/mandos/release : revision 237.7.337

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

import SocketServer as socketserver

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

40

43

import socket

41

44

import argparse

42

45

import datetime

47

50

import gnutls.library.functions

48

51

import gnutls.library.constants

49

52

import gnutls.library.types

50

import ConfigParser as configparser

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

51

57

import sys

52

58

import re

53

59

import os

62

68

import struct

63

69

import fcntl

64

70

import functools

65

import cPickle as pickle

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

66

75

import multiprocessing

67

76

import types

68

77

import binascii

69

78

import tempfile

70

79

import itertools

71

80

import collections

81

import codecs

72

82

73

83

import dbus

74

84

import dbus.service

75

import gobject

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

76

89

import avahi

77

90

from dbus.mainloop.glib import DBusGMainLoop

78

91

import ctypes

88

101

except ImportError:

89

102

SO_BINDTODEVICE = None

90

103

91

version = "1.6.8"

104

if sys.version_info.major == 2:

105

str = unicode

106

107

version = "1.7.0"

92

108

stored_state_file = "clients.pickle"

93

109

94

110

logger = logging.getLogger()

95

111

syslogger = None

96

112

97

113

try:

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

101

116

except (OSError, AttributeError):

117

102

118

def if_nametoindex(interface):

103

119

"Get an interface index the hard way, i.e. using fcntl()"

104

120

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

105

121

with contextlib.closing(socket.socket()) as s:

106

122

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

123

struct.pack(b"16s16x", interface))

124

interface_index = struct.unpack("I", ifreq[16:20])[0]

111

125

return interface_index

112

126

113

127

115

129

"""init logger and add loglevel"""

116

130

117

131

global syslogger

118

syslogger = (logging.handlers.SysLogHandler

119

(facility =

120

logging.handlers.SysLogHandler.LOG_DAEMON,

121

address = str("/dev/log")))

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

122

135

syslogger.setFormatter(logging.Formatter

123

136

('Mandos [%(process)d]: %(levelname)s:'

124

137

' %(message)s'))

141

154

142

155

class PGPEngine(object):

143

156

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

144

158

def __init__(self):

145

159

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

146

160

self.gnupgargs = ['--batch',

185

199

186

200

def encrypt(self, data, password):

187

201

passphrase = self.password_encode(password)

188

with tempfile.NamedTemporaryFile(dir=self.tempdir

189

) as passfile:

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

190

204

passfile.write(passphrase)

191

205

passfile.flush()

192

206

proc = subprocess.Popen(['gpg', '--symmetric',

203

217

204

218

def decrypt(self, data, password):

205

219

passphrase = self.password_encode(password)

206

with tempfile.NamedTemporaryFile(dir = self.tempdir

207

) as passfile:

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

208

222

passfile.write(passphrase)

209

223

passfile.flush()

210

224

proc = subprocess.Popen(['gpg', '--decrypt',

214

228

stdin = subprocess.PIPE,

215

229

stdout = subprocess.PIPE,

216

230

stderr = subprocess.PIPE)

217

decrypted_plaintext, err = proc.communicate(input

218

= data)

231

decrypted_plaintext, err = proc.communicate(input = data)

219

232

if proc.returncode != 0:

220

233

raise PGPError(err)

221

234

return decrypted_plaintext

224

237

class AvahiError(Exception):

225

238

def __init__(self, value, *args, **kwargs):

226

239

self.value = value

227

super(AvahiError, self).__init__(value, *args, **kwargs)

228

def __unicode__(self):

229

return unicode(repr(self.value))

240

return super(AvahiError, self).__init__(value, *args,

241

**kwargs)

242

230

243

231

244

class AvahiServiceError(AvahiError):

232

245

pass

233

246

247

234

248

class AvahiGroupError(AvahiError):

235

249

pass

236

250

256

270

bus: dbus.SystemBus()

257

271

"""

258

272

259

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

260

servicetype = None, port = None, TXT = None,

261

domain = "", host = "", max_renames = 32768,

262

protocol = avahi.PROTO_UNSPEC, bus = None):

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

263

284

self.interface = interface

264

285

self.name = name

265

286

self.type = servicetype

275

296

self.bus = bus

276

297

self.entry_group_state_changed_match = None

277

298

278

def rename(self):

299

def rename(self, remove=True):

279

300

"""Derived from the Avahi example code"""

280

301

if self.rename_count >= self.max_renames:

281

302

logger.critical("No suitable Zeroconf service name found"

282

303

" after %i retries, exiting.",

283

304

self.rename_count)

284

305

raise AvahiServiceError("Too many renames")

285

self.name = unicode(self.server

286

.GetAlternativeServiceName(self.name))

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

287

309

logger.info("Changing Zeroconf service name to %r ...",

288

310

self.name)

289

self.remove()

311

if remove:

312

self.remove()

290

313

try:

291

314

self.add()

292

315

except dbus.exceptions.DBusException as error:

293

logger.critical("D-Bus Exception", exc_info=error)

294

self.cleanup()

295

os._exit(1)

296

self.rename_count += 1

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

297

324

298

325

def remove(self):

299

326

"""Derived from the Avahi example code"""

337

364

self.rename()

338

365

elif state == avahi.ENTRY_GROUP_FAILURE:

339

366

logger.critical("Avahi: Error in group state changed %s",

340

unicode(error))

341

raise AvahiGroupError("State changed: {!s}"

342

.format(error))

367

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

343

369

344

370

def cleanup(self):

345

371

"""Derived from the Avahi example code"""

355

381

def server_state_changed(self, state, error=None):

356

382

"""Derived from the Avahi example code"""

357

383

logger.debug("Avahi server state change: %i", state)

358

bad_states = { avahi.SERVER_INVALID:

359

"Zeroconf server invalid",

360

avahi.SERVER_REGISTERING: None,

361

avahi.SERVER_COLLISION:

362

"Zeroconf server name collision",

363

avahi.SERVER_FAILURE:

364

"Zeroconf server failure" }

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

365

390

if state in bad_states:

366

391

if bad_states[state] is not None:

367

392

if error is None:

370

395

logger.error(bad_states[state] + ": %r", error)

371

396

self.cleanup()

372

397

elif state == avahi.SERVER_RUNNING:

373

self.add()

398

try:

399

self.add()

400

except dbus.exceptions.DBusException as error:

401

if (error.get_dbus_name()

402

== "org.freedesktop.Avahi.CollisionError"):

403

logger.info("Local Zeroconf service name"

404

" collision.")

405

return self.rename(remove=False)

406

else:

407

logger.critical("D-Bus Exception", exc_info=error)

408

self.cleanup()

409

os._exit(1)

374

410

else:

375

411

if error is None:

376

412

logger.debug("Unknown state: %r", state)

386

422

follow_name_owner_changes=True),

387

423

avahi.DBUS_INTERFACE_SERVER)

388

424

self.server.connect_to_signal("StateChanged",

389

self.server_state_changed)

425

self.server_state_changed)

390

426

self.server_state_changed(self.server.GetState())

391

427

392

428

393

429

class AvahiServiceToSyslog(AvahiService):

394

def rename(self):

430

def rename(self, *args, **kwargs):

395

431

"""Add the new name to the syslog messages"""

396

ret = AvahiService.rename(self)

397

syslogger.setFormatter(logging.Formatter

398

('Mandos ({}) [%(process)d]:'

399

' %(levelname)s: %(message)s'

400

.format(self.name)))

432

ret = AvahiService.rename(self, *args, **kwargs)

433

syslogger.setFormatter(logging.Formatter(

434

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

435

.format(self.name)))

401

436

return ret

402

437

438

def call_pipe(connection, # : multiprocessing.Connection

439

func, *args, **kwargs):

440

"""This function is meant to be called by multiprocessing.Process

441

442

This function runs func(*args, **kwargs), and writes the resulting

443

return value on the provided multiprocessing.Connection.

444

"""

445

connection.send(func(*args, **kwargs))

446

connection.close()

403

447

404

448

class Client(object):

405

449

"""A representation of a client host served by this server.

432

476

last_checker_status: integer between 0 and 255 reflecting exit

433

477

status of last checker. -1 reflects crashed

434

478

checker, -2 means no checker completed yet.

479

last_checker_signal: The signal which killed the last checker, if

480

last_checker_status is -1

435

481

last_enabled: datetime.datetime(); (UTC) or None

436

482

name: string; from the config file, used in log messages and

437

483

D-Bus identifiers

450

496

"fingerprint", "host", "interval",

451

497

"last_approval_request", "last_checked_ok",

452

498

"last_enabled", "name", "timeout")

453

client_defaults = { "timeout": "PT5M",

454

"extended_timeout": "PT15M",

455

"interval": "PT2M",

456

"checker": "fping -q -- %%(host)s",

457

"host": "",

458

"approval_delay": "PT0S",

459

"approval_duration": "PT1S",

460

"approved_by_default": "True",

461

"enabled": "True",

462

}

499

client_defaults = {

500

"timeout": "PT5M",

501

"extended_timeout": "PT15M",

502

"interval": "PT2M",

503

"checker": "fping -q -- %%(host)s",

504

"host": "",

505

"approval_delay": "PT0S",

506

"approval_duration": "PT1S",

507

"approved_by_default": "True",

508

"enabled": "True",

509

}

463

510

464

511

@staticmethod

465

512

def config_parser(config):

481

528

client["enabled"] = config.getboolean(client_name,

482

529

"enabled")

483

530

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the

533

# fingerprint() function

484

534

client["fingerprint"] = (section["fingerprint"].upper()

485

535

.replace(" ", ""))

486

536

if "secret" in section:

528

578

self.expires = None

529

579

530

580

logger.debug("Creating client %r", self.name)

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the fingerprint()

533

# function

534

581

logger.debug(" Fingerprint: %s", self.fingerprint)

535

582

self.created = settings.get("created",

536

583

datetime.datetime.utcnow())

543

590

self.current_checker_command = None

544

591

self.approved = None

545

592

self.approvals_pending = 0

546

self.changedstate = (multiprocessing_manager

547

.Condition(multiprocessing_manager

548

.Lock()))

549

self.client_structure = [attr for attr in

550

self.__dict__.iterkeys()

593

self.changedstate = multiprocessing_manager.Condition(

594

multiprocessing_manager.Lock())

595

self.client_structure = [attr

596

for attr in self.__dict__.iterkeys()

551

597

if not attr.startswith("_")]

552

598

self.client_structure.append("client_structure")

553

599

554

for name, t in inspect.getmembers(type(self),

555

lambda obj:

556

isinstance(obj,

557

property)):

600

for name, t in inspect.getmembers(

601

type(self), lambda obj: isinstance(obj, property)):

558

602

if not name.startswith("_"):

559

603

self.client_structure.append(name)

560

604

602

646

# and every interval from then on.

603

647

if self.checker_initiator_tag is not None:

604

648

gobject.source_remove(self.checker_initiator_tag)

605

self.checker_initiator_tag = (gobject.timeout_add

606

(int(self.interval

607

.total_seconds() * 1000),

608

self.start_checker))

649

self.checker_initiator_tag = gobject.timeout_add(

650

int(self.interval.total_seconds() * 1000),

651

self.start_checker)

609

652

# Schedule a disable() when 'timeout' has passed

610

653

if self.disable_initiator_tag is not None:

611

654

gobject.source_remove(self.disable_initiator_tag)

612

self.disable_initiator_tag = (gobject.timeout_add

613

(int(self.timeout

614

.total_seconds() * 1000),

615

self.disable))

655

self.disable_initiator_tag = gobject.timeout_add(

656

int(self.timeout.total_seconds() * 1000), self.disable)

616

657

# Also start a new checker *right now*.

617

658

self.start_checker()

618

659

619

def checker_callback(self, pid, condition, command):

660

def checker_callback(self, source, condition, connection,

661

command):

620

662

"""The checker has completed, so take appropriate actions."""

621

663

self.checker_callback_tag = None

622

664

self.checker = None

623

if os.WIFEXITED(condition):

624

self.last_checker_status = os.WEXITSTATUS(condition)

665

# Read return code from connection (see call_pipe)

666

returncode = connection.recv()

667

connection.close()

668

669

if returncode >= 0:

670

self.last_checker_status = returncode

671

self.last_checker_signal = None

625

672

if self.last_checker_status == 0:

626

673

logger.info("Checker for %(name)s succeeded",

627

674

vars(self))

628

675

self.checked_ok()

629

676

else:

630

logger.info("Checker for %(name)s failed",

631

vars(self))

677

logger.info("Checker for %(name)s failed", vars(self))

632

678

else:

633

679

self.last_checker_status = -1

680

self.last_checker_signal = -returncode

634

681

logger.warning("Checker for %(name)s crashed?",

635

682

vars(self))

683

return False

636

684

637

685

def checked_ok(self):

638

686

"""Assert that the client has been seen, alive and well."""

639

687

self.last_checked_ok = datetime.datetime.utcnow()

640

688

self.last_checker_status = 0

689

self.last_checker_signal = None

641

690

self.bump_timeout()

642

691

643

692

def bump_timeout(self, timeout=None):

648

697

gobject.source_remove(self.disable_initiator_tag)

649

698

self.disable_initiator_tag = None

650

699

if getattr(self, "enabled", False):

651

self.disable_initiator_tag = (gobject.timeout_add

652

(int(timeout.total_seconds()

653

* 1000), self.disable))

700

self.disable_initiator_tag = gobject.timeout_add(

701

int(timeout.total_seconds() * 1000), self.disable)

654

702

self.expires = datetime.datetime.utcnow() + timeout

655

703

656

704

def need_approval(self):

670

718

# than 'timeout' for the client to be disabled, which is as it

671

719

# should be.

672

720

673

# If a checker exists, make sure it is not a zombie

674

try:

675

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

676

except AttributeError:

677

pass

678

except OSError as error:

679

if error.errno != errno.ECHILD:

680

raise

681

else:

682

if pid:

683

logger.warning("Checker was a zombie")

684

gobject.source_remove(self.checker_callback_tag)

685

self.checker_callback(pid, status,

686

self.current_checker_command)

721

if self.checker is not None and not self.checker.is_alive():

722

logger.warning("Checker was not alive; joining")

723

self.checker.join()

724

self.checker = None

687

725

# Start a new checker if needed

688

726

if self.checker is None:

689

727

# Escape attributes for the shell

690

escaped_attrs = { attr:

691

re.escape(unicode(getattr(self,

692

attr)))

693

for attr in self.runtime_expansions }

728

escaped_attrs = {

729

attr: re.escape(str(getattr(self, attr)))

730

for attr in self.runtime_expansions }

694

731

try:

695

732

command = self.checker_command % escaped_attrs

696

733

except TypeError as error:

697

734

logger.error('Could not format string "%s"',

698

self.checker_command, exc_info=error)

699

return True # Try again later

735

self.checker_command,

736

exc_info=error)

737

return True # Try again later

700

738

self.current_checker_command = command

701

try:

702

logger.info("Starting checker %r for %s",

703

command, self.name)

704

# We don't need to redirect stdout and stderr, since

705

# in normal mode, that is already done by daemon(),

706

# and in debug mode we don't want to. (Stdin is

707

# always replaced by /dev/null.)

708

# The exception is when not debugging but nevertheless

709

# running in the foreground; use the previously

710

# created wnull.

711

popen_args = {}

712

if (not self.server_settings["debug"]

713

and self.server_settings["foreground"]):

714

popen_args.update({"stdout": wnull,

715

"stderr": wnull })

716

self.checker = subprocess.Popen(command,

717

close_fds=True,

718

shell=True, cwd="/",

719

**popen_args)

720

except OSError as error:

721

logger.error("Failed to start subprocess",

722

exc_info=error)

723

return True

724

self.checker_callback_tag = (gobject.child_watch_add

725

(self.checker.pid,

726

self.checker_callback,

727

data=command))

728

# The checker may have completed before the gobject

729

# watch was added. Check for this.

730

try:

731

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

732

except OSError as error:

733

if error.errno == errno.ECHILD:

734

# This should never happen

735

logger.error("Child process vanished",

736

exc_info=error)

737

return True

738

raise

739

if pid:

740

gobject.source_remove(self.checker_callback_tag)

741

self.checker_callback(pid, status, command)

739

logger.info("Starting checker %r for %s", command,

740

self.name)

741

# We don't need to redirect stdout and stderr, since

742

# in normal mode, that is already done by daemon(),

743

# and in debug mode we don't want to. (Stdin is

744

# always replaced by /dev/null.)

745

# The exception is when not debugging but nevertheless

746

# running in the foreground; use the previously

747

# created wnull.

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

751

if (not self.server_settings["debug"]

752

and self.server_settings["foreground"]):

753

popen_args.update({"stdout": wnull,

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

756

self.checker = multiprocessing.Process(

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

760

self.checker.start()

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

763

self.checker_callback, pipe[0], command)

742

764

# Re-run this periodically if run by gobject.timeout_add

743

765

return True

744

766

750

772

if getattr(self, "checker", None) is None:

751

773

return

752

774

logger.debug("Stopping checker for %(name)s", vars(self))

753

try:

754

self.checker.terminate()

755

#time.sleep(0.5)

756

#if self.checker.poll() is None:

757

# self.checker.kill()

758

except OSError as error:

759

if error.errno != errno.ESRCH: # No such process

760

raise

775

self.checker.terminate()

761

776

self.checker = None

762

777

763

778

764

def dbus_service_property(dbus_interface, signature="v",

765

access="readwrite", byte_arrays=False):

779

def dbus_service_property(dbus_interface,

780

signature="v",

781

access="readwrite",

782

byte_arrays=False):

766

783

"""Decorators for marking methods of a DBusObjectWithProperties to

767

784

become properties on the D-Bus.

768

785

778

795

if byte_arrays and signature != "ay":

779

796

raise ValueError("Byte arrays not supported for non-'ay'"

780

797

" signature {!r}".format(signature))

798

781

799

def decorator(func):

782

800

func._dbus_is_property = True

783

801

func._dbus_interface = dbus_interface

788

806

func._dbus_name = func._dbus_name[:-14]

789

807

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

790

808

return func

809

791

810

return decorator

792

811

793

812

802

821

"org.freedesktop.DBus.Property.EmitsChangedSignal":

803

822

"false"}

804

823

"""

824

805

825

def decorator(func):

806

826

func._dbus_is_interface = True

807

827

func._dbus_interface = dbus_interface

808

828

func._dbus_name = dbus_interface

809

829

return func

830

810

831

return decorator

811

832

812

833

814

835

"""Decorator to annotate D-Bus methods, signals or properties

815

836

Usage:

816

837

838

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

817

841

@dbus_service_property("org.example.Interface", signature="b",

818

842

access="r")

819

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

820

"org.freedesktop.DBus.Property."

821

"EmitsChangedSignal": "false"})

822

843

def Property_dbus_property(self):

823

844

return dbus.Boolean(False)

845

846

See also the DBusObjectWithAnnotations class.

824

847

"""

848

825

849

def decorator(func):

826

850

func._dbus_annotations = annotations

827

851

return func

852

828

853

return decorator

829

854

830

855

831

856

class DBusPropertyException(dbus.exceptions.DBusException):

832

857

"""A base class for D-Bus property-related exceptions

833

858

"""

834

def __unicode__(self):

835

return unicode(str(self))

859

pass

836

860

837

861

838

862

class DBusPropertyAccessException(DBusPropertyException):

847

871

pass

848

872

849

873

850

class DBusObjectWithProperties(dbus.service.Object):

851

"""A D-Bus object with properties.

874

class DBusObjectWithAnnotations(dbus.service.Object):

875

"""A D-Bus object with annotations.

852

876

853

Classes inheriting from this can use the dbus_service_property

854

decorator to expose methods as D-Bus properties. It exposes the

855

standard Get(), Set(), and GetAll() methods on the D-Bus.

877

Classes inheriting from this can use the dbus_annotations

878

decorator to add annotations to methods or signals.

856

879

"""

857

880

858

881

@staticmethod

868

891

def _get_all_dbus_things(self, thing):

869

892

"""Returns a generator of (name, attribute) pairs

870

893

"""

871

return ((getattr(athing.__get__(self), "_dbus_name",

872

name),

894

return ((getattr(athing.__get__(self), "_dbus_name", name),

873

895

athing.__get__(self))

874

896

for cls in self.__class__.__mro__

875

897

for name, athing in

876

inspect.getmembers(cls,

877

self._is_dbus_thing(thing)))

898

inspect.getmembers(cls, self._is_dbus_thing(thing)))

899

900

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

901

out_signature = "s",

902

path_keyword = 'object_path',

903

connection_keyword = 'connection')

904

def Introspect(self, object_path, connection):

905

"""Overloading of standard D-Bus method.

906

907

Inserts annotation tags on methods and signals.

908

"""

909

xmlstring = dbus.service.Object.Introspect(self, object_path,

910

connection)

911

try:

912

document = xml.dom.minidom.parseString(xmlstring)

913

914

for if_tag in document.getElementsByTagName("interface"):

915

# Add annotation tags

916

for typ in ("method", "signal"):

917

for tag in if_tag.getElementsByTagName(typ):

918

annots = dict()

919

for name, prop in (self.

920

_get_all_dbus_things(typ)):

921

if (name == tag.getAttribute("name")

922

and prop._dbus_interface

923

== if_tag.getAttribute("name")):

924

annots.update(getattr(

925

prop, "_dbus_annotations", {}))

926

for name, value in annots.items():

927

ann_tag = document.createElement(

928

"annotation")

929

ann_tag.setAttribute("name", name)

930

ann_tag.setAttribute("value", value)

931

tag.appendChild(ann_tag)

932

# Add interface annotation tags

933

for annotation, value in dict(

934

itertools.chain.from_iterable(

935

annotations().items()

936

for name, annotations

937

in self._get_all_dbus_things("interface")

938

if name == if_tag.getAttribute("name")

939

)).items():

940

ann_tag = document.createElement("annotation")

941

ann_tag.setAttribute("name", annotation)

942

ann_tag.setAttribute("value", value)

943

if_tag.appendChild(ann_tag)

944

# Fix argument name for the Introspect method itself

945

if (if_tag.getAttribute("name")

946

== dbus.INTROSPECTABLE_IFACE):

947

for cn in if_tag.getElementsByTagName("method"):

948

if cn.getAttribute("name") == "Introspect":

949

for arg in cn.getElementsByTagName("arg"):

950

if (arg.getAttribute("direction")

951

== "out"):

952

arg.setAttribute("name",

953

"xml_data")

954

xmlstring = document.toxml("utf-8")

955

document.unlink()

956

except (AttributeError, xml.dom.DOMException,

957

xml.parsers.expat.ExpatError) as error:

958

logger.error("Failed to override Introspection method",

959

exc_info=error)

960

return xmlstring

961

962

963

class DBusObjectWithProperties(DBusObjectWithAnnotations):

964

"""A D-Bus object with properties.

965

966

Classes inheriting from this can use the dbus_service_property

967

decorator to expose methods as D-Bus properties. It exposes the

968

standard Get(), Set(), and GetAll() methods on the D-Bus.

969

"""

878

970

879

971

def _get_dbus_property(self, interface_name, property_name):

880

972

"""Returns a bound method if one exists which is a D-Bus

881

973

property with the specified name and interface.

882

974

"""

883

for cls in self.__class__.__mro__:

884

for name, value in (inspect.getmembers

885

(cls,

886

self._is_dbus_thing("property"))):

975

for cls in self.__class__.__mro__:

976

for name, value in inspect.getmembers(

977

cls, self._is_dbus_thing("property")):

887

978

if (value._dbus_name == property_name

888

979

and value._dbus_interface == interface_name):

889

980

return value.__get__(self)

890

981

891

982

# No such property

892

raise DBusPropertyNotFound(self.dbus_object_path + ":"

893

+ interface_name + "."

894

+ property_name)

895

896

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

983

raise DBusPropertyNotFound("{}:{}.{}".format(

984

self.dbus_object_path, interface_name, property_name))

985

986

@classmethod

987

def _get_all_interface_names(cls):

988

"""Get a sequence of all interfaces supported by an object"""

989

return (name for name in set(getattr(getattr(x, attr),

990

"_dbus_interface", None)

991

for x in (inspect.getmro(cls))

992

for attr in dir(x))

993

if name is not None)

994

995

@dbus.service.method(dbus.PROPERTIES_IFACE,

996

in_signature="ss",

897

997

out_signature="v")

898

998

def Get(self, interface_name, property_name):

899

999

"""Standard D-Bus property Get() method, see D-Bus standard.

924

1024

for byte in value))

925

1025

prop(value)

926

1026

927

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1027

@dbus.service.method(dbus.PROPERTIES_IFACE,

1028

in_signature="s",

928

1029

out_signature="a{sv}")

929

1030

def GetAll(self, interface_name):

930

1031

"""Standard D-Bus property GetAll() method, see D-Bus

945

1046

if not hasattr(value, "variant_level"):

946

1047

properties[name] = value

947

1048

continue

948

properties[name] = type(value)(value, variant_level=

949

value.variant_level+1)

1049

properties[name] = type(value)(

1050

value, variant_level = value.variant_level + 1)

950

1051

return dbus.Dictionary(properties, signature="sv")

951

1052

1053

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1054

def PropertiesChanged(self, interface_name, changed_properties,

1055

invalidated_properties):

1056

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1057

standard.

1058

"""

1059

pass

1060

952

1061

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

953

1062

out_signature="s",

954

1063

path_keyword='object_path',

958

1067

959

1068

Inserts property tags and interface annotation tags.

960

1069

"""

961

xmlstring = dbus.service.Object.Introspect(self, object_path,

962

connection)

1070

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1071

object_path,

1072

connection)

963

1073

try:

964

1074

document = xml.dom.minidom.parseString(xmlstring)

1075

965

1076

def make_tag(document, name, prop):

966

1077

e = document.createElement("property")

967

1078

e.setAttribute("name", name)

968

1079

e.setAttribute("type", prop._dbus_signature)

969

1080

e.setAttribute("access", prop._dbus_access)

970

1081

return e

1082

971

1083

for if_tag in document.getElementsByTagName("interface"):

972

1084

# Add property tags

973

1085

for tag in (make_tag(document, name, prop)

976

1088

if prop._dbus_interface

977

1089

== if_tag.getAttribute("name")):

978

1090

if_tag.appendChild(tag)

979

# Add annotation tags

980

for typ in ("method", "signal", "property"):

981

for tag in if_tag.getElementsByTagName(typ):

982

annots = dict()

983

for name, prop in (self.

984

_get_all_dbus_things(typ)):

985

if (name == tag.getAttribute("name")

986

and prop._dbus_interface

987

== if_tag.getAttribute("name")):

988

annots.update(getattr

989

(prop,

990

"_dbus_annotations",

991

{}))

992

for name, value in annots.items():

993

ann_tag = document.createElement(

994

"annotation")

995

ann_tag.setAttribute("name", name)

996

ann_tag.setAttribute("value", value)

997

tag.appendChild(ann_tag)

998

# Add interface annotation tags

999

for annotation, value in dict(

1000

itertools.chain.from_iterable(

1001

annotations().items()

1002

for name, annotations in

1003

self._get_all_dbus_things("interface")

1004

if name == if_tag.getAttribute("name")

1005

)).items():

1006

ann_tag = document.createElement("annotation")

1007

ann_tag.setAttribute("name", annotation)

1008

ann_tag.setAttribute("value", value)

1009

if_tag.appendChild(ann_tag)

1091

# Add annotation tags for properties

1092

for tag in if_tag.getElementsByTagName("property"):

1093

annots = dict()

1094

for name, prop in self._get_all_dbus_things(

1095

"property"):

1096

if (name == tag.getAttribute("name")

1097

and prop._dbus_interface

1098

== if_tag.getAttribute("name")):

1099

annots.update(getattr(

1100

prop, "_dbus_annotations", {}))

1101

for name, value in annots.items():

1102

ann_tag = document.createElement(

1103

"annotation")

1104

ann_tag.setAttribute("name", name)

1105

ann_tag.setAttribute("value", value)

1106

tag.appendChild(ann_tag)

1010

1107

# Add the names to the return values for the

1011

1108

# "org.freedesktop.DBus.Properties" methods

1012

1109

if (if_tag.getAttribute("name")

1030

1127

exc_info=error)

1031

1128

return xmlstring

1032

1129

1130

try:

1131

dbus.OBJECT_MANAGER_IFACE

1132

except AttributeError:

1133

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1134

1135

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1136

"""A D-Bus object with an ObjectManager.

1137

1138

Classes inheriting from this exposes the standard

1139

GetManagedObjects call and the InterfacesAdded and

1140

InterfacesRemoved signals on the standard

1141

"org.freedesktop.DBus.ObjectManager" interface.

1142

1143

Note: No signals are sent automatically; they must be sent

1144

manually.

1145

"""

1146

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1147

out_signature = "a{oa{sa{sv}}}")

1148

def GetManagedObjects(self):

1149

"""This function must be overridden"""

1150

raise NotImplementedError()

1151

1152

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1153

signature = "oa{sa{sv}}")

1154

def InterfacesAdded(self, object_path, interfaces_and_properties):

1155

pass

1156

1157

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1158

def InterfacesRemoved(self, object_path, interfaces):

1159

pass

1160

1161

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1162

out_signature = "s",

1163

path_keyword = 'object_path',

1164

connection_keyword = 'connection')

1165

def Introspect(self, object_path, connection):

1166

"""Overloading of standard D-Bus method.

1167

1168

Override return argument name of GetManagedObjects to be

1169

"objpath_interfaces_and_properties"

1170

"""

1171

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1172

object_path,

1173

connection)

1174

try:

1175

document = xml.dom.minidom.parseString(xmlstring)

1176

1177

for if_tag in document.getElementsByTagName("interface"):

1178

# Fix argument name for the GetManagedObjects method

1179

if (if_tag.getAttribute("name")

1180

== dbus.OBJECT_MANAGER_IFACE):

1181

for cn in if_tag.getElementsByTagName("method"):

1182

if (cn.getAttribute("name")

1183

== "GetManagedObjects"):

1184

for arg in cn.getElementsByTagName("arg"):

1185

if (arg.getAttribute("direction")

1186

== "out"):

1187

arg.setAttribute(

1188

"name",

1189

"objpath_interfaces"

1190

"_and_properties")

1191

xmlstring = document.toxml("utf-8")

1192

document.unlink()

1193

except (AttributeError, xml.dom.DOMException,

1194

xml.parsers.expat.ExpatError) as error:

1195

logger.error("Failed to override Introspection method",

1196

exc_info = error)

1197

return xmlstring

1033

1198

1034

1199

def datetime_to_dbus(dt, variant_level=0):

1035

1200

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1036

1201

if dt is None:

1037

1202

return dbus.String("", variant_level = variant_level)

1038

return dbus.String(dt.isoformat(),

1039

variant_level=variant_level)

1203

return dbus.String(dt.isoformat(), variant_level=variant_level)

1040

1204

1041

1205

1042

1206

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1062

1226

(from DBusObjectWithProperties) and interfaces (from the

1063

1227

dbus_interface_annotations decorator).

1064

1228

"""

1229

1065

1230

def wrapper(cls):

1066

1231

for orig_interface_name, alt_interface_name in (

1067

alt_interface_names.items()):

1232

alt_interface_names.items()):

1068

1233

attr = {}

1069

1234

interface_names = set()

1070

1235

# Go though all attributes of the class

1072

1237

# Ignore non-D-Bus attributes, and D-Bus attributes

1073

1238

# with the wrong interface name

1074

1239

if (not hasattr(attribute, "_dbus_interface")

1075

or not attribute._dbus_interface

1076

.startswith(orig_interface_name)):

1240

or not attribute._dbus_interface.startswith(

1241

orig_interface_name)):

1077

1242

continue

1078

1243

# Create an alternate D-Bus interface name based on

1079

1244

# the current name

1080

alt_interface = (attribute._dbus_interface

1081

.replace(orig_interface_name,

1082

alt_interface_name))

1245

alt_interface = attribute._dbus_interface.replace(

1246

orig_interface_name, alt_interface_name)

1083

1247

interface_names.add(alt_interface)

1084

1248

# Is this a D-Bus signal?

1085

1249

if getattr(attribute, "_dbus_is_signal", False):

1086

# Extract the original non-method undecorated

1087

# function by black magic

1088

nonmethod_func = (dict(

1250

if sys.version_info.major == 2:

1251

# Extract the original non-method undecorated

1252

# function by black magic

1253

nonmethod_func = (dict(

1089

1254

zip(attribute.func_code.co_freevars,

1090

attribute.__closure__))["func"]

1091

.cell_contents)

1255

attribute.__closure__))

1256

["func"].cell_contents)

1257

else:

1258

nonmethod_func = attribute

1092

1259

# Create a new, but exactly alike, function

1093

1260

# object, and decorate it to be a new D-Bus signal

1094

1261

# with the alternate D-Bus interface name

1095

new_function = (dbus.service.signal

1096

(alt_interface,

1097

attribute._dbus_signature)

1098

(types.FunctionType(

1099

nonmethod_func.func_code,

1100

nonmethod_func.func_globals,

1101

nonmethod_func.func_name,

1102

nonmethod_func.func_defaults,

1103

nonmethod_func.func_closure)))

1262

if sys.version_info.major == 2:

1263

new_function = types.FunctionType(

1264

nonmethod_func.func_code,

1265

nonmethod_func.func_globals,

1266

nonmethod_func.func_name,

1267

nonmethod_func.func_defaults,

1268

nonmethod_func.func_closure)

1269

else:

1270

new_function = types.FunctionType(

1271

nonmethod_func.__code__,

1272

nonmethod_func.__globals__,

1273

nonmethod_func.__name__,

1274

nonmethod_func.__defaults__,

1275

nonmethod_func.__closure__)

1276

new_function = (dbus.service.signal(

1277

alt_interface,

1278

attribute._dbus_signature)(new_function))

1104

1279

# Copy annotations, if any

1105

1280

try:

1106

new_function._dbus_annotations = (

1107

dict(attribute._dbus_annotations))

1281

new_function._dbus_annotations = dict(

1282

attribute._dbus_annotations)

1108

1283

except AttributeError:

1109

1284

pass

1110

1285

# Define a creator of a function to call both the

1115

1290

"""This function is a scope container to pass

1116

1291

func1 and func2 to the "call_both" function

1117

1292

outside of its arguments"""

1293

1294

@functools.wraps(func2)

1118

1295

def call_both(*args, **kwargs):

1119

1296

"""This function will emit two D-Bus

1120

1297

signals by calling func1 and func2"""

1121

1298

func1(*args, **kwargs)

1122

1299

func2(*args, **kwargs)

1300

# Make wrapper function look like a D-Bus signal

1301

for name, attr in inspect.getmembers(func2):

1302

if name.startswith("_dbus_"):

1303

setattr(call_both, name, attr)

1304

1123

1305

return call_both

1124

1306

# Create the "call_both" function and add it to

1125

1307

# the class

1130

1312

# object. Decorate it to be a new D-Bus method

1131

1313

# with the alternate D-Bus interface name. Add it

1132

1314

# to the class.

1133

attr[attrname] = (dbus.service.method

1134

(alt_interface,

1135

attribute._dbus_in_signature,

1136

attribute._dbus_out_signature)

1137

(types.FunctionType

1138

(attribute.func_code,

1139

attribute.func_globals,

1140

attribute.func_name,

1141

attribute.func_defaults,

1142

attribute.func_closure)))

1315

attr[attrname] = (

1316

dbus.service.method(

1317

alt_interface,

1318

attribute._dbus_in_signature,

1319

attribute._dbus_out_signature)

1320

(types.FunctionType(attribute.func_code,

1321

attribute.func_globals,

1322

attribute.func_name,

1323

attribute.func_defaults,

1324

attribute.func_closure)))

1143

1325

# Copy annotations, if any

1144

1326

try:

1145

attr[attrname]._dbus_annotations = (

1146

dict(attribute._dbus_annotations))

1327

attr[attrname]._dbus_annotations = dict(

1328

attribute._dbus_annotations)

1147

1329

except AttributeError:

1148

1330

pass

1149

1331

# Is this a D-Bus property?

1152

1334

# object, and decorate it to be a new D-Bus

1153

1335

# property with the alternate D-Bus interface

1154

1336

# name. Add it to the class.

1155

attr[attrname] = (dbus_service_property

1156

(alt_interface,

1157

attribute._dbus_signature,

1158

attribute._dbus_access,

1159

attribute

1160

._dbus_get_args_options

1161

["byte_arrays"])

1162

(types.FunctionType

1163

(attribute.func_code,

1164

attribute.func_globals,

1165

attribute.func_name,

1166

attribute.func_defaults,

1167

attribute.func_closure)))

1337

attr[attrname] = (dbus_service_property(

1338

alt_interface, attribute._dbus_signature,

1339

attribute._dbus_access,

1340

attribute._dbus_get_args_options

1341

["byte_arrays"])

1342

(types.FunctionType(

1343

attribute.func_code,

1344

attribute.func_globals,

1345

attribute.func_name,

1346

attribute.func_defaults,

1347

attribute.func_closure)))

1168

1348

# Copy annotations, if any

1169

1349

try:

1170

attr[attrname]._dbus_annotations = (

1171

dict(attribute._dbus_annotations))

1350

attr[attrname]._dbus_annotations = dict(

1351

attribute._dbus_annotations)

1172

1352

except AttributeError:

1173

1353

pass

1174

1354

# Is this a D-Bus interface?

1177

1357

# object. Decorate it to be a new D-Bus interface

1178

1358

# with the alternate D-Bus interface name. Add it

1179

1359

# to the class.

1180

attr[attrname] = (dbus_interface_annotations

1181

(alt_interface)

1182

(types.FunctionType

1183

(attribute.func_code,

1184

attribute.func_globals,

1185

attribute.func_name,

1186

attribute.func_defaults,

1187

attribute.func_closure)))

1360

attr[attrname] = (

1361

dbus_interface_annotations(alt_interface)

1362

(types.FunctionType(attribute.func_code,

1363

attribute.func_globals,

1364

attribute.func_name,

1365

attribute.func_defaults,

1366

attribute.func_closure)))

1188

1367

if deprecate:

1189

1368

# Deprecate all alternate interfaces

1190

1369

iname="_AlternateDBusNames_interface_annotation{}"

1191

1370

for interface_name in interface_names:

1371

1192

1372

@dbus_interface_annotations(interface_name)

1193

1373

def func(self):

1194

1374

return { "org.freedesktop.DBus.Deprecated":

1195

"true" }

1375

"true" }

1196

1376

# Find an unused name

1197

1377

for aname in (iname.format(i)

1198

1378

for i in itertools.count()):

1203

1383

# Replace the class with a new subclass of it with

1204

1384

# methods, signals, etc. as created above.

1205

1385

cls = type(b"{}Alternate".format(cls.__name__),

1206

(cls,), attr)

1386

(cls, ), attr)

1207

1387

return cls

1388

1208

1389

return wrapper

1209

1390

1210

1391

1211

1392

@alternate_dbus_interfaces({"se.recompile.Mandos":

1212

"se.bsnet.fukt.Mandos"})

1393

"se.bsnet.fukt.Mandos"})

1213

1394

class ClientDBus(Client, DBusObjectWithProperties):

1214

1395

"""A Client class using D-Bus

1215

1396

1219

1400

"""

1220

1401

1221

1402

runtime_expansions = (Client.runtime_expansions

1222

+ ("dbus_object_path",))

1403

+ ("dbus_object_path", ))

1404

1405

_interface = "se.recompile.Mandos.Client"

1223

1406

1224

1407

# dbus.service.Object doesn't use super(), so we can't either.

1225

1408

1228

1411

Client.__init__(self, *args, **kwargs)

1229

1412

# Only now, when this client is initialized, can it show up on

1230

1413

# the D-Bus

1231

client_object_name = unicode(self.name).translate(

1414

client_object_name = str(self.name).translate(

1232

1415

{ord("."): ord("_"),

1233

1416

ord("-"): ord("_")})

1234

self.dbus_object_path = (dbus.ObjectPath

1235

("/clients/" + client_object_name))

1417

self.dbus_object_path = dbus.ObjectPath(

1418

"/clients/" + client_object_name)

1236

1419

DBusObjectWithProperties.__init__(self, self.bus,

1237

1420

self.dbus_object_path)

1238

1421

1239

def notifychangeproperty(transform_func,

1240

dbus_name, type_func=lambda x: x,

1241

variant_level=1):

1422

def notifychangeproperty(transform_func, dbus_name,

1423

type_func=lambda x: x,

1424

variant_level=1,

1425

invalidate_only=False,

1426

_interface=_interface):

1242

1427

""" Modify a variable so that it's a property which announces

1243

1428

its changes to DBus.

1244

1429

1250

1435

variant_level: D-Bus variant level. Default: 1

1251

1436

"""

1252

1437

attrname = "_{}".format(dbus_name)

1438

1253

1439

def setter(self, value):

1254

1440

if hasattr(self, "dbus_object_path"):

1255

1441

if (not hasattr(self, attrname) or

1256

1442

type_func(getattr(self, attrname, None))

1257

1443

!= type_func(value)):

1258

dbus_value = transform_func(type_func(value),

1259

variant_level

1260

=variant_level)

1261

self.PropertyChanged(dbus.String(dbus_name),

1262

dbus_value)

1444

if invalidate_only:

1445

self.PropertiesChanged(

1446

_interface, dbus.Dictionary(),

1447

dbus.Array((dbus_name, )))

1448

else:

1449

dbus_value = transform_func(

1450

type_func(value),

1451

variant_level = variant_level)

1452

self.PropertyChanged(dbus.String(dbus_name),

1453

dbus_value)

1454

self.PropertiesChanged(

1455

_interface,

1456

dbus.Dictionary({ dbus.String(dbus_name):

1457

dbus_value }),

1458

dbus.Array())

1263

1459

setattr(self, attrname, value)

1264

1460

1265

1461

return property(lambda self: getattr(self, attrname), setter)

1271

1467

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1272

1468

last_enabled = notifychangeproperty(datetime_to_dbus,

1273

1469

"LastEnabled")

1274

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1275

type_func = lambda checker:

1276

checker is not None)

1470

checker = notifychangeproperty(

1471

dbus.Boolean, "CheckerRunning",

1472

type_func = lambda checker: checker is not None)

1277

1473

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1278

1474

"LastCheckedOK")

1279

1475

last_checker_status = notifychangeproperty(dbus.Int16,

1282

1478

datetime_to_dbus, "LastApprovalRequest")

1283

1479

approved_by_default = notifychangeproperty(dbus.Boolean,

1284

1480

"ApprovedByDefault")

1285

approval_delay = notifychangeproperty(dbus.UInt64,

1286

"ApprovalDelay",

1287

type_func =

1288

lambda td: td.total_seconds()

1289

* 1000)

1481

approval_delay = notifychangeproperty(

1482

dbus.UInt64, "ApprovalDelay",

1483

type_func = lambda td: td.total_seconds() * 1000)

1290

1484

approval_duration = notifychangeproperty(

1291

1485

dbus.UInt64, "ApprovalDuration",

1292

1486

type_func = lambda td: td.total_seconds() * 1000)

1293

1487

host = notifychangeproperty(dbus.String, "Host")

1294

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1295

type_func = lambda td:

1296

td.total_seconds() * 1000)

1488

timeout = notifychangeproperty(

1489

dbus.UInt64, "Timeout",

1490

type_func = lambda td: td.total_seconds() * 1000)

1297

1491

extended_timeout = notifychangeproperty(

1298

1492

dbus.UInt64, "ExtendedTimeout",

1299

1493

type_func = lambda td: td.total_seconds() * 1000)

1300

interval = notifychangeproperty(dbus.UInt64,

1301

"Interval",

1302

type_func =

1303

lambda td: td.total_seconds()

1304

* 1000)

1494

interval = notifychangeproperty(

1495

dbus.UInt64, "Interval",

1496

type_func = lambda td: td.total_seconds() * 1000)

1305

1497

checker_command = notifychangeproperty(dbus.String, "Checker")

1498

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1499

invalidate_only=True)

1306

1500

1307

1501

del notifychangeproperty

1308

1502

1315

1509

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1316

1510

Client.__del__(self, *args, **kwargs)

1317

1511

1318

def checker_callback(self, pid, condition, command,

1319

*args, **kwargs):

1320

self.checker_callback_tag = None

1321

self.checker = None

1322

if os.WIFEXITED(condition):

1323

exitstatus = os.WEXITSTATUS(condition)

1512

def checker_callback(self, source, condition,

1513

connection, command, *args, **kwargs):

1514

ret = Client.checker_callback(self, source, condition,

1515

connection, command, *args,

1516

**kwargs)

1517

exitstatus = self.last_checker_status

1518

if exitstatus >= 0:

1324

1519

# Emit D-Bus signal

1325

1520

self.CheckerCompleted(dbus.Int16(exitstatus),

1326

dbus.Int64(condition),

1521

# This is specific to GNU libC

1522

dbus.Int64(exitstatus << 8),

1327

1523

dbus.String(command))

1328

1524

else:

1329

1525

# Emit D-Bus signal

1330

1526

self.CheckerCompleted(dbus.Int16(-1),

1331

dbus.Int64(condition),

1527

dbus.Int64(

1528

# This is specific to GNU libC

1529

(exitstatus << 8)

1530

| self.last_checker_signal),

1332

1531

dbus.String(command))

1333

1334

return Client.checker_callback(self, pid, condition, command,

1335

*args, **kwargs)

1532

return ret

1336

1533

1337

1534

def start_checker(self, *args, **kwargs):

1338

1535

old_checker_pid = getattr(self.checker, "pid", None)

1355

1552

self.send_changedstate()

1356

1553

1357

1554

## D-Bus methods, signals & properties

1358

_interface = "se.recompile.Mandos.Client"

1359

1555

1360

1556

## Interfaces

1361

1557

1362

@dbus_interface_annotations(_interface)

1363

def _foo(self):

1364

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1365

"false"}

1366

1367

1558

## Signals

1368

1559

1369

1560

# CheckerCompleted - signal

1379

1570

pass

1380

1571

1381

1572

# PropertyChanged - signal

1573

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1382

1574

@dbus.service.signal(_interface, signature="sv")

1383

1575

def PropertyChanged(self, property, value):

1384

1576

"D-Bus signal"

1418

1610

self.checked_ok()

1419

1611

1420

1612

# Enable - method

1613

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1421

1614

@dbus.service.method(_interface)

1422

1615

def Enable(self):

1423

1616

"D-Bus method"

1424

1617

self.enable()

1425

1618

1426

1619

# StartChecker - method

1620

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1427

1621

@dbus.service.method(_interface)

1428

1622

def StartChecker(self):

1429

1623

"D-Bus method"

1430

1624

self.start_checker()

1431

1625

1432

1626

# Disable - method

1627

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1433

1628

@dbus.service.method(_interface)

1434

1629

def Disable(self):

1435

1630

"D-Bus method"

1436

1631

self.disable()

1437

1632

1438

1633

# StopChecker - method

1634

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1439

1635

@dbus.service.method(_interface)

1440

1636

def StopChecker(self):

1441

1637

self.stop_checker()

1448

1644

return dbus.Boolean(bool(self.approvals_pending))

1449

1645

1450

1646

# ApprovedByDefault - property

1451

@dbus_service_property(_interface, signature="b",

1647

@dbus_service_property(_interface,

1648

signature="b",

1452

1649

access="readwrite")

1453

1650

def ApprovedByDefault_dbus_property(self, value=None):

1454

1651

if value is None: # get

1456

1653

self.approved_by_default = bool(value)

1457

1654

1458

1655

# ApprovalDelay - property

1459

@dbus_service_property(_interface, signature="t",

1656

@dbus_service_property(_interface,

1657

signature="t",

1460

1658

access="readwrite")

1461

1659

def ApprovalDelay_dbus_property(self, value=None):

1462

1660

if value is None: # get

1465

1663

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1466

1664

1467

1665

# ApprovalDuration - property

1468

@dbus_service_property(_interface, signature="t",

1666

@dbus_service_property(_interface,

1667

signature="t",

1469

1668

access="readwrite")

1470

1669

def ApprovalDuration_dbus_property(self, value=None):

1471

1670

if value is None: # get

1474

1673

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1475

1674

1476

1675

# Name - property

1676

@dbus_annotations(

1677

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1477

1678

@dbus_service_property(_interface, signature="s", access="read")

1478

1679

def Name_dbus_property(self):

1479

1680

return dbus.String(self.name)

1480

1681

1481

1682

# Fingerprint - property

1683

@dbus_annotations(

1684

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1482

1685

@dbus_service_property(_interface, signature="s", access="read")

1483

1686

def Fingerprint_dbus_property(self):

1484

1687

return dbus.String(self.fingerprint)

1485

1688

1486

1689

# Host - property

1487

@dbus_service_property(_interface, signature="s",

1690

@dbus_service_property(_interface,

1691

signature="s",

1488

1692

access="readwrite")

1489

1693

def Host_dbus_property(self, value=None):

1490

1694

if value is None: # get

1491

1695

return dbus.String(self.host)

1492

self.host = unicode(value)

1696

self.host = str(value)

1493

1697

1494

1698

# Created - property

1699

@dbus_annotations(

1700

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1495

1701

@dbus_service_property(_interface, signature="s", access="read")

1496

1702

def Created_dbus_property(self):

1497

1703

return datetime_to_dbus(self.created)

1502

1708

return datetime_to_dbus(self.last_enabled)

1503

1709

1504

1710

# Enabled - property

1505

@dbus_service_property(_interface, signature="b",

1711

@dbus_service_property(_interface,

1712

signature="b",

1506

1713

access="readwrite")

1507

1714

def Enabled_dbus_property(self, value=None):

1508

1715

if value is None: # get

1513

1720

self.disable()

1514

1721

1515

1722

# LastCheckedOK - property

1516

@dbus_service_property(_interface, signature="s",

1723

@dbus_service_property(_interface,

1724

signature="s",

1517

1725

access="readwrite")

1518

1726

def LastCheckedOK_dbus_property(self, value=None):

1519

1727

if value is not None:

1522

1730

return datetime_to_dbus(self.last_checked_ok)

1523

1731

1524

1732

# LastCheckerStatus - property

1525

@dbus_service_property(_interface, signature="n",

1526

access="read")

1733

@dbus_service_property(_interface, signature="n", access="read")

1527

1734

def LastCheckerStatus_dbus_property(self):

1528

1735

return dbus.Int16(self.last_checker_status)

1529

1736

1538

1745

return datetime_to_dbus(self.last_approval_request)

1539

1746

1540

1747

# Timeout - property

1541

@dbus_service_property(_interface, signature="t",

1748

@dbus_service_property(_interface,

1749

signature="t",

1542

1750

access="readwrite")

1543

1751

def Timeout_dbus_property(self, value=None):

1544

1752

if value is None: # get

1557

1765

is None):

1558

1766

return

1559

1767

gobject.source_remove(self.disable_initiator_tag)

1560

self.disable_initiator_tag = (

1561

gobject.timeout_add(

1562

int((self.expires - now).total_seconds()

1563

* 1000), self.disable))

1768

self.disable_initiator_tag = gobject.timeout_add(

1769

int((self.expires - now).total_seconds() * 1000),

1770

self.disable)

1564

1771

1565

1772

# ExtendedTimeout - property

1566

@dbus_service_property(_interface, signature="t",

1773

@dbus_service_property(_interface,

1774

signature="t",

1567

1775

access="readwrite")

1568

1776

def ExtendedTimeout_dbus_property(self, value=None):

1569

1777

if value is None: # get

1572

1780

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1573

1781

1574

1782

# Interval - property

1575

@dbus_service_property(_interface, signature="t",

1783

@dbus_service_property(_interface,

1784

signature="t",

1576

1785

access="readwrite")

1577

1786

def Interval_dbus_property(self, value=None):

1578

1787

if value is None: # get

1583

1792

if self.enabled:

1584

1793

# Reschedule checker run

1585

1794

gobject.source_remove(self.checker_initiator_tag)

1586

self.checker_initiator_tag = (gobject.timeout_add

1587

(value, self.start_checker))

1588

self.start_checker() # Start one now, too

1795

self.checker_initiator_tag = gobject.timeout_add(

1796

value, self.start_checker)

1797

self.start_checker() # Start one now, too

1589

1798

1590

1799

# Checker - property

1591

@dbus_service_property(_interface, signature="s",

1800

@dbus_service_property(_interface,

1801

signature="s",

1592

1802

access="readwrite")

1593

1803

def Checker_dbus_property(self, value=None):

1594

1804

if value is None: # get

1595

1805

return dbus.String(self.checker_command)

1596

self.checker_command = unicode(value)

1806

self.checker_command = str(value)

1597

1807

1598

1808

# CheckerRunning - property

1599

@dbus_service_property(_interface, signature="b",

1809

@dbus_service_property(_interface,

1810

signature="b",

1600

1811

access="readwrite")

1601

1812

def CheckerRunning_dbus_property(self, value=None):

1602

1813

if value is None: # get

1607

1818

self.stop_checker()

1608

1819

1609

1820

# ObjectPath - property

1821

@dbus_annotations(

1822

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

1823

"org.freedesktop.DBus.Deprecated": "true"})

1610

1824

@dbus_service_property(_interface, signature="o", access="read")

1611

1825

def ObjectPath_dbus_property(self):

1612

1826

return self.dbus_object_path # is already a dbus.ObjectPath

1613

1827

1614

1828

# Secret = property

1615

@dbus_service_property(_interface, signature="ay",

1616

access="write", byte_arrays=True)

1829

@dbus_annotations(

1830

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

1831

"invalidates"})

1832

@dbus_service_property(_interface,

1833

signature="ay",

1834

access="write",

1835

byte_arrays=True)

1617

1836

def Secret_dbus_property(self, value):

1618

self.secret = str(value)

1837

self.secret = bytes(value)

1619

1838

1620

1839

del _interface

1621

1840

1625

1844

self._pipe = child_pipe

1626

1845

self._pipe.send(('init', fpr, address))

1627

1846

if not self._pipe.recv():

1628

raise KeyError()

1847

raise KeyError(fpr)

1629

1848

1630

1849

def __getattribute__(self, name):

1631

1850

if name == '_pipe':

1635

1854

if data[0] == 'data':

1636

1855

return data[1]

1637

1856

if data[0] == 'function':

1857

1638

1858

def func(*args, **kwargs):

1639

1859

self._pipe.send(('funcall', name, args, kwargs))

1640

1860

return self._pipe.recv()[1]

1861

1641

1862

return func

1642

1863

1643

1864

def __setattr__(self, name, value):

1655

1876

def handle(self):

1656

1877

with contextlib.closing(self.server.child_pipe) as child_pipe:

1657

1878

logger.info("TCP connection from: %s",

1658

unicode(self.client_address))

1879

str(self.client_address))

1659

1880

logger.debug("Pipe FD: %d",

1660

1881

self.server.child_pipe.fileno())

1661

1882

1662

session = (gnutls.connection

1663

.ClientSession(self.request,

1664

gnutls.connection

1665

.X509Credentials()))

1883

session = gnutls.connection.ClientSession(

1884

self.request, gnutls.connection .X509Credentials())

1666

1885

1667

1886

# Note: gnutls.connection.X509Credentials is really a

1668

1887

# generic GnuTLS certificate credentials object so long as

1677

1896

priority = self.server.gnutls_priority

1678

1897

if priority is None:

1679

1898

priority = "NORMAL"

1680

(gnutls.library.functions

1681

.gnutls_priority_set_direct(session._c_object,

1682

priority, None))

1899

gnutls.library.functions.gnutls_priority_set_direct(

1900

session._c_object, priority, None)

1683

1901

1684

1902

# Start communication using the Mandos protocol

1685

1903

# Get protocol number

1705

1923

approval_required = False

1706

1924

try:

1707

1925

try:

1708

fpr = self.fingerprint(self.peer_certificate

1709

(session))

1926

fpr = self.fingerprint(

1927

self.peer_certificate(session))

1710

1928

except (TypeError,

1711

1929

gnutls.errors.GNUTLSError) as error:

1712

1930

logger.warning("Bad certificate: %s", error)

1727

1945

while True:

1728

1946

if not client.enabled:

1729

1947

logger.info("Client %s is disabled",

1730

client.name)

1948

client.name)

1731

1949

if self.server.use_dbus:

1732

1950

# Emit D-Bus signal

1733

1951

client.Rejected("Disabled")

1780

1998

logger.warning("gnutls send failed",

1781

1999

exc_info=error)

1782

2000

return

1783

logger.debug("Sent: %d, remaining: %d",

1784

sent, len(client.secret)

1785

- (sent_size + sent))

2001

logger.debug("Sent: %d, remaining: %d", sent,

2002

len(client.secret) - (sent_size

2003

+ sent))

1786

2004

sent_size += sent

1787

2005

1788

2006

logger.info("Sending secret to %s", client.name)

1805

2023

def peer_certificate(session):

1806

2024

"Return the peer's OpenPGP certificate as a bytestring"

1807

2025

# If not an OpenPGP certificate...

1808

if (gnutls.library.functions

1809

.gnutls_certificate_type_get(session._c_object)

2026

if (gnutls.library.functions.gnutls_certificate_type_get(

2027

session._c_object)

1810

2028

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1811

2029

# ...do the normal thing

1812

2030

return session.peer_certificate

1826

2044

def fingerprint(openpgp):

1827

2045

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1828

2046

# New GnuTLS "datum" with the OpenPGP public key

1829

datum = (gnutls.library.types

1830

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1831

ctypes.POINTER

1832

(ctypes.c_ubyte)),

1833

ctypes.c_uint(len(openpgp))))

2047

datum = gnutls.library.types.gnutls_datum_t(

2048

ctypes.cast(ctypes.c_char_p(openpgp),

2049

ctypes.POINTER(ctypes.c_ubyte)),

2050

ctypes.c_uint(len(openpgp)))

1834

2051

# New empty GnuTLS certificate

1835

2052

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1836

(gnutls.library.functions

1837

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2053

gnutls.library.functions.gnutls_openpgp_crt_init(

2054

ctypes.byref(crt))

1838

2055

# Import the OpenPGP public key into the certificate

1839

(gnutls.library.functions

1840

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1841

gnutls.library.constants

1842

.GNUTLS_OPENPGP_FMT_RAW))

2056

gnutls.library.functions.gnutls_openpgp_crt_import(

2057

crt, ctypes.byref(datum),

2058

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1843

2059

# Verify the self signature in the key

1844

2060

crtverify = ctypes.c_uint()

1845

(gnutls.library.functions

1846

.gnutls_openpgp_crt_verify_self(crt, 0,

1847

ctypes.byref(crtverify)))

2061

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

2062

crt, 0, ctypes.byref(crtverify))

1848

2063

if crtverify.value != 0:

1849

2064

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1850

raise (gnutls.errors.CertificateSecurityError

1851

("Verify failed"))

2065

raise gnutls.errors.CertificateSecurityError(

2066

"Verify failed")

1852

2067

# New buffer for the fingerprint

1853

2068

buf = ctypes.create_string_buffer(20)

1854

2069

buf_len = ctypes.c_size_t()

1855

2070

# Get the fingerprint from the certificate into the buffer

1856

(gnutls.library.functions

1857

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1858

ctypes.byref(buf_len)))

2071

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

2072

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1859

2073

# Deinit the certificate

1860

2074

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1861

2075

# Convert the buffer to a Python bytestring

1867

2081

1868

2082

class MultiprocessingMixIn(object):

1869

2083

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2084

1870

2085

def sub_process_main(self, request, address):

1871

2086

try:

1872

2087

self.finish_request(request, address)

1884

2099

1885

2100

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1886

2101

""" adds a pipe to the MixIn """

2102

1887

2103

def process_request(self, request, client_address):

1888

2104

"""Overrides and wraps the original process_request().

1889

2105

1910

2126

interface: None or a network interface name (string)

1911

2127

use_ipv6: Boolean; to use IPv6 or not

1912

2128

"""

2129

1913

2130

def __init__(self, server_address, RequestHandlerClass,

1914

interface=None, use_ipv6=True, socketfd=None):

2131

interface=None,

2132

use_ipv6=True,

2133

socketfd=None):

1915

2134

"""If socketfd is set, use that file descriptor instead of

1916

2135

creating a new one with socket.socket().

1917

2136

"""

1958

2177

self.interface)

1959

2178

else:

1960

2179

try:

1961

self.socket.setsockopt(socket.SOL_SOCKET,

1962

SO_BINDTODEVICE,

1963

str(self.interface + '\0'))

2180

self.socket.setsockopt(

2181

socket.SOL_SOCKET, SO_BINDTODEVICE,

2182

(self.interface + "\0").encode("utf-8"))

1964

2183

except socket.error as error:

1965

2184

if error.errno == errno.EPERM:

1966

2185

logger.error("No permission to bind to"

1984

2203

self.server_address = (any_address,

1985

2204

self.server_address[1])

1986

2205

elif not self.server_address[1]:

1987

self.server_address = (self.server_address[0],

1988

0)

2206

self.server_address = (self.server_address[0], 0)

1989

2207

# if self.interface:

1990

2208

# self.server_address = (self.server_address[0],

1991

2209

# 0, # port

2005

2223

2006

2224

Assumes a gobject.MainLoop event loop.

2007

2225

"""

2226

2008

2227

def __init__(self, server_address, RequestHandlerClass,

2009

interface=None, use_ipv6=True, clients=None,

2010

gnutls_priority=None, use_dbus=True, socketfd=None):

2228

interface=None,

2229

use_ipv6=True,

2230

clients=None,

2231

gnutls_priority=None,

2232

use_dbus=True,

2233

socketfd=None):

2011

2234

self.enabled = False

2012

2235

self.clients = clients

2013

2236

if self.clients is None:

2019

2242

interface = interface,

2020

2243

use_ipv6 = use_ipv6,

2021

2244

socketfd = socketfd)

2245

2022

2246

def server_activate(self):

2023

2247

if self.enabled:

2024

2248

return socketserver.TCPServer.server_activate(self)

2028

2252

2029

2253

def add_pipe(self, parent_pipe, proc):

2030

2254

# Call "handle_ipc" for both data and EOF events

2031

gobject.io_add_watch(parent_pipe.fileno(),

2032

gobject.IO_IN | gobject.IO_HUP,

2033

functools.partial(self.handle_ipc,

2034

parent_pipe =

2035

parent_pipe,

2036

proc = proc))

2255

gobject.io_add_watch(

2256

parent_pipe.fileno(),

2257

gobject.IO_IN | gobject.IO_HUP,

2258

functools.partial(self.handle_ipc,

2259

parent_pipe = parent_pipe,

2260

proc = proc))

2037

2261

2038

def handle_ipc(self, source, condition, parent_pipe=None,

2039

proc = None, client_object=None):

2262

def handle_ipc(self, source, condition,

2263

parent_pipe=None,

2264

proc = None,

2265

client_object=None):

2040

2266

# error, or the other end of multiprocessing.Pipe has closed

2041

2267

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2042

2268

# Wait for other process to exit

2065

2291

parent_pipe.send(False)

2066

2292

return False

2067

2293

2068

gobject.io_add_watch(parent_pipe.fileno(),

2069

gobject.IO_IN | gobject.IO_HUP,

2070

functools.partial(self.handle_ipc,

2071

parent_pipe =

2072

parent_pipe,

2073

proc = proc,

2074

client_object =

2075

client))

2294

gobject.io_add_watch(

2295

parent_pipe.fileno(),

2296

gobject.IO_IN | gobject.IO_HUP,

2297

functools.partial(self.handle_ipc,

2298

parent_pipe = parent_pipe,

2299

proc = proc,

2300

client_object = client))

2076

2301

parent_pipe.send(True)

2077

2302

# remove the old hook in favor of the new above hook on

2078

2303

# same fileno

2084

2309

2085

2310

parent_pipe.send(('data', getattr(client_object,

2086

2311

funcname)(*args,

2087

**kwargs)))

2312

**kwargs)))

2088

2313

2089

2314

if command == 'getattr':

2090

2315

attrname = request[1]

2091

if callable(client_object.__getattribute__(attrname)):

2092

parent_pipe.send(('function',))

2316

if isinstance(client_object.__getattribute__(attrname),

2317

collections.Callable):

2318

parent_pipe.send(('function', ))

2093

2319

else:

2094

parent_pipe.send(('data', client_object

2095

.__getattribute__(attrname)))

2320

parent_pipe.send((

2321

'data', client_object.__getattribute__(attrname)))

2096

2322

2097

2323

if command == 'setattr':

2098

2324

attrname = request[1]

2129

2355

# avoid excessive use of external libraries.

2130

2356

2131

2357

# New type for defining tokens, syntax, and semantics all-in-one

2132

Token = collections.namedtuple("Token",

2133

("regexp", # To match token; if

2134

# "value" is not None,

2135

# must have a "group"

2136

# containing digits

2137

"value", # datetime.timedelta or

2138

# None

2139

"followers")) # Tokens valid after

2140

# this token

2358

Token = collections.namedtuple("Token", (

2359

"regexp", # To match token; if "value" is not None, must have

2360

# a "group" containing digits

2361

"value", # datetime.timedelta or None

2362

"followers")) # Tokens valid after this token

2141

2363

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2142

2364

# the "duration" ABNF definition in RFC 3339, Appendix A.

2143

2365

token_end = Token(re.compile(r"$"), None, frozenset())

2144

2366

token_second = Token(re.compile(r"(\d+)S"),

2145

2367

datetime.timedelta(seconds=1),

2146

frozenset((token_end,)))

2368

frozenset((token_end, )))

2147

2369

token_minute = Token(re.compile(r"(\d+)M"),

2148

2370

datetime.timedelta(minutes=1),

2149

2371

frozenset((token_second, token_end)))

2165

2387

frozenset((token_month, token_end)))

2166

2388

token_week = Token(re.compile(r"(\d+)W"),

2167

2389

datetime.timedelta(weeks=1),

2168

frozenset((token_end,)))

2390

frozenset((token_end, )))

2169

2391

token_duration = Token(re.compile(r"P"), None,

2170

2392

frozenset((token_year, token_month,

2171

2393

token_day, token_time,

2173

2395

# Define starting values

2174

2396

value = datetime.timedelta() # Value so far

2175

2397

found_token = None

2176

followers = frozenset((token_duration,)) # Following valid tokens

2398

followers = frozenset((token_duration, )) # Following valid tokens

2177

2399

s = duration # String left to parse

2178

2400

# Loop until end token is found

2179

2401

while found_token is not token_end:

2196

2418

break

2197

2419

else:

2198

2420

# No currently valid tokens were found

2199

raise ValueError("Invalid RFC 3339 duration")

2421

raise ValueError("Invalid RFC 3339 duration: {!r}"

2422

.format(duration))

2200

2423

# End token found

2201

2424

return value

2202

2425

2226

2449

timevalue = datetime.timedelta(0)

2227

2450

for s in interval.split():

2228

2451

try:

2229

suffix = unicode(s[-1])

2452

suffix = s[-1]

2230

2453

value = int(s[:-1])

2231

2454

if suffix == "d":

2232

2455

delta = datetime.timedelta(value)

2239

2462

elif suffix == "w":

2240

2463

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2241

2464

else:

2242

raise ValueError("Unknown suffix {!r}"

2243

.format(suffix))

2465

raise ValueError("Unknown suffix {!r}".format(suffix))

2244

2466

except IndexError as e:

2245

2467

raise ValueError(*(e.args))

2246

2468

timevalue += delta

2262

2484

# Close all standard open file descriptors

2263

2485

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2264

2486

if not stat.S_ISCHR(os.fstat(null).st_mode):

2265

raise OSError(errno.ENODEV, "{} not a character device"

2487

raise OSError(errno.ENODEV,

2488

"{} not a character device"

2266

2489

.format(os.devnull))

2267

2490

os.dup2(null, sys.stdin.fileno())

2268

2491

os.dup2(null, sys.stdout.fileno())

2334

2557

"port": "",

2335

2558

"debug": "False",

2336

2559

"priority":

2337

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2560

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2561

":+SIGN-DSA-SHA256",

2338

2562

"servicename": "Mandos",

2339

2563

"use_dbus": "True",

2340

2564

"use_ipv6": "True",

2344

2568

"statedir": "/var/lib/mandos",

2345

2569

"foreground": "False",

2346

2570

"zeroconf": "True",

2347

}

2571

}

2348

2572

2349

2573

# Parse config file for server-global settings

2350

2574

server_config = configparser.SafeConfigParser(server_defaults)

2351

2575

del server_defaults

2352

server_config.read(os.path.join(options.configdir,

2353

"mandos.conf"))

2576

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2354

2577

# Convert the SafeConfigParser object to a dict

2355

2578

server_settings = server_config.defaults()

2356

2579

# Use the appropriate methods on the non-string config options

2374

2597

# Override the settings from the config file with command line

2375

2598

# options, if set.

2376

2599

for option in ("interface", "address", "port", "debug",

2377

"priority", "servicename", "configdir",

2378

"use_dbus", "use_ipv6", "debuglevel", "restore",

2379

"statedir", "socket", "foreground", "zeroconf"):

2600

"priority", "servicename", "configdir", "use_dbus",

2601

"use_ipv6", "debuglevel", "restore", "statedir",

2602

"socket", "foreground", "zeroconf"):

2380

2603

value = getattr(options, option)

2381

2604

if value is not None:

2382

2605

server_settings[option] = value

2383

2606

del options

2384

2607

# Force all strings to be unicode

2385

2608

for option in server_settings.keys():

2386

if type(server_settings[option]) is str:

2387

server_settings[option] = unicode(server_settings[option])

2609

if isinstance(server_settings[option], bytes):

2610

server_settings[option] = (server_settings[option]

2611

.decode("utf-8"))

2388

2612

# Force all boolean options to be boolean

2389

2613

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2390

2614

"foreground", "zeroconf"):

2396

2620

2397

2621

##################################################################

2398

2622

2399

if (not server_settings["zeroconf"] and

2400

not (server_settings["port"]

2401

or server_settings["socket"] != "")):

2402

parser.error("Needs port or socket to work without"

2403

" Zeroconf")

2623

if (not server_settings["zeroconf"]

2624

and not (server_settings["port"]

2625

or server_settings["socket"] != "")):

2626

parser.error("Needs port or socket to work without Zeroconf")

2404

2627

2405

2628

# For convenience

2406

2629

debug = server_settings["debug"]

2422

2645

initlogger(debug, level)

2423

2646

2424

2647

if server_settings["servicename"] != "Mandos":

2425

syslogger.setFormatter(logging.Formatter

2426

('Mandos ({}) [%(process)d]:'

2427

' %(levelname)s: %(message)s'

2428

.format(server_settings

2429

["servicename"])))

2648

syslogger.setFormatter(

2649

logging.Formatter('Mandos ({}) [%(process)d]:'

2650

' %(levelname)s: %(message)s'.format(

2651

server_settings["servicename"])))

2430

2652

2431

2653

# Parse config file with clients

2432

2654

client_config = configparser.SafeConfigParser(Client

2440

2662

socketfd = None

2441

2663

if server_settings["socket"] != "":

2442

2664

socketfd = server_settings["socket"]

2443

tcp_server = MandosServer((server_settings["address"],

2444

server_settings["port"]),

2445

ClientHandler,

2446

interface=(server_settings["interface"]

2447

or None),

2448

use_ipv6=use_ipv6,

2449

gnutls_priority=

2450

server_settings["priority"],

2451

use_dbus=use_dbus,

2452

socketfd=socketfd)

2665

tcp_server = MandosServer(

2666

(server_settings["address"], server_settings["port"]),

2667

ClientHandler,

2668

interface=(server_settings["interface"] or None),

2669

use_ipv6=use_ipv6,

2670

gnutls_priority=server_settings["priority"],

2671

use_dbus=use_dbus,

2672

socketfd=socketfd)

2453

2673

if not foreground:

2454

2674

pidfilename = "/run/mandos.pid"

2455

2675

if not os.path.isdir("/run/."):

2456

2676

pidfilename = "/var/run/mandos.pid"

2457

2677

pidfile = None

2458

2678

try:

2459

pidfile = open(pidfilename, "w")

2679

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2460

2680

except IOError as e:

2461

2681

logger.error("Could not open file %r", pidfilename,

2462

2682

exc_info=e)

2489

2709

def debug_gnutls(level, string):

2490

2710

logger.debug("GnuTLS: %s", string[:-1])

2491

2711

2492

(gnutls.library.functions

2493

.gnutls_global_set_log_function(debug_gnutls))

2712

gnutls.library.functions.gnutls_global_set_log_function(

2713

debug_gnutls)

2494

2714

2495

2715

# Redirect stdin so all checkers get /dev/null

2496

2716

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2516

2736

if use_dbus:

2517

2737

try:

2518

2738

bus_name = dbus.service.BusName("se.recompile.Mandos",

2519

bus, do_not_queue=True)

2520

old_bus_name = (dbus.service.BusName

2521

("se.bsnet.fukt.Mandos", bus,

2522

do_not_queue=True))

2523

except dbus.exceptions.NameExistsException as e:

2739

bus,

2740

do_not_queue=True)

2741

old_bus_name = dbus.service.BusName(

2742

"se.bsnet.fukt.Mandos", bus,

2743

do_not_queue=True)

2744

except dbus.exceptions.DBusException as e:

2524

2745

logger.error("Disabling D-Bus:", exc_info=e)

2525

2746

use_dbus = False

2526

2747

server_settings["use_dbus"] = False

2527

2748

tcp_server.use_dbus = False

2528

2749

if zeroconf:

2529

2750

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2530

service = AvahiServiceToSyslog(name =

2531

server_settings["servicename"],

2532

servicetype = "_mandos._tcp",

2533

protocol = protocol, bus = bus)

2751

service = AvahiServiceToSyslog(

2752

name = server_settings["servicename"],

2753

servicetype = "_mandos._tcp",

2754

protocol = protocol,

2755

bus = bus)

2534

2756

if server_settings["interface"]:

2535

service.interface = (if_nametoindex

2536

(str(server_settings["interface"])))

2757

service.interface = if_nametoindex(

2758

server_settings["interface"].encode("utf-8"))

2537

2759

2538

2760

global multiprocessing_manager

2539

2761

multiprocessing_manager = multiprocessing.Manager()

2558

2780

if server_settings["restore"]:

2559

2781

try:

2560

2782

with open(stored_state_path, "rb") as stored_state:

2561

clients_data, old_client_settings = (pickle.load

2562

(stored_state))

2783

clients_data, old_client_settings = pickle.load(

2784

stored_state)

2563

2785

os.remove(stored_state_path)

2564

2786

except IOError as e:

2565

2787

if e.errno == errno.ENOENT:

2566

logger.warning("Could not load persistent state: {}"

2567

.format(os.strerror(e.errno)))

2788

logger.warning("Could not load persistent state:"

2789

" {}".format(os.strerror(e.errno)))

2568

2790

else:

2569

2791

logger.critical("Could not load persistent state:",

2570

2792

exc_info=e)

2571

2793

raise

2572

2794

except EOFError as e:

2573

2795

logger.warning("Could not load persistent state: "

2574

"EOFError:", exc_info=e)

2796

"EOFError:",

2797

exc_info=e)

2575

2798

2576

2799

with PGPEngine() as pgp:

2577

2800

for client_name, client in clients_data.items():

2589

2812

# For each value in new config, check if it

2590

2813

# differs from the old config value (Except for

2591

2814

# the "secret" attribute)

2592

if (name != "secret" and

2593

value != old_client_settings[client_name]

2594

[name]):

2815

if (name != "secret"

2816

and (value !=

2817

old_client_settings[client_name][name])):

2595

2818

client[name] = value

2596

2819

except KeyError:

2597

2820

pass

2598

2821

2599

2822

# Clients who has passed its expire date can still be

2600

# enabled if its last checker was successful. Clients

2823

# enabled if its last checker was successful. A Client

2601

2824

# whose checker succeeded before we stored its state is

2602

2825

# assumed to have successfully run all checkers during

2603

2826

# downtime.

2606

2829

if not client["last_checked_ok"]:

2607

2830

logger.warning(

2608

2831

"disabling client {} - Client never "

2609

"performed a successful checker"

2610

.format(client_name))

2832

"performed a successful checker".format(

2833

client_name))

2611

2834

client["enabled"] = False

2612

2835

elif client["last_checker_status"] != 0:

2613

2836

logger.warning(

2614

2837

"disabling client {} - Client last"

2615

" checker failed with error code {}"

2616

.format(client_name,

2617

client["last_checker_status"]))

2838

" checker failed with error code"

2839

" {}".format(

2840

client_name,

2841

client["last_checker_status"]))

2618

2842

client["enabled"] = False

2619

2843

else:

2620

client["expires"] = (datetime.datetime

2621

.utcnow()

2622

+ client["timeout"])

2844

client["expires"] = (

2845

datetime.datetime.utcnow()

2846

+ client["timeout"])

2623

2847

logger.debug("Last checker succeeded,"

2624

" keeping {} enabled"

2625

.format(client_name))

2848

" keeping {} enabled".format(

2849

client_name))

2626

2850

try:

2627

client["secret"] = (

2628

pgp.decrypt(client["encrypted_secret"],

2629

client_settings[client_name]

2630

["secret"]))

2851

client["secret"] = pgp.decrypt(

2852

client["encrypted_secret"],

2853

client_settings[client_name]["secret"])

2631

2854

except PGPError:

2632

2855

# If decryption fails, we use secret from new settings

2633

logger.debug("Failed to decrypt {} old secret"

2634

.format(client_name))

2635

client["secret"] = (

2636

client_settings[client_name]["secret"])

2856

logger.debug("Failed to decrypt {} old secret".format(

2857

client_name))

2858

client["secret"] = (client_settings[client_name]

2859

["secret"])

2637

2860

2638

2861

# Add/remove clients based on new changes made to config

2639

2862

for client_name in (set(old_client_settings)

2646

2869

# Create all client objects

2647

2870

for client_name, client in clients_data.items():

2648

2871

tcp_server.clients[client_name] = client_class(

2649

name = client_name, settings = client,

2872

name = client_name,

2873

settings = client,

2650

2874

server_settings = server_settings)

2651

2875

2652

2876

if not tcp_server.clients:

2654

2878

2655

2879

if not foreground:

2656

2880

if pidfile is not None:

2881

pid = os.getpid()

2657

2882

try:

2658

2883

with pidfile:

2659

pid = os.getpid()

2660

pidfile.write(str(pid) + "\n".encode("utf-8"))

2884

print(pid, file=pidfile)

2661

2885

except IOError:

2662

2886

logger.error("Could not write to file %r with PID %d",

2663

2887

pidfilename, pid)

2668

2892

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2669

2893

2670

2894

if use_dbus:

2671

@alternate_dbus_interfaces({"se.recompile.Mandos":

2672

"se.bsnet.fukt.Mandos"})

2673

class MandosDBusService(DBusObjectWithProperties):

2895

2896

@alternate_dbus_interfaces(

2897

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2898

class MandosDBusService(DBusObjectWithObjectManager):

2674

2899

"""A D-Bus proxy object"""

2900

2675

2901

def __init__(self):

2676

2902

dbus.service.Object.__init__(self, bus, "/")

2903

2677

2904

_interface = "se.recompile.Mandos"

2678

2905

2679

@dbus_interface_annotations(_interface)

2680

def _foo(self):

2681

return { "org.freedesktop.DBus.Property"

2682

".EmitsChangedSignal":

2683

"false"}

2684

2685

2906

@dbus.service.signal(_interface, signature="o")

2686

2907

def ClientAdded(self, objpath):

2687

2908

"D-Bus signal"

2692

2913

"D-Bus signal"

2693

2914

pass

2694

2915

2916

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2917

"true"})

2695

2918

@dbus.service.signal(_interface, signature="os")

2696

2919

def ClientRemoved(self, objpath, name):

2697

2920

"D-Bus signal"

2698

2921

pass

2699

2922

2923

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2924

"true"})

2700

2925

@dbus.service.method(_interface, out_signature="ao")

2701

2926

def GetAllClients(self):

2702

2927

"D-Bus method"

2703

return dbus.Array(c.dbus_object_path

2704

for c in

2928

return dbus.Array(c.dbus_object_path for c in

2705

2929

tcp_server.clients.itervalues())

2706

2930

2931

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2932

"true"})

2707

2933

@dbus.service.method(_interface,

2708

2934

out_signature="a{oa{sv}}")

2709

2935

def GetAllClientsWithProperties(self):

2710

2936

"D-Bus method"

2711

2937

return dbus.Dictionary(

2712

((c.dbus_object_path, c.GetAll(""))

2713

for c in tcp_server.clients.itervalues()),

2938

{ c.dbus_object_path: c.GetAll(

2939

"se.recompile.Mandos.Client")

2940

for c in tcp_server.clients.itervalues() },

2714

2941

signature="oa{sv}")

2715

2942

2716

2943

@dbus.service.method(_interface, in_signature="o")

2720

2947

if c.dbus_object_path == object_path:

2721

2948

del tcp_server.clients[c.name]

2722

2949

c.remove_from_connection()

2723

# Don't signal anything except ClientRemoved

2950

# Don't signal the disabling

2724

2951

c.disable(quiet=True)

2725

# Emit D-Bus signal

2726

self.ClientRemoved(object_path, c.name)

2952

# Emit D-Bus signal for removal

2953

self.client_removed_signal(c)

2727

2954

return

2728

2955

raise KeyError(object_path)

2729

2956

2730

2957

del _interface

2958

2959

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

2960

out_signature = "a{oa{sa{sv}}}")

2961

def GetManagedObjects(self):

2962

"""D-Bus method"""

2963

return dbus.Dictionary(

2964

{ client.dbus_object_path:

2965

dbus.Dictionary(

2966

{ interface: client.GetAll(interface)

2967

for interface in

2968

client._get_all_interface_names()})

2969

for client in tcp_server.clients.values()})

2970

2971

def client_added_signal(self, client):

2972

"""Send the new standard signal and the old signal"""

2973

if use_dbus:

2974

# New standard signal

2975

self.InterfacesAdded(

2976

client.dbus_object_path,

2977

dbus.Dictionary(

2978

{ interface: client.GetAll(interface)

2979

for interface in

2980

client._get_all_interface_names()}))

2981

# Old signal

2982

self.ClientAdded(client.dbus_object_path)

2983

2984

def client_removed_signal(self, client):

2985

"""Send the new standard signal and the old signal"""

2986

if use_dbus:

2987

# New standard signal

2988

self.InterfacesRemoved(

2989

client.dbus_object_path,

2990

client._get_all_interface_names())

2991

# Old signal

2992

self.ClientRemoved(client.dbus_object_path,

2993

client.name)

2731

2994

2732

2995

mandos_dbus_service = MandosDBusService()

2733

2996

2756

3019

# + secret.

2757

3020

exclude = { "bus", "changedstate", "secret",

2758

3021

"checker", "server_settings" }

2759

for name, typ in (inspect.getmembers

2760

(dbus.service.Object)):

3022

for name, typ in inspect.getmembers(dbus.service

3023

.Object):

2761

3024

exclude.add(name)

2762

3025

2763

3026

client_dict["encrypted_secret"] = (client

2770

3033

del client_settings[client.name]["secret"]

2771

3034

2772

3035

try:

2773

with (tempfile.NamedTemporaryFile

2774

(mode='wb', suffix=".pickle", prefix='clients-',

2775

dir=os.path.dirname(stored_state_path),

2776

delete=False)) as stored_state:

3036

with tempfile.NamedTemporaryFile(

3037

mode='wb',

3038

suffix=".pickle",

3039

prefix='clients-',

3040

dir=os.path.dirname(stored_state_path),

3041

delete=False) as stored_state:

2777

3042

pickle.dump((clients, client_settings), stored_state)

2778

tempname=stored_state.name

3043

tempname = stored_state.name

2779

3044

os.rename(tempname, stored_state_path)

2780

3045

except (IOError, OSError) as e:

2781

3046

if not debug:

2796

3061

name, client = tcp_server.clients.popitem()

2797

3062

if use_dbus:

2798

3063

client.remove_from_connection()

2799

# Don't signal anything except ClientRemoved

3064

# Don't signal the disabling

2800

3065

client.disable(quiet=True)

2801

if use_dbus:

2802

# Emit D-Bus signal

2803

mandos_dbus_service.ClientRemoved(client

2804

.dbus_object_path,

2805

client.name)

3066

# Emit D-Bus signal for removal

3067

mandos_dbus_service.client_removed_signal(client)

2806

3068

client_settings.clear()

2807

3069

2808

3070

atexit.register(cleanup)

2809

3071

2810

3072

for client in tcp_server.clients.itervalues():

2811

3073

if use_dbus:

2812

# Emit D-Bus signal

2813

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3074

# Emit D-Bus signal for adding

3075

mandos_dbus_service.client_added_signal(client)

2814

3076

# Need to initiate checking of clients

2815

3077

if client.enabled:

2816

3078

client.init_checker()

2861

3123

# Must run before the D-Bus bus name gets deregistered

2862

3124

cleanup()

2863

3125

3126

2864

3127

if __name__ == '__main__':

2865

3128

main()