2
2
# -*- mode: python; coding: utf-8 -*-
4
4
# Mandos server - give out binary blobs to connecting clients.
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
9
# methods "add", "remove", "server_state_changed",
10
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
11
# "AvahiService" class, and some lines in "main".
13
13
# Everything else is
14
14
# Copyright © 2008-2016 Teddy Hogeborn
15
15
# Copyright © 2008-2016 Björn Påhlsson
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
19
19
# the Free Software Foundation, either version 3 of the License, or
81
78
import dbus.service
82
from gi.repository import GLib
80
from gi.repository import GObject
82
import gobject as GObject
83
84
from dbus.mainloop.glib import DBusGMainLoop
86
87
import xml.dom.minidom
89
# Try to find the value of SO_BINDTODEVICE:
91
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
92
# newer, and it is also the most natural place for it:
93
91
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
94
92
except AttributeError:
96
# This is where SO_BINDTODEVICE was up to and including Python
98
94
from IN import SO_BINDTODEVICE
99
95
except ImportError:
100
# In Python 2.7 it seems to have been removed entirely.
101
# Try running the C preprocessor:
103
cc = subprocess.Popen(["cc", "--language=c", "-E",
105
stdin=subprocess.PIPE,
106
stdout=subprocess.PIPE)
107
stdout = cc.communicate(
108
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
109
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
110
except (OSError, ValueError, IndexError):
112
SO_BINDTODEVICE = None
96
SO_BINDTODEVICE = None
114
98
if sys.version_info.major == 2:
118
102
stored_state_file = "clients.pickle"
120
104
logger = logging.getLogger()
135
119
return interface_index
138
def copy_function(func):
139
"""Make a copy of a function"""
140
if sys.version_info.major == 2:
141
return types.FunctionType(func.func_code,
147
return types.FunctionType(func.__code__,
154
122
def initlogger(debug, level=logging.WARNING):
155
123
"""init logger and add loglevel"""
158
126
syslogger = (logging.handlers.SysLogHandler(
159
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
127
facility = logging.handlers.SysLogHandler.LOG_DAEMON,
128
address = "/dev/log"))
161
129
syslogger.setFormatter(logging.Formatter
162
130
('Mandos [%(process)d]: %(levelname)s:'
164
132
logger.addHandler(syslogger)
167
135
console = logging.StreamHandler()
168
136
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
246
212
'--passphrase-file',
248
214
+ self.gnupgargs,
249
stdin=subprocess.PIPE,
250
stdout=subprocess.PIPE,
251
stderr=subprocess.PIPE)
252
ciphertext, err = proc.communicate(input=data)
215
stdin = subprocess.PIPE,
216
stdout = subprocess.PIPE,
217
stderr = subprocess.PIPE)
218
ciphertext, err = proc.communicate(input = data)
253
219
if proc.returncode != 0:
254
220
raise PGPError(err)
255
221
return ciphertext
257
223
def decrypt(self, data, password):
258
224
passphrase = self.password_encode(password)
259
225
with tempfile.NamedTemporaryFile(
260
dir=self.tempdir) as passfile:
226
dir = self.tempdir) as passfile:
261
227
passfile.write(passphrase)
263
229
proc = subprocess.Popen([self.gpg, '--decrypt',
264
230
'--passphrase-file',
266
232
+ self.gnupgargs,
267
stdin=subprocess.PIPE,
268
stdout=subprocess.PIPE,
269
stderr=subprocess.PIPE)
270
decrypted_plaintext, err = proc.communicate(input=data)
233
stdin = subprocess.PIPE,
234
stdout = subprocess.PIPE,
235
stderr = subprocess.PIPE)
236
decrypted_plaintext, err = proc.communicate(input = data)
271
237
if proc.returncode != 0:
272
238
raise PGPError(err)
273
239
return decrypted_plaintext
276
# Pretend that we have an Avahi module
278
"""This isn't so much a class as it is a module-like namespace.
279
It is instantiated once, and simulates having an Avahi module."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
289
def string_array_to_txt_array(self, t):
290
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
291
for s in t), signature="ay")
292
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
293
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
294
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
295
SERVER_INVALID = 0 # avahi-common/defs.h
296
SERVER_REGISTERING = 1 # avahi-common/defs.h
297
SERVER_RUNNING = 2 # avahi-common/defs.h
298
SERVER_COLLISION = 3 # avahi-common/defs.h
299
SERVER_FAILURE = 4 # avahi-common/defs.h
303
242
class AvahiError(Exception):
304
243
def __init__(self, value, *args, **kwargs):
305
244
self.value = value
501
440
.format(self.name)))
505
443
# Pretend that we have a GnuTLS module
506
444
class GnuTLS(object):
507
445
"""This isn't so much a class as it is a module-like namespace.
508
446
It is instantiated once, and simulates having a GnuTLS module."""
510
library = ctypes.util.find_library("gnutls")
512
library = ctypes.util.find_library("gnutls-deb0")
513
_library = ctypes.cdll.LoadLibrary(library)
515
_need_version = b"3.3.0"
448
_library = ctypes.cdll.LoadLibrary(
449
ctypes.util.find_library("gnutls"))
450
_need_version = "3.3.0"
517
451
def __init__(self):
518
# Need to use "self" here, since this method is called before
519
# the assignment to the "gnutls" global variable happens.
520
if self.check_version(self._need_version) is None:
521
raise self.Error("Needs GnuTLS {} or later"
522
.format(self._need_version))
452
# Need to use class name "GnuTLS" here, since this method is
453
# called before the assignment to the "gnutls" global variable
455
if GnuTLS.check_version(self._need_version) is None:
456
raise GnuTLS.Error("Needs GnuTLS {} or later"
457
.format(self._need_version))
524
459
# Unless otherwise indicated, the constants and types below are
525
460
# all from the gnutls/gnutls.h C header file.
529
464
E_INTERRUPTED = -52
534
469
CRD_CERTIFICATE = 1
535
470
E_NO_CERTIFICATE_FOUND = -49
536
471
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
539
474
class session_int(ctypes.Structure):
541
476
session_t = ctypes.POINTER(session_int)
543
477
class certificate_credentials_st(ctypes.Structure):
545
479
certificate_credentials_t = ctypes.POINTER(
546
480
certificate_credentials_st)
547
481
certificate_type_t = ctypes.c_int
549
482
class datum_t(ctypes.Structure):
550
483
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
551
484
('size', ctypes.c_uint)]
553
485
class openpgp_crt_int(ctypes.Structure):
555
487
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
556
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
488
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
557
489
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
558
490
credentials_type_t = ctypes.c_int
559
491
transport_ptr_t = ctypes.c_void_p
560
492
close_request_t = ctypes.c_int
563
495
class Error(Exception):
564
496
# We need to use the class name "GnuTLS" here, since this
565
497
# exception might be raised from within GnuTLS.__init__,
566
498
# which is called before the assignment to the "gnutls"
567
499
# global variable has happened.
568
def __init__(self, message=None, code=None, args=()):
500
def __init__(self, message = None, code = None, args=()):
569
501
# Default usage is by a message string, but if a return
570
502
# code is passed, convert it to a string with
571
503
# gnutls.strerror()
640
572
return _error_code(result)
641
573
result = func(*arguments)
644
576
# Unless otherwise indicated, the function declarations below are
645
577
# all from the gnutls/gnutls.h C header file.
648
580
priority_set_direct = _library.gnutls_priority_set_direct
649
581
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
650
582
ctypes.POINTER(ctypes.c_char_p)]
651
583
priority_set_direct.restype = _error_code
653
585
init = _library.gnutls_init
654
586
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
655
587
init.restype = _error_code
657
589
set_default_priority = _library.gnutls_set_default_priority
658
590
set_default_priority.argtypes = [session_t]
659
591
set_default_priority.restype = _error_code
661
593
record_send = _library.gnutls_record_send
662
594
record_send.argtypes = [session_t, ctypes.c_void_p,
664
596
record_send.restype = ctypes.c_ssize_t
665
597
record_send.errcheck = _retry_on_error
667
599
certificate_allocate_credentials = (
668
600
_library.gnutls_certificate_allocate_credentials)
669
601
certificate_allocate_credentials.argtypes = [
670
602
ctypes.POINTER(certificate_credentials_t)]
671
603
certificate_allocate_credentials.restype = _error_code
673
605
certificate_free_credentials = (
674
606
_library.gnutls_certificate_free_credentials)
675
certificate_free_credentials.argtypes = [
676
certificate_credentials_t]
607
certificate_free_credentials.argtypes = [certificate_credentials_t]
677
608
certificate_free_credentials.restype = None
679
610
handshake_set_private_extensions = (
680
611
_library.gnutls_handshake_set_private_extensions)
681
612
handshake_set_private_extensions.argtypes = [session_t,
683
614
handshake_set_private_extensions.restype = None
685
616
credentials_set = _library.gnutls_credentials_set
686
617
credentials_set.argtypes = [session_t, credentials_type_t,
688
619
credentials_set.restype = _error_code
690
621
strerror = _library.gnutls_strerror
691
622
strerror.argtypes = [ctypes.c_int]
692
623
strerror.restype = ctypes.c_char_p
694
625
certificate_type_get = _library.gnutls_certificate_type_get
695
626
certificate_type_get.argtypes = [session_t]
696
627
certificate_type_get.restype = _error_code
698
629
certificate_get_peers = _library.gnutls_certificate_get_peers
699
630
certificate_get_peers.argtypes = [session_t,
700
631
ctypes.POINTER(ctypes.c_uint)]
701
632
certificate_get_peers.restype = ctypes.POINTER(datum_t)
703
634
global_set_log_level = _library.gnutls_global_set_log_level
704
635
global_set_log_level.argtypes = [ctypes.c_int]
705
636
global_set_log_level.restype = None
707
638
global_set_log_function = _library.gnutls_global_set_log_function
708
639
global_set_log_function.argtypes = [log_func]
709
640
global_set_log_function.restype = None
711
642
deinit = _library.gnutls_deinit
712
643
deinit.argtypes = [session_t]
713
644
deinit.restype = None
715
646
handshake = _library.gnutls_handshake
716
647
handshake.argtypes = [session_t]
717
648
handshake.restype = _error_code
718
649
handshake.errcheck = _retry_on_error
720
651
transport_set_ptr = _library.gnutls_transport_set_ptr
721
652
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
722
653
transport_set_ptr.restype = None
724
655
bye = _library.gnutls_bye
725
656
bye.argtypes = [session_t, close_request_t]
726
657
bye.restype = _error_code
727
658
bye.errcheck = _retry_on_error
729
660
check_version = _library.gnutls_check_version
730
661
check_version.argtypes = [ctypes.c_char_p]
731
662
check_version.restype = ctypes.c_char_p
733
664
# All the function declarations below are from gnutls/openpgp.h
735
666
openpgp_crt_init = _library.gnutls_openpgp_crt_init
736
667
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
737
668
openpgp_crt_init.restype = _error_code
739
670
openpgp_crt_import = _library.gnutls_openpgp_crt_import
740
671
openpgp_crt_import.argtypes = [openpgp_crt_t,
741
672
ctypes.POINTER(datum_t),
742
673
openpgp_crt_fmt_t]
743
674
openpgp_crt_import.restype = _error_code
745
676
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
746
677
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
747
678
ctypes.POINTER(ctypes.c_uint)]
748
679
openpgp_crt_verify_self.restype = _error_code
750
681
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
751
682
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
752
683
openpgp_crt_deinit.restype = None
754
685
openpgp_crt_get_fingerprint = (
755
686
_library.gnutls_openpgp_crt_get_fingerprint)
756
687
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
786
715
checker: subprocess.Popen(); a running checker process used
787
716
to see if the client lives.
788
717
'None' if no process is running.
789
checker_callback_tag: a GLib event source tag, or None
718
checker_callback_tag: a GObject event source tag, or None
790
719
checker_command: string; External command which is run to check
791
720
if client lives. %() expansions are done at
792
721
runtime with vars(self) as dict, so that for
793
722
instance %(name)s can be used in the command.
794
checker_initiator_tag: a GLib event source tag, or None
723
checker_initiator_tag: a GObject event source tag, or None
795
724
created: datetime.datetime(); (UTC) object creation
796
725
client_structure: Object describing what attributes a client has
797
726
and is used for storing the client at exit
798
727
current_checker_command: string; current running checker_command
799
disable_initiator_tag: a GLib event source tag, or None
728
disable_initiator_tag: a GObject event source tag, or None
801
730
fingerprint: string (40 or 32 hexadecimal digits); used to
802
731
uniquely identify the client
851
780
for client_name in config.sections():
852
781
section = dict(config.items(client_name))
853
782
client = settings[client_name] = {}
855
784
client["host"] = section["host"]
856
785
# Reformat values from string types to Python types
857
786
client["approved_by_default"] = config.getboolean(
858
787
client_name, "approved_by_default")
859
788
client["enabled"] = config.getboolean(client_name,
862
791
# Uppercase and remove spaces from fingerprint for later
863
792
# comparison purposes with return value from the
864
793
# fingerprint() function
865
794
client["fingerprint"] = (section["fingerprint"].upper()
866
795
.replace(" ", ""))
867
796
if "secret" in section:
868
client["secret"] = codecs.decode(section["secret"]
797
client["secret"] = section["secret"].decode("base64")
871
798
elif "secfile" in section:
872
799
with open(os.path.expanduser(os.path.expandvars
873
800
(section["secfile"])),
926
853
self.changedstate = multiprocessing_manager.Condition(
927
854
multiprocessing_manager.Lock())
928
855
self.client_structure = [attr
929
for attr in self.__dict__.keys()
856
for attr in self.__dict__.iterkeys()
930
857
if not attr.startswith("_")]
931
858
self.client_structure.append("client_structure")
933
860
for name, t in inspect.getmembers(
934
861
type(self), lambda obj: isinstance(obj, property)):
935
862
if not name.startswith("_"):
936
863
self.client_structure.append(name)
938
865
# Send notice to process children that client state has changed
939
866
def send_changedstate(self):
940
867
with self.changedstate:
941
868
self.changedstate.notify_all()
943
870
def enable(self):
944
871
"""Start this client's checker and timeout hooks"""
945
872
if getattr(self, "enabled", False):
959
886
logger.info("Disabling client %s", self.name)
960
887
if getattr(self, "disable_initiator_tag", None) is not None:
961
GLib.source_remove(self.disable_initiator_tag)
888
GObject.source_remove(self.disable_initiator_tag)
962
889
self.disable_initiator_tag = None
963
890
self.expires = None
964
891
if getattr(self, "checker_initiator_tag", None) is not None:
965
GLib.source_remove(self.checker_initiator_tag)
892
GObject.source_remove(self.checker_initiator_tag)
966
893
self.checker_initiator_tag = None
967
894
self.stop_checker()
968
895
self.enabled = False
970
897
self.send_changedstate()
971
# Do not run this again if called by a GLib.timeout_add
898
# Do not run this again if called by a GObject.timeout_add
974
901
def __del__(self):
977
904
def init_checker(self):
978
905
# Schedule a new checker to be started an 'interval' from now,
979
906
# and every interval from then on.
980
907
if self.checker_initiator_tag is not None:
981
GLib.source_remove(self.checker_initiator_tag)
982
self.checker_initiator_tag = GLib.timeout_add(
908
GObject.source_remove(self.checker_initiator_tag)
909
self.checker_initiator_tag = GObject.timeout_add(
983
910
int(self.interval.total_seconds() * 1000),
984
911
self.start_checker)
985
912
# Schedule a disable() when 'timeout' has passed
986
913
if self.disable_initiator_tag is not None:
987
GLib.source_remove(self.disable_initiator_tag)
988
self.disable_initiator_tag = GLib.timeout_add(
914
GObject.source_remove(self.disable_initiator_tag)
915
self.disable_initiator_tag = GObject.timeout_add(
989
916
int(self.timeout.total_seconds() * 1000), self.disable)
990
917
# Also start a new checker *right now*.
991
918
self.start_checker()
993
920
def checker_callback(self, source, condition, connection,
995
922
"""The checker has completed, so take appropriate actions."""
1014
941
logger.warning("Checker for %(name)s crashed?",
1018
945
def checked_ok(self):
1019
946
"""Assert that the client has been seen, alive and well."""
1020
947
self.last_checked_ok = datetime.datetime.utcnow()
1021
948
self.last_checker_status = 0
1022
949
self.last_checker_signal = None
1023
950
self.bump_timeout()
1025
952
def bump_timeout(self, timeout=None):
1026
953
"""Bump up the timeout for this client."""
1027
954
if timeout is None:
1028
955
timeout = self.timeout
1029
956
if self.disable_initiator_tag is not None:
1030
GLib.source_remove(self.disable_initiator_tag)
957
GObject.source_remove(self.disable_initiator_tag)
1031
958
self.disable_initiator_tag = None
1032
959
if getattr(self, "enabled", False):
1033
self.disable_initiator_tag = GLib.timeout_add(
960
self.disable_initiator_tag = GObject.timeout_add(
1034
961
int(timeout.total_seconds() * 1000), self.disable)
1035
962
self.expires = datetime.datetime.utcnow() + timeout
1037
964
def need_approval(self):
1038
965
self.last_approval_request = datetime.datetime.utcnow()
1040
967
def start_checker(self):
1041
968
"""Start a new checker subprocess if one is not running.
1043
970
If a checker already exists, leave it running and do
1045
972
# The reason for not killing a running checker is that if we
1078
1005
# The exception is when not debugging but nevertheless
1079
1006
# running in the foreground; use the previously
1080
1007
# created wnull.
1081
popen_args = {"close_fds": True,
1008
popen_args = { "close_fds": True,
1084
1011
if (not self.server_settings["debug"]
1085
1012
and self.server_settings["foreground"]):
1086
1013
popen_args.update({"stdout": wnull,
1088
pipe = multiprocessing.Pipe(duplex=False)
1015
pipe = multiprocessing.Pipe(duplex = False)
1089
1016
self.checker = multiprocessing.Process(
1091
args=(pipe[1], subprocess.call, command),
1018
args = (pipe[1], subprocess.call, command),
1019
kwargs = popen_args)
1093
1020
self.checker.start()
1094
self.checker_callback_tag = GLib.io_add_watch(
1095
pipe[0].fileno(), GLib.IO_IN,
1021
self.checker_callback_tag = GObject.io_add_watch(
1022
pipe[0].fileno(), GObject.IO_IN,
1096
1023
self.checker_callback, pipe[0], command)
1097
# Re-run this periodically if run by GLib.timeout_add
1024
# Re-run this periodically if run by GObject.timeout_add
1100
1027
def stop_checker(self):
1101
1028
"""Force the checker process, if any, to stop."""
1102
1029
if self.checker_callback_tag:
1103
GLib.source_remove(self.checker_callback_tag)
1030
GObject.source_remove(self.checker_callback_tag)
1104
1031
self.checker_callback_tag = None
1105
1032
if getattr(self, "checker", None) is None:
1137
1064
func._dbus_name = func.__name__
1138
1065
if func._dbus_name.endswith("_dbus_property"):
1139
1066
func._dbus_name = func._dbus_name[:-14]
1140
func._dbus_get_args_options = {'byte_arrays': byte_arrays}
1067
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
1143
1070
return decorator
1146
1073
def dbus_interface_annotations(dbus_interface):
1147
1074
"""Decorator for marking functions returning interface annotations
1151
1078
@dbus_interface_annotations("org.example.Interface")
1152
1079
def _foo(self): # Function name does not matter
1153
1080
return {"org.freedesktop.DBus.Deprecated": "true",
1154
1081
"org.freedesktop.DBus.Property.EmitsChangedSignal":
1158
1085
def decorator(func):
1159
1086
func._dbus_is_interface = True
1160
1087
func._dbus_interface = dbus_interface
1161
1088
func._dbus_name = dbus_interface
1164
1091
return decorator
1167
1094
def dbus_annotations(annotations):
1168
1095
"""Decorator to annotate D-Bus methods, signals or properties
1171
1098
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",
1172
1099
"org.freedesktop.DBus.Property."
1173
1100
"EmitsChangedSignal": "false"})
1229
1156
for cls in self.__class__.__mro__
1230
1157
for name, athing in
1231
1158
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1233
1160
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1235
path_keyword='object_path',
1236
connection_keyword='connection')
1161
out_signature = "s",
1162
path_keyword = 'object_path',
1163
connection_keyword = 'connection')
1237
1164
def Introspect(self, object_path, connection):
1238
1165
"""Overloading of standard D-Bus method.
1240
1167
Inserts annotation tags on methods and signals.
1242
1169
xmlstring = dbus.service.Object.Introspect(self, object_path,
1245
1172
document = xml.dom.minidom.parseString(xmlstring)
1247
1174
for if_tag in document.getElementsByTagName("interface"):
1248
1175
# Add annotation tags
1249
1176
for typ in ("method", "signal"):
1460
1387
exc_info=error)
1461
1388
return xmlstring
1465
1391
dbus.OBJECT_MANAGER_IFACE
1466
1392
except AttributeError:
1467
1393
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1470
1395
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1471
1396
"""A D-Bus object with an ObjectManager.
1473
1398
Classes inheriting from this exposes the standard
1474
1399
GetManagedObjects call and the InterfacesAdded and
1475
1400
InterfacesRemoved signals on the standard
1476
1401
"org.freedesktop.DBus.ObjectManager" interface.
1478
1403
Note: No signals are sent automatically; they must be sent
1481
1406
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1482
out_signature="a{oa{sa{sv}}}")
1407
out_signature = "a{oa{sa{sv}}}")
1483
1408
def GetManagedObjects(self):
1484
1409
"""This function must be overridden"""
1485
1410
raise NotImplementedError()
1487
1412
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1488
signature="oa{sa{sv}}")
1413
signature = "oa{sa{sv}}")
1489
1414
def InterfacesAdded(self, object_path, interfaces_and_properties):
1492
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1417
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")
1493
1418
def InterfacesRemoved(self, object_path, interfaces):
1496
1421
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1498
path_keyword='object_path',
1499
connection_keyword='connection')
1422
out_signature = "s",
1423
path_keyword = 'object_path',
1424
connection_keyword = 'connection')
1500
1425
def Introspect(self, object_path, connection):
1501
1426
"""Overloading of standard D-Bus method.
1503
1428
Override return argument name of GetManagedObjects to be
1504
1429
"objpath_interfaces_and_properties"
1544
1468
dbus.service.Object, it will add alternate D-Bus attributes with
1545
1469
interface names according to the "alt_interface_names" mapping.
1548
1472
@alternate_dbus_interfaces({"org.example.Interface":
1549
1473
"net.example.AlternateInterface"})
1550
1474
class SampleDBusObject(dbus.service.Object):
1551
1475
@dbus.service.method("org.example.Interface")
1552
1476
def SampleDBusMethod():
1555
1479
The above "SampleDBusMethod" on "SampleDBusObject" will be
1556
1480
reachable via two interfaces: "org.example.Interface" and
1557
1481
"net.example.AlternateInterface", the latter of which will have
1558
1482
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1559
1483
"true", unless "deprecate" is passed with a False value.
1561
1485
This works for methods and signals, and also for D-Bus properties
1562
1486
(from DBusObjectWithProperties) and interfaces (from the
1563
1487
dbus_interface_annotations decorator).
1566
1490
def wrapper(cls):
1567
1491
for orig_interface_name, alt_interface_name in (
1568
1492
alt_interface_names.items()):
1583
1507
interface_names.add(alt_interface)
1584
1508
# Is this a D-Bus signal?
1585
1509
if getattr(attribute, "_dbus_is_signal", False):
1586
# Extract the original non-method undecorated
1587
# function by black magic
1588
1510
if sys.version_info.major == 2:
1511
# Extract the original non-method undecorated
1512
# function by black magic
1589
1513
nonmethod_func = (dict(
1590
1514
zip(attribute.func_code.co_freevars,
1591
1515
attribute.__closure__))
1592
1516
["func"].cell_contents)
1594
nonmethod_func = (dict(
1595
zip(attribute.__code__.co_freevars,
1596
attribute.__closure__))
1597
["func"].cell_contents)
1518
nonmethod_func = attribute
1598
1519
# Create a new, but exactly alike, function
1599
1520
# object, and decorate it to be a new D-Bus signal
1600
1521
# with the alternate D-Bus interface name
1601
new_function = copy_function(nonmethod_func)
1522
if sys.version_info.major == 2:
1523
new_function = types.FunctionType(
1524
nonmethod_func.func_code,
1525
nonmethod_func.func_globals,
1526
nonmethod_func.func_name,
1527
nonmethod_func.func_defaults,
1528
nonmethod_func.func_closure)
1530
new_function = types.FunctionType(
1531
nonmethod_func.__code__,
1532
nonmethod_func.__globals__,
1533
nonmethod_func.__name__,
1534
nonmethod_func.__defaults__,
1535
nonmethod_func.__closure__)
1602
1536
new_function = (dbus.service.signal(
1604
1538
attribute._dbus_signature)(new_function))
1712
1653
"se.bsnet.fukt.Mandos"})
1713
1654
class ClientDBus(Client, DBusObjectWithProperties):
1714
1655
"""A Client class using D-Bus
1717
1658
dbus_object_path: dbus.ObjectPath
1718
1659
bus: dbus.SystemBus()
1721
1662
runtime_expansions = (Client.runtime_expansions
1722
1663
+ ("dbus_object_path", ))
1724
1665
_interface = "se.recompile.Mandos.Client"
1726
1667
# dbus.service.Object doesn't use super(), so we can't either.
1728
def __init__(self, bus=None, *args, **kwargs):
1669
def __init__(self, bus = None, *args, **kwargs):
1730
1671
Client.__init__(self, *args, **kwargs)
1731
1672
# Only now, when this client is initialized, can it show up on
1768
1709
dbus_value = transform_func(
1769
1710
type_func(value),
1770
variant_level=variant_level)
1711
variant_level = variant_level)
1771
1712
self.PropertyChanged(dbus.String(dbus_name),
1773
1714
self.PropertiesChanged(
1775
dbus.Dictionary({dbus.String(dbus_name):
1716
dbus.Dictionary({ dbus.String(dbus_name):
1778
1719
setattr(self, attrname, value)
1780
1721
return property(lambda self: getattr(self, attrname), setter)
1782
1723
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1783
1724
approvals_pending = notifychangeproperty(dbus.Boolean,
1784
1725
"ApprovalPending",
1786
1727
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1787
1728
last_enabled = notifychangeproperty(datetime_to_dbus,
1789
1730
checker = notifychangeproperty(
1790
1731
dbus.Boolean, "CheckerRunning",
1791
type_func=lambda checker: checker is not None)
1732
type_func = lambda checker: checker is not None)
1792
1733
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1793
1734
"LastCheckedOK")
1794
1735
last_checker_status = notifychangeproperty(dbus.Int16,
1799
1740
"ApprovedByDefault")
1800
1741
approval_delay = notifychangeproperty(
1801
1742
dbus.UInt64, "ApprovalDelay",
1802
type_func=lambda td: td.total_seconds() * 1000)
1743
type_func = lambda td: td.total_seconds() * 1000)
1803
1744
approval_duration = notifychangeproperty(
1804
1745
dbus.UInt64, "ApprovalDuration",
1805
type_func=lambda td: td.total_seconds() * 1000)
1746
type_func = lambda td: td.total_seconds() * 1000)
1806
1747
host = notifychangeproperty(dbus.String, "Host")
1807
1748
timeout = notifychangeproperty(
1808
1749
dbus.UInt64, "Timeout",
1809
type_func=lambda td: td.total_seconds() * 1000)
1750
type_func = lambda td: td.total_seconds() * 1000)
1810
1751
extended_timeout = notifychangeproperty(
1811
1752
dbus.UInt64, "ExtendedTimeout",
1812
type_func=lambda td: td.total_seconds() * 1000)
1753
type_func = lambda td: td.total_seconds() * 1000)
1813
1754
interval = notifychangeproperty(
1814
1755
dbus.UInt64, "Interval",
1815
type_func=lambda td: td.total_seconds() * 1000)
1756
type_func = lambda td: td.total_seconds() * 1000)
1816
1757
checker_command = notifychangeproperty(dbus.String, "Checker")
1817
1758
secret = notifychangeproperty(dbus.ByteArray, "Secret",
1818
1759
invalidate_only=True)
1820
1761
del notifychangeproperty
1822
1763
def __del__(self, *args, **kwargs):
1824
1765
self.remove_from_connection()
1859
1800
# Emit D-Bus signal
1860
1801
self.CheckerStarted(self.current_checker_command)
1863
1804
def _reset_approved(self):
1864
1805
self.approved = None
1867
1808
def approve(self, value=True):
1868
1809
self.approved = value
1869
GLib.timeout_add(int(self.approval_duration.total_seconds()
1870
* 1000), self._reset_approved)
1810
GObject.timeout_add(int(self.approval_duration.total_seconds()
1811
* 1000), self._reset_approved)
1871
1812
self.send_changedstate()
1873
# D-Bus methods, signals & properties
1814
## D-Bus methods, signals & properties
1879
1820
# CheckerCompleted - signal
1880
1821
@dbus.service.signal(_interface, signature="nxs")
1881
1822
def CheckerCompleted(self, exitcode, waitstatus, command):
1885
1826
# CheckerStarted - signal
1886
1827
@dbus.service.signal(_interface, signature="s")
1887
1828
def CheckerStarted(self, command):
1891
1832
# PropertyChanged - signal
1892
1833
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1893
1834
@dbus.service.signal(_interface, signature="sv")
1894
1835
def PropertyChanged(self, property, value):
1898
1839
# GotSecret - signal
1899
1840
@dbus.service.signal(_interface)
1900
1841
def GotSecret(self):
1903
1844
server to mandos-client
1907
1848
# Rejected - signal
1908
1849
@dbus.service.signal(_interface, signature="s")
1909
1850
def Rejected(self, reason):
1913
1854
# NeedApproval - signal
1914
1855
@dbus.service.signal(_interface, signature="tb")
1915
1856
def NeedApproval(self, timeout, default):
1917
1858
return self.need_approval()
1921
1862
# Approve - method
1922
1863
@dbus.service.method(_interface, in_signature="b")
1923
1864
def Approve(self, value):
1924
1865
self.approve(value)
1926
1867
# CheckedOK - method
1927
1868
@dbus.service.method(_interface)
1928
1869
def CheckedOK(self):
1929
1870
self.checked_ok()
1931
1872
# Enable - method
1932
1873
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1933
1874
@dbus.service.method(_interface)
1934
1875
def Enable(self):
1938
1879
# StartChecker - method
1939
1880
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1940
1881
@dbus.service.method(_interface)
1941
1882
def StartChecker(self):
1943
1884
self.start_checker()
1945
1886
# Disable - method
1946
1887
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1947
1888
@dbus.service.method(_interface)
1948
1889
def Disable(self):
1952
1893
# StopChecker - method
1953
1894
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1954
1895
@dbus.service.method(_interface)
1955
1896
def StopChecker(self):
1956
1897
self.stop_checker()
1960
1901
# ApprovalPending - property
1961
1902
@dbus_service_property(_interface, signature="b", access="read")
1962
1903
def ApprovalPending_dbus_property(self):
1963
1904
return dbus.Boolean(bool(self.approvals_pending))
1965
1906
# ApprovedByDefault - property
1966
1907
@dbus_service_property(_interface,
2047
1988
self.checked_ok()
2049
1990
return datetime_to_dbus(self.last_checked_ok)
2051
1992
# LastCheckerStatus - property
2052
1993
@dbus_service_property(_interface, signature="n", access="read")
2053
1994
def LastCheckerStatus_dbus_property(self):
2054
1995
return dbus.Int16(self.last_checker_status)
2056
1997
# Expires - property
2057
1998
@dbus_service_property(_interface, signature="s", access="read")
2058
1999
def Expires_dbus_property(self):
2059
2000
return datetime_to_dbus(self.expires)
2061
2002
# LastApprovalRequest - property
2062
2003
@dbus_service_property(_interface, signature="s", access="read")
2063
2004
def LastApprovalRequest_dbus_property(self):
2064
2005
return datetime_to_dbus(self.last_approval_request)
2066
2007
# Timeout - property
2067
2008
@dbus_service_property(_interface,
2189
2130
class ClientHandler(socketserver.BaseRequestHandler, object):
2190
2131
"""A class to handle client connections.
2192
2133
Instantiated once for each connection to handle it.
2193
2134
Note: This will run in its own forked process."""
2195
2136
def handle(self):
2196
2137
with contextlib.closing(self.server.child_pipe) as child_pipe:
2197
2138
logger.info("TCP connection from: %s",
2198
2139
str(self.client_address))
2199
2140
logger.debug("Pipe FD: %d",
2200
2141
self.server.child_pipe.fileno())
2202
2143
session = gnutls.ClientSession(self.request)
2204
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2205
# "+AES-256-CBC", "+SHA1",
2206
# "+COMP-NULL", "+CTYPE-OPENPGP",
2145
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
2146
# "+AES-256-CBC", "+SHA1",
2147
# "+COMP-NULL", "+CTYPE-OPENPGP",
2208
2149
# Use a fallback default, since this MUST be set.
2209
2150
priority = self.server.gnutls_priority
2210
2151
if priority is None:
2211
2152
priority = "NORMAL"
2212
gnutls.priority_set_direct(session._c_object,
2213
priority.encode("utf-8"),
2153
gnutls.priority_set_direct(session._c_object, priority,
2216
2156
# Start communication using the Mandos protocol
2217
2157
# Get protocol number
2218
2158
line = self.request.makefile().readline()
2383
2323
class MultiprocessingMixIn(object):
2384
2324
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
2386
2326
def sub_process_main(self, request, address):
2388
2328
self.finish_request(request, address)
2389
2329
except Exception:
2390
2330
self.handle_error(request, address)
2391
2331
self.close_request(request)
2393
2333
def process_request(self, request, address):
2394
2334
"""Start a new process to process the request."""
2395
proc = multiprocessing.Process(target=self.sub_process_main,
2396
args=(request, address))
2335
proc = multiprocessing.Process(target = self.sub_process_main,
2336
args = (request, address))
2401
2341
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
2402
2342
""" adds a pipe to the MixIn """
2404
2344
def process_request(self, request, client_address):
2405
2345
"""Overrides and wraps the original process_request().
2407
2347
This function creates a new pipe in self.pipe
2409
2349
parent_pipe, self.child_pipe = multiprocessing.Pipe()
2411
2351
proc = MultiprocessingMixIn.process_request(self, request,
2412
2352
client_address)
2413
2353
self.child_pipe.close()
2414
2354
self.add_pipe(parent_pipe, proc)
2416
2356
def add_pipe(self, parent_pipe, proc):
2417
2357
"""Dummy function; override as necessary"""
2418
2358
raise NotImplementedError()
2467
2406
# socket_wrapper(), if socketfd was set.
2468
2407
socketserver.TCPServer.__init__(self, server_address,
2469
2408
RequestHandlerClass)
2471
2410
def server_bind(self):
2472
2411
"""This overrides the normal server_bind() function
2473
2412
to bind to an interface if one was specified, and also NOT to
2474
2413
bind to an address or port if they were not specified."""
2475
global SO_BINDTODEVICE
2476
2414
if self.interface is not None:
2477
2415
if SO_BINDTODEVICE is None:
2478
# Fall back to a hard-coded value which seems to be
2480
logger.warning("SO_BINDTODEVICE not found, trying 25")
2481
SO_BINDTODEVICE = 25
2483
self.socket.setsockopt(
2484
socket.SOL_SOCKET, SO_BINDTODEVICE,
2485
(self.interface + "\0").encode("utf-8"))
2486
except socket.error as error:
2487
if error.errno == errno.EPERM:
2488
logger.error("No permission to bind to"
2489
" interface %s", self.interface)
2490
elif error.errno == errno.ENOPROTOOPT:
2491
logger.error("SO_BINDTODEVICE not available;"
2492
" cannot bind to interface %s",
2494
elif error.errno == errno.ENODEV:
2495
logger.error("Interface %s does not exist,"
2496
" cannot bind", self.interface)
2416
logger.error("SO_BINDTODEVICE does not exist;"
2417
" cannot bind to interface %s",
2421
self.socket.setsockopt(
2422
socket.SOL_SOCKET, SO_BINDTODEVICE,
2423
(self.interface + "\0").encode("utf-8"))
2424
except socket.error as error:
2425
if error.errno == errno.EPERM:
2426
logger.error("No permission to bind to"
2427
" interface %s", self.interface)
2428
elif error.errno == errno.ENOPROTOOPT:
2429
logger.error("SO_BINDTODEVICE not available;"
2430
" cannot bind to interface %s",
2432
elif error.errno == errno.ENODEV:
2433
logger.error("Interface %s does not exist,"
2434
" cannot bind", self.interface)
2499
2437
# Only bind(2) the socket if we really need to.
2500
2438
if self.server_address[0] or self.server_address[1]:
2501
2439
if not self.server_address[0]:
2502
2440
if self.address_family == socket.AF_INET6:
2503
any_address = "::" # in6addr_any
2441
any_address = "::" # in6addr_any
2505
any_address = "0.0.0.0" # INADDR_ANY
2443
any_address = "0.0.0.0" # INADDR_ANY
2506
2444
self.server_address = (any_address,
2507
2445
self.server_address[1])
2508
2446
elif not self.server_address[1]:
2542
2480
self.gnutls_priority = gnutls_priority
2543
2481
IPv6_TCPServer.__init__(self, server_address,
2544
2482
RequestHandlerClass,
2545
interface=interface,
2483
interface = interface,
2484
use_ipv6 = use_ipv6,
2485
socketfd = socketfd)
2549
2487
def server_activate(self):
2550
2488
if self.enabled:
2551
2489
return socketserver.TCPServer.server_activate(self)
2553
2491
def enable(self):
2554
2492
self.enabled = True
2556
2494
def add_pipe(self, parent_pipe, proc):
2557
2495
# Call "handle_ipc" for both data and EOF events
2496
GObject.io_add_watch(
2559
2497
parent_pipe.fileno(),
2560
GLib.IO_IN | GLib.IO_HUP,
2498
GObject.IO_IN | GObject.IO_HUP,
2561
2499
functools.partial(self.handle_ipc,
2562
parent_pipe=parent_pipe,
2500
parent_pipe = parent_pipe,
2565
2503
def handle_ipc(self, source, condition,
2566
2504
parent_pipe=None,
2568
2506
client_object=None):
2569
2507
# error, or the other end of multiprocessing.Pipe has closed
2570
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2508
if condition & (GObject.IO_ERR | GObject.IO_HUP):
2571
2509
# Wait for other process to exit
2575
2513
# Read a request from the child
2576
2514
request = parent_pipe.recv()
2577
2515
command = request[0]
2579
2517
if command == 'init':
2580
2518
fpr = request[1]
2581
2519
address = request[2]
2583
for c in self.clients.values():
2521
for c in self.clients.itervalues():
2584
2522
if c.fingerprint == fpr:
2649
2587
>>> rfc3339_duration_to_delta("P1DT3M20S")
2650
2588
datetime.timedelta(1, 200)
2653
2591
# Parsing an RFC 3339 duration with regular expressions is not
2654
2592
# possible - there would have to be multiple places for the same
2655
2593
# values, like seconds. The current code, while more esoteric, is
2656
2594
# cleaner without depending on a parsing library. If Python had a
2657
2595
# built-in library for parsing we would use it, but we'd like to
2658
2596
# avoid excessive use of external libraries.
2660
2598
# New type for defining tokens, syntax, and semantics all-in-one
2661
2599
Token = collections.namedtuple("Token", (
2662
2600
"regexp", # To match token; if "value" is not None, must have
2849
2784
parser.add_argument("--no-zeroconf", action="store_false",
2850
2785
dest="zeroconf", help="Do not use Zeroconf",
2853
2788
options = parser.parse_args()
2855
2790
if options.check:
2857
2792
fail_count, test_count = doctest.testmod()
2858
2793
sys.exit(os.EX_OK if fail_count == 0 else 1)
2860
2795
# Default values for config file for server-global settings
2861
server_defaults = {"interface": "",
2866
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2867
":+SIGN-DSA-SHA256",
2868
"servicename": "Mandos",
2874
"statedir": "/var/lib/mandos",
2875
"foreground": "False",
2796
server_defaults = { "interface": "",
2801
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"
2802
":+SIGN-DSA-SHA256",
2803
"servicename": "Mandos",
2809
"statedir": "/var/lib/mandos",
2810
"foreground": "False",
2879
2814
# Parse config file for server-global settings
2880
2815
server_config = configparser.SafeConfigParser(server_defaults)
2881
2816
del server_defaults
3006
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3008
2940
except OSError as error:
3009
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3010
.format(uid, gid, os.strerror(error.errno)))
3011
2941
if error.errno != errno.EPERM:
3015
2945
# Enable all possible GnuTLS debugging
3017
2947
# "Use a log level over 10 to enable all debugging options."
3018
2948
# - GnuTLS manual
3019
2949
gnutls.global_set_log_level(11)
3021
2951
@gnutls.log_func
3022
2952
def debug_gnutls(level, string):
3023
2953
logger.debug("GnuTLS: %s", string[:-1])
3025
2955
gnutls.global_set_log_function(debug_gnutls)
3027
2957
# Redirect stdin so all checkers get /dev/null
3028
2958
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3029
2959
os.dup2(null, sys.stdin.fileno())
3033
2963
# Need to fork before connecting to D-Bus
3034
2964
if not foreground:
3035
2965
# Close all input and output, do double fork, etc.
3038
# multiprocessing will use threads, so before we use GLib we need
3039
# to inform GLib that threads will be used.
2968
# multiprocessing will use threads, so before we use GObject we
2969
# need to inform GObject that threads will be used.
2970
GObject.threads_init()
3042
2972
global main_loop
3043
2973
# From the Avahi example code
3044
2974
DBusGMainLoop(set_as_default=True)
3045
main_loop = GLib.MainLoop()
2975
main_loop = GObject.MainLoop()
3046
2976
bus = dbus.SystemBus()
3047
2977
# End of Avahi example code
3062
2992
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3063
2993
service = AvahiServiceToSyslog(
3064
name=server_settings["servicename"],
3065
servicetype="_mandos._tcp",
2994
name = server_settings["servicename"],
2995
servicetype = "_mandos._tcp",
2996
protocol = protocol,
3068
2998
if server_settings["interface"]:
3069
2999
service.interface = if_nametoindex(
3070
3000
server_settings["interface"].encode("utf-8"))
3072
3002
global multiprocessing_manager
3073
3003
multiprocessing_manager = multiprocessing.Manager()
3075
3005
client_class = Client
3077
client_class = functools.partial(ClientDBus, bus=bus)
3007
client_class = functools.partial(ClientDBus, bus = bus)
3079
3009
client_settings = Client.config_parser(client_config)
3080
3010
old_client_settings = {}
3081
3011
clients_data = {}
3083
3013
# This is used to redirect stdout and stderr for checker processes
3085
wnull = open(os.devnull, "w") # A writable /dev/null
3015
wnull = open(os.devnull, "w") # A writable /dev/null
3086
3016
# Only used if server is running in foreground but not in debug
3088
3018
if debug or not foreground:
3091
3021
# Get client data and settings from last running state.
3092
3022
if server_settings["restore"]:
3094
3024
with open(stored_state_path, "rb") as stored_state:
3095
if sys.version_info.major == 2:
3096
clients_data, old_client_settings = pickle.load(
3099
bytes_clients_data, bytes_old_client_settings = (
3100
pickle.load(stored_state, encoding="bytes"))
3101
# Fix bytes to strings
3104
clients_data = {(key.decode("utf-8")
3105
if isinstance(key, bytes)
3108
bytes_clients_data.items()}
3109
del bytes_clients_data
3110
for key in clients_data:
3111
value = {(k.decode("utf-8")
3112
if isinstance(k, bytes) else k): v
3114
clients_data[key].items()}
3115
clients_data[key] = value
3117
value["client_structure"] = [
3119
if isinstance(s, bytes)
3121
value["client_structure"]]
3123
for k in ("name", "host"):
3124
if isinstance(value[k], bytes):
3125
value[k] = value[k].decode("utf-8")
3126
# old_client_settings
3128
old_client_settings = {
3129
(key.decode("utf-8")
3130
if isinstance(key, bytes)
3133
bytes_old_client_settings.items()}
3134
del bytes_old_client_settings
3136
for value in old_client_settings.values():
3137
if isinstance(value["host"], bytes):
3138
value["host"] = (value["host"]
3025
clients_data, old_client_settings = pickle.load(
3140
3027
os.remove(stored_state_path)
3141
3028
except IOError as e:
3142
3029
if e.errno == errno.ENOENT:
3242
3129
pidfilename, pid)
3244
3131
del pidfilename
3246
for termsig in (signal.SIGHUP, signal.SIGTERM):
3247
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3248
lambda: main_loop.quit() and False)
3133
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
3134
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3252
3138
@alternate_dbus_interfaces(
3253
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3139
{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })
3254
3140
class MandosDBusService(DBusObjectWithObjectManager):
3255
3141
"""A D-Bus proxy object"""
3257
3143
def __init__(self):
3258
3144
dbus.service.Object.__init__(self, bus, "/")
3260
3146
_interface = "se.recompile.Mandos"
3262
3148
@dbus.service.signal(_interface, signature="o")
3263
3149
def ClientAdded(self, objpath):
3267
3153
@dbus.service.signal(_interface, signature="ss")
3268
3154
def ClientNotFound(self, fingerprint, address):
3272
3158
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3274
3160
@dbus.service.signal(_interface, signature="os")
3275
3161
def ClientRemoved(self, objpath, name):
3279
3165
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3281
3167
@dbus.service.method(_interface, out_signature="ao")
3282
3168
def GetAllClients(self):
3284
3170
return dbus.Array(c.dbus_object_path for c in
3285
tcp_server.clients.values())
3171
tcp_server.clients.itervalues())
3287
3173
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3289
3175
@dbus.service.method(_interface,
3309
3195
self.client_removed_signal(c)
3311
3197
raise KeyError(object_path)
3315
3201
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3316
out_signature="a{oa{sa{sv}}}")
3202
out_signature = "a{oa{sa{sv}}}")
3317
3203
def GetManagedObjects(self):
3318
3204
"""D-Bus method"""
3319
3205
return dbus.Dictionary(
3320
{client.dbus_object_path:
3322
{interface: client.GetAll(interface)
3324
client._get_all_interface_names()})
3325
for client in tcp_server.clients.values()})
3206
{ client.dbus_object_path:
3208
{ interface: client.GetAll(interface)
3210
client._get_all_interface_names()})
3211
for client in tcp_server.clients.values()})
3327
3213
def client_added_signal(self, client):
3328
3214
"""Send the new standard signal and the old signal"""
3348
3234
self.ClientRemoved(client.dbus_object_path,
3351
3237
mandos_dbus_service = MandosDBusService()
3353
# Save modules to variables to exempt the modules from being
3354
# unloaded before the function registered with atexit() is run.
3355
mp = multiprocessing
3359
3240
"Cleanup function; run on exit"
3361
3242
service.cleanup()
3363
mp.active_children()
3244
multiprocessing.active_children()
3365
3246
if not (tcp_server.clients or client_settings):
3368
3249
# Store client before exiting. Secrets are encrypted with key
3369
3250
# based on what config file has. If config file is
3370
3251
# removed/edited, old secret will thus be unrecovable.
3372
3253
with PGPEngine() as pgp:
3373
for client in tcp_server.clients.values():
3254
for client in tcp_server.clients.itervalues():
3374
3255
key = client_settings[client.name]["secret"]
3375
3256
client.encrypted_secret = pgp.encrypt(client.secret,
3377
3258
client_dict = {}
3379
3260
# A list of attributes that can not be pickled
3381
exclude = {"bus", "changedstate", "secret",
3382
"checker", "server_settings"}
3262
exclude = { "bus", "changedstate", "secret",
3263
"checker", "server_settings" }
3383
3264
for name, typ in inspect.getmembers(dbus.service
3385
3266
exclude.add(name)
3387
3268
client_dict["encrypted_secret"] = (client
3388
3269
.encrypted_secret)
3389
3270
for attr in client.client_structure:
3390
3271
if attr not in exclude:
3391
3272
client_dict[attr] = getattr(client, attr)
3393
3274
clients[client.name] = client_dict
3394
3275
del client_settings[client.name]["secret"]
3397
3278
with tempfile.NamedTemporaryFile(