/mandos/release : revision 237.7.301

1

#!/usr/bin/python

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

import SocketServer as socketserver

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

40

43

import socket

41

44

import argparse

42

45

import datetime

47

50

import gnutls.library.functions

48

51

import gnutls.library.constants

49

52

import gnutls.library.types

50

import ConfigParser as configparser

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

51

57

import sys

52

58

import re

53

59

import os

62

68

import struct

63

69

import fcntl

64

70

import functools

65

import cPickle as pickle

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

66

75

import multiprocessing

67

76

import types

68

77

import binascii

69

78

import tempfile

70

79

import itertools

71

80

import collections

81

import codecs

72

82

73

83

import dbus

74

84

import dbus.service

75

import gobject

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

76

89

import avahi

77

90

from dbus.mainloop.glib import DBusGMainLoop

78

91

import ctypes

88

101

except ImportError:

89

102

SO_BINDTODEVICE = None

90

103

91

version = "1.6.4"

104

if sys.version_info.major == 2:

105

str = unicode

106

107

version = "1.6.9"

92

108

stored_state_file = "clients.pickle"

93

109

94

110

logger = logging.getLogger()

95

111

syslogger = None

96

112

97

113

try:

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

101

116

except (OSError, AttributeError):

117

102

118

def if_nametoindex(interface):

103

119

"Get an interface index the hard way, i.e. using fcntl()"

104

120

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

105

121

with contextlib.closing(socket.socket()) as s:

106

122

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

123

struct.pack(b"16s16x", interface))

124

interface_index = struct.unpack("I", ifreq[16:20])[0]

111

125

return interface_index

112

126

113

127

114

128

def initlogger(debug, level=logging.WARNING):

115

129

"""init logger and add loglevel"""

116

130

117

syslogger = (logging.handlers.SysLogHandler

118

(facility =

119

logging.handlers.SysLogHandler.LOG_DAEMON,

120

address = str("/dev/log")))

131

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

121

135

syslogger.setFormatter(logging.Formatter

122

136

('Mandos [%(process)d]: %(levelname)s:'

123

137

' %(message)s'))

140

154

141

155

class PGPEngine(object):

142

156

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

143

158

def __init__(self):

144

159

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

145

160

self.gnupgargs = ['--batch',

184

199

185

200

def encrypt(self, data, password):

186

201

passphrase = self.password_encode(password)

187

with tempfile.NamedTemporaryFile(dir=self.tempdir

188

) as passfile:

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

189

204

passfile.write(passphrase)

190

205

passfile.flush()

191

206

proc = subprocess.Popen(['gpg', '--symmetric',

202

217

203

218

def decrypt(self, data, password):

204

219

passphrase = self.password_encode(password)

205

with tempfile.NamedTemporaryFile(dir = self.tempdir

206

) as passfile:

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

207

222

passfile.write(passphrase)

208

223

passfile.flush()

209

224

proc = subprocess.Popen(['gpg', '--decrypt',

213

228

stdin = subprocess.PIPE,

214

229

stdout = subprocess.PIPE,

215

230

stderr = subprocess.PIPE)

216

decrypted_plaintext, err = proc.communicate(input

217

= data)

231

decrypted_plaintext, err = proc.communicate(input = data)

218

232

if proc.returncode != 0:

219

233

raise PGPError(err)

220

234

return decrypted_plaintext

223

237

class AvahiError(Exception):

224

238

def __init__(self, value, *args, **kwargs):

225

239

self.value = value

226

super(AvahiError, self).__init__(value, *args, **kwargs)

227

def __unicode__(self):

228

return unicode(repr(self.value))

240

return super(AvahiError, self).__init__(value, *args,

241

**kwargs)

242

229

243

230

244

class AvahiServiceError(AvahiError):

231

245

pass

232

246

247

233

248

class AvahiGroupError(AvahiError):

234

249

pass

235

250

255

270

bus: dbus.SystemBus()

256

271

"""

257

272

258

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

259

servicetype = None, port = None, TXT = None,

260

domain = "", host = "", max_renames = 32768,

261

protocol = avahi.PROTO_UNSPEC, bus = None):

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

262

284

self.interface = interface

263

285

self.name = name

264

286

self.type = servicetype

274

296

self.bus = bus

275

297

self.entry_group_state_changed_match = None

276

298

277

def rename(self):

299

def rename(self, remove=True):

278

300

"""Derived from the Avahi example code"""

279

301

if self.rename_count >= self.max_renames:

280

302

logger.critical("No suitable Zeroconf service name found"

281

303

" after %i retries, exiting.",

282

304

self.rename_count)

283

305

raise AvahiServiceError("Too many renames")

284

self.name = unicode(self.server

285

.GetAlternativeServiceName(self.name))

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

286

309

logger.info("Changing Zeroconf service name to %r ...",

287

310

self.name)

288

self.remove()

311

if remove:

312

self.remove()

289

313

try:

290

314

self.add()

291

315

except dbus.exceptions.DBusException as error:

292

logger.critical("D-Bus Exception", exc_info=error)

293

self.cleanup()

294

os._exit(1)

295

self.rename_count += 1

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

296

324

297

325

def remove(self):

298

326

"""Derived from the Avahi example code"""

336

364

self.rename()

337

365

elif state == avahi.ENTRY_GROUP_FAILURE:

338

366

logger.critical("Avahi: Error in group state changed %s",

339

unicode(error))

340

raise AvahiGroupError("State changed: {0!s}"

341

.format(error))

367

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

342

369

343

370

def cleanup(self):

344

371

"""Derived from the Avahi example code"""

354

381

def server_state_changed(self, state, error=None):

355

382

"""Derived from the Avahi example code"""

356

383

logger.debug("Avahi server state change: %i", state)

357

bad_states = { avahi.SERVER_INVALID:

358

"Zeroconf server invalid",

359

avahi.SERVER_REGISTERING: None,

360

avahi.SERVER_COLLISION:

361

"Zeroconf server name collision",

362

avahi.SERVER_FAILURE:

363

"Zeroconf server failure" }

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

364

390

if state in bad_states:

365

391

if bad_states[state] is not None:

366

392

if error is None:

385

411

follow_name_owner_changes=True),

386

412

avahi.DBUS_INTERFACE_SERVER)

387

413

self.server.connect_to_signal("StateChanged",

388

self.server_state_changed)

414

self.server_state_changed)

389

415

self.server_state_changed(self.server.GetState())

390

416

391

417

392

418

class AvahiServiceToSyslog(AvahiService):

393

def rename(self):

419

def rename(self, *args, **kwargs):

394

420

"""Add the new name to the syslog messages"""

395

ret = AvahiService.rename(self)

396

syslogger.setFormatter(logging.Formatter

397

('Mandos ({0}) [%(process)d]:'

398

' %(levelname)s: %(message)s'

399

.format(self.name)))

421

ret = AvahiService.rename(self, *args, **kwargs)

422

syslogger.setFormatter(logging.Formatter(

423

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

424

.format(self.name)))

400

425

return ret

401

426

402

427

403

def timedelta_to_milliseconds(td):

404

"Convert a datetime.timedelta() to milliseconds"

405

return ((td.days * 24 * 60 * 60 * 1000)

406

+ (td.seconds * 1000)

407

+ (td.microseconds // 1000))

408

409

410

428

class Client(object):

411

429

"""A representation of a client host served by this server.

412

430

456

474

"fingerprint", "host", "interval",

457

475

"last_approval_request", "last_checked_ok",

458

476

"last_enabled", "name", "timeout")

459

client_defaults = { "timeout": "PT5M",

460

"extended_timeout": "PT15M",

461

"interval": "PT2M",

462

"checker": "fping -q -- %%(host)s",

463

"host": "",

464

"approval_delay": "PT0S",

465

"approval_duration": "PT1S",

466

"approved_by_default": "True",

467

"enabled": "True",

468

}

469

470

def timeout_milliseconds(self):

471

"Return the 'timeout' attribute in milliseconds"

472

return timedelta_to_milliseconds(self.timeout)

473

474

def extended_timeout_milliseconds(self):

475

"Return the 'extended_timeout' attribute in milliseconds"

476

return timedelta_to_milliseconds(self.extended_timeout)

477

478

def interval_milliseconds(self):

479

"Return the 'interval' attribute in milliseconds"

480

return timedelta_to_milliseconds(self.interval)

481

482

def approval_delay_milliseconds(self):

483

return timedelta_to_milliseconds(self.approval_delay)

477

client_defaults = {

478

"timeout": "PT5M",

479

"extended_timeout": "PT15M",

480

"interval": "PT2M",

481

"checker": "fping -q -- %%(host)s",

482

"host": "",

483

"approval_delay": "PT0S",

484

"approval_duration": "PT1S",

485

"approved_by_default": "True",

486

"enabled": "True",

487

}

484

488

485

489

@staticmethod

486

490

def config_parser(config):

502

506

client["enabled"] = config.getboolean(client_name,

503

507

"enabled")

504

508

509

# Uppercase and remove spaces from fingerprint for later

510

# comparison purposes with return value from the

511

# fingerprint() function

505

512

client["fingerprint"] = (section["fingerprint"].upper()

506

513

.replace(" ", ""))

507

514

if "secret" in section:

512

519

"rb") as secfile:

513

520

client["secret"] = secfile.read()

514

521

else:

515

raise TypeError("No secret or secfile for section {0}"

522

raise TypeError("No secret or secfile for section {}"

516

523

.format(section))

517

524

client["timeout"] = string_to_delta(section["timeout"])

518

525

client["extended_timeout"] = string_to_delta(

535

542

server_settings = {}

536

543

self.server_settings = server_settings

537

544

# adding all client settings

538

for setting, value in settings.iteritems():

545

for setting, value in settings.items():

539

546

setattr(self, setting, value)

540

547

541

548

if self.enabled:

549

556

self.expires = None

550

557

551

558

logger.debug("Creating client %r", self.name)

552

# Uppercase and remove spaces from fingerprint for later

553

# comparison purposes with return value from the fingerprint()

554

# function

555

559

logger.debug(" Fingerprint: %s", self.fingerprint)

556

560

self.created = settings.get("created",

557

561

datetime.datetime.utcnow())

564

568

self.current_checker_command = None

565

569

self.approved = None

566

570

self.approvals_pending = 0

567

self.changedstate = (multiprocessing_manager

568

.Condition(multiprocessing_manager

569

.Lock()))

570

self.client_structure = [attr for attr in

571

self.__dict__.iterkeys()

571

self.changedstate = multiprocessing_manager.Condition(

572

multiprocessing_manager.Lock())

573

self.client_structure = [attr

574

for attr in self.__dict__.iterkeys()

572

575

if not attr.startswith("_")]

573

576

self.client_structure.append("client_structure")

574

577

575

for name, t in inspect.getmembers(type(self),

576

lambda obj:

577

isinstance(obj,

578

property)):

578

for name, t in inspect.getmembers(

579

type(self), lambda obj: isinstance(obj, property)):

579

580

if not name.startswith("_"):

580

581

self.client_structure.append(name)

581

582

623

624

# and every interval from then on.

624

625

if self.checker_initiator_tag is not None:

625

626

gobject.source_remove(self.checker_initiator_tag)

626

self.checker_initiator_tag = (gobject.timeout_add

627

(self.interval_milliseconds(),

628

self.start_checker))

627

self.checker_initiator_tag = gobject.timeout_add(

628

int(self.interval.total_seconds() * 1000),

629

self.start_checker)

629

630

# Schedule a disable() when 'timeout' has passed

630

631

if self.disable_initiator_tag is not None:

631

632

gobject.source_remove(self.disable_initiator_tag)

632

self.disable_initiator_tag = (gobject.timeout_add

633

(self.timeout_milliseconds(),

634

self.disable))

633

self.disable_initiator_tag = gobject.timeout_add(

634

int(self.timeout.total_seconds() * 1000), self.disable)

635

# Also start a new checker *right now*.

636

self.start_checker()

637

646

vars(self))

647

self.checked_ok()

648

else:

649

logger.info("Checker for %(name)s failed",

650

vars(self))

649

logger.info("Checker for %(name)s failed", vars(self))

651

650

else:

652

651

self.last_checker_status = -1

653

652

logger.warning("Checker for %(name)s crashed?",

667

666

gobject.source_remove(self.disable_initiator_tag)

668

667

self.disable_initiator_tag = None

669

668

if getattr(self, "enabled", False):

670

self.disable_initiator_tag = (gobject.timeout_add

671

(timedelta_to_milliseconds

672

(timeout), self.disable))

669

self.disable_initiator_tag = gobject.timeout_add(

670

int(timeout.total_seconds() * 1000), self.disable)

673

671

self.expires = datetime.datetime.utcnow() + timeout

674

672

675

673

def need_approval(self):

706

704

# Start a new checker if needed

707

705

if self.checker is None:

708

706

# Escape attributes for the shell

709

escaped_attrs = dict(

710

(attr, re.escape(unicode(getattr(self, attr))))

711

for attr in

712

self.runtime_expansions)

707

escaped_attrs = {

708

attr: re.escape(str(getattr(self, attr)))

709

for attr in self.runtime_expansions }

713

710

try:

714

711

command = self.checker_command % escaped_attrs

715

712

except TypeError as error:

716

713

logger.error('Could not format string "%s"',

717

self.checker_command, exc_info=error)

718

return True # Try again later

714

self.checker_command,

715

exc_info=error)

716

return True # Try again later

719

717

self.current_checker_command = command

720

718

try:

721

logger.info("Starting checker %r for %s",

722

command, self.name)

719

logger.info("Starting checker %r for %s", command,

720

self.name)

723

721

# We don't need to redirect stdout and stderr, since

724

722

# in normal mode, that is already done by daemon(),

725

723

# and in debug mode we don't want to. (Stdin is

734

732

"stderr": wnull })

735

733

self.checker = subprocess.Popen(command,

736

734

close_fds=True,

737

shell=True, cwd="/",

735

shell=True,

736

cwd="/",

738

737

**popen_args)

739

738

except OSError as error:

740

739

logger.error("Failed to start subprocess",

741

740

exc_info=error)

742

741

return True

743

self.checker_callback_tag = (gobject.child_watch_add

744

(self.checker.pid,

745

self.checker_callback,

746

data=command))

742

self.checker_callback_tag = gobject.child_watch_add(

743

self.checker.pid, self.checker_callback, data=command)

747

744

# The checker may have completed before the gobject

748

745

# watch was added. Check for this.

749

746

try:

780

777

self.checker = None

781

778

782

779

783

def dbus_service_property(dbus_interface, signature="v",

784

access="readwrite", byte_arrays=False):

780

def dbus_service_property(dbus_interface,

781

signature="v",

782

access="readwrite",

783

byte_arrays=False):

785

784

"""Decorators for marking methods of a DBusObjectWithProperties to

786

785

become properties on the D-Bus.

787

786

796

795

# "Set" method, so we fail early here:

797

796

if byte_arrays and signature != "ay":

798

797

raise ValueError("Byte arrays not supported for non-'ay'"

799

" signature {0!r}".format(signature))

798

" signature {!r}".format(signature))

799

800

def decorator(func):

801

func._dbus_is_property = True

802

func._dbus_interface = dbus_interface

807

func._dbus_name = func._dbus_name[:-14]

808

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

809

return func

810

811

return decorator

811

812

813

821

822

"org.freedesktop.DBus.Property.EmitsChangedSignal":

822

823

"false"}

823

824

"""

825

824

826

def decorator(func):

825

827

func._dbus_is_interface = True

826

828

func._dbus_interface = dbus_interface

827

829

func._dbus_name = dbus_interface

828

830

return func

831

829

832

return decorator

830

833

831

834

833

836

"""Decorator to annotate D-Bus methods, signals or properties

834

837

Usage:

835

838

839

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

840

"org.freedesktop.DBus.Property."

841

"EmitsChangedSignal": "false"})

836

842

@dbus_service_property("org.example.Interface", signature="b",

837

843

access="r")

838

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

841

844

def Property_dbus_property(self):

842

845

return dbus.Boolean(False)

843

846

"""

847

844

848

def decorator(func):

845

849

func._dbus_annotations = annotations

846

850

return func

851

847

852

return decorator

848

853

849

854

850

855

class DBusPropertyException(dbus.exceptions.DBusException):

851

856

"""A base class for D-Bus property-related exceptions

852

857

"""

853

def __unicode__(self):

854

return unicode(str(self))

858

pass

855

859

856

860

857

861

class DBusPropertyAccessException(DBusPropertyException):

881

885

If called like _is_dbus_thing("method") it returns a function

882

886

suitable for use as predicate to inspect.getmembers().

883

887

"""

884

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

888

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

885

889

False)

886

890

887

891

def _get_all_dbus_things(self, thing):

888

892

"""Returns a generator of (name, attribute) pairs

889

893

"""

890

return ((getattr(athing.__get__(self), "_dbus_name",

891

name),

894

return ((getattr(athing.__get__(self), "_dbus_name", name),

892

895

athing.__get__(self))

893

896

for cls in self.__class__.__mro__

894

897

for name, athing in

895

inspect.getmembers(cls,

896

self._is_dbus_thing(thing)))

898

inspect.getmembers(cls, self._is_dbus_thing(thing)))

897

899

898

900

def _get_dbus_property(self, interface_name, property_name):

899

901

"""Returns a bound method if one exists which is a D-Bus

900

902

property with the specified name and interface.

901

903

"""

902

for cls in self.__class__.__mro__:

903

for name, value in (inspect.getmembers

904

(cls,

905

self._is_dbus_thing("property"))):

904

for cls in self.__class__.__mro__:

905

for name, value in inspect.getmembers(

906

cls, self._is_dbus_thing("property")):

906

907

if (value._dbus_name == property_name

907

908

and value._dbus_interface == interface_name):

908

909

return value.__get__(self)

909

910

911

# No such property

911

raise DBusPropertyNotFound(self.dbus_object_path + ":"

912

+ interface_name + "."

913

+ property_name)

912

raise DBusPropertyNotFound("{}:{}.{}".format(

913

self.dbus_object_path, interface_name, property_name))

914

915

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

915

@dbus.service.method(dbus.PROPERTIES_IFACE,

916

in_signature="ss",

916

917

out_signature="v")

917

918

def Get(self, interface_name, property_name):

918

919

"""Standard D-Bus property Get() method, see D-Bus standard.

937

938

# signatures other than "ay".

938

939

if prop._dbus_signature != "ay":

939

940

raise ValueError("Byte arrays not supported for non-"

940

"'ay' signature {0!r}"

941

"'ay' signature {!r}"

941

942

.format(prop._dbus_signature))

942

943

value = dbus.ByteArray(b''.join(chr(byte)

943

944

for byte in value))

944

945

prop(value)

945

946

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

947

@dbus.service.method(dbus.PROPERTIES_IFACE,

948

in_signature="s",

947

949

out_signature="a{sv}")

948

950

def GetAll(self, interface_name):

949

951

"""Standard D-Bus property GetAll() method, see D-Bus

964

966

if not hasattr(value, "variant_level"):

965

967

properties[name] = value

966

968

continue

967

properties[name] = type(value)(value, variant_level=

968

value.variant_level+1)

969

properties[name] = type(value)(

970

value, variant_level = value.variant_level + 1)

969

971

return dbus.Dictionary(properties, signature="sv")

970

972

973

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

974

def PropertiesChanged(self, interface_name, changed_properties,

975

invalidated_properties):

976

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

977

standard.

978

"""

979

pass

980

971

981

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

972

982

out_signature="s",

973

983

path_keyword='object_path',

981

991

connection)

982

992

try:

983

993

document = xml.dom.minidom.parseString(xmlstring)

994

984

995

def make_tag(document, name, prop):

985

996

e = document.createElement("property")

986

997

e.setAttribute("name", name)

987

998

e.setAttribute("type", prop._dbus_signature)

988

999

e.setAttribute("access", prop._dbus_access)

989

1000

return e

1001

990

1002

for if_tag in document.getElementsByTagName("interface"):

991

1003

# Add property tags

992

1004

for tag in (make_tag(document, name, prop)

1004

1016

if (name == tag.getAttribute("name")

1005

1017

and prop._dbus_interface

1006

1018

== if_tag.getAttribute("name")):

1007

annots.update(getattr

1008

(prop,

1009

"_dbus_annotations",

1010

{}))

1011

for name, value in annots.iteritems():

1019

annots.update(getattr(

1020

prop, "_dbus_annotations", {}))

1021

for name, value in annots.items():

1012

1022

ann_tag = document.createElement(

1013

1023

"annotation")

1014

1024

ann_tag.setAttribute("name", name)

1017

1027

# Add interface annotation tags

1018

1028

for annotation, value in dict(

1019

1029

itertools.chain.from_iterable(

1020

annotations().iteritems()

1021

for name, annotations in

1022

self._get_all_dbus_things("interface")

1030

annotations().items()

1031

for name, annotations

1032

in self._get_all_dbus_things("interface")

1023

1033

if name == if_tag.getAttribute("name")

1024

)).iteritems():

1034

)).items():

1025

1035

ann_tag = document.createElement("annotation")

1026

1036

ann_tag.setAttribute("name", annotation)

1027

1037

ann_tag.setAttribute("value", value)

1054

1064

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1055

1065

if dt is None:

1056

1066

return dbus.String("", variant_level = variant_level)

1057

return dbus.String(dt.isoformat(),

1058

variant_level=variant_level)

1067

return dbus.String(dt.isoformat(), variant_level=variant_level)

1059

1068

1060

1069

1061

1070

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1081

1090

(from DBusObjectWithProperties) and interfaces (from the

1082

1091

dbus_interface_annotations decorator).

1083

1092

"""

1093

1084

1094

def wrapper(cls):

1085

1095

for orig_interface_name, alt_interface_name in (

1086

alt_interface_names.iteritems()):

1096

alt_interface_names.items()):

1087

1097

attr = {}

1088

1098

interface_names = set()

1089

1099

# Go though all attributes of the class

1091

1101

# Ignore non-D-Bus attributes, and D-Bus attributes

1092

1102

# with the wrong interface name

1093

1103

if (not hasattr(attribute, "_dbus_interface")

1094

or not attribute._dbus_interface

1095

.startswith(orig_interface_name)):

1104

or not attribute._dbus_interface.startswith(

1105

orig_interface_name)):

1096

1106

continue

1097

1107

# Create an alternate D-Bus interface name based on

1098

1108

# the current name

1099

alt_interface = (attribute._dbus_interface

1100

.replace(orig_interface_name,

1101

alt_interface_name))

1109

alt_interface = attribute._dbus_interface.replace(

1110

orig_interface_name, alt_interface_name)

1102

1111

interface_names.add(alt_interface)

1103

1112

# Is this a D-Bus signal?

1104

1113

if getattr(attribute, "_dbus_is_signal", False):

1105

1114

# Extract the original non-method undecorated

1106

1115

# function by black magic

1107

1116

nonmethod_func = (dict(

1108

zip(attribute.func_code.co_freevars,

1109

attribute.__closure__))["func"]

1110

.cell_contents)

1117

zip(attribute.func_code.co_freevars,

1118

attribute.__closure__))

1119

["func"].cell_contents)

1111

1120

# Create a new, but exactly alike, function

1112

1121

# object, and decorate it to be a new D-Bus signal

1113

1122

# with the alternate D-Bus interface name

1114

new_function = (dbus.service.signal

1115

(alt_interface,

1116

attribute._dbus_signature)

1123

new_function = (dbus.service.signal(

1124

alt_interface, attribute._dbus_signature)

1117

1125

(types.FunctionType(

1118

nonmethod_func.func_code,

1119

nonmethod_func.func_globals,

1120

nonmethod_func.func_name,

1121

nonmethod_func.func_defaults,

1122

nonmethod_func.func_closure)))

1126

nonmethod_func.func_code,

1127

nonmethod_func.func_globals,

1128

nonmethod_func.func_name,

1129

nonmethod_func.func_defaults,

1130

nonmethod_func.func_closure)))

1123

1131

# Copy annotations, if any

1124

1132

try:

1125

new_function._dbus_annotations = (

1126

dict(attribute._dbus_annotations))

1133

new_function._dbus_annotations = dict(

1134

attribute._dbus_annotations)

1127

1135

except AttributeError:

1128

1136

pass

1129

1137

# Define a creator of a function to call both the

1134

1142

"""This function is a scope container to pass

1135

1143

func1 and func2 to the "call_both" function

1136

1144

outside of its arguments"""

1145

1137

1146

def call_both(*args, **kwargs):

1138

1147

"""This function will emit two D-Bus

1139

1148

signals by calling func1 and func2"""

1140

1149

func1(*args, **kwargs)

1141

1150

func2(*args, **kwargs)

1151

1142

1152

return call_both

1143

1153

# Create the "call_both" function and add it to

1144

1154

# the class

1149

1159

# object. Decorate it to be a new D-Bus method

1150

1160

# with the alternate D-Bus interface name. Add it

1151

1161

# to the class.

1152

attr[attrname] = (dbus.service.method

1153

(alt_interface,

1154

attribute._dbus_in_signature,

1155

attribute._dbus_out_signature)

1156

(types.FunctionType

1157

(attribute.func_code,

1158

attribute.func_globals,

1159

attribute.func_name,

1160

attribute.func_defaults,

1161

attribute.func_closure)))

1162

attr[attrname] = (

1163

dbus.service.method(

1164

alt_interface,

1165

attribute._dbus_in_signature,

1166

attribute._dbus_out_signature)

1167

(types.FunctionType(attribute.func_code,

1168

attribute.func_globals,

1169

attribute.func_name,

1170

attribute.func_defaults,

1171

attribute.func_closure)))

1162

1172

# Copy annotations, if any

1163

1173

try:

1164

attr[attrname]._dbus_annotations = (

1165

dict(attribute._dbus_annotations))

1174

attr[attrname]._dbus_annotations = dict(

1175

attribute._dbus_annotations)

1166

1176

except AttributeError:

1167

1177

pass

1168

1178

# Is this a D-Bus property?

1171

1181

# object, and decorate it to be a new D-Bus

1172

1182

# property with the alternate D-Bus interface

1173

1183

# name. Add it to the class.

1174

attr[attrname] = (dbus_service_property

1175

(alt_interface,

1176

attribute._dbus_signature,

1177

attribute._dbus_access,

1178

attribute

1179

._dbus_get_args_options

1180

["byte_arrays"])

1181

(types.FunctionType

1182

(attribute.func_code,

1183

attribute.func_globals,

1184

attribute.func_name,

1185

attribute.func_defaults,

1186

attribute.func_closure)))

1184

attr[attrname] = (dbus_service_property(

1185

alt_interface, attribute._dbus_signature,

1186

attribute._dbus_access,

1187

attribute._dbus_get_args_options

1188

["byte_arrays"])

1189

(types.FunctionType(

1190

attribute.func_code,

1191

attribute.func_globals,

1192

attribute.func_name,

1193

attribute.func_defaults,

1194

attribute.func_closure)))

1187

1195

# Copy annotations, if any

1188

1196

try:

1189

attr[attrname]._dbus_annotations = (

1190

dict(attribute._dbus_annotations))

1197

attr[attrname]._dbus_annotations = dict(

1198

attribute._dbus_annotations)

1191

1199

except AttributeError:

1192

1200

pass

1193

1201

# Is this a D-Bus interface?

1196

1204

# object. Decorate it to be a new D-Bus interface

1197

1205

# with the alternate D-Bus interface name. Add it

1198

1206

# to the class.

1199

attr[attrname] = (dbus_interface_annotations

1200

(alt_interface)

1201

(types.FunctionType

1202

(attribute.func_code,

1203

attribute.func_globals,

1204

attribute.func_name,

1205

attribute.func_defaults,

1206

attribute.func_closure)))

1207

attr[attrname] = (

1208

dbus_interface_annotations(alt_interface)

1209

(types.FunctionType(attribute.func_code,

1210

attribute.func_globals,

1211

attribute.func_name,

1212

attribute.func_defaults,

1213

attribute.func_closure)))

1207

1214

if deprecate:

1208

1215

# Deprecate all alternate interfaces

1209

iname="_AlternateDBusNames_interface_annotation{0}"

1216

iname="_AlternateDBusNames_interface_annotation{}"

1210

1217

for interface_name in interface_names:

1218

1211

1219

@dbus_interface_annotations(interface_name)

1212

1220

def func(self):

1213

1221

return { "org.freedesktop.DBus.Deprecated":

1214

"true" }

1222

"true" }

1215

1223

# Find an unused name

1216

1224

for aname in (iname.format(i)

1217

1225

for i in itertools.count()):

1221

1229

if interface_names:

1222

1230

# Replace the class with a new subclass of it with

1223

1231

# methods, signals, etc. as created above.

1224

cls = type(b"{0}Alternate".format(cls.__name__),

1225

(cls,), attr)

1232

cls = type(b"{}Alternate".format(cls.__name__),

1233

(cls, ), attr)

1226

1234

return cls

1235

1227

1236

return wrapper

1228

1237

1229

1238

1230

1239

@alternate_dbus_interfaces({"se.recompile.Mandos":

1231

"se.bsnet.fukt.Mandos"})

1240

"se.bsnet.fukt.Mandos"})

1232

1241

class ClientDBus(Client, DBusObjectWithProperties):

1233

1242

"""A Client class using D-Bus

1234

1243

1238

1247

"""

1239

1248

1240

1249

runtime_expansions = (Client.runtime_expansions

1241

+ ("dbus_object_path",))

1250

+ ("dbus_object_path", ))

1251

1252

_interface = "se.recompile.Mandos.Client"

1242

1253

1243

1254

# dbus.service.Object doesn't use super(), so we can't either.

1244

1255

1247

1258

Client.__init__(self, *args, **kwargs)

1248

1259

# Only now, when this client is initialized, can it show up on

1249

1260

# the D-Bus

1250

client_object_name = unicode(self.name).translate(

1261

client_object_name = str(self.name).translate(

1251

1262

{ord("."): ord("_"),

1252

1263

ord("-"): ord("_")})

1253

self.dbus_object_path = (dbus.ObjectPath

1254

("/clients/" + client_object_name))

1264

self.dbus_object_path = dbus.ObjectPath(

1265

"/clients/" + client_object_name)

1255

1266

DBusObjectWithProperties.__init__(self, self.bus,

1256

1267

self.dbus_object_path)

1257

1268

1258

def notifychangeproperty(transform_func,

1259

dbus_name, type_func=lambda x: x,

1260

variant_level=1):

1269

def notifychangeproperty(transform_func, dbus_name,

1270

type_func=lambda x: x,

1271

variant_level=1,

1272

invalidate_only=False,

1273

_interface=_interface):

1261

1274

""" Modify a variable so that it's a property which announces

1262

1275

its changes to DBus.

1263

1276

1268

1281

to the D-Bus. Default: no transform

1269

1282

variant_level: D-Bus variant level. Default: 1

1270

1283

"""

1271

attrname = "_{0}".format(dbus_name)

1284

attrname = "_{}".format(dbus_name)

1285

1272

1286

def setter(self, value):

1273

1287

if hasattr(self, "dbus_object_path"):

1274

1288

if (not hasattr(self, attrname) or

1275

1289

type_func(getattr(self, attrname, None))

1276

1290

!= type_func(value)):

1277

dbus_value = transform_func(type_func(value),

1278

variant_level

1279

=variant_level)

1280

self.PropertyChanged(dbus.String(dbus_name),

1281

dbus_value)

1291

if invalidate_only:

1292

self.PropertiesChanged(

1293

_interface, dbus.Dictionary(),

1294

dbus.Array((dbus_name, )))

1295

else:

1296

dbus_value = transform_func(

1297

type_func(value),

1298

variant_level = variant_level)

1299

self.PropertyChanged(dbus.String(dbus_name),

1300

dbus_value)

1301

self.PropertiesChanged(

1302

_interface,

1303

dbus.Dictionary({ dbus.String(dbus_name):

1304

dbus_value }),

1305

dbus.Array())

1282

1306

setattr(self, attrname, value)

1283

1307

1284

1308

return property(lambda self: getattr(self, attrname), setter)

1290

1314

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1291

1315

last_enabled = notifychangeproperty(datetime_to_dbus,

1292

1316

"LastEnabled")

1293

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1294

type_func = lambda checker:

1295

checker is not None)

1317

checker = notifychangeproperty(

1318

dbus.Boolean, "CheckerRunning",

1319

type_func = lambda checker: checker is not None)

1296

1320

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1297

1321

"LastCheckedOK")

1298

1322

last_checker_status = notifychangeproperty(dbus.Int16,

1301

1325

datetime_to_dbus, "LastApprovalRequest")

1302

1326

approved_by_default = notifychangeproperty(dbus.Boolean,

1303

1327

"ApprovedByDefault")

1304

approval_delay = notifychangeproperty(dbus.UInt64,

1305

"ApprovalDelay",

1306

type_func =

1307

timedelta_to_milliseconds)

1328

approval_delay = notifychangeproperty(

1329

dbus.UInt64, "ApprovalDelay",

1330

type_func = lambda td: td.total_seconds() * 1000)

1308

1331

approval_duration = notifychangeproperty(

1309

1332

dbus.UInt64, "ApprovalDuration",

1310

type_func = timedelta_to_milliseconds)

1333

type_func = lambda td: td.total_seconds() * 1000)

1311

1334

host = notifychangeproperty(dbus.String, "Host")

1312

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1313

type_func =

1314

timedelta_to_milliseconds)

1335

timeout = notifychangeproperty(

1336

dbus.UInt64, "Timeout",

1337

type_func = lambda td: td.total_seconds() * 1000)

1315

1338

extended_timeout = notifychangeproperty(

1316

1339

dbus.UInt64, "ExtendedTimeout",

1317

type_func = timedelta_to_milliseconds)

1318

interval = notifychangeproperty(dbus.UInt64,

1319

"Interval",

1320

type_func =

1321

timedelta_to_milliseconds)

1340

type_func = lambda td: td.total_seconds() * 1000)

1341

interval = notifychangeproperty(

1342

dbus.UInt64, "Interval",

1343

type_func = lambda td: td.total_seconds() * 1000)

1322

1344

checker_command = notifychangeproperty(dbus.String, "Checker")

1345

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1346

invalidate_only=True)

1323

1347

1324

1348

del notifychangeproperty

1325

1349

1352

1376

*args, **kwargs)

1353

1377

1354

1378

def start_checker(self, *args, **kwargs):

1355

old_checker = self.checker

1356

if self.checker is not None:

1357

old_checker_pid = self.checker.pid

1358

else:

1359

old_checker_pid = None

1379

old_checker_pid = getattr(self.checker, "pid", None)

1360

1380

r = Client.start_checker(self, *args, **kwargs)

1361

1381

# Only if new checker process was started

1362

1382

if (self.checker is not None

1371

1391

1372

1392

def approve(self, value=True):

1373

1393

self.approved = value

1374

gobject.timeout_add(timedelta_to_milliseconds

1375

(self.approval_duration),

1376

self._reset_approved)

1394

gobject.timeout_add(int(self.approval_duration.total_seconds()

1395

* 1000), self._reset_approved)

1377

1396

self.send_changedstate()

1378

1397

1379

1398

## D-Bus methods, signals & properties

1380

_interface = "se.recompile.Mandos.Client"

1381

1399

1382

1400

## Interfaces

1383

1401

1384

@dbus_interface_annotations(_interface)

1385

def _foo(self):

1386

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1387

"false"}

1388

1389

1402

## Signals

1390

1403

1391

1404

# CheckerCompleted - signal

1401

1414

pass

1402

1415

1403

1416

# PropertyChanged - signal

1417

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1404

1418

@dbus.service.signal(_interface, signature="sv")

1405

1419

def PropertyChanged(self, property, value):

1406

1420

"D-Bus signal"

1470

1484

return dbus.Boolean(bool(self.approvals_pending))

1471

1485

1472

1486

# ApprovedByDefault - property

1473

@dbus_service_property(_interface, signature="b",

1487

@dbus_service_property(_interface,

1488

signature="b",

1474

1489

access="readwrite")

1475

1490

def ApprovedByDefault_dbus_property(self, value=None):

1476

1491

if value is None: # get

1478

1493

self.approved_by_default = bool(value)

1479

1494

1480

1495

# ApprovalDelay - property

1481

@dbus_service_property(_interface, signature="t",

1496

@dbus_service_property(_interface,

1497

signature="t",

1482

1498

access="readwrite")

1483

1499

def ApprovalDelay_dbus_property(self, value=None):

1484

1500

if value is None: # get

1485

return dbus.UInt64(self.approval_delay_milliseconds())

1501

return dbus.UInt64(self.approval_delay.total_seconds()

1502

* 1000)

1486

1503

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1487

1504

1488

1505

# ApprovalDuration - property

1489

@dbus_service_property(_interface, signature="t",

1506

@dbus_service_property(_interface,

1507

signature="t",

1490

1508

access="readwrite")

1491

1509

def ApprovalDuration_dbus_property(self, value=None):

1492

1510

if value is None: # get

1493

return dbus.UInt64(timedelta_to_milliseconds(

1494

self.approval_duration))

1511

return dbus.UInt64(self.approval_duration.total_seconds()

1512

* 1000)

1495

1513

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1496

1514

1497

1515

# Name - property

1505

1523

return dbus.String(self.fingerprint)

1506

1524

1507

1525

# Host - property

1508

@dbus_service_property(_interface, signature="s",

1526

@dbus_service_property(_interface,

1527

signature="s",

1509

1528

access="readwrite")

1510

1529

def Host_dbus_property(self, value=None):

1511

1530

if value is None: # get

1512

1531

return dbus.String(self.host)

1513

self.host = unicode(value)

1532

self.host = str(value)

1514

1533

1515

1534

# Created - property

1516

1535

@dbus_service_property(_interface, signature="s", access="read")

1523

1542

return datetime_to_dbus(self.last_enabled)

1524

1543

1525

1544

# Enabled - property

1526

@dbus_service_property(_interface, signature="b",

1545

@dbus_service_property(_interface,

1546

signature="b",

1527

1547

access="readwrite")

1528

1548

def Enabled_dbus_property(self, value=None):

1529

1549

if value is None: # get

1534

1554

self.disable()

1535

1555

1536

1556

# LastCheckedOK - property

1537

@dbus_service_property(_interface, signature="s",

1557

@dbus_service_property(_interface,

1558

signature="s",

1538

1559

access="readwrite")

1539

1560

def LastCheckedOK_dbus_property(self, value=None):

1540

1561

if value is not None:

1543

1564

return datetime_to_dbus(self.last_checked_ok)

1544

1565

1545

1566

# LastCheckerStatus - property

1546

@dbus_service_property(_interface, signature="n",

1547

access="read")

1567

@dbus_service_property(_interface, signature="n", access="read")

1548

1568

def LastCheckerStatus_dbus_property(self):

1549

1569

return dbus.Int16(self.last_checker_status)

1550

1570

1559

1579

return datetime_to_dbus(self.last_approval_request)

1560

1580

1561

1581

# Timeout - property

1562

@dbus_service_property(_interface, signature="t",

1582

@dbus_service_property(_interface,

1583

signature="t",

1563

1584

access="readwrite")

1564

1585

def Timeout_dbus_property(self, value=None):

1565

1586

if value is None: # get

1566

return dbus.UInt64(self.timeout_milliseconds())

1587

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1567

1588

old_timeout = self.timeout

1568

1589

self.timeout = datetime.timedelta(0, 0, 0, value)

1569

1590

# Reschedule disabling

1578

1599

is None):

1579

1600

return

1580

1601

gobject.source_remove(self.disable_initiator_tag)

1581

self.disable_initiator_tag = (

1582

gobject.timeout_add(

1583

timedelta_to_milliseconds(self.expires - now),

1584

self.disable))

1602

self.disable_initiator_tag = gobject.timeout_add(

1603

int((self.expires - now).total_seconds() * 1000),

1604

self.disable)

1585

1605

1586

1606

# ExtendedTimeout - property

1587

@dbus_service_property(_interface, signature="t",

1607

@dbus_service_property(_interface,

1608

signature="t",

1588

1609

access="readwrite")

1589

1610

def ExtendedTimeout_dbus_property(self, value=None):

1590

1611

if value is None: # get

1591

return dbus.UInt64(self.extended_timeout_milliseconds())

1612

return dbus.UInt64(self.extended_timeout.total_seconds()

1613

* 1000)

1592

1614

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1593

1615

1594

1616

# Interval - property

1595

@dbus_service_property(_interface, signature="t",

1617

@dbus_service_property(_interface,

1618

signature="t",

1596

1619

access="readwrite")

1597

1620

def Interval_dbus_property(self, value=None):

1598

1621

if value is None: # get

1599

return dbus.UInt64(self.interval_milliseconds())

1622

return dbus.UInt64(self.interval.total_seconds() * 1000)

1600

1623

self.interval = datetime.timedelta(0, 0, 0, value)

1601

1624

if getattr(self, "checker_initiator_tag", None) is None:

1602

1625

return

1603

1626

if self.enabled:

1604

1627

# Reschedule checker run

1605

1628

gobject.source_remove(self.checker_initiator_tag)

1606

self.checker_initiator_tag = (gobject.timeout_add

1607

(value, self.start_checker))

1608

self.start_checker() # Start one now, too

1629

self.checker_initiator_tag = gobject.timeout_add(

1630

value, self.start_checker)

1631

self.start_checker() # Start one now, too

1609

1632

1610

1633

# Checker - property

1611

@dbus_service_property(_interface, signature="s",

1634

@dbus_service_property(_interface,

1635

signature="s",

1612

1636

access="readwrite")

1613

1637

def Checker_dbus_property(self, value=None):

1614

1638

if value is None: # get

1615

1639

return dbus.String(self.checker_command)

1616

self.checker_command = unicode(value)

1640

self.checker_command = str(value)

1617

1641

1618

1642

# CheckerRunning - property

1619

@dbus_service_property(_interface, signature="b",

1643

@dbus_service_property(_interface,

1644

signature="b",

1620

1645

access="readwrite")

1621

1646

def CheckerRunning_dbus_property(self, value=None):

1622

1647

if value is None: # get

1632

1657

return self.dbus_object_path # is already a dbus.ObjectPath

1633

1658

1634

1659

# Secret = property

1635

@dbus_service_property(_interface, signature="ay",

1636

access="write", byte_arrays=True)

1660

@dbus_service_property(_interface,

1661

signature="ay",

1662

access="write",

1663

byte_arrays=True)

1637

1664

def Secret_dbus_property(self, value):

1638

self.secret = str(value)

1665

self.secret = bytes(value)

1639

1666

1640

1667

del _interface

1641

1668

1645

1672

self._pipe = child_pipe

1646

1673

self._pipe.send(('init', fpr, address))

1647

1674

if not self._pipe.recv():

1648

raise KeyError()

1675

raise KeyError(fpr)

1649

1676

1650

1677

def __getattribute__(self, name):

1651

1678

if name == '_pipe':

1655

1682

if data[0] == 'data':

1656

1683

return data[1]

1657

1684

if data[0] == 'function':

1685

1658

1686

def func(*args, **kwargs):

1659

1687

self._pipe.send(('funcall', name, args, kwargs))

1660

1688

return self._pipe.recv()[1]

1689

1661

1690

return func

1662

1691

1663

1692

def __setattr__(self, name, value):

1675

1704

def handle(self):

1676

1705

with contextlib.closing(self.server.child_pipe) as child_pipe:

1677

1706

logger.info("TCP connection from: %s",

1678

unicode(self.client_address))

1707

str(self.client_address))

1679

1708

logger.debug("Pipe FD: %d",

1680

1709

self.server.child_pipe.fileno())

1681

1710

1682

session = (gnutls.connection

1683

.ClientSession(self.request,

1684

gnutls.connection

1685

.X509Credentials()))

1711

session = gnutls.connection.ClientSession(

1712

self.request, gnutls.connection .X509Credentials())

1686

1713

1687

1714

# Note: gnutls.connection.X509Credentials is really a

1688

1715

# generic GnuTLS certificate credentials object so long as

1697

1724

priority = self.server.gnutls_priority

1698

1725

if priority is None:

1699

1726

priority = "NORMAL"

1700

(gnutls.library.functions

1701

.gnutls_priority_set_direct(session._c_object,

1702

priority, None))

1727

gnutls.library.functions.gnutls_priority_set_direct(

1728

session._c_object, priority, None)

1703

1729

1704

1730

# Start communication using the Mandos protocol

1705

1731

# Get protocol number

1725

1751

approval_required = False

1726

1752

try:

1727

1753

try:

1728

fpr = self.fingerprint(self.peer_certificate

1729

(session))

1754

fpr = self.fingerprint(

1755

self.peer_certificate(session))

1730

1756

except (TypeError,

1731

1757

gnutls.errors.GNUTLSError) as error:

1732

1758

logger.warning("Bad certificate: %s", error)

1747

1773

while True:

1748

1774

if not client.enabled:

1749

1775

logger.info("Client %s is disabled",

1750

client.name)

1776

client.name)

1751

1777

if self.server.use_dbus:

1752

1778

# Emit D-Bus signal

1753

1779

client.Rejected("Disabled")

1762

1788

if self.server.use_dbus:

1763

1789

# Emit D-Bus signal

1764

1790

client.NeedApproval(

1765

client.approval_delay_milliseconds(),

1766

client.approved_by_default)

1791

client.approval_delay.total_seconds()

1792

* 1000, client.approved_by_default)

1767

1793

else:

1768

1794

logger.warning("Client %s was not approved",

1769

1795

client.name)

1775

1801

#wait until timeout or approved

1776

1802

time = datetime.datetime.now()

1777

1803

client.changedstate.acquire()

1778

client.changedstate.wait(

1779

float(timedelta_to_milliseconds(delay)

1780

/ 1000))

1804

client.changedstate.wait(delay.total_seconds())

1781

1805

client.changedstate.release()

1782

1806

time2 = datetime.datetime.now()

1783

1807

if (time2 - time) >= delay:

1802

1826

logger.warning("gnutls send failed",

1803

1827

exc_info=error)

1804

1828

return

1805

logger.debug("Sent: %d, remaining: %d",

1806

sent, len(client.secret)

1807

- (sent_size + sent))

1829

logger.debug("Sent: %d, remaining: %d", sent,

1830

len(client.secret) - (sent_size

1831

+ sent))

1808

1832

sent_size += sent

1809

1833

1810

1834

logger.info("Sending secret to %s", client.name)

1827

1851

def peer_certificate(session):

1828

1852

"Return the peer's OpenPGP certificate as a bytestring"

1829

1853

# If not an OpenPGP certificate...

1830

if (gnutls.library.functions

1831

.gnutls_certificate_type_get(session._c_object)

1854

if (gnutls.library.functions.gnutls_certificate_type_get(

1855

session._c_object)

1832

1856

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1833

1857

# ...do the normal thing

1834

1858

return session.peer_certificate

1848

1872

def fingerprint(openpgp):

1849

1873

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1850

1874

# New GnuTLS "datum" with the OpenPGP public key

1851

datum = (gnutls.library.types

1852

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1853

ctypes.POINTER

1854

(ctypes.c_ubyte)),

1855

ctypes.c_uint(len(openpgp))))

1875

datum = gnutls.library.types.gnutls_datum_t(

1876

ctypes.cast(ctypes.c_char_p(openpgp),

1877

ctypes.POINTER(ctypes.c_ubyte)),

1878

ctypes.c_uint(len(openpgp)))

1856

1879

# New empty GnuTLS certificate

1857

1880

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1858

(gnutls.library.functions

1859

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1881

gnutls.library.functions.gnutls_openpgp_crt_init(

1882

ctypes.byref(crt))

1860

1883

# Import the OpenPGP public key into the certificate

1861

(gnutls.library.functions

1862

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1863

gnutls.library.constants

1864

.GNUTLS_OPENPGP_FMT_RAW))

1884

gnutls.library.functions.gnutls_openpgp_crt_import(

1885

crt, ctypes.byref(datum),

1886

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1865

1887

# Verify the self signature in the key

1866

1888

crtverify = ctypes.c_uint()

1867

(gnutls.library.functions

1868

.gnutls_openpgp_crt_verify_self(crt, 0,

1869

ctypes.byref(crtverify)))

1889

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1890

crt, 0, ctypes.byref(crtverify))

1870

1891

if crtverify.value != 0:

1871

1892

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1872

raise (gnutls.errors.CertificateSecurityError

1873

("Verify failed"))

1893

raise gnutls.errors.CertificateSecurityError(

1894

"Verify failed")

1874

1895

# New buffer for the fingerprint

1875

1896

buf = ctypes.create_string_buffer(20)

1876

1897

buf_len = ctypes.c_size_t()

1877

1898

# Get the fingerprint from the certificate into the buffer

1878

(gnutls.library.functions

1879

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1880

ctypes.byref(buf_len)))

1899

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1900

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1881

1901

# Deinit the certificate

1882

1902

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1883

1903

# Convert the buffer to a Python bytestring

1889

1909

1890

1910

class MultiprocessingMixIn(object):

1891

1911

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1912

1892

1913

def sub_process_main(self, request, address):

1893

1914

try:

1894

1915

self.finish_request(request, address)

1906

1927

1907

1928

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1908

1929

""" adds a pipe to the MixIn """

1930

1909

1931

def process_request(self, request, client_address):

1910

1932

"""Overrides and wraps the original process_request().

1911

1933

1932

1954

interface: None or a network interface name (string)

1933

1955

use_ipv6: Boolean; to use IPv6 or not

1934

1956

"""

1957

1935

1958

def __init__(self, server_address, RequestHandlerClass,

1936

interface=None, use_ipv6=True, socketfd=None):

1959

interface=None,

1960

use_ipv6=True,

1961

socketfd=None):

1937

1962

"""If socketfd is set, use that file descriptor instead of

1938

1963

creating a new one with socket.socket().

1939

1964

"""

1980

2005

self.interface)

1981

2006

else:

1982

2007

try:

1983

self.socket.setsockopt(socket.SOL_SOCKET,

1984

SO_BINDTODEVICE,

1985

str(self.interface + '\0'))

2008

self.socket.setsockopt(

2009

socket.SOL_SOCKET, SO_BINDTODEVICE,

2010

(self.interface + "\0").encode("utf-8"))

1986

2011

except socket.error as error:

1987

2012

if error.errno == errno.EPERM:

1988

2013

logger.error("No permission to bind to"

2006

2031

self.server_address = (any_address,

2007

2032

self.server_address[1])

2008

2033

elif not self.server_address[1]:

2009

self.server_address = (self.server_address[0],

2010

0)

2034

self.server_address = (self.server_address[0], 0)

2011

2035

# if self.interface:

2012

2036

# self.server_address = (self.server_address[0],

2013

2037

# 0, # port

2027

2051

2028

2052

Assumes a gobject.MainLoop event loop.

2029

2053

"""

2054

2030

2055

def __init__(self, server_address, RequestHandlerClass,

2031

interface=None, use_ipv6=True, clients=None,

2032

gnutls_priority=None, use_dbus=True, socketfd=None):

2056

interface=None,

2057

use_ipv6=True,

2058

clients=None,

2059

gnutls_priority=None,

2060

use_dbus=True,

2061

socketfd=None):

2033

2062

self.enabled = False

2034

2063

self.clients = clients

2035

2064

if self.clients is None:

2041

2070

interface = interface,

2042

2071

use_ipv6 = use_ipv6,

2043

2072

socketfd = socketfd)

2073

2044

2074

def server_activate(self):

2045

2075

if self.enabled:

2046

2076

return socketserver.TCPServer.server_activate(self)

2050

2080

2051

2081

def add_pipe(self, parent_pipe, proc):

2052

2082

# Call "handle_ipc" for both data and EOF events

2053

gobject.io_add_watch(parent_pipe.fileno(),

2054

gobject.IO_IN | gobject.IO_HUP,

2055

functools.partial(self.handle_ipc,

2056

parent_pipe =

2057

parent_pipe,

2058

proc = proc))

2083

gobject.io_add_watch(

2084

parent_pipe.fileno(),

2085

gobject.IO_IN | gobject.IO_HUP,

2086

functools.partial(self.handle_ipc,

2087

parent_pipe = parent_pipe,

2088

proc = proc))

2059

2089

2060

def handle_ipc(self, source, condition, parent_pipe=None,

2061

proc = None, client_object=None):

2090

def handle_ipc(self, source, condition,

2091

parent_pipe=None,

2092

proc = None,

2093

client_object=None):

2062

2094

# error, or the other end of multiprocessing.Pipe has closed

2063

2095

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2064

2096

# Wait for other process to exit

2087

2119

parent_pipe.send(False)

2088

2120

return False

2089

2121

2090

gobject.io_add_watch(parent_pipe.fileno(),

2091

gobject.IO_IN | gobject.IO_HUP,

2092

functools.partial(self.handle_ipc,

2093

parent_pipe =

2094

parent_pipe,

2095

proc = proc,

2096

client_object =

2097

client))

2122

gobject.io_add_watch(

2123

parent_pipe.fileno(),

2124

gobject.IO_IN | gobject.IO_HUP,

2125

functools.partial(self.handle_ipc,

2126

parent_pipe = parent_pipe,

2127

proc = proc,

2128

client_object = client))

2098

2129

parent_pipe.send(True)

2099

2130

# remove the old hook in favor of the new above hook on

2100

2131

# same fileno

2106

2137

2107

2138

parent_pipe.send(('data', getattr(client_object,

2108

2139

funcname)(*args,

2109

**kwargs)))

2140

**kwargs)))

2110

2141

2111

2142

if command == 'getattr':

2112

2143

attrname = request[1]

2113

2144

if callable(client_object.__getattribute__(attrname)):

2114

parent_pipe.send(('function',))

2145

parent_pipe.send(('function', ))

2115

2146

else:

2116

parent_pipe.send(('data', client_object

2117

.__getattribute__(attrname)))

2147

parent_pipe.send((

2148

'data', client_object.__getattribute__(attrname)))

2118

2149

2119

2150

if command == 'setattr':

2120

2151

attrname = request[1]

2151

2182

# avoid excessive use of external libraries.

2152

2183

2153

2184

# New type for defining tokens, syntax, and semantics all-in-one

2154

Token = collections.namedtuple("Token",

2155

("regexp", # To match token; if

2156

# "value" is not None,

2157

# must have a "group"

2158

# containing digits

2159

"value", # datetime.timedelta or

2160

# None

2161

"followers")) # Tokens valid after

2162

# this token

2185

Token = collections.namedtuple("Token", (

2186

"regexp", # To match token; if "value" is not None, must have

2187

# a "group" containing digits

2188

"value", # datetime.timedelta or None

2189

"followers")) # Tokens valid after this token

2163

2190

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2164

2191

# the "duration" ABNF definition in RFC 3339, Appendix A.

2165

2192

token_end = Token(re.compile(r"$"), None, frozenset())

2166

2193

token_second = Token(re.compile(r"(\d+)S"),

2167

2194

datetime.timedelta(seconds=1),

2168

frozenset((token_end,)))

2195

frozenset((token_end, )))

2169

2196

token_minute = Token(re.compile(r"(\d+)M"),

2170

2197

datetime.timedelta(minutes=1),

2171

2198

frozenset((token_second, token_end)))

2187

2214

frozenset((token_month, token_end)))

2188

2215

token_week = Token(re.compile(r"(\d+)W"),

2189

2216

datetime.timedelta(weeks=1),

2190

frozenset((token_end,)))

2217

frozenset((token_end, )))

2191

2218

token_duration = Token(re.compile(r"P"), None,

2192

2219

frozenset((token_year, token_month,

2193

2220

token_day, token_time,

2194

token_week))),

2221

token_week)))

2195

2222

# Define starting values

2196

2223

value = datetime.timedelta() # Value so far

2197

2224

found_token = None

2198

followers = frozenset(token_duration,) # Following valid tokens

2225

followers = frozenset((token_duration, )) # Following valid tokens

2199

2226

s = duration # String left to parse

2200

2227

# Loop until end token is found

2201

2228

while found_token is not token_end:

2218

2245

break

2219

2246

else:

2220

2247

# No currently valid tokens were found

2221

raise ValueError("Invalid RFC 3339 duration")

2248

raise ValueError("Invalid RFC 3339 duration: {!r}"

2249

.format(duration))

2222

2250

# End token found

2223

2251

return value

2224

2252

2248

2276

timevalue = datetime.timedelta(0)

2249

2277

for s in interval.split():

2250

2278

try:

2251

suffix = unicode(s[-1])

2279

suffix = s[-1]

2252

2280

value = int(s[:-1])

2253

2281

if suffix == "d":

2254

2282

delta = datetime.timedelta(value)

2261

2289

elif suffix == "w":

2262

2290

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2263

2291

else:

2264

raise ValueError("Unknown suffix {0!r}"

2265

.format(suffix))

2292

raise ValueError("Unknown suffix {!r}".format(suffix))

2266

2293

except IndexError as e:

2267

2294

raise ValueError(*(e.args))

2268

2295

timevalue += delta

2285

2312

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2286

2313

if not stat.S_ISCHR(os.fstat(null).st_mode):

2287

2314

raise OSError(errno.ENODEV,

2288

"{0} not a character device"

2315

"{} not a character device"

2289

2316

.format(os.devnull))

2290

2317

os.dup2(null, sys.stdin.fileno())

2291

2318

os.dup2(null, sys.stdout.fileno())

2301

2328

2302

2329

parser = argparse.ArgumentParser()

2303

2330

parser.add_argument("-v", "--version", action="version",

2304

version = "%(prog)s {0}".format(version),

2331

version = "%(prog)s {}".format(version),

2305

2332

help="show version number and exit")

2306

2333

parser.add_argument("-i", "--interface", metavar="IF",

2307

2334

help="Bind to interface IF")

2340

2367

help="Directory to save/restore state in")

2341

2368

parser.add_argument("--foreground", action="store_true",

2342

2369

help="Run in foreground", default=None)

2370

parser.add_argument("--no-zeroconf", action="store_false",

2371

dest="zeroconf", help="Do not use Zeroconf",

2372

default=None)

2343

2373

2344

2374

options = parser.parse_args()

2345

2375

2354

2384

"port": "",

2355

2385

"debug": "False",

2356

2386

"priority":

2357

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2387

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2388

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2358

2389

"servicename": "Mandos",

2359

2390

"use_dbus": "True",

2360

2391

"use_ipv6": "True",

2363

2394

"socket": "",

2364

2395

"statedir": "/var/lib/mandos",

2365

2396

"foreground": "False",

2366

}

2397

"zeroconf": "True",

2398

}

2367

2399

2368

2400

# Parse config file for server-global settings

2369

2401

server_config = configparser.SafeConfigParser(server_defaults)

2370

2402

del server_defaults

2371

server_config.read(os.path.join(options.configdir,

2372

"mandos.conf"))

2403

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2373

2404

# Convert the SafeConfigParser object to a dict

2374

2405

server_settings = server_config.defaults()

2375

2406

# Use the appropriate methods on the non-string config options

2393

2424

# Override the settings from the config file with command line

2394

2425

# options, if set.

2395

2426

for option in ("interface", "address", "port", "debug",

2396

"priority", "servicename", "configdir",

2397

"use_dbus", "use_ipv6", "debuglevel", "restore",

2398

"statedir", "socket", "foreground"):

2427

"priority", "servicename", "configdir", "use_dbus",

2428

"use_ipv6", "debuglevel", "restore", "statedir",

2429

"socket", "foreground", "zeroconf"):

2399

2430

value = getattr(options, option)

2400

2431

if value is not None:

2401

2432

server_settings[option] = value

2402

2433

del options

2403

2434

# Force all strings to be unicode

2404

2435

for option in server_settings.keys():

2405

if type(server_settings[option]) is str:

2406

server_settings[option] = unicode(server_settings[option])

2436

if isinstance(server_settings[option], bytes):

2437

server_settings[option] = (server_settings[option]

2438

.decode("utf-8"))

2407

2439

# Force all boolean options to be boolean

2408

2440

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2409

"foreground"):

2441

"foreground", "zeroconf"):

2410

2442

server_settings[option] = bool(server_settings[option])

2411

2443

# Debug implies foreground

2412

2444

if server_settings["debug"]:

2415

2447

2416

2448

##################################################################

2417

2449

2450

if (not server_settings["zeroconf"]

2451

and not (server_settings["port"]

2452

or server_settings["socket"] != "")):

2453

parser.error("Needs port or socket to work without Zeroconf")

2454

2418

2455

# For convenience

2419

2456

debug = server_settings["debug"]

2420

2457

debuglevel = server_settings["debuglevel"]

2423

2460

stored_state_path = os.path.join(server_settings["statedir"],

2424

2461

stored_state_file)

2425

2462

foreground = server_settings["foreground"]

2463

zeroconf = server_settings["zeroconf"]

2426

2464

2427

2465

if debug:

2428

2466

initlogger(debug, logging.DEBUG)

2434

2472

initlogger(debug, level)

2435

2473

2436

2474

if server_settings["servicename"] != "Mandos":

2437

syslogger.setFormatter(logging.Formatter

2438

('Mandos ({0}) [%(process)d]:'

2439

' %(levelname)s: %(message)s'

2440

.format(server_settings

2441

["servicename"])))

2475

syslogger.setFormatter(

2476

logging.Formatter('Mandos ({}) [%(process)d]:'

2477

' %(levelname)s: %(message)s'.format(

2478

server_settings["servicename"])))

2442

2479

2443

2480

# Parse config file with clients

2444

2481

client_config = configparser.SafeConfigParser(Client

2449

2486

global mandos_dbus_service

2450

2487

mandos_dbus_service = None

2451

2488

2452

tcp_server = MandosServer((server_settings["address"],

2453

server_settings["port"]),

2454

ClientHandler,

2455

interface=(server_settings["interface"]

2456

or None),

2457

use_ipv6=use_ipv6,

2458

gnutls_priority=

2459

server_settings["priority"],

2460

use_dbus=use_dbus,

2461

socketfd=(server_settings["socket"]

2462

or None))

2489

socketfd = None

2490

if server_settings["socket"] != "":

2491

socketfd = server_settings["socket"]

2492

tcp_server = MandosServer(

2493

(server_settings["address"], server_settings["port"]),

2494

ClientHandler,

2495

interface=(server_settings["interface"] or None),

2496

use_ipv6=use_ipv6,

2497

gnutls_priority=server_settings["priority"],

2498

use_dbus=use_dbus,

2499

socketfd=socketfd)

2463

2500

if not foreground:

2464

2501

pidfilename = "/run/mandos.pid"

2465

2502

if not os.path.isdir("/run/."):

2466

2503

pidfilename = "/var/run/mandos.pid"

2467

2504

pidfile = None

2468

2505

try:

2469

pidfile = open(pidfilename, "w")

2506

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2470

2507

except IOError as e:

2471

2508

logger.error("Could not open file %r", pidfilename,

2472

2509

exc_info=e)

2499

2536

def debug_gnutls(level, string):

2500

2537

logger.debug("GnuTLS: %s", string[:-1])

2501

2538

2502

(gnutls.library.functions

2503

.gnutls_global_set_log_function(debug_gnutls))

2539

gnutls.library.functions.gnutls_global_set_log_function(

2540

debug_gnutls)

2504

2541

2505

2542

# Redirect stdin so all checkers get /dev/null

2506

2543

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2526

2563

if use_dbus:

2527

2564

try:

2528

2565

bus_name = dbus.service.BusName("se.recompile.Mandos",

2529

bus, do_not_queue=True)

2530

old_bus_name = (dbus.service.BusName

2531

("se.bsnet.fukt.Mandos", bus,

2532

do_not_queue=True))

2533

except dbus.exceptions.NameExistsException as e:

2566

bus,

2567

do_not_queue=True)

2568

old_bus_name = dbus.service.BusName(

2569

"se.bsnet.fukt.Mandos", bus,

2570

do_not_queue=True)

2571

except dbus.exceptions.DBusException as e:

2534

2572

logger.error("Disabling D-Bus:", exc_info=e)

2535

2573

use_dbus = False

2536

2574

server_settings["use_dbus"] = False

2537

2575

tcp_server.use_dbus = False

2538

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2539

service = AvahiServiceToSyslog(name =

2540

server_settings["servicename"],

2541

servicetype = "_mandos._tcp",

2542

protocol = protocol, bus = bus)

2543

if server_settings["interface"]:

2544

service.interface = (if_nametoindex

2545

(str(server_settings["interface"])))

2576

if zeroconf:

2577

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2578

service = AvahiServiceToSyslog(

2579

name = server_settings["servicename"],

2580

servicetype = "_mandos._tcp",

2581

protocol = protocol,

2582

bus = bus)

2583

if server_settings["interface"]:

2584

service.interface = if_nametoindex(

2585

server_settings["interface"].encode("utf-8"))

2546

2586

2547

2587

global multiprocessing_manager

2548

2588

multiprocessing_manager = multiprocessing.Manager()

2567

2607

if server_settings["restore"]:

2568

2608

try:

2569

2609

with open(stored_state_path, "rb") as stored_state:

2570

clients_data, old_client_settings = (pickle.load

2571

(stored_state))

2610

clients_data, old_client_settings = pickle.load(

2611

stored_state)

2572

2612

os.remove(stored_state_path)

2573

2613

except IOError as e:

2574

2614

if e.errno == errno.ENOENT:

2575

logger.warning("Could not load persistent state: {0}"

2576

.format(os.strerror(e.errno)))

2615

logger.warning("Could not load persistent state:"

2616

" {}".format(os.strerror(e.errno)))

2577

2617

else:

2578

2618

logger.critical("Could not load persistent state:",

2579

2619

exc_info=e)

2580

2620

raise

2581

2621

except EOFError as e:

2582

2622

logger.warning("Could not load persistent state: "

2583

"EOFError:", exc_info=e)

2623

"EOFError:",

2624

exc_info=e)

2584

2625

2585

2626

with PGPEngine() as pgp:

2586

for client_name, client in clients_data.iteritems():

2627

for client_name, client in clients_data.items():

2587

2628

# Skip removed clients

2588

2629

if client_name not in client_settings:

2589

2630

continue

2598

2639

# For each value in new config, check if it

2599

2640

# differs from the old config value (Except for

2600

2641

# the "secret" attribute)

2601

if (name != "secret" and

2602

value != old_client_settings[client_name]

2603

[name]):

2642

if (name != "secret"

2643

and (value !=

2644

old_client_settings[client_name][name])):

2604

2645

client[name] = value

2605

2646

except KeyError:

2606

2647

pass

2614

2655

if datetime.datetime.utcnow() >= client["expires"]:

2615

2656

if not client["last_checked_ok"]:

2616

2657

logger.warning(

2617

"disabling client {0} - Client never "

2618

"performed a successful checker"

2619

.format(client_name))

2658

"disabling client {} - Client never "

2659

"performed a successful checker".format(

2660

client_name))

2620

2661

client["enabled"] = False

2621

2662

elif client["last_checker_status"] != 0:

2622

2663

logger.warning(

2623

"disabling client {0} - Client "

2624

"last checker failed with error code {1}"

2625

.format(client_name,

2626

client["last_checker_status"]))

2664

"disabling client {} - Client last"

2665

" checker failed with error code"

2666

" {}".format(

2667

client_name,

2668

client["last_checker_status"]))

2627

2669

client["enabled"] = False

2628

2670

else:

2629

client["expires"] = (datetime.datetime

2630

.utcnow()

2631

+ client["timeout"])

2671

client["expires"] = (

2672

datetime.datetime.utcnow()

2673

+ client["timeout"])

2632

2674

logger.debug("Last checker succeeded,"

2633

" keeping {0} enabled"

2634

.format(client_name))

2675

" keeping {} enabled".format(

2676

client_name))

2635

2677

try:

2636

client["secret"] = (

2637

pgp.decrypt(client["encrypted_secret"],

2638

client_settings[client_name]

2639

["secret"]))

2678

client["secret"] = pgp.decrypt(

2679

client["encrypted_secret"],

2680

client_settings[client_name]["secret"])

2640

2681

except PGPError:

2641

2682

# If decryption fails, we use secret from new settings

2642

logger.debug("Failed to decrypt {0} old secret"

2643

.format(client_name))

2644

client["secret"] = (

2645

client_settings[client_name]["secret"])

2683

logger.debug("Failed to decrypt {} old secret".format(

2684

client_name))

2685

client["secret"] = (client_settings[client_name]

2686

["secret"])

2646

2687

2647

2688

# Add/remove clients based on new changes made to config

2648

2689

for client_name in (set(old_client_settings)

2653

2694

clients_data[client_name] = client_settings[client_name]

2654

2695

2655

2696

# Create all client objects

2656

for client_name, client in clients_data.iteritems():

2697

for client_name, client in clients_data.items():

2657

2698

tcp_server.clients[client_name] = client_class(

2658

name = client_name, settings = client,

2699

name = client_name,

2700

settings = client,

2659

2701

server_settings = server_settings)

2660

2702

2661

2703

if not tcp_server.clients:

2663

2705

2664

2706

if not foreground:

2665

2707

if pidfile is not None:

2708

pid = os.getpid()

2666

2709

try:

2667

2710

with pidfile:

2668

pid = os.getpid()

2669

pidfile.write(str(pid) + "\n".encode("utf-8"))

2711

print(pid, file=pidfile)

2670

2712

except IOError:

2671

2713

logger.error("Could not write to file %r with PID %d",

2672

2714

pidfilename, pid)

2677

2719

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2678

2720

2679

2721

if use_dbus:

2680

@alternate_dbus_interfaces({"se.recompile.Mandos":

2681

"se.bsnet.fukt.Mandos"})

2722

2723

@alternate_dbus_interfaces(

2724

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2682

2725

class MandosDBusService(DBusObjectWithProperties):

2683

2726

"""A D-Bus proxy object"""

2727

2684

2728

def __init__(self):

2685

2729

dbus.service.Object.__init__(self, bus, "/")

2730

2686

2731

_interface = "se.recompile.Mandos"

2687

2732

2688

2733

@dbus_interface_annotations(_interface)

2689

2734

def _foo(self):

2690

return { "org.freedesktop.DBus.Property"

2691

".EmitsChangedSignal":

2692

"false"}

2735

return {

2736

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2737

"false" }

2693

2738

2694

2739

@dbus.service.signal(_interface, signature="o")

2695

2740

def ClientAdded(self, objpath):

2709

2754

@dbus.service.method(_interface, out_signature="ao")

2710

2755

def GetAllClients(self):

2711

2756

"D-Bus method"

2712

return dbus.Array(c.dbus_object_path

2713

for c in

2757

return dbus.Array(c.dbus_object_path for c in

2714

2758

tcp_server.clients.itervalues())

2715

2759

2716

2760

@dbus.service.method(_interface,

2718

2762

def GetAllClientsWithProperties(self):

2719

2763

"D-Bus method"

2720

2764

return dbus.Dictionary(

2721

((c.dbus_object_path, c.GetAll(""))

2722

for c in tcp_server.clients.itervalues()),

2765

{ c.dbus_object_path: c.GetAll("")

2766

for c in tcp_server.clients.itervalues() },

2723

2767

signature="oa{sv}")

2724

2768

2725

2769

@dbus.service.method(_interface, in_signature="o")

2742

2786

2743

2787

def cleanup():

2744

2788

"Cleanup function; run on exit"

2745

service.cleanup()

2789

if zeroconf:

2790

service.cleanup()

2746

2791

2747

2792

multiprocessing.active_children()

2748

2793

wnull.close()

2762

2807

2763

2808

# A list of attributes that can not be pickled

2764

2809

# + secret.

2765

exclude = set(("bus", "changedstate", "secret",

2766

"checker", "server_settings"))

2767

for name, typ in (inspect.getmembers

2768

(dbus.service.Object)):

2810

exclude = { "bus", "changedstate", "secret",

2811

"checker", "server_settings" }

2812

for name, typ in inspect.getmembers(dbus.service

2813

.Object):

2769

2814

exclude.add(name)

2770

2815

2771

2816

client_dict["encrypted_secret"] = (client

2778

2823

del client_settings[client.name]["secret"]

2779

2824

2780

2825

try:

2781

with (tempfile.NamedTemporaryFile

2782

(mode='wb', suffix=".pickle", prefix='clients-',

2783

dir=os.path.dirname(stored_state_path),

2784

delete=False)) as stored_state:

2826

with tempfile.NamedTemporaryFile(

2827

mode='wb',

2828

suffix=".pickle",

2829

prefix='clients-',

2830

dir=os.path.dirname(stored_state_path),

2831

delete=False) as stored_state:

2785

2832

pickle.dump((clients, client_settings), stored_state)

2786

tempname=stored_state.name

2833

tempname = stored_state.name

2787

2834

os.rename(tempname, stored_state_path)

2788

2835

except (IOError, OSError) as e:

2789

2836

if not debug:

2792

2839

except NameError:

2793

2840

pass

2794

2841

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2795

logger.warning("Could not save persistent state: {0}"

2842

logger.warning("Could not save persistent state: {}"

2796

2843

.format(os.strerror(e.errno)))

2797

2844

else:

2798

2845

logger.warning("Could not save persistent state:",

2808

2855

client.disable(quiet=True)

2809

2856

if use_dbus:

2810

2857

# Emit D-Bus signal

2811

mandos_dbus_service.ClientRemoved(client

2812

.dbus_object_path,

2813

client.name)

2858

mandos_dbus_service.ClientRemoved(

2859

client.dbus_object_path, client.name)

2814

2860

client_settings.clear()

2815

2861

2816

2862

atexit.register(cleanup)

2827

2873

tcp_server.server_activate()

2828

2874

2829

2875

# Find out what port we got

2830

service.port = tcp_server.socket.getsockname()[1]

2876

if zeroconf:

2877

service.port = tcp_server.socket.getsockname()[1]

2831

2878

if use_ipv6:

2832

2879

logger.info("Now listening on address %r, port %d,"

2833

2880

" flowinfo %d, scope_id %d",

2839

2886

#service.interface = tcp_server.socket.getsockname()[3]

2840

2887

2841

2888

try:

2842

# From the Avahi example code

2843

try:

2844

service.activate()

2845

except dbus.exceptions.DBusException as error:

2846

logger.critical("D-Bus Exception", exc_info=error)

2847

cleanup()

2848

sys.exit(1)

2849

# End of Avahi example code

2889

if zeroconf:

2890

# From the Avahi example code

2891

try:

2892

service.activate()

2893

except dbus.exceptions.DBusException as error:

2894

logger.critical("D-Bus Exception", exc_info=error)

2895

cleanup()

2896

sys.exit(1)

2897

# End of Avahi example code

2850

2898

2851

2899

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2852

2900

lambda *args, **kwargs:

2867

2915

# Must run before the D-Bus bus name gets deregistered

2868

2916

cleanup()

2869

2917

2918

2870

2919

if __name__ == '__main__':

2871

2920

main()