/mandos/release : revision 237.7.278

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

39

import SocketServer as socketserver

43

40

import socket

44

41

import argparse

45

42

import datetime

50

47

import gnutls.library.functions

51

48

import gnutls.library.constants

52

49

import gnutls.library.types

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

50

import ConfigParser as configparser

57

51

import sys

58

52

import re

59

53

import os

68

62

import struct

69

63

import fcntl

70

64

import functools

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

65

import cPickle as pickle

75

66

import multiprocessing

76

67

import types

77

68

import binascii

78

69

import tempfile

79

70

import itertools

80

71

import collections

81

import codecs

82

72

83

73

import dbus

84

74

import dbus.service

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

75

import gobject

89

76

import avahi

90

77

from dbus.mainloop.glib import DBusGMainLoop

91

78

import ctypes

104

91

if sys.version_info.major == 2:

105

92

str = unicode

106

93

107

version = "1.7.0"

94

version = "1.6.8"

108

95

stored_state_file = "clients.pickle"

109

96

110

97

logger = logging.getLogger()

111

98

syslogger = None

112

99

113

100

try:

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

101

if_nametoindex = (ctypes.cdll.LoadLibrary

102

(ctypes.util.find_library("c"))

103

.if_nametoindex)

116

104

except (OSError, AttributeError):

117

118

105

def if_nametoindex(interface):

119

106

"Get an interface index the hard way, i.e. using fcntl()"

120

107

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

129

116

"""init logger and add loglevel"""

130

117

131

118

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

119

syslogger = (logging.handlers.SysLogHandler

120

(facility =

121

logging.handlers.SysLogHandler.LOG_DAEMON,

122

address = "/dev/log"))

135

123

syslogger.setFormatter(logging.Formatter

136

124

('Mandos [%(process)d]: %(levelname)s:'

137

125

' %(message)s'))

154

142

155

143

class PGPEngine(object):

156

144

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

158

145

def __init__(self):

159

146

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

160

147

self.gnupgargs = ['--batch',

199

186

200

187

def encrypt(self, data, password):

201

188

passphrase = self.password_encode(password)

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

189

with tempfile.NamedTemporaryFile(dir=self.tempdir

190

) as passfile:

204

191

passfile.write(passphrase)

205

192

passfile.flush()

206

193

proc = subprocess.Popen(['gpg', '--symmetric',

217

204

218

205

def decrypt(self, data, password):

219

206

passphrase = self.password_encode(password)

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

207

with tempfile.NamedTemporaryFile(dir = self.tempdir

208

) as passfile:

222

209

passfile.write(passphrase)

223

210

passfile.flush()

224

211

proc = subprocess.Popen(['gpg', '--decrypt',

228

215

stdin = subprocess.PIPE,

229

216

stdout = subprocess.PIPE,

230

217

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

218

decrypted_plaintext, err = proc.communicate(input

219

= data)

232

220

if proc.returncode != 0:

233

221

raise PGPError(err)

234

222

return decrypted_plaintext

240

228

return super(AvahiError, self).__init__(value, *args,

241

229

**kwargs)

242

230

243

244

231

class AvahiServiceError(AvahiError):

245

232

pass

246

233

247

248

234

class AvahiGroupError(AvahiError):

249

235

pass

250

236

270

256

bus: dbus.SystemBus()

271

257

"""

272

258

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

259

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

260

servicetype = None, port = None, TXT = None,

261

domain = "", host = "", max_renames = 32768,

262

protocol = avahi.PROTO_UNSPEC, bus = None):

284

263

self.interface = interface

285

264

self.name = name

286

265

self.type = servicetype

296

275

self.bus = bus

297

276

self.entry_group_state_changed_match = None

298

277

299

def rename(self, remove=True):

278

def rename(self):

300

279

"""Derived from the Avahi example code"""

301

280

if self.rename_count >= self.max_renames:

302

281

logger.critical("No suitable Zeroconf service name found"

303

282

" after %i retries, exiting.",

304

283

self.rename_count)

305

284

raise AvahiServiceError("Too many renames")

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

285

self.name = str(self.server

286

.GetAlternativeServiceName(self.name))

309

287

logger.info("Changing Zeroconf service name to %r ...",

310

288

self.name)

311

if remove:

312

self.remove()

289

self.remove()

313

290

try:

314

291

self.add()

315

292

except dbus.exceptions.DBusException as error:

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

293

logger.critical("D-Bus Exception", exc_info=error)

294

self.cleanup()

295

os._exit(1)

296

self.rename_count += 1

324

297

325

298

def remove(self):

326

299

"""Derived from the Avahi example code"""

365

338

elif state == avahi.ENTRY_GROUP_FAILURE:

366

339

logger.critical("Avahi: Error in group state changed %s",

367

340

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

341

raise AvahiGroupError("State changed: {!s}"

342

.format(error))

369

343

370

344

def cleanup(self):

371

345

"""Derived from the Avahi example code"""

381

355

def server_state_changed(self, state, error=None):

382

356

"""Derived from the Avahi example code"""

383

357

logger.debug("Avahi server state change: %i", state)

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

358

bad_states = { avahi.SERVER_INVALID:

359

"Zeroconf server invalid",

360

avahi.SERVER_REGISTERING: None,

361

avahi.SERVER_COLLISION:

362

"Zeroconf server name collision",

363

avahi.SERVER_FAILURE:

364

"Zeroconf server failure" }

390

365

if state in bad_states:

391

366

if bad_states[state] is not None:

392

367

if error is None:

395

370

logger.error(bad_states[state] + ": %r", error)

396

371

self.cleanup()

397

372

elif state == avahi.SERVER_RUNNING:

398

try:

399

self.add()

400

except dbus.exceptions.DBusException as error:

401

if (error.get_dbus_name()

402

== "org.freedesktop.Avahi.CollisionError"):

403

logger.info("Local Zeroconf service name"

404

" collision.")

405

return self.rename(remove=False)

406

else:

407

logger.critical("D-Bus Exception", exc_info=error)

408

self.cleanup()

409

os._exit(1)

373

self.add()

410

374

else:

411

375

if error is None:

412

376

logger.debug("Unknown state: %r", state)

422

386

follow_name_owner_changes=True),

423

387

avahi.DBUS_INTERFACE_SERVER)

424

388

self.server.connect_to_signal("StateChanged",

425

self.server_state_changed)

389

self.server_state_changed)

426

390

self.server_state_changed(self.server.GetState())

427

391

428

392

429

393

class AvahiServiceToSyslog(AvahiService):

430

def rename(self, *args, **kwargs):

394

def rename(self):

431

395

"""Add the new name to the syslog messages"""

432

ret = AvahiService.rename(self, *args, **kwargs)

433

syslogger.setFormatter(logging.Formatter(

434

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

435

.format(self.name)))

396

ret = AvahiService.rename(self)

397

syslogger.setFormatter(logging.Formatter

398

('Mandos ({}) [%(process)d]:'

399

' %(levelname)s: %(message)s'

400

.format(self.name)))

436

401

return ret

437

402

438

def call_pipe(connection, # : multiprocessing.Connection

439

func, *args, **kwargs):

440

"""This function is meant to be called by multiprocessing.Process

441

442

This function runs func(*args, **kwargs), and writes the resulting

443

return value on the provided multiprocessing.Connection.

444

"""

445

connection.send(func(*args, **kwargs))

446

connection.close()

447

403

448

404

class Client(object):

449

405

"""A representation of a client host served by this server.

476

432

last_checker_status: integer between 0 and 255 reflecting exit

477

433

status of last checker. -1 reflects crashed

478

434

checker, -2 means no checker completed yet.

479

last_checker_signal: The signal which killed the last checker, if

480

last_checker_status is -1

481

435

last_enabled: datetime.datetime(); (UTC) or None

482

436

name: string; from the config file, used in log messages and

483

437

D-Bus identifiers

496

450

"fingerprint", "host", "interval",

497

451

"last_approval_request", "last_checked_ok",

498

452

"last_enabled", "name", "timeout")

499

client_defaults = {

500

"timeout": "PT5M",

501

"extended_timeout": "PT15M",

502

"interval": "PT2M",

503

"checker": "fping -q -- %%(host)s",

504

"host": "",

505

"approval_delay": "PT0S",

506

"approval_duration": "PT1S",

507

"approved_by_default": "True",

508

"enabled": "True",

509

}

453

client_defaults = { "timeout": "PT5M",

454

"extended_timeout": "PT15M",

455

"interval": "PT2M",

456

"checker": "fping -q -- %%(host)s",

457

"host": "",

458

"approval_delay": "PT0S",

459

"approval_duration": "PT1S",

460

"approved_by_default": "True",

461

"enabled": "True",

462

}

510

463

511

464

@staticmethod

512

465

def config_parser(config):

528

481

client["enabled"] = config.getboolean(client_name,

529

482

"enabled")

530

483

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the

533

# fingerprint() function

534

484

client["fingerprint"] = (section["fingerprint"].upper()

535

485

.replace(" ", ""))

536

486

if "secret" in section:

578

528

self.expires = None

579

529

580

530

logger.debug("Creating client %r", self.name)

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the fingerprint()

533

# function

581

534

logger.debug(" Fingerprint: %s", self.fingerprint)

582

535

self.created = settings.get("created",

583

536

datetime.datetime.utcnow())

590

543

self.current_checker_command = None

591

544

self.approved = None

592

545

self.approvals_pending = 0

593

self.changedstate = multiprocessing_manager.Condition(

594

multiprocessing_manager.Lock())

595

self.client_structure = [attr

596

for attr in self.__dict__.iterkeys()

546

self.changedstate = (multiprocessing_manager

547

.Condition(multiprocessing_manager

548

.Lock()))

549

self.client_structure = [attr for attr in

550

self.__dict__.iterkeys()

597

551

if not attr.startswith("_")]

598

552

self.client_structure.append("client_structure")

599

553

600

for name, t in inspect.getmembers(

601

type(self), lambda obj: isinstance(obj, property)):

554

for name, t in inspect.getmembers(type(self),

555

lambda obj:

556

isinstance(obj,

557

property)):

602

558

if not name.startswith("_"):

603

559

self.client_structure.append(name)

604

560

646

602

# and every interval from then on.

647

603

if self.checker_initiator_tag is not None:

648

604

gobject.source_remove(self.checker_initiator_tag)

649

self.checker_initiator_tag = gobject.timeout_add(

650

int(self.interval.total_seconds() * 1000),

651

self.start_checker)

605

self.checker_initiator_tag = (gobject.timeout_add

606

(int(self.interval

607

.total_seconds() * 1000),

608

self.start_checker))

652

609

# Schedule a disable() when 'timeout' has passed

653

610

if self.disable_initiator_tag is not None:

654

611

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = gobject.timeout_add(

656

int(self.timeout.total_seconds() * 1000), self.disable)

612

self.disable_initiator_tag = (gobject.timeout_add

613

(int(self.timeout

614

.total_seconds() * 1000),

615

self.disable))

657

616

# Also start a new checker *right now*.

658

617

self.start_checker()

659

618

660

def checker_callback(self, source, condition, connection,

661

command):

619

def checker_callback(self, pid, condition, command):

662

620

"""The checker has completed, so take appropriate actions."""

663

621

self.checker_callback_tag = None

664

622

self.checker = None

665

# Read return code from connection (see call_pipe)

666

returncode = connection.recv()

667

connection.close()

668

669

if returncode >= 0:

670

self.last_checker_status = returncode

671

self.last_checker_signal = None

623

if os.WIFEXITED(condition):

624

self.last_checker_status = os.WEXITSTATUS(condition)

672

625

if self.last_checker_status == 0:

673

626

logger.info("Checker for %(name)s succeeded",

674

627

vars(self))

675

628

self.checked_ok()

676

629

else:

677

logger.info("Checker for %(name)s failed", vars(self))

630

logger.info("Checker for %(name)s failed",

631

vars(self))

678

632

else:

679

633

self.last_checker_status = -1

680

self.last_checker_signal = -returncode

681

634

logger.warning("Checker for %(name)s crashed?",

682

635

vars(self))

683

return False

684

636

685

637

def checked_ok(self):

686

638

"""Assert that the client has been seen, alive and well."""

687

639

self.last_checked_ok = datetime.datetime.utcnow()

688

640

self.last_checker_status = 0

689

self.last_checker_signal = None

690

641

self.bump_timeout()

691

642

692

643

def bump_timeout(self, timeout=None):

697

648

gobject.source_remove(self.disable_initiator_tag)

698

649

self.disable_initiator_tag = None

699

650

if getattr(self, "enabled", False):

700

self.disable_initiator_tag = gobject.timeout_add(

701

int(timeout.total_seconds() * 1000), self.disable)

651

self.disable_initiator_tag = (gobject.timeout_add

652

(int(timeout.total_seconds()

653

* 1000), self.disable))

702

654

self.expires = datetime.datetime.utcnow() + timeout

703

655

704

656

def need_approval(self):

718

670

# than 'timeout' for the client to be disabled, which is as it

719

671

# should be.

720

672

721

if self.checker is not None and not self.checker.is_alive():

722

logger.warning("Checker was not alive; joining")

723

self.checker.join()

724

self.checker = None

673

# If a checker exists, make sure it is not a zombie

674

try:

675

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

676

except AttributeError:

677

pass

678

except OSError as error:

679

if error.errno != errno.ECHILD:

680

raise

681

else:

682

if pid:

683

logger.warning("Checker was a zombie")

684

gobject.source_remove(self.checker_callback_tag)

685

self.checker_callback(pid, status,

686

self.current_checker_command)

725

687

# Start a new checker if needed

726

688

if self.checker is None:

727

689

# Escape attributes for the shell

728

escaped_attrs = {

729

attr: re.escape(str(getattr(self, attr)))

730

for attr in self.runtime_expansions }

690

escaped_attrs = { attr:

691

re.escape(str(getattr(self, attr)))

692

for attr in self.runtime_expansions }

731

693

try:

732

694

command = self.checker_command % escaped_attrs

733

695

except TypeError as error:

734

696

logger.error('Could not format string "%s"',

735

self.checker_command,

697

self.checker_command, exc_info=error)

698

return True # Try again later

699

self.current_checker_command = command

700

try:

701

logger.info("Starting checker %r for %s",

702

command, self.name)

703

# We don't need to redirect stdout and stderr, since

704

# in normal mode, that is already done by daemon(),

705

# and in debug mode we don't want to. (Stdin is

706

# always replaced by /dev/null.)

707

# The exception is when not debugging but nevertheless

708

# running in the foreground; use the previously

709

# created wnull.

710

popen_args = {}

711

if (not self.server_settings["debug"]

712

and self.server_settings["foreground"]):

713

popen_args.update({"stdout": wnull,

714

"stderr": wnull })

715

self.checker = subprocess.Popen(command,

716

close_fds=True,

717

shell=True, cwd="/",

718

**popen_args)

719

except OSError as error:

720

logger.error("Failed to start subprocess",

736

721

exc_info=error)

737

return True # Try again later

738

self.current_checker_command = command

739

logger.info("Starting checker %r for %s", command,

740

self.name)

741

# We don't need to redirect stdout and stderr, since

742

# in normal mode, that is already done by daemon(),

743

# and in debug mode we don't want to. (Stdin is

744

# always replaced by /dev/null.)

745

# The exception is when not debugging but nevertheless

746

# running in the foreground; use the previously

747

# created wnull.

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

751

if (not self.server_settings["debug"]

752

and self.server_settings["foreground"]):

753

popen_args.update({"stdout": wnull,

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

756

self.checker = multiprocessing.Process(

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

760

self.checker.start()

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

763

self.checker_callback, pipe[0], command)

722

return True

723

self.checker_callback_tag = (gobject.child_watch_add

724

(self.checker.pid,

725

self.checker_callback,

726

data=command))

727

# The checker may have completed before the gobject

728

# watch was added. Check for this.

729

try:

730

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

731

except OSError as error:

732

if error.errno == errno.ECHILD:

733

# This should never happen

734

logger.error("Child process vanished",

735

exc_info=error)

736

return True

737

raise

738

if pid:

739

gobject.source_remove(self.checker_callback_tag)

740

self.checker_callback(pid, status, command)

764

741

# Re-run this periodically if run by gobject.timeout_add

765

742

return True

766

743

772

749

if getattr(self, "checker", None) is None:

773

750

return

774

751

logger.debug("Stopping checker for %(name)s", vars(self))

775

self.checker.terminate()

752

try:

753

self.checker.terminate()

754

#time.sleep(0.5)

755

#if self.checker.poll() is None:

756

# self.checker.kill()

757

except OSError as error:

758

if error.errno != errno.ESRCH: # No such process

759

raise

776

760

self.checker = None

777

761

778

762

779

def dbus_service_property(dbus_interface,

780

signature="v",

781

access="readwrite",

782

byte_arrays=False):

763

def dbus_service_property(dbus_interface, signature="v",

764

access="readwrite", byte_arrays=False):

783

765

"""Decorators for marking methods of a DBusObjectWithProperties to

784

766

become properties on the D-Bus.

785

767

795

777

if byte_arrays and signature != "ay":

796

778

raise ValueError("Byte arrays not supported for non-'ay'"

797

779

" signature {!r}".format(signature))

798

799

780

def decorator(func):

800

781

func._dbus_is_property = True

801

782

func._dbus_interface = dbus_interface

806

787

func._dbus_name = func._dbus_name[:-14]

807

788

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

808

789

return func

809

810

790

return decorator

811

791

812

792

821

801

"org.freedesktop.DBus.Property.EmitsChangedSignal":

822

802

"false"}

823

803

"""

824

825

804

def decorator(func):

826

805

func._dbus_is_interface = True

827

806

func._dbus_interface = dbus_interface

828

807

func._dbus_name = dbus_interface

829

808

return func

830

831

809

return decorator

832

810

833

811

835

813

"""Decorator to annotate D-Bus methods, signals or properties

836

814

Usage:

837

815

838

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

841

816

@dbus_service_property("org.example.Interface", signature="b",

842

817

access="r")

818

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

819

"org.freedesktop.DBus.Property."

820

"EmitsChangedSignal": "false"})

843

821

def Property_dbus_property(self):

844

822

return dbus.Boolean(False)

845

846

See also the DBusObjectWithAnnotations class.

847

823

"""

848

849

824

def decorator(func):

850

825

func._dbus_annotations = annotations

851

826

return func

852

853

827

return decorator

854

828

855

829

858

832

"""

859

833

pass

860

834

861

862

835

class DBusPropertyAccessException(DBusPropertyException):

863

836

"""A property's access permissions disallows an operation.

864

837

"""

871

844

pass

872

845

873

846

874

class DBusObjectWithAnnotations(dbus.service.Object):

875

"""A D-Bus object with annotations.

847

class DBusObjectWithProperties(dbus.service.Object):

848

"""A D-Bus object with properties.

876

849

877

Classes inheriting from this can use the dbus_annotations

878

decorator to add annotations to methods or signals.

850

Classes inheriting from this can use the dbus_service_property

851

decorator to expose methods as D-Bus properties. It exposes the

852

standard Get(), Set(), and GetAll() methods on the D-Bus.

879

853

"""

880

854

881

855

@staticmethod

891

865

def _get_all_dbus_things(self, thing):

892

866

"""Returns a generator of (name, attribute) pairs

893

867

"""

894

return ((getattr(athing.__get__(self), "_dbus_name", name),

868

return ((getattr(athing.__get__(self), "_dbus_name",

869

name),

895

870

athing.__get__(self))

896

871

for cls in self.__class__.__mro__

897

872

for name, athing in

898

inspect.getmembers(cls, self._is_dbus_thing(thing)))

899

900

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

901

out_signature = "s",

902

path_keyword = 'object_path',

903

connection_keyword = 'connection')

904

def Introspect(self, object_path, connection):

905

"""Overloading of standard D-Bus method.

906

907

Inserts annotation tags on methods and signals.

908

"""

909

xmlstring = dbus.service.Object.Introspect(self, object_path,

910

connection)

911

try:

912

document = xml.dom.minidom.parseString(xmlstring)

913

914

for if_tag in document.getElementsByTagName("interface"):

915

# Add annotation tags

916

for typ in ("method", "signal"):

917

for tag in if_tag.getElementsByTagName(typ):

918

annots = dict()

919

for name, prop in (self.

920

_get_all_dbus_things(typ)):

921

if (name == tag.getAttribute("name")

922

and prop._dbus_interface

923

== if_tag.getAttribute("name")):

924

annots.update(getattr(

925

prop, "_dbus_annotations", {}))

926

for name, value in annots.items():

927

ann_tag = document.createElement(

928

"annotation")

929

ann_tag.setAttribute("name", name)

930

ann_tag.setAttribute("value", value)

931

tag.appendChild(ann_tag)

932

# Add interface annotation tags

933

for annotation, value in dict(

934

itertools.chain.from_iterable(

935

annotations().items()

936

for name, annotations

937

in self._get_all_dbus_things("interface")

938

if name == if_tag.getAttribute("name")

939

)).items():

940

ann_tag = document.createElement("annotation")

941

ann_tag.setAttribute("name", annotation)

942

ann_tag.setAttribute("value", value)

943

if_tag.appendChild(ann_tag)

944

# Fix argument name for the Introspect method itself

945

if (if_tag.getAttribute("name")

946

== dbus.INTROSPECTABLE_IFACE):

947

for cn in if_tag.getElementsByTagName("method"):

948

if cn.getAttribute("name") == "Introspect":

949

for arg in cn.getElementsByTagName("arg"):

950

if (arg.getAttribute("direction")

951

== "out"):

952

arg.setAttribute("name",

953

"xml_data")

954

xmlstring = document.toxml("utf-8")

955

document.unlink()

956

except (AttributeError, xml.dom.DOMException,

957

xml.parsers.expat.ExpatError) as error:

958

logger.error("Failed to override Introspection method",

959

exc_info=error)

960

return xmlstring

961

962

963

class DBusObjectWithProperties(DBusObjectWithAnnotations):

964

"""A D-Bus object with properties.

965

966

Classes inheriting from this can use the dbus_service_property

967

decorator to expose methods as D-Bus properties. It exposes the

968

standard Get(), Set(), and GetAll() methods on the D-Bus.

969

"""

873

inspect.getmembers(cls,

874

self._is_dbus_thing(thing)))

970

875

971

876

def _get_dbus_property(self, interface_name, property_name):

972

877

"""Returns a bound method if one exists which is a D-Bus

973

878

property with the specified name and interface.

974

879

"""

975

for cls in self.__class__.__mro__:

976

for name, value in inspect.getmembers(

977

cls, self._is_dbus_thing("property")):

880

for cls in self.__class__.__mro__:

881

for name, value in (inspect.getmembers

882

(cls,

883

self._is_dbus_thing("property"))):

978

884

if (value._dbus_name == property_name

979

885

and value._dbus_interface == interface_name):

980

886

return value.__get__(self)

981

887

982

888

# No such property

983

raise DBusPropertyNotFound("{}:{}.{}".format(

984

self.dbus_object_path, interface_name, property_name))

985

986

@classmethod

987

def _get_all_interface_names(cls):

988

"""Get a sequence of all interfaces supported by an object"""

989

return (name for name in set(getattr(getattr(x, attr),

990

"_dbus_interface", None)

991

for x in (inspect.getmro(cls))

992

for attr in dir(x))

993

if name is not None)

994

995

@dbus.service.method(dbus.PROPERTIES_IFACE,

996

in_signature="ss",

889

raise DBusPropertyNotFound(self.dbus_object_path + ":"

890

+ interface_name + "."

891

+ property_name)

892

893

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

997

894

out_signature="v")

998

895

def Get(self, interface_name, property_name):

999

896

"""Standard D-Bus property Get() method, see D-Bus standard.

1024

921

for byte in value))

1025

922

prop(value)

1026

923

1027

@dbus.service.method(dbus.PROPERTIES_IFACE,

1028

in_signature="s",

924

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1029

925

out_signature="a{sv}")

1030

926

def GetAll(self, interface_name):

1031

927

"""Standard D-Bus property GetAll() method, see D-Bus

1046

942

if not hasattr(value, "variant_level"):

1047

943

properties[name] = value

1048

944

continue

1049

properties[name] = type(value)(

1050

value, variant_level = value.variant_level + 1)

945

properties[name] = type(value)(value, variant_level=

946

value.variant_level+1)

1051

947

return dbus.Dictionary(properties, signature="sv")

1052

948

1053

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1054

def PropertiesChanged(self, interface_name, changed_properties,

1055

invalidated_properties):

1056

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1057

standard.

1058

"""

1059

pass

1060

1061

949

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1062

950

out_signature="s",

1063

951

path_keyword='object_path',

1067

955

1068

956

Inserts property tags and interface annotation tags.

1069

957

"""

1070

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1071

object_path,

1072

connection)

958

xmlstring = dbus.service.Object.Introspect(self, object_path,

959

connection)

1073

960

try:

1074

961

document = xml.dom.minidom.parseString(xmlstring)

1075

1076

962

def make_tag(document, name, prop):

1077

963

e = document.createElement("property")

1078

964

e.setAttribute("name", name)

1079

965

e.setAttribute("type", prop._dbus_signature)

1080

966

e.setAttribute("access", prop._dbus_access)

1081

967

return e

1082

1083

968

for if_tag in document.getElementsByTagName("interface"):

1084

969

# Add property tags

1085

970

for tag in (make_tag(document, name, prop)

1088

973

if prop._dbus_interface

1089

974

== if_tag.getAttribute("name")):

1090

975

if_tag.appendChild(tag)

1091

# Add annotation tags for properties

1092

for tag in if_tag.getElementsByTagName("property"):

1093

annots = dict()

1094

for name, prop in self._get_all_dbus_things(

1095

"property"):

1096

if (name == tag.getAttribute("name")

1097

and prop._dbus_interface

1098

== if_tag.getAttribute("name")):

1099

annots.update(getattr(

1100

prop, "_dbus_annotations", {}))

1101

for name, value in annots.items():

1102

ann_tag = document.createElement(

1103

"annotation")

1104

ann_tag.setAttribute("name", name)

1105

ann_tag.setAttribute("value", value)

1106

tag.appendChild(ann_tag)

976

# Add annotation tags

977

for typ in ("method", "signal", "property"):

978

for tag in if_tag.getElementsByTagName(typ):

979

annots = dict()

980

for name, prop in (self.

981

_get_all_dbus_things(typ)):

982

if (name == tag.getAttribute("name")

983

and prop._dbus_interface

984

== if_tag.getAttribute("name")):

985

annots.update(getattr

986

(prop,

987

"_dbus_annotations",

988

{}))

989

for name, value in annots.items():

990

ann_tag = document.createElement(

991

"annotation")

992

ann_tag.setAttribute("name", name)

993

ann_tag.setAttribute("value", value)

994

tag.appendChild(ann_tag)

995

# Add interface annotation tags

996

for annotation, value in dict(

997

itertools.chain.from_iterable(

998

annotations().items()

999

for name, annotations in

1000

self._get_all_dbus_things("interface")

1001

if name == if_tag.getAttribute("name")

1002

)).items():

1003

ann_tag = document.createElement("annotation")

1004

ann_tag.setAttribute("name", annotation)

1005

ann_tag.setAttribute("value", value)

1006

if_tag.appendChild(ann_tag)

1107

1007

# Add the names to the return values for the

1108

1008

# "org.freedesktop.DBus.Properties" methods

1109

1009

if (if_tag.getAttribute("name")

1127

1027

exc_info=error)

1128

1028

return xmlstring

1129

1029

1130

try:

1131

dbus.OBJECT_MANAGER_IFACE

1132

except AttributeError:

1133

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1134

1135

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1136

"""A D-Bus object with an ObjectManager.

1137

1138

Classes inheriting from this exposes the standard

1139

GetManagedObjects call and the InterfacesAdded and

1140

InterfacesRemoved signals on the standard

1141

"org.freedesktop.DBus.ObjectManager" interface.

1142

1143

Note: No signals are sent automatically; they must be sent

1144

manually.

1145

"""

1146

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1147

out_signature = "a{oa{sa{sv}}}")

1148

def GetManagedObjects(self):

1149

"""This function must be overridden"""

1150

raise NotImplementedError()

1151

1152

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1153

signature = "oa{sa{sv}}")

1154

def InterfacesAdded(self, object_path, interfaces_and_properties):

1155

pass

1156

1157

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1158

def InterfacesRemoved(self, object_path, interfaces):

1159

pass

1160

1161

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1162

out_signature = "s",

1163

path_keyword = 'object_path',

1164

connection_keyword = 'connection')

1165

def Introspect(self, object_path, connection):

1166

"""Overloading of standard D-Bus method.

1167

1168

Override return argument name of GetManagedObjects to be

1169

"objpath_interfaces_and_properties"

1170

"""

1171

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1172

object_path,

1173

connection)

1174

try:

1175

document = xml.dom.minidom.parseString(xmlstring)

1176

1177

for if_tag in document.getElementsByTagName("interface"):

1178

# Fix argument name for the GetManagedObjects method

1179

if (if_tag.getAttribute("name")

1180

== dbus.OBJECT_MANAGER_IFACE):

1181

for cn in if_tag.getElementsByTagName("method"):

1182

if (cn.getAttribute("name")

1183

== "GetManagedObjects"):

1184

for arg in cn.getElementsByTagName("arg"):

1185

if (arg.getAttribute("direction")

1186

== "out"):

1187

arg.setAttribute(

1188

"name",

1189

"objpath_interfaces"

1190

"_and_properties")

1191

xmlstring = document.toxml("utf-8")

1192

document.unlink()

1193

except (AttributeError, xml.dom.DOMException,

1194

xml.parsers.expat.ExpatError) as error:

1195

logger.error("Failed to override Introspection method",

1196

exc_info = error)

1197

return xmlstring

1198

1030

1199

1031

def datetime_to_dbus(dt, variant_level=0):

1200

1032

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1201

1033

if dt is None:

1202

1034

return dbus.String("", variant_level = variant_level)

1203

return dbus.String(dt.isoformat(), variant_level=variant_level)

1035

return dbus.String(dt.isoformat(),

1036

variant_level=variant_level)

1204

1037

1205

1038

1206

1039

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1226

1059

(from DBusObjectWithProperties) and interfaces (from the

1227

1060

dbus_interface_annotations decorator).

1228

1061

"""

1229

1230

1062

def wrapper(cls):

1231

1063

for orig_interface_name, alt_interface_name in (

1232

alt_interface_names.items()):

1064

alt_interface_names.items()):

1233

1065

attr = {}

1234

1066

interface_names = set()

1235

1067

# Go though all attributes of the class

1237

1069

# Ignore non-D-Bus attributes, and D-Bus attributes

1238

1070

# with the wrong interface name

1239

1071

if (not hasattr(attribute, "_dbus_interface")

1240

or not attribute._dbus_interface.startswith(

1241

orig_interface_name)):

1072

or not attribute._dbus_interface

1073

.startswith(orig_interface_name)):

1242

1074

continue

1243

1075

# Create an alternate D-Bus interface name based on

1244

1076

# the current name

1245

alt_interface = attribute._dbus_interface.replace(

1246

orig_interface_name, alt_interface_name)

1077

alt_interface = (attribute._dbus_interface

1078

.replace(orig_interface_name,

1079

alt_interface_name))

1247

1080

interface_names.add(alt_interface)

1248

1081

# Is this a D-Bus signal?

1249

1082

if getattr(attribute, "_dbus_is_signal", False):

1250

if sys.version_info.major == 2:

1251

# Extract the original non-method undecorated

1252

# function by black magic

1253

nonmethod_func = (dict(

1083

# Extract the original non-method undecorated

1084

# function by black magic

1085

nonmethod_func = (dict(

1254

1086

zip(attribute.func_code.co_freevars,

1255

attribute.__closure__))

1256

["func"].cell_contents)

1257

else:

1258

nonmethod_func = attribute

1087

attribute.__closure__))["func"]

1088

.cell_contents)

1259

1089

# Create a new, but exactly alike, function

1260

1090

# object, and decorate it to be a new D-Bus signal

1261

1091

# with the alternate D-Bus interface name

1262

if sys.version_info.major == 2:

1263

new_function = types.FunctionType(

1264

nonmethod_func.func_code,

1265

nonmethod_func.func_globals,

1266

nonmethod_func.func_name,

1267

nonmethod_func.func_defaults,

1268

nonmethod_func.func_closure)

1269

else:

1270

new_function = types.FunctionType(

1271

nonmethod_func.__code__,

1272

nonmethod_func.__globals__,

1273

nonmethod_func.__name__,

1274

nonmethod_func.__defaults__,

1275

nonmethod_func.__closure__)

1276

new_function = (dbus.service.signal(

1277

alt_interface,

1278

attribute._dbus_signature)(new_function))

1092

new_function = (dbus.service.signal

1093

(alt_interface,

1094

attribute._dbus_signature)

1095

(types.FunctionType(

1096

nonmethod_func.func_code,

1097

nonmethod_func.func_globals,

1098

nonmethod_func.func_name,

1099

nonmethod_func.func_defaults,

1100

nonmethod_func.func_closure)))

1279

1101

# Copy annotations, if any

1280

1102

try:

1281

new_function._dbus_annotations = dict(

1282

attribute._dbus_annotations)

1103

new_function._dbus_annotations = (

1104

dict(attribute._dbus_annotations))

1283

1105

except AttributeError:

1284

1106

pass

1285

1107

# Define a creator of a function to call both the

1290

1112

"""This function is a scope container to pass

1291

1113

func1 and func2 to the "call_both" function

1292

1114

outside of its arguments"""

1293

1294

@functools.wraps(func2)

1295

1115

def call_both(*args, **kwargs):

1296

1116

"""This function will emit two D-Bus

1297

1117

signals by calling func1 and func2"""

1298

1118

func1(*args, **kwargs)

1299

1119

func2(*args, **kwargs)

1300

# Make wrapper function look like a D-Bus signal

1301

for name, attr in inspect.getmembers(func2):

1302

if name.startswith("_dbus_"):

1303

setattr(call_both, name, attr)

1304

1305

1120

return call_both

1306

1121

# Create the "call_both" function and add it to

1307

1122

# the class

1312

1127

# object. Decorate it to be a new D-Bus method

1313

1128

# with the alternate D-Bus interface name. Add it

1314

1129

# to the class.

1315

attr[attrname] = (

1316

dbus.service.method(

1317

alt_interface,

1318

attribute._dbus_in_signature,

1319

attribute._dbus_out_signature)

1320

(types.FunctionType(attribute.func_code,

1321

attribute.func_globals,

1322

attribute.func_name,

1323

attribute.func_defaults,

1324

attribute.func_closure)))

1130

attr[attrname] = (dbus.service.method

1131

(alt_interface,

1132

attribute._dbus_in_signature,

1133

attribute._dbus_out_signature)

1134

(types.FunctionType

1135

(attribute.func_code,

1136

attribute.func_globals,

1137

attribute.func_name,

1138

attribute.func_defaults,

1139

attribute.func_closure)))

1325

1140

# Copy annotations, if any

1326

1141

try:

1327

attr[attrname]._dbus_annotations = dict(

1328

attribute._dbus_annotations)

1142

attr[attrname]._dbus_annotations = (

1143

dict(attribute._dbus_annotations))

1329

1144

except AttributeError:

1330

1145

pass

1331

1146

# Is this a D-Bus property?

1334

1149

# object, and decorate it to be a new D-Bus

1335

1150

# property with the alternate D-Bus interface

1336

1151

# name. Add it to the class.

1337

attr[attrname] = (dbus_service_property(

1338

alt_interface, attribute._dbus_signature,

1339

attribute._dbus_access,

1340

attribute._dbus_get_args_options

1341

["byte_arrays"])

1342

(types.FunctionType(

1343

attribute.func_code,

1344

attribute.func_globals,

1345

attribute.func_name,

1346

attribute.func_defaults,

1347

attribute.func_closure)))

1152

attr[attrname] = (dbus_service_property

1153

(alt_interface,

1154

attribute._dbus_signature,

1155

attribute._dbus_access,

1156

attribute

1157

._dbus_get_args_options

1158

["byte_arrays"])

1159

(types.FunctionType

1160

(attribute.func_code,

1161

attribute.func_globals,

1162

attribute.func_name,

1163

attribute.func_defaults,

1164

attribute.func_closure)))

1348

1165

# Copy annotations, if any

1349

1166

try:

1350

attr[attrname]._dbus_annotations = dict(

1351

attribute._dbus_annotations)

1167

attr[attrname]._dbus_annotations = (

1168

dict(attribute._dbus_annotations))

1352

1169

except AttributeError:

1353

1170

pass

1354

1171

# Is this a D-Bus interface?

1357

1174

# object. Decorate it to be a new D-Bus interface

1358

1175

# with the alternate D-Bus interface name. Add it

1359

1176

# to the class.

1360

attr[attrname] = (

1361

dbus_interface_annotations(alt_interface)

1362

(types.FunctionType(attribute.func_code,

1363

attribute.func_globals,

1364

attribute.func_name,

1365

attribute.func_defaults,

1366

attribute.func_closure)))

1177

attr[attrname] = (dbus_interface_annotations

1178

(alt_interface)

1179

(types.FunctionType

1180

(attribute.func_code,

1181

attribute.func_globals,

1182

attribute.func_name,

1183

attribute.func_defaults,

1184

attribute.func_closure)))

1367

1185

if deprecate:

1368

1186

# Deprecate all alternate interfaces

1369

1187

iname="_AlternateDBusNames_interface_annotation{}"

1370

1188

for interface_name in interface_names:

1371

1372

1189

@dbus_interface_annotations(interface_name)

1373

1190

def func(self):

1374

1191

return { "org.freedesktop.DBus.Deprecated":

1375

"true" }

1192

"true" }

1376

1193

# Find an unused name

1377

1194

for aname in (iname.format(i)

1378

1195

for i in itertools.count()):

1383

1200

# Replace the class with a new subclass of it with

1384

1201

# methods, signals, etc. as created above.

1385

1202

cls = type(b"{}Alternate".format(cls.__name__),

1386

(cls, ), attr)

1203

(cls,), attr)

1387

1204

return cls

1388

1389

1205

return wrapper

1390

1206

1391

1207

1392

1208

@alternate_dbus_interfaces({"se.recompile.Mandos":

1393

"se.bsnet.fukt.Mandos"})

1209

"se.bsnet.fukt.Mandos"})

1394

1210

class ClientDBus(Client, DBusObjectWithProperties):

1395

1211

"""A Client class using D-Bus

1396

1212

1400

1216

"""

1401

1217

1402

1218

runtime_expansions = (Client.runtime_expansions

1403

+ ("dbus_object_path", ))

1404

1405

_interface = "se.recompile.Mandos.Client"

1219

+ ("dbus_object_path",))

1406

1220

1407

1221

# dbus.service.Object doesn't use super(), so we can't either.

1408

1222

1414

1228

client_object_name = str(self.name).translate(

1415

1229

{ord("."): ord("_"),

1416

1230

ord("-"): ord("_")})

1417

self.dbus_object_path = dbus.ObjectPath(

1418

"/clients/" + client_object_name)

1231

self.dbus_object_path = (dbus.ObjectPath

1232

("/clients/" + client_object_name))

1419

1233

DBusObjectWithProperties.__init__(self, self.bus,

1420

1234

self.dbus_object_path)

1421

1235

1422

def notifychangeproperty(transform_func, dbus_name,

1423

type_func=lambda x: x,

1424

variant_level=1,

1425

invalidate_only=False,

1426

_interface=_interface):

1236

def notifychangeproperty(transform_func,

1237

dbus_name, type_func=lambda x: x,

1238

variant_level=1):

1427

1239

""" Modify a variable so that it's a property which announces

1428

1240

its changes to DBus.

1429

1241

1435

1247

variant_level: D-Bus variant level. Default: 1

1436

1248

"""

1437

1249

attrname = "_{}".format(dbus_name)

1438

1439

1250

def setter(self, value):

1440

1251

if hasattr(self, "dbus_object_path"):

1441

1252

if (not hasattr(self, attrname) or

1442

1253

type_func(getattr(self, attrname, None))

1443

1254

!= type_func(value)):

1444

if invalidate_only:

1445

self.PropertiesChanged(

1446

_interface, dbus.Dictionary(),

1447

dbus.Array((dbus_name, )))

1448

else:

1449

dbus_value = transform_func(

1450

type_func(value),

1451

variant_level = variant_level)

1452

self.PropertyChanged(dbus.String(dbus_name),

1453

dbus_value)

1454

self.PropertiesChanged(

1455

_interface,

1456

dbus.Dictionary({ dbus.String(dbus_name):

1457

dbus_value }),

1458

dbus.Array())

1255

dbus_value = transform_func(type_func(value),

1256

variant_level

1257

=variant_level)

1258

self.PropertyChanged(dbus.String(dbus_name),

1259

dbus_value)

1459

1260

setattr(self, attrname, value)

1460

1261

1461

1262

return property(lambda self: getattr(self, attrname), setter)

1467

1268

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1468

1269

last_enabled = notifychangeproperty(datetime_to_dbus,

1469

1270

"LastEnabled")

1470

checker = notifychangeproperty(

1471

dbus.Boolean, "CheckerRunning",

1472

type_func = lambda checker: checker is not None)

1271

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1272

type_func = lambda checker:

1273

checker is not None)

1473

1274

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1474

1275

"LastCheckedOK")

1475

1276

last_checker_status = notifychangeproperty(dbus.Int16,

1478

1279

datetime_to_dbus, "LastApprovalRequest")

1479

1280

approved_by_default = notifychangeproperty(dbus.Boolean,

1480

1281

"ApprovedByDefault")

1481

approval_delay = notifychangeproperty(

1482

dbus.UInt64, "ApprovalDelay",

1483

type_func = lambda td: td.total_seconds() * 1000)

1282

approval_delay = notifychangeproperty(dbus.UInt64,

1283

"ApprovalDelay",

1284

type_func =

1285

lambda td: td.total_seconds()

1286

* 1000)

1484

1287

approval_duration = notifychangeproperty(

1485

1288

dbus.UInt64, "ApprovalDuration",

1486

1289

type_func = lambda td: td.total_seconds() * 1000)

1487

1290

host = notifychangeproperty(dbus.String, "Host")

1488

timeout = notifychangeproperty(

1489

dbus.UInt64, "Timeout",

1490

type_func = lambda td: td.total_seconds() * 1000)

1291

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1292

type_func = lambda td:

1293

td.total_seconds() * 1000)

1491

1294

extended_timeout = notifychangeproperty(

1492

1295

dbus.UInt64, "ExtendedTimeout",

1493

1296

type_func = lambda td: td.total_seconds() * 1000)

1494

interval = notifychangeproperty(

1495

dbus.UInt64, "Interval",

1496

type_func = lambda td: td.total_seconds() * 1000)

1297

interval = notifychangeproperty(dbus.UInt64,

1298

"Interval",

1299

type_func =

1300

lambda td: td.total_seconds()

1301

* 1000)

1497

1302

checker_command = notifychangeproperty(dbus.String, "Checker")

1498

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1499

invalidate_only=True)

1500

1303

1501

1304

del notifychangeproperty

1502

1305

1509

1312

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1510

1313

Client.__del__(self, *args, **kwargs)

1511

1314

1512

def checker_callback(self, source, condition,

1513

connection, command, *args, **kwargs):

1514

ret = Client.checker_callback(self, source, condition,

1515

connection, command, *args,

1516

**kwargs)

1517

exitstatus = self.last_checker_status

1518

if exitstatus >= 0:

1315

def checker_callback(self, pid, condition, command,

1316

*args, **kwargs):

1317

self.checker_callback_tag = None

1318

self.checker = None

1319

if os.WIFEXITED(condition):

1320

exitstatus = os.WEXITSTATUS(condition)

1519

1321

# Emit D-Bus signal

1520

1322

self.CheckerCompleted(dbus.Int16(exitstatus),

1521

# This is specific to GNU libC

1522

dbus.Int64(exitstatus << 8),

1323

dbus.Int64(condition),

1523

1324

dbus.String(command))

1524

1325

else:

1525

1326

# Emit D-Bus signal

1526

1327

self.CheckerCompleted(dbus.Int16(-1),

1527

dbus.Int64(

1528

# This is specific to GNU libC

1529

(exitstatus << 8)

1530

| self.last_checker_signal),

1328

dbus.Int64(condition),

1531

1329

dbus.String(command))

1532

return ret

1330

1331

return Client.checker_callback(self, pid, condition, command,

1332

*args, **kwargs)

1533

1333

1534

1334

def start_checker(self, *args, **kwargs):

1535

1335

old_checker_pid = getattr(self.checker, "pid", None)

1552

1352

self.send_changedstate()

1553

1353

1554

1354

## D-Bus methods, signals & properties

1355

_interface = "se.recompile.Mandos.Client"

1555

1356

1556

1357

## Interfaces

1557

1358

1359

@dbus_interface_annotations(_interface)

1360

def _foo(self):

1361

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1362

"false"}

1363

1558

1364

## Signals

1559

1365

1560

1366

# CheckerCompleted - signal

1570

1376

pass

1571

1377

1572

1378

# PropertyChanged - signal

1573

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1574

1379

@dbus.service.signal(_interface, signature="sv")

1575

1380

def PropertyChanged(self, property, value):

1576

1381

"D-Bus signal"

1610

1415

self.checked_ok()

1611

1416

1612

1417

# Enable - method

1613

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1614

1418

@dbus.service.method(_interface)

1615

1419

def Enable(self):

1616

1420

"D-Bus method"

1617

1421

self.enable()

1618

1422

1619

1423

# StartChecker - method

1620

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1621

1424

@dbus.service.method(_interface)

1622

1425

def StartChecker(self):

1623

1426

"D-Bus method"

1624

1427

self.start_checker()

1625

1428

1626

1429

# Disable - method

1627

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1628

1430

@dbus.service.method(_interface)

1629

1431

def Disable(self):

1630

1432

"D-Bus method"

1631

1433

self.disable()

1632

1434

1633

1435

# StopChecker - method

1634

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1635

1436

@dbus.service.method(_interface)

1636

1437

def StopChecker(self):

1637

1438

self.stop_checker()

1644

1445

return dbus.Boolean(bool(self.approvals_pending))

1645

1446

1646

1447

# ApprovedByDefault - property

1647

@dbus_service_property(_interface,

1648

signature="b",

1448

@dbus_service_property(_interface, signature="b",

1649

1449

access="readwrite")

1650

1450

def ApprovedByDefault_dbus_property(self, value=None):

1651

1451

if value is None: # get

1653

1453

self.approved_by_default = bool(value)

1654

1454

1655

1455

# ApprovalDelay - property

1656

@dbus_service_property(_interface,

1657

signature="t",

1456

@dbus_service_property(_interface, signature="t",

1658

1457

access="readwrite")

1659

1458

def ApprovalDelay_dbus_property(self, value=None):

1660

1459

if value is None: # get

1663

1462

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1664

1463

1665

1464

# ApprovalDuration - property

1666

@dbus_service_property(_interface,

1667

signature="t",

1465

@dbus_service_property(_interface, signature="t",

1668

1466

access="readwrite")

1669

1467

def ApprovalDuration_dbus_property(self, value=None):

1670

1468

if value is None: # get

1673

1471

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1674

1472

1675

1473

# Name - property

1676

@dbus_annotations(

1677

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1678

1474

@dbus_service_property(_interface, signature="s", access="read")

1679

1475

def Name_dbus_property(self):

1680

1476

return dbus.String(self.name)

1681

1477

1682

1478

# Fingerprint - property

1683

@dbus_annotations(

1684

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1685

1479

@dbus_service_property(_interface, signature="s", access="read")

1686

1480

def Fingerprint_dbus_property(self):

1687

1481

return dbus.String(self.fingerprint)

1688

1482

1689

1483

# Host - property

1690

@dbus_service_property(_interface,

1691

signature="s",

1484

@dbus_service_property(_interface, signature="s",

1692

1485

access="readwrite")

1693

1486

def Host_dbus_property(self, value=None):

1694

1487

if value is None: # get

1696

1489

self.host = str(value)

1697

1490

1698

1491

# Created - property

1699

@dbus_annotations(

1700

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1701

1492

@dbus_service_property(_interface, signature="s", access="read")

1702

1493

def Created_dbus_property(self):

1703

1494

return datetime_to_dbus(self.created)

1708

1499

return datetime_to_dbus(self.last_enabled)

1709

1500

1710

1501

# Enabled - property

1711

@dbus_service_property(_interface,

1712

signature="b",

1502

@dbus_service_property(_interface, signature="b",

1713

1503

access="readwrite")

1714

1504

def Enabled_dbus_property(self, value=None):

1715

1505

if value is None: # get

1720

1510

self.disable()

1721

1511

1722

1512

# LastCheckedOK - property

1723

@dbus_service_property(_interface,

1724

signature="s",

1513

@dbus_service_property(_interface, signature="s",

1725

1514

access="readwrite")

1726

1515

def LastCheckedOK_dbus_property(self, value=None):

1727

1516

if value is not None:

1730

1519

return datetime_to_dbus(self.last_checked_ok)

1731

1520

1732

1521

# LastCheckerStatus - property

1733

@dbus_service_property(_interface, signature="n", access="read")

1522

@dbus_service_property(_interface, signature="n",

1523

access="read")

1734

1524

def LastCheckerStatus_dbus_property(self):

1735

1525

return dbus.Int16(self.last_checker_status)

1736

1526

1745

1535

return datetime_to_dbus(self.last_approval_request)

1746

1536

1747

1537

# Timeout - property

1748

@dbus_service_property(_interface,

1749

signature="t",

1538

@dbus_service_property(_interface, signature="t",

1750

1539

access="readwrite")

1751

1540

def Timeout_dbus_property(self, value=None):

1752

1541

if value is None: # get

1765

1554

is None):

1766

1555

return

1767

1556

gobject.source_remove(self.disable_initiator_tag)

1768

self.disable_initiator_tag = gobject.timeout_add(

1769

int((self.expires - now).total_seconds() * 1000),

1770

self.disable)

1557

self.disable_initiator_tag = (

1558

gobject.timeout_add(

1559

int((self.expires - now).total_seconds()

1560

* 1000), self.disable))

1771

1561

1772

1562

# ExtendedTimeout - property

1773

@dbus_service_property(_interface,

1774

signature="t",

1563

@dbus_service_property(_interface, signature="t",

1775

1564

access="readwrite")

1776

1565

def ExtendedTimeout_dbus_property(self, value=None):

1777

1566

if value is None: # get

1780

1569

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1781

1570

1782

1571

# Interval - property

1783

@dbus_service_property(_interface,

1784

signature="t",

1572

@dbus_service_property(_interface, signature="t",

1785

1573

access="readwrite")

1786

1574

def Interval_dbus_property(self, value=None):

1787

1575

if value is None: # get

1792

1580

if self.enabled:

1793

1581

# Reschedule checker run

1794

1582

gobject.source_remove(self.checker_initiator_tag)

1795

self.checker_initiator_tag = gobject.timeout_add(

1796

value, self.start_checker)

1797

self.start_checker() # Start one now, too

1583

self.checker_initiator_tag = (gobject.timeout_add

1584

(value, self.start_checker))

1585

self.start_checker() # Start one now, too

1798

1586

1799

1587

# Checker - property

1800

@dbus_service_property(_interface,

1801

signature="s",

1588

@dbus_service_property(_interface, signature="s",

1802

1589

access="readwrite")

1803

1590

def Checker_dbus_property(self, value=None):

1804

1591

if value is None: # get

1806

1593

self.checker_command = str(value)

1807

1594

1808

1595

# CheckerRunning - property

1809

@dbus_service_property(_interface,

1810

signature="b",

1596

@dbus_service_property(_interface, signature="b",

1811

1597

access="readwrite")

1812

1598

def CheckerRunning_dbus_property(self, value=None):

1813

1599

if value is None: # get

1818

1604

self.stop_checker()

1819

1605

1820

1606

# ObjectPath - property

1821

@dbus_annotations(

1822

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

1823

"org.freedesktop.DBus.Deprecated": "true"})

1824

1607

@dbus_service_property(_interface, signature="o", access="read")

1825

1608

def ObjectPath_dbus_property(self):

1826

1609

return self.dbus_object_path # is already a dbus.ObjectPath

1827

1610

1828

1611

# Secret = property

1829

@dbus_annotations(

1830

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

1831

"invalidates"})

1832

@dbus_service_property(_interface,

1833

signature="ay",

1834

access="write",

1835

byte_arrays=True)

1612

@dbus_service_property(_interface, signature="ay",

1613

access="write", byte_arrays=True)

1836

1614

def Secret_dbus_property(self, value):

1837

1615

self.secret = bytes(value)

1838

1616

1844

1622

self._pipe = child_pipe

1845

1623

self._pipe.send(('init', fpr, address))

1846

1624

if not self._pipe.recv():

1847

raise KeyError(fpr)

1625

raise KeyError()

1848

1626

1849

1627

def __getattribute__(self, name):

1850

1628

if name == '_pipe':

1854

1632

if data[0] == 'data':

1855

1633

return data[1]

1856

1634

if data[0] == 'function':

1857

1858

1635

def func(*args, **kwargs):

1859

1636

self._pipe.send(('funcall', name, args, kwargs))

1860

1637

return self._pipe.recv()[1]

1861

1862

1638

return func

1863

1639

1864

1640

def __setattr__(self, name, value):

1880

1656

logger.debug("Pipe FD: %d",

1881

1657

self.server.child_pipe.fileno())

1882

1658

1883

session = gnutls.connection.ClientSession(

1884

self.request, gnutls.connection .X509Credentials())

1659

session = (gnutls.connection

1660

.ClientSession(self.request,

1661

gnutls.connection

1662

.X509Credentials()))

1885

1663

1886

1664

# Note: gnutls.connection.X509Credentials is really a

1887

1665

# generic GnuTLS certificate credentials object so long as

1896

1674

priority = self.server.gnutls_priority

1897

1675

if priority is None:

1898

1676

priority = "NORMAL"

1899

gnutls.library.functions.gnutls_priority_set_direct(

1900

session._c_object, priority, None)

1677

(gnutls.library.functions

1678

.gnutls_priority_set_direct(session._c_object,

1679

priority, None))

1901

1680

1902

1681

# Start communication using the Mandos protocol

1903

1682

# Get protocol number

1923

1702

approval_required = False

1924

1703

try:

1925

1704

try:

1926

fpr = self.fingerprint(

1927

self.peer_certificate(session))

1705

fpr = self.fingerprint(self.peer_certificate

1706

(session))

1928

1707

except (TypeError,

1929

1708

gnutls.errors.GNUTLSError) as error:

1930

1709

logger.warning("Bad certificate: %s", error)

1945

1724

while True:

1946

1725

if not client.enabled:

1947

1726

logger.info("Client %s is disabled",

1948

client.name)

1727

client.name)

1949

1728

if self.server.use_dbus:

1950

1729

# Emit D-Bus signal

1951

1730

client.Rejected("Disabled")

1998

1777

logger.warning("gnutls send failed",

1999

1778

exc_info=error)

2000

1779

return

2001

logger.debug("Sent: %d, remaining: %d", sent,

2002

len(client.secret) - (sent_size

2003

+ sent))

1780

logger.debug("Sent: %d, remaining: %d",

1781

sent, len(client.secret)

1782

- (sent_size + sent))

2004

1783

sent_size += sent

2005

1784

2006

1785

logger.info("Sending secret to %s", client.name)

2023

1802

def peer_certificate(session):

2024

1803

"Return the peer's OpenPGP certificate as a bytestring"

2025

1804

# If not an OpenPGP certificate...

2026

if (gnutls.library.functions.gnutls_certificate_type_get(

2027

session._c_object)

1805

if (gnutls.library.functions

1806

.gnutls_certificate_type_get(session._c_object)

2028

1807

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

2029

1808

# ...do the normal thing

2030

1809

return session.peer_certificate

2044

1823

def fingerprint(openpgp):

2045

1824

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2046

1825

# New GnuTLS "datum" with the OpenPGP public key

2047

datum = gnutls.library.types.gnutls_datum_t(

2048

ctypes.cast(ctypes.c_char_p(openpgp),

2049

ctypes.POINTER(ctypes.c_ubyte)),

2050

ctypes.c_uint(len(openpgp)))

1826

datum = (gnutls.library.types

1827

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1828

ctypes.POINTER

1829

(ctypes.c_ubyte)),

1830

ctypes.c_uint(len(openpgp))))

2051

1831

# New empty GnuTLS certificate

2052

1832

crt = gnutls.library.types.gnutls_openpgp_crt_t()

2053

gnutls.library.functions.gnutls_openpgp_crt_init(

2054

ctypes.byref(crt))

1833

(gnutls.library.functions

1834

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2055

1835

# Import the OpenPGP public key into the certificate

2056

gnutls.library.functions.gnutls_openpgp_crt_import(

2057

crt, ctypes.byref(datum),

2058

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1836

(gnutls.library.functions

1837

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1838

gnutls.library.constants

1839

.GNUTLS_OPENPGP_FMT_RAW))

2059

1840

# Verify the self signature in the key

2060

1841

crtverify = ctypes.c_uint()

2061

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

2062

crt, 0, ctypes.byref(crtverify))

1842

(gnutls.library.functions

1843

.gnutls_openpgp_crt_verify_self(crt, 0,

1844

ctypes.byref(crtverify)))

2063

1845

if crtverify.value != 0:

2064

1846

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2065

raise gnutls.errors.CertificateSecurityError(

2066

"Verify failed")

1847

raise (gnutls.errors.CertificateSecurityError

1848

("Verify failed"))

2067

1849

# New buffer for the fingerprint

2068

1850

buf = ctypes.create_string_buffer(20)

2069

1851

buf_len = ctypes.c_size_t()

2070

1852

# Get the fingerprint from the certificate into the buffer

2071

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

2072

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1853

(gnutls.library.functions

1854

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1855

ctypes.byref(buf_len)))

2073

1856

# Deinit the certificate

2074

1857

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2075

1858

# Convert the buffer to a Python bytestring

2081

1864

2082

1865

class MultiprocessingMixIn(object):

2083

1866

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2084

2085

1867

def sub_process_main(self, request, address):

2086

1868

try:

2087

1869

self.finish_request(request, address)

2099

1881

2100

1882

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2101

1883

""" adds a pipe to the MixIn """

2102

2103

1884

def process_request(self, request, client_address):

2104

1885

"""Overrides and wraps the original process_request().

2105

1886

2126

1907

interface: None or a network interface name (string)

2127

1908

use_ipv6: Boolean; to use IPv6 or not

2128

1909

"""

2129

2130

1910

def __init__(self, server_address, RequestHandlerClass,

2131

interface=None,

2132

use_ipv6=True,

2133

socketfd=None):

1911

interface=None, use_ipv6=True, socketfd=None):

2134

1912

"""If socketfd is set, use that file descriptor instead of

2135

1913

creating a new one with socket.socket().

2136

1914

"""

2177

1955

self.interface)

2178

1956

else:

2179

1957

try:

2180

self.socket.setsockopt(

2181

socket.SOL_SOCKET, SO_BINDTODEVICE,

2182

(self.interface + "\0").encode("utf-8"))

1958

self.socket.setsockopt(socket.SOL_SOCKET,

1959

SO_BINDTODEVICE,

1960

(self.interface + "\0")

1961

.encode("utf-8"))

2183

1962

except socket.error as error:

2184

1963

if error.errno == errno.EPERM:

2185

1964

logger.error("No permission to bind to"

2203

1982

self.server_address = (any_address,

2204

1983

self.server_address[1])

2205

1984

elif not self.server_address[1]:

2206

self.server_address = (self.server_address[0], 0)

1985

self.server_address = (self.server_address[0],

1986

0)

2207

1987

# if self.interface:

2208

1988

# self.server_address = (self.server_address[0],

2209

1989

# 0, # port

2223

2003

2224

2004

Assumes a gobject.MainLoop event loop.

2225

2005

"""

2226

2227

2006

def __init__(self, server_address, RequestHandlerClass,

2228

interface=None,

2229

use_ipv6=True,

2230

clients=None,

2231

gnutls_priority=None,

2232

use_dbus=True,

2233

socketfd=None):

2007

interface=None, use_ipv6=True, clients=None,

2008

gnutls_priority=None, use_dbus=True, socketfd=None):

2234

2009

self.enabled = False

2235

2010

self.clients = clients

2236

2011

if self.clients is None:

2242

2017

interface = interface,

2243

2018

use_ipv6 = use_ipv6,

2244

2019

socketfd = socketfd)

2245

2246

2020

def server_activate(self):

2247

2021

if self.enabled:

2248

2022

return socketserver.TCPServer.server_activate(self)

2252

2026

2253

2027

def add_pipe(self, parent_pipe, proc):

2254

2028

# Call "handle_ipc" for both data and EOF events

2255

gobject.io_add_watch(

2256

parent_pipe.fileno(),

2257

gobject.IO_IN | gobject.IO_HUP,

2258

functools.partial(self.handle_ipc,

2259

parent_pipe = parent_pipe,

2260

proc = proc))

2029

gobject.io_add_watch(parent_pipe.fileno(),

2030

gobject.IO_IN | gobject.IO_HUP,

2031

functools.partial(self.handle_ipc,

2032

parent_pipe =

2033

parent_pipe,

2034

proc = proc))

2261

2035

2262

def handle_ipc(self, source, condition,

2263

parent_pipe=None,

2264

proc = None,

2265

client_object=None):

2036

def handle_ipc(self, source, condition, parent_pipe=None,

2037

proc = None, client_object=None):

2266

2038

# error, or the other end of multiprocessing.Pipe has closed

2267

2039

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2268

2040

# Wait for other process to exit

2291

2063

parent_pipe.send(False)

2292

2064

return False

2293

2065

2294

gobject.io_add_watch(

2295

parent_pipe.fileno(),

2296

gobject.IO_IN | gobject.IO_HUP,

2297

functools.partial(self.handle_ipc,

2298

parent_pipe = parent_pipe,

2299

proc = proc,

2300

client_object = client))

2066

gobject.io_add_watch(parent_pipe.fileno(),

2067

gobject.IO_IN | gobject.IO_HUP,

2068

functools.partial(self.handle_ipc,

2069

parent_pipe =

2070

parent_pipe,

2071

proc = proc,

2072

client_object =

2073

client))

2301

2074

parent_pipe.send(True)

2302

2075

# remove the old hook in favor of the new above hook on

2303

2076

# same fileno

2309

2082

2310

2083

parent_pipe.send(('data', getattr(client_object,

2311

2084

funcname)(*args,

2312

**kwargs)))

2085

**kwargs)))

2313

2086

2314

2087

if command == 'getattr':

2315

2088

attrname = request[1]

2316

if isinstance(client_object.__getattribute__(attrname),

2317

collections.Callable):

2318

parent_pipe.send(('function', ))

2089

if callable(client_object.__getattribute__(attrname)):

2090

parent_pipe.send(('function',))

2319

2091

else:

2320

parent_pipe.send((

2321

'data', client_object.__getattribute__(attrname)))

2092

parent_pipe.send(('data', client_object

2093

.__getattribute__(attrname)))

2322

2094

2323

2095

if command == 'setattr':

2324

2096

attrname = request[1]

2355

2127

# avoid excessive use of external libraries.

2356

2128

2357

2129

# New type for defining tokens, syntax, and semantics all-in-one

2358

Token = collections.namedtuple("Token", (

2359

"regexp", # To match token; if "value" is not None, must have

2360

# a "group" containing digits

2361

"value", # datetime.timedelta or None

2362

"followers")) # Tokens valid after this token

2130

Token = collections.namedtuple("Token",

2131

("regexp", # To match token; if

2132

# "value" is not None,

2133

# must have a "group"

2134

# containing digits

2135

"value", # datetime.timedelta or

2136

# None

2137

"followers")) # Tokens valid after

2138

# this token

2363

2139

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2364

2140

# the "duration" ABNF definition in RFC 3339, Appendix A.

2365

2141

token_end = Token(re.compile(r"$"), None, frozenset())

2366

2142

token_second = Token(re.compile(r"(\d+)S"),

2367

2143

datetime.timedelta(seconds=1),

2368

frozenset((token_end, )))

2144

frozenset((token_end,)))

2369

2145

token_minute = Token(re.compile(r"(\d+)M"),

2370

2146

datetime.timedelta(minutes=1),

2371

2147

frozenset((token_second, token_end)))

2387

2163

frozenset((token_month, token_end)))

2388

2164

token_week = Token(re.compile(r"(\d+)W"),

2389

2165

datetime.timedelta(weeks=1),

2390

frozenset((token_end, )))

2166

frozenset((token_end,)))

2391

2167

token_duration = Token(re.compile(r"P"), None,

2392

2168

frozenset((token_year, token_month,

2393

2169

token_day, token_time,

2395

2171

# Define starting values

2396

2172

value = datetime.timedelta() # Value so far

2397

2173

found_token = None

2398

followers = frozenset((token_duration, )) # Following valid tokens

2174

followers = frozenset((token_duration,)) # Following valid tokens

2399

2175

s = duration # String left to parse

2400

2176

# Loop until end token is found

2401

2177

while found_token is not token_end:

2418

2194

break

2419

2195

else:

2420

2196

# No currently valid tokens were found

2421

raise ValueError("Invalid RFC 3339 duration: {!r}"

2422

.format(duration))

2197

raise ValueError("Invalid RFC 3339 duration")

2423

2198

# End token found

2424

2199

return value

2425

2200

2462

2237

elif suffix == "w":

2463

2238

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2464

2239

else:

2465

raise ValueError("Unknown suffix {!r}".format(suffix))

2240

raise ValueError("Unknown suffix {!r}"

2241

.format(suffix))

2466

2242

except IndexError as e:

2467

2243

raise ValueError(*(e.args))

2468

2244

timevalue += delta

2484

2260

# Close all standard open file descriptors

2485

2261

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2486

2262

if not stat.S_ISCHR(os.fstat(null).st_mode):

2487

raise OSError(errno.ENODEV,

2488

"{} not a character device"

2263

raise OSError(errno.ENODEV, "{} not a character device"

2489

2264

.format(os.devnull))

2490

2265

os.dup2(null, sys.stdin.fileno())

2491

2266

os.dup2(null, sys.stdout.fileno())

2557

2332

"port": "",

2558

2333

"debug": "False",

2559

2334

"priority":

2560

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2561

":+SIGN-DSA-SHA256",

2335

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2562

2336

"servicename": "Mandos",

2563

2337

"use_dbus": "True",

2564

2338

"use_ipv6": "True",

2568

2342

"statedir": "/var/lib/mandos",

2569

2343

"foreground": "False",

2570

2344

"zeroconf": "True",

2571

}

2345

}

2572

2346

2573

2347

# Parse config file for server-global settings

2574

2348

server_config = configparser.SafeConfigParser(server_defaults)

2575

2349

del server_defaults

2576

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2350

server_config.read(os.path.join(options.configdir,

2351

"mandos.conf"))

2577

2352

# Convert the SafeConfigParser object to a dict

2578

2353

server_settings = server_config.defaults()

2579

2354

# Use the appropriate methods on the non-string config options

2597

2372

# Override the settings from the config file with command line

2598

2373

# options, if set.

2599

2374

for option in ("interface", "address", "port", "debug",

2600

"priority", "servicename", "configdir", "use_dbus",

2601

"use_ipv6", "debuglevel", "restore", "statedir",

2602

"socket", "foreground", "zeroconf"):

2375

"priority", "servicename", "configdir",

2376

"use_dbus", "use_ipv6", "debuglevel", "restore",

2377

"statedir", "socket", "foreground", "zeroconf"):

2603

2378

value = getattr(options, option)

2604

2379

if value is not None:

2605

2380

server_settings[option] = value

2620

2395

2621

2396

##################################################################

2622

2397

2623

if (not server_settings["zeroconf"]

2624

and not (server_settings["port"]

2625

or server_settings["socket"] != "")):

2626

parser.error("Needs port or socket to work without Zeroconf")

2398

if (not server_settings["zeroconf"] and

2399

not (server_settings["port"]

2400

or server_settings["socket"] != "")):

2401

parser.error("Needs port or socket to work without"

2402

" Zeroconf")

2627

2403

2628

2404

# For convenience

2629

2405

debug = server_settings["debug"]

2645

2421

initlogger(debug, level)

2646

2422

2647

2423

if server_settings["servicename"] != "Mandos":

2648

syslogger.setFormatter(

2649

logging.Formatter('Mandos ({}) [%(process)d]:'

2650

' %(levelname)s: %(message)s'.format(

2651

server_settings["servicename"])))

2424

syslogger.setFormatter(logging.Formatter

2425

('Mandos ({}) [%(process)d]:'

2426

' %(levelname)s: %(message)s'

2427

.format(server_settings

2428

["servicename"])))

2652

2429

2653

2430

# Parse config file with clients

2654

2431

client_config = configparser.SafeConfigParser(Client

2662

2439

socketfd = None

2663

2440

if server_settings["socket"] != "":

2664

2441

socketfd = server_settings["socket"]

2665

tcp_server = MandosServer(

2666

(server_settings["address"], server_settings["port"]),

2667

ClientHandler,

2668

interface=(server_settings["interface"] or None),

2669

use_ipv6=use_ipv6,

2670

gnutls_priority=server_settings["priority"],

2671

use_dbus=use_dbus,

2672

socketfd=socketfd)

2442

tcp_server = MandosServer((server_settings["address"],

2443

server_settings["port"]),

2444

ClientHandler,

2445

interface=(server_settings["interface"]

2446

or None),

2447

use_ipv6=use_ipv6,

2448

gnutls_priority=

2449

server_settings["priority"],

2450

use_dbus=use_dbus,

2451

socketfd=socketfd)

2673

2452

if not foreground:

2674

2453

pidfilename = "/run/mandos.pid"

2675

2454

if not os.path.isdir("/run/."):

2676

2455

pidfilename = "/var/run/mandos.pid"

2677

2456

pidfile = None

2678

2457

try:

2679

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2458

pidfile = open(pidfilename, "w")

2680

2459

except IOError as e:

2681

2460

logger.error("Could not open file %r", pidfilename,

2682

2461

exc_info=e)

2709

2488

def debug_gnutls(level, string):

2710

2489

logger.debug("GnuTLS: %s", string[:-1])

2711

2490

2712

gnutls.library.functions.gnutls_global_set_log_function(

2713

debug_gnutls)

2491

(gnutls.library.functions

2492

.gnutls_global_set_log_function(debug_gnutls))

2714

2493

2715

2494

# Redirect stdin so all checkers get /dev/null

2716

2495

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2736

2515

if use_dbus:

2737

2516

try:

2738

2517

bus_name = dbus.service.BusName("se.recompile.Mandos",

2739

bus,

2740

do_not_queue=True)

2741

old_bus_name = dbus.service.BusName(

2742

"se.bsnet.fukt.Mandos", bus,

2743

do_not_queue=True)

2744

except dbus.exceptions.DBusException as e:

2518

bus, do_not_queue=True)

2519

old_bus_name = (dbus.service.BusName

2520

("se.bsnet.fukt.Mandos", bus,

2521

do_not_queue=True))

2522

except dbus.exceptions.NameExistsException as e:

2745

2523

logger.error("Disabling D-Bus:", exc_info=e)

2746

2524

use_dbus = False

2747

2525

server_settings["use_dbus"] = False

2748

2526

tcp_server.use_dbus = False

2749

2527

if zeroconf:

2750

2528

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2751

service = AvahiServiceToSyslog(

2752

name = server_settings["servicename"],

2753

servicetype = "_mandos._tcp",

2754

protocol = protocol,

2755

bus = bus)

2529

service = AvahiServiceToSyslog(name =

2530

server_settings["servicename"],

2531

servicetype = "_mandos._tcp",

2532

protocol = protocol, bus = bus)

2756

2533

if server_settings["interface"]:

2757

service.interface = if_nametoindex(

2758

server_settings["interface"].encode("utf-8"))

2534

service.interface = (if_nametoindex

2535

(server_settings["interface"]

2536

.encode("utf-8")))

2759

2537

2760

2538

global multiprocessing_manager

2761

2539

multiprocessing_manager = multiprocessing.Manager()

2780

2558

if server_settings["restore"]:

2781

2559

try:

2782

2560

with open(stored_state_path, "rb") as stored_state:

2783

clients_data, old_client_settings = pickle.load(

2784

stored_state)

2561

clients_data, old_client_settings = (pickle.load

2562

(stored_state))

2785

2563

os.remove(stored_state_path)

2786

2564

except IOError as e:

2787

2565

if e.errno == errno.ENOENT:

2788

logger.warning("Could not load persistent state:"

2789

" {}".format(os.strerror(e.errno)))

2566

logger.warning("Could not load persistent state: {}"

2567

.format(os.strerror(e.errno)))

2790

2568

else:

2791

2569

logger.critical("Could not load persistent state:",

2792

2570

exc_info=e)

2793

2571

raise

2794

2572

except EOFError as e:

2795

2573

logger.warning("Could not load persistent state: "

2796

"EOFError:",

2797

exc_info=e)

2574

"EOFError:", exc_info=e)

2798

2575

2799

2576

with PGPEngine() as pgp:

2800

2577

for client_name, client in clients_data.items():

2812

2589

# For each value in new config, check if it

2813

2590

# differs from the old config value (Except for

2814

2591

# the "secret" attribute)

2815

if (name != "secret"

2816

and (value !=

2817

old_client_settings[client_name][name])):

2592

if (name != "secret" and

2593

value != old_client_settings[client_name]

2594

[name]):

2818

2595

client[name] = value

2819

2596

except KeyError:

2820

2597

pass

2821

2598

2822

2599

# Clients who has passed its expire date can still be

2823

# enabled if its last checker was successful. A Client

2600

# enabled if its last checker was successful. Clients

2824

2601

# whose checker succeeded before we stored its state is

2825

2602

# assumed to have successfully run all checkers during

2826

2603

# downtime.

2829

2606

if not client["last_checked_ok"]:

2830

2607

logger.warning(

2831

2608

"disabling client {} - Client never "

2832

"performed a successful checker".format(

2833

client_name))

2609

"performed a successful checker"

2610

.format(client_name))

2834

2611

client["enabled"] = False

2835

2612

elif client["last_checker_status"] != 0:

2836

2613

logger.warning(

2837

2614

"disabling client {} - Client last"

2838

" checker failed with error code"

2839

" {}".format(

2840

client_name,

2841

client["last_checker_status"]))

2615

" checker failed with error code {}"

2616

.format(client_name,

2617

client["last_checker_status"]))

2842

2618

client["enabled"] = False

2843

2619

else:

2844

client["expires"] = (

2845

datetime.datetime.utcnow()

2846

+ client["timeout"])

2620

client["expires"] = (datetime.datetime

2621

.utcnow()

2622

+ client["timeout"])

2847

2623

logger.debug("Last checker succeeded,"

2848

" keeping {} enabled".format(

2849

client_name))

2624

" keeping {} enabled"

2625

.format(client_name))

2850

2626

try:

2851

client["secret"] = pgp.decrypt(

2852

client["encrypted_secret"],

2853

client_settings[client_name]["secret"])

2627

client["secret"] = (

2628

pgp.decrypt(client["encrypted_secret"],

2629

client_settings[client_name]

2630

["secret"]))

2854

2631

except PGPError:

2855

2632

# If decryption fails, we use secret from new settings

2856

logger.debug("Failed to decrypt {} old secret".format(

2857

client_name))

2858

client["secret"] = (client_settings[client_name]

2859

["secret"])

2633

logger.debug("Failed to decrypt {} old secret"

2634

.format(client_name))

2635

client["secret"] = (

2636

client_settings[client_name]["secret"])

2860

2637

2861

2638

# Add/remove clients based on new changes made to config

2862

2639

for client_name in (set(old_client_settings)

2869

2646

# Create all client objects

2870

2647

for client_name, client in clients_data.items():

2871

2648

tcp_server.clients[client_name] = client_class(

2872

name = client_name,

2873

settings = client,

2649

name = client_name, settings = client,

2874

2650

server_settings = server_settings)

2875

2651

2876

2652

if not tcp_server.clients:

2878

2654

2879

2655

if not foreground:

2880

2656

if pidfile is not None:

2881

pid = os.getpid()

2882

2657

try:

2883

2658

with pidfile:

2884

print(pid, file=pidfile)

2659

pid = os.getpid()

2660

pidfile.write("{}\n".format(pid).encode("utf-8"))

2885

2661

except IOError:

2886

2662

logger.error("Could not write to file %r with PID %d",

2887

2663

pidfilename, pid)

2892

2668

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2893

2669

2894

2670

if use_dbus:

2895

2896

@alternate_dbus_interfaces(

2897

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2898

class MandosDBusService(DBusObjectWithObjectManager):

2671

@alternate_dbus_interfaces({"se.recompile.Mandos":

2672

"se.bsnet.fukt.Mandos"})

2673

class MandosDBusService(DBusObjectWithProperties):

2899

2674

"""A D-Bus proxy object"""

2900

2901

2675

def __init__(self):

2902

2676

dbus.service.Object.__init__(self, bus, "/")

2903

2904

2677

_interface = "se.recompile.Mandos"

2905

2678

2679

@dbus_interface_annotations(_interface)

2680

def _foo(self):

2681

return { "org.freedesktop.DBus.Property"

2682

".EmitsChangedSignal":

2683

"false"}

2684

2906

2685

@dbus.service.signal(_interface, signature="o")

2907

2686

def ClientAdded(self, objpath):

2908

2687

"D-Bus signal"

2913

2692

"D-Bus signal"

2914

2693

pass

2915

2694

2916

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2917

"true"})

2918

2695

@dbus.service.signal(_interface, signature="os")

2919

2696

def ClientRemoved(self, objpath, name):

2920

2697

"D-Bus signal"

2921

2698

pass

2922

2699

2923

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2924

"true"})

2925

2700

@dbus.service.method(_interface, out_signature="ao")

2926

2701

def GetAllClients(self):

2927

2702

"D-Bus method"

2928

return dbus.Array(c.dbus_object_path for c in

2703

return dbus.Array(c.dbus_object_path

2704

for c in

2929

2705

tcp_server.clients.itervalues())

2930

2706

2931

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2932

"true"})

2933

2707

@dbus.service.method(_interface,

2934

2708

out_signature="a{oa{sv}}")

2935

2709

def GetAllClientsWithProperties(self):

2936

2710

"D-Bus method"

2937

2711

return dbus.Dictionary(

2938

{ c.dbus_object_path: c.GetAll(

2939

"se.recompile.Mandos.Client")

2940

for c in tcp_server.clients.itervalues() },

2712

((c.dbus_object_path, c.GetAll(""))

2713

for c in tcp_server.clients.itervalues()),

2941

2714

signature="oa{sv}")

2942

2715

2943

2716

@dbus.service.method(_interface, in_signature="o")

2947

2720

if c.dbus_object_path == object_path:

2948

2721

del tcp_server.clients[c.name]

2949

2722

c.remove_from_connection()

2950

# Don't signal the disabling

2723

# Don't signal anything except ClientRemoved

2951

2724

c.disable(quiet=True)

2952

# Emit D-Bus signal for removal

2953

self.client_removed_signal(c)

2725

# Emit D-Bus signal

2726

self.ClientRemoved(object_path, c.name)

2954

2727

return

2955

2728

raise KeyError(object_path)

2956

2729

2957

2730

del _interface

2958

2959

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

2960

out_signature = "a{oa{sa{sv}}}")

2961

def GetManagedObjects(self):

2962

"""D-Bus method"""

2963

return dbus.Dictionary(

2964

{ client.dbus_object_path:

2965

dbus.Dictionary(

2966

{ interface: client.GetAll(interface)

2967

for interface in

2968

client._get_all_interface_names()})

2969

for client in tcp_server.clients.values()})

2970

2971

def client_added_signal(self, client):

2972

"""Send the new standard signal and the old signal"""

2973

if use_dbus:

2974

# New standard signal

2975

self.InterfacesAdded(

2976

client.dbus_object_path,

2977

dbus.Dictionary(

2978

{ interface: client.GetAll(interface)

2979

for interface in

2980

client._get_all_interface_names()}))

2981

# Old signal

2982

self.ClientAdded(client.dbus_object_path)

2983

2984

def client_removed_signal(self, client):

2985

"""Send the new standard signal and the old signal"""

2986

if use_dbus:

2987

# New standard signal

2988

self.InterfacesRemoved(

2989

client.dbus_object_path,

2990

client._get_all_interface_names())

2991

# Old signal

2992

self.ClientRemoved(client.dbus_object_path,

2993

client.name)

2994

2731

2995

2732

mandos_dbus_service = MandosDBusService()

2996

2733

3019

2756

# + secret.

3020

2757

exclude = { "bus", "changedstate", "secret",

3021

2758

"checker", "server_settings" }

3022

for name, typ in inspect.getmembers(dbus.service

3023

.Object):

2759

for name, typ in (inspect.getmembers

2760

(dbus.service.Object)):

3024

2761

exclude.add(name)

3025

2762

3026

2763

client_dict["encrypted_secret"] = (client

3033

2770

del client_settings[client.name]["secret"]

3034

2771

3035

2772

try:

3036

with tempfile.NamedTemporaryFile(

3037

mode='wb',

3038

suffix=".pickle",

3039

prefix='clients-',

3040

dir=os.path.dirname(stored_state_path),

3041

delete=False) as stored_state:

2773

with (tempfile.NamedTemporaryFile

2774

(mode='wb', suffix=".pickle", prefix='clients-',

2775

dir=os.path.dirname(stored_state_path),

2776

delete=False)) as stored_state:

3042

2777

pickle.dump((clients, client_settings), stored_state)

3043

tempname = stored_state.name

2778

tempname=stored_state.name

3044

2779

os.rename(tempname, stored_state_path)

3045

2780

except (IOError, OSError) as e:

3046

2781

if not debug:

3061

2796

name, client = tcp_server.clients.popitem()

3062

2797

if use_dbus:

3063

2798

client.remove_from_connection()

3064

# Don't signal the disabling

2799

# Don't signal anything except ClientRemoved

3065

2800

client.disable(quiet=True)

3066

# Emit D-Bus signal for removal

3067

mandos_dbus_service.client_removed_signal(client)

2801

if use_dbus:

2802

# Emit D-Bus signal

2803

mandos_dbus_service.ClientRemoved(client

2804

.dbus_object_path,

2805

client.name)

3068

2806

client_settings.clear()

3069

2807

3070

2808

atexit.register(cleanup)

3071

2809

3072

2810

for client in tcp_server.clients.itervalues():

3073

2811

if use_dbus:

3074

# Emit D-Bus signal for adding

3075

mandos_dbus_service.client_added_signal(client)

2812

# Emit D-Bus signal

2813

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3076

2814

# Need to initiate checking of clients

3077

2815

if client.enabled:

3078

2816

client.init_checker()

3123

2861

# Must run before the D-Bus bus name gets deregistered

3124

2862

cleanup()

3125

2863

3126

3127

2864

if __name__ == '__main__':

3128

2865

main()