandos.pid"

2497

2475

if not os.path.isdir("/run/."):

2531

2509

def debug_gnutls(level, string):

2532

2510

logger.debug("GnuTLS: %s", string[:-1])

2533

2511

2534

gnutls.library.functions.gnutls_global_set_log_function(

2535

debug_gnutls)

2512

(gnutls.library.functions

2513

.gnutls_global_set_log_function(debug_gnutls))

2536

2514

2537

2515

# Redirect stdin so all checkers get /dev/null

2538

2516

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2558

2536

if use_dbus:

2559

2537

try:

2560

2538

bus_name = dbus.service.BusName("se.recompile.Mandos",

2561

bus,

2562

do_not_queue=True)

2563

old_bus_name = dbus.service.BusName(

2564

"se.bsnet.fukt.Mandos", bus,

2565

do_not_queue=True)

2539

bus, do_not_queue=True)

2540

old_bus_name = (dbus.service.BusName

2541

("se.bsnet.fukt.Mandos", bus,

2542

do_not_queue=True))

2566

2543

except dbus.exceptions.NameExistsException as e:

2567

2544

logger.error("Disabling D-Bus:", exc_info=e)

2568

2545

use_dbus = False

2570

2547

tcp_server.use_dbus = False

2571

2548

if zeroconf:

2572

2549

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2573

service = AvahiServiceToSyslog(

2574

name = server_settings["servicename"],

2575

servicetype = "_mandos._tcp",

2576

protocol = protocol,

2577

bus = bus)

2550

service = AvahiServiceToSyslog(name =

2551

server_settings["servicename"],

2552

servicetype = "_mandos._tcp",

2553

protocol = protocol, bus = bus)

2578

2554

if server_settings["interface"]:

2579

service.interface = if_nametoindex(

2580

server_settings["interface"].encode("utf-8"))

2555

service.interface = (if_nametoindex

2556

(str(server_settings["interface"])))

2581

2557

2582

2558

global multiprocessing_manager

2583

2559

multiprocessing_manager = multiprocessing.Manager()

2602

2578

if server_settings["restore"]:

2603

2579

try:

2604

2580

with open(stored_state_path, "rb") as stored_state:

2605

clients_data, old_client_settings = pickle.load(

2606

stored_state)

2581

clients_data, old_client_settings = (pickle.load

2582

(stored_state))

2607

2583

os.remove(stored_state_path)

2608

2584

except IOError as e:

2609

2585

if e.errno == errno.ENOENT:

2610

logger.warning("Could not load persistent state:"

2611

" {}".format(os.strerror(e.errno)))

2586

logger.warning("Could not load persistent state: {0}"

2587

.format(os.strerror(e.errno)))

2612

2588

else:

2613

2589

logger.critical("Could not load persistent state:",

2614

2590

exc_info=e)

2615

2591

raise

2616

2592

except EOFError as e:

2617

2593

logger.warning("Could not load persistent state: "

2618

"EOFError:",

2619

exc_info=e)

2594

"EOFError:", exc_info=e)

2620

2595

2621

2596

with PGPEngine() as pgp:

2622

for client_name, client in clients_data.items():

2597

for client_name, client in clients_data.iteritems():

2623

2598

# Skip removed clients

2624

2599

if client_name not in client_settings:

2625

2600

continue

2634

2609

# For each value in new config, check if it

2635

2610

# differs from the old config value (Except for

2636

2611

# the "secret" attribute)

2637

if (name != "secret"

2638

and (value !=

2639

old_client_settings[client_name][name])):

2612

if (name != "secret" and

2613

value != old_client_settings[client_name]

2614

[name]):

2640

2615

client[name] = value

2641

2616

except KeyError:

2642

2617

pass

2650

2625

if datetime.datetime.utcnow() >= client["expires"]:

2651

2626

if not client["last_checked_ok"]:

2652

2627

logger.warning(

2653

"disabling client {} - Client never "

2654

"performed a successful checker".format(

2655

client_name))

2628

"disabling client {0} - Client never "

2629

"performed a successful checker"

2630

.format(client_name))

2656

2631

client["enabled"] = False

2657

2632

elif client["last_checker_status"] != 0:

2658

2633

logger.warning(

2659

"disabling client {} - Client last"

2660

" checker failed with error code"

2661

" {}".format(

2662

client_name,

2663

client["last_checker_status"]))

2634

"disabling client {0} - Client "

2635

"last checker failed with error code {1}"

2636

.format(client_name,

2637

client["last_checker_status"]))

2664

2638

client["enabled"] = False

2665

2639

else:

2666

client["expires"] = (

2667

datetime.datetime.utcnow()

2668

+ client["timeout"])

2640

client["expires"] = (datetime.datetime

2641

.utcnow()

2642

+ client["timeout"])

2669

2643

logger.debug("Last checker succeeded,"

2670

" keeping {} enabled".format(

2671

client_name))

2644

" keeping {0} enabled"

2645

.format(client_name))

2672

2646

try:

2673

client["secret"] = pgp.decrypt(

2674

client["encrypted_secret"],

2675

client_settings[client_name]["secret"])

2647

client["secret"] = (

2648

pgp.decrypt(client["encrypted_secret"],

2649

client_settings[client_name]

2650

["secret"]))

2676

2651

except PGPError:

2677

2652

# If decryption fails, we use secret from new settings

2678

logger.debug("Failed to decrypt {} old secret".format(

2679

client_name))

2680

client["secret"] = (client_settings[client_name]

2681

["secret"])

2653

logger.debug("Failed to decrypt {0} old secret"

2654

.format(client_name))

2655

client["secret"] = (

2656

client_settings[client_name]["secret"])

2682

2657

2683

2658

# Add/remove clients based on new changes made to config

2684

2659

for client_name in (set(old_client_settings)

2689

2664

clients_data[client_name] = client_settings[client_name]

2690

2665

2691

2666

# Create all client objects

2692

for client_name, client in clients_data.items():

2667

for client_name, client in clients_data.iteritems():

2693

2668

tcp_server.clients[client_name] = client_class(

2694

name = client_name,

2695

settings = client,

2669

name = client_name, settings = client,

2696

2670

server_settings = server_settings)

2697

2671

2698

2672

if not tcp_server.clients:

2703

2677

try:

2704

2678

with pidfile:

2705

2679

pid = os.getpid()

2706

pidfile.write("{}\n".format(pid).encode("utf-8"))

2680

pidfile.write(str(pid) + "\n".encode("utf-8"))

2707

2681

except IOError:

2708

2682

logger.error("Could not write to file %r with PID %d",

2709

2683

pidfilename, pid)

2714

2688

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2715

2689

2716

2690

if use_dbus:

2717

2718

@alternate_dbus_interfaces(

2719

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2691

@alternate_dbus_interfaces({"se.recompile.Mandos":

2692

"se.bsnet.fukt.Mandos"})

2720

2693

class MandosDBusService(DBusObjectWithProperties):

2721

2694

"""A D-Bus proxy object"""

2722

2723

2695

def __init__(self):

2724

2696

dbus.service.Object.__init__(self, bus, "/")

2725

2726

2697

_interface = "se.recompile.Mandos"

2727

2698

2728

2699

@dbus_interface_annotations(_interface)

2729

2700

def _foo(self):

2730

return {

2731

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2732

"false" }

2701

return { "org.freedesktop.DBus.Property"

2702

".EmitsChangedSignal":

2703

"false"}

2733

2704

2734

2705

@dbus.service.signal(_interface, signature="o")

2735

2706

def ClientAdded(self, objpath):

2749

2720

@dbus.service.method(_interface, out_signature="ao")

2750

2721

def GetAllClients(self):

2751

2722

"D-Bus method"

2752

return dbus.Array(c.dbus_object_path for c in

2723

return dbus.Array(c.dbus_object_path

2724

for c in

2753

2725

tcp_server.clients.itervalues())

2754

2726

2755

2727

@dbus.service.method(_interface,

2757

2729

def GetAllClientsWithProperties(self):

2758

2730

"D-Bus method"

2759

2731

return dbus.Dictionary(

2760

{ c.dbus_object_path: c.GetAll("")

2761

for c in tcp_server.clients.itervalues() },

2732

((c.dbus_object_path, c.GetAll(""))

2733

for c in tcp_server.clients.itervalues()),

2762

2734

signature="oa{sv}")

2763

2735

2764

2736

@dbus.service.method(_interface, in_signature="o")

2802

2774

2803

2775

# A list of attributes that can not be pickled

2804

2776

# + secret.

2805

exclude = { "bus", "changedstate", "secret",

2806

"checker", "server_settings" }

2807

for name, typ in inspect.getmembers(dbus.service

2808

.Object):

2777

exclude = set(("bus", "changedstate", "secret",

2778

"checker", "server_settings"))

2779

for name, typ in (inspect.getmembers

2780

(dbus.service.Object)):

2809

2781

exclude.add(name)

2810

2782

2811

2783

client_dict["encrypted_secret"] = (client

2818

2790

del client_settings[client.name]["secret"]

2819

2791

2820

2792

try:

2821

with tempfile.NamedTemporaryFile(

2822

mode='wb',

2823

suffix=".pickle",

2824

prefix='clients-',

2825

dir=os.path.dirname(stored_state_path),

2826

delete=False) as stored_state:

2793

with (tempfile.NamedTemporaryFile

2794

(mode='wb', suffix=".pickle", prefix='clients-',

2795

dir=os.path.dirname(stored_state_path),

2796

delete=False)) as stored_state:

2827

2797

pickle.dump((clients, client_settings), stored_state)

2828

tempname = stored_state.name

2798

tempname=stored_state.name

2829

2799

os.rename(tempname, stored_state_path)

2830

2800

except (IOError, OSError) as e:

2831

2801

if not debug:

2834

2804

except NameError:

2835

2805

pass

2836

2806

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2837

logger.warning("Could not save persistent state: {}"

2807

logger.warning("Could not save persistent state: {0}"

2838

2808

.format(os.strerror(e.errno)))

2839

2809

else:

2840

2810

logger.warning("Could not save persistent state:",

2850

2820

client.disable(quiet=True)

2851

2821

if use_dbus:

2852

2822

# Emit D-Bus signal

2853

mandos_dbus_service.ClientRemoved(

2854

client.dbus_object_path, client.name)

2823

mandos_dbus_service.ClientRemoved(client

2824

.dbus_object_path,

2825

client.name)

2855

2826

client_settings.clear()

2856

2827

2857

2828

atexit.register(cleanup)

2910

2881

# Must run before the D-Bus bus name gets deregistered

2911

2882

cleanup()

2912

2883

2913

2914

2884

if __name__ == '__main__':

2915

2885

main()