/mandos/release : revision 237.7.435

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

19

# the Free Software Foundation, either version 3 of the License, or

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

25

# GNU General Public License for more details.

26

#

26

#

27

# You should have received a copy of the GNU General Public License

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

30

#

31

# Contact the authors at <mandos@recompile.se>.

32

#

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

86

import xml.dom.minidom

87

import inspect

88

89

# Try to find the value of SO_BINDTODEVICE:

89

90

try:

91

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

92

# newer, and it is also the most natural place for it:

90

93

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

91

94

except AttributeError:

92

95

try:

96

# This is where SO_BINDTODEVICE was up to and including Python

97

# 2.6, and also 3.2:

93

98

from IN import SO_BINDTODEVICE

94

99

except ImportError:

95

SO_BINDTODEVICE = None

100

# In Python 2.7 it seems to have been removed entirely.

101

# Try running the C preprocessor:

102

try:

103

cc = subprocess.Popen(["cc", "--language=c", "-E",

104

"/dev/stdin"],

105

stdin=subprocess.PIPE,

106

stdout=subprocess.PIPE)

107

stdout = cc.communicate(

108

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

109

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

110

except (OSError, ValueError, IndexError):

111

# No value found

112

SO_BINDTODEVICE = None

96

113

97

114

if sys.version_info.major == 2:

98

115

str = unicode

99

116

100

version = "1.7.6"

117

version = "1.7.13"

101

118

stored_state_file = "clients.pickle"

102

119

103

120

logger = logging.getLogger()

107

124

if_nametoindex = ctypes.cdll.LoadLibrary(

108

125

ctypes.util.find_library("c")).if_nametoindex

109

126

except (OSError, AttributeError):

110

127

111

128

def if_nametoindex(interface):

112

129

"Get an interface index the hard way, i.e. using fcntl()"

113

130

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

136

153

137

154

def initlogger(debug, level=logging.WARNING):

138

155

"""init logger and add loglevel"""

139

156

140

157

global syslogger

141

158

syslogger = (logging.handlers.SysLogHandler(

142

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

143

address = "/dev/log"))

159

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

160

address="/dev/log"))

144

161

syslogger.setFormatter(logging.Formatter

145

162

('Mandos [%(process)d]: %(levelname)s:'

146

163

' %(message)s'))

147

164

logger.addHandler(syslogger)

148

165

149

166

if debug:

150

167

console = logging.StreamHandler()

151

168

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

163

180

164

181

class PGPEngine(object):

165

182

"""A simple class for OpenPGP symmetric encryption & decryption"""

166

183

167

184

def __init__(self):

168

185

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

169

186

self.gpg = "gpg"

180

197

self.gnupgargs = ['--batch',

181

198

'--homedir', self.tempdir,

182

199

'--force-mdc',

183

'--quiet',

184

'--no-use-agent']

185

200

'--quiet']

201

# Only GPG version 1 has the --no-use-agent option.

202

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

203

self.gnupgargs.append("--no-use-agent")

204

186

205

def __enter__(self):

187

206

return self

188

207

189

208

def __exit__(self, exc_type, exc_value, traceback):

190

209

self._cleanup()

191

210

return False

192

211

193

212

def __del__(self):

194

213

self._cleanup()

195

214

196

215

def _cleanup(self):

197

216

if self.tempdir is not None:

198

217

# Delete contents of tempdir

199

218

for root, dirs, files in os.walk(self.tempdir,

200

topdown = False):

219

topdown=False):

201

220

for filename in files:

202

221

os.remove(os.path.join(root, filename))

203

222

for dirname in dirs:

205

224

# Remove tempdir

206

225

os.rmdir(self.tempdir)

207

226

self.tempdir = None

208

227

209

228

def password_encode(self, password):

210

229

# Passphrase can not be empty and can not contain newlines or

211

230

# NUL bytes. So we prefix it and hex encode it.

216

235

.replace(b"\n", b"\\n")

217

236

.replace(b"\0", b"\\x00"))

218

237

return encoded

219

238

220

239

def encrypt(self, data, password):

221

240

passphrase = self.password_encode(password)

222

241

with tempfile.NamedTemporaryFile(

227

246

'--passphrase-file',

228

247

passfile.name]

229

248

+ self.gnupgargs,

230

stdin = subprocess.PIPE,

231

stdout = subprocess.PIPE,

232

stderr = subprocess.PIPE)

233

ciphertext, err = proc.communicate(input = data)

249

stdin=subprocess.PIPE,

250

stdout=subprocess.PIPE,

251

stderr=subprocess.PIPE)

252

ciphertext, err = proc.communicate(input=data)

234

253

if proc.returncode != 0:

235

254

raise PGPError(err)

236

255

return ciphertext

237

256

238

257

def decrypt(self, data, password):

239

258

passphrase = self.password_encode(password)

240

259

with tempfile.NamedTemporaryFile(

241

dir = self.tempdir) as passfile:

260

dir=self.tempdir) as passfile:

242

261

passfile.write(passphrase)

243

262

passfile.flush()

244

263

proc = subprocess.Popen([self.gpg, '--decrypt',

245

264

'--passphrase-file',

246

265

passfile.name]

247

266

+ self.gnupgargs,

248

stdin = subprocess.PIPE,

249

stdout = subprocess.PIPE,

250

stderr = subprocess.PIPE)

251

decrypted_plaintext, err = proc.communicate(input = data)

267

stdin=subprocess.PIPE,

268

stdout=subprocess.PIPE,

269

stderr=subprocess.PIPE)

270

decrypted_plaintext, err = proc.communicate(input=data)

252

271

if proc.returncode != 0:

253

272

raise PGPError(err)

254

273

return decrypted_plaintext

255

274

275

256

276

# Pretend that we have an Avahi module

257

277

class Avahi(object):

258

278

"""This isn't so much a class as it is a module-like namespace.

259

279

It is instantiated once, and simulates having an Avahi module."""

260

IF_UNSPEC = -1 # avahi-common/address.h

261

PROTO_UNSPEC = -1 # avahi-common/address.h

262

PROTO_INET = 0 # avahi-common/address.h

263

PROTO_INET6 = 1 # avahi-common/address.h

280

IF_UNSPEC = -1 # avahi-common/address.h

281

PROTO_UNSPEC = -1 # avahi-common/address.h

282

PROTO_INET = 0 # avahi-common/address.h

283

PROTO_INET6 = 1 # avahi-common/address.h

264

284

DBUS_NAME = "org.freedesktop.Avahi"

265

285

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

266

286

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

267

287

DBUS_PATH_SERVER = "/"

288

268

289

def string_array_to_txt_array(self, t):

269

290

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

270

291

for s in t), signature="ay")

271

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

272

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

273

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

274

SERVER_INVALID = 0 # avahi-common/defs.h

275

SERVER_REGISTERING = 1 # avahi-common/defs.h

276

SERVER_RUNNING = 2 # avahi-common/defs.h

277

SERVER_COLLISION = 3 # avahi-common/defs.h

278

SERVER_FAILURE = 4 # avahi-common/defs.h

292

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

293

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

294

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

295

SERVER_INVALID = 0 # avahi-common/defs.h

296

SERVER_REGISTERING = 1 # avahi-common/defs.h

297

SERVER_RUNNING = 2 # avahi-common/defs.h

298

SERVER_COLLISION = 3 # avahi-common/defs.h

299

SERVER_FAILURE = 4 # avahi-common/defs.h

279

300

avahi = Avahi()

280

301

302

281

303

class AvahiError(Exception):

282

304

def __init__(self, value, *args, **kwargs):

283

305

self.value = value

295

317

296

318

class AvahiService(object):

297

319

"""An Avahi (Zeroconf) service.

298

320

299

321

Attributes:

300

322

interface: integer; avahi.IF_UNSPEC or an interface index.

301

323

Used to optionally bind to the specified interface.

313

335

server: D-Bus Server

314

336

bus: dbus.SystemBus()

315

337

"""

316

338

317

339

def __init__(self,

318

interface = avahi.IF_UNSPEC,

319

name = None,

320

servicetype = None,

321

port = None,

322

TXT = None,

323

domain = "",

324

host = "",

325

max_renames = 32768,

326

protocol = avahi.PROTO_UNSPEC,

327

bus = None):

340

interface=avahi.IF_UNSPEC,

341

name=None,

342

servicetype=None,

343

port=None,

344

TXT=None,

345

domain="",

346

host="",

347

max_renames=32768,

348

protocol=avahi.PROTO_UNSPEC,

349

bus=None):

328

350

self.interface = interface

329

351

self.name = name

330

352

self.type = servicetype

339

361

self.server = None

340

362

self.bus = bus

341

363

self.entry_group_state_changed_match = None

342

364

343

365

def rename(self, remove=True):

344

366

"""Derived from the Avahi example code"""

345

367

if self.rename_count >= self.max_renames:

365

387

logger.critical("D-Bus Exception", exc_info=error)

366

388

self.cleanup()

367

389

os._exit(1)

368

390

369

391

def remove(self):

370

392

"""Derived from the Avahi example code"""

371

393

if self.entry_group_state_changed_match is not None:

373

395

self.entry_group_state_changed_match = None

374

396

if self.group is not None:

375

397

self.group.Reset()

376

398

377

399

def add(self):

378

400

"""Derived from the Avahi example code"""

379

401

self.remove()

396

418

dbus.UInt16(self.port),

397

419

avahi.string_array_to_txt_array(self.TXT))

398

420

self.group.Commit()

399

421

400

422

def entry_group_state_changed(self, state, error):

401

423

"""Derived from the Avahi example code"""

402

424

logger.debug("Avahi entry group state change: %i", state)

403

425

404

426

if state == avahi.ENTRY_GROUP_ESTABLISHED:

405

427

logger.debug("Zeroconf service established.")

406

428

elif state == avahi.ENTRY_GROUP_COLLISION:

410

432

logger.critical("Avahi: Error in group state changed %s",

411

433

str(error))

412

434

raise AvahiGroupError("State changed: {!s}".format(error))

413

435

414

436

def cleanup(self):

415

437

"""Derived from the Avahi example code"""

416

438

if self.group is not None:

421

443

pass

422

444

self.group = None

423

445

self.remove()

424

446

425

447

def server_state_changed(self, state, error=None):

426

448

"""Derived from the Avahi example code"""

427

449

logger.debug("Avahi server state change: %i", state)

456

478

logger.debug("Unknown state: %r", state)

457

479

else:

458

480

logger.debug("Unknown state: %r: %r", state, error)

459

481

460

482

def activate(self):

461

483

"""Derived from the Avahi example code"""

462

484

if self.server is None:

479

501

.format(self.name)))

480

502

return ret

481

503

504

482

505

# Pretend that we have a GnuTLS module

483

506

class GnuTLS(object):

484

507

"""This isn't so much a class as it is a module-like namespace.

485

508

It is instantiated once, and simulates having a GnuTLS module."""

486

487

_library = ctypes.cdll.LoadLibrary(

488

ctypes.util.find_library("gnutls"))

509

510

library = ctypes.util.find_library("gnutls")

511

if library is None:

512

library = ctypes.util.find_library("gnutls-deb0")

513

_library = ctypes.cdll.LoadLibrary(library)

514

del library

489

515

_need_version = b"3.3.0"

516

490

517

def __init__(self):

491

# Need to use class name "GnuTLS" here, since this method is

492

# called before the assignment to the "gnutls" global variable

493

# happens.

494

if GnuTLS.check_version(self._need_version) is None:

495

raise GnuTLS.Error("Needs GnuTLS {} or later"

496

.format(self._need_version))

497

518

# Need to use "self" here, since this method is called before

519

# the assignment to the "gnutls" global variable happens.

520

if self.check_version(self._need_version) is None:

521

raise self.Error("Needs GnuTLS {} or later"

522

.format(self._need_version))

523

498

524

# Unless otherwise indicated, the constants and types below are

499

525

# all from the gnutls/gnutls.h C header file.

500

526

501

527

# Constants

502

528

E_SUCCESS = 0

503

529

E_INTERRUPTED = -52

508

534

CRD_CERTIFICATE = 1

509

535

E_NO_CERTIFICATE_FOUND = -49

510

536

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

511

537

512

538

# Types

513

539

class session_int(ctypes.Structure):

514

540

_fields_ = []

515

541

session_t = ctypes.POINTER(session_int)

542

516

543

class certificate_credentials_st(ctypes.Structure):

517

544

_fields_ = []

518

545

certificate_credentials_t = ctypes.POINTER(

519

546

certificate_credentials_st)

520

547

certificate_type_t = ctypes.c_int

548

521

549

class datum_t(ctypes.Structure):

522

550

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

523

551

('size', ctypes.c_uint)]

552

524

553

class openpgp_crt_int(ctypes.Structure):

525

554

_fields_ = []

526

555

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

527

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

556

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

528

557

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

529

558

credentials_type_t = ctypes.c_int

530

559

transport_ptr_t = ctypes.c_void_p

531

560

close_request_t = ctypes.c_int

532

561

533

562

# Exceptions

534

563

class Error(Exception):

535

564

# We need to use the class name "GnuTLS" here, since this

536

565

# exception might be raised from within GnuTLS.__init__,

537

566

# which is called before the assignment to the "gnutls"

538

567

# global variable has happened.

539

def __init__(self, message = None, code = None, args=()):

568

def __init__(self, message=None, code=None, args=()):

540

569

# Default usage is by a message string, but if a return

541

570

# code is passed, convert it to a string with

542

571

# gnutls.strerror()

545

574

message = GnuTLS.strerror(code)

546

575

return super(GnuTLS.Error, self).__init__(

547

576

message, *args)

548

577

549

578

class CertificateSecurityError(Error):

550

579

pass

551

580

552

581

# Classes

553

582

class Credentials(object):

554

583

def __init__(self):

556

585

gnutls.certificate_allocate_credentials(

557

586

ctypes.byref(self._c_object))

558

587

self.type = gnutls.CRD_CERTIFICATE

559

588

560

589

def __del__(self):

561

590

gnutls.certificate_free_credentials(self._c_object)

562

591

563

592

class ClientSession(object):

564

def __init__(self, socket, credentials = None):

593

def __init__(self, socket, credentials=None):

565

594

self._c_object = gnutls.session_t()

566

595

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

567

596

gnutls.set_default_priority(self._c_object)

575

604

ctypes.cast(credentials._c_object,

576

605

ctypes.c_void_p))

577

606

self.credentials = credentials

578

607

579

608

def __del__(self):

580

609

gnutls.deinit(self._c_object)

581

610

582

611

def handshake(self):

583

612

return gnutls.handshake(self._c_object)

584

613

585

614

def send(self, data):

586

615

data = bytes(data)

587

616

data_len = len(data)

589

618

data_len -= gnutls.record_send(self._c_object,

590

619

data[-data_len:],

591

620

data_len)

592

621

593

622

def bye(self):

594

623

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

595

624

596

625

# Error handling functions

597

626

def _error_code(result):

598

627

"""A function to raise exceptions on errors, suitable

600

629

if result >= 0:

601

630

return result

602

631

if result == gnutls.E_NO_CERTIFICATE_FOUND:

603

raise gnutls.CertificateSecurityError(code = result)

604

raise gnutls.Error(code = result)

605

632

raise gnutls.CertificateSecurityError(code=result)

633

raise gnutls.Error(code=result)

634

606

635

def _retry_on_error(result, func, arguments):

607

636

"""A function to retry on some errors, suitable

608

637

for the 'errcheck' attribute on ctypes functions"""

611

640

return _error_code(result)

612

641

result = func(*arguments)

613

642

return result

614

643

615

644

# Unless otherwise indicated, the function declarations below are

616

645

# all from the gnutls/gnutls.h C header file.

617

646

618

647

# Functions

619

648

priority_set_direct = _library.gnutls_priority_set_direct

620

649

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

621

650

ctypes.POINTER(ctypes.c_char_p)]

622

651

priority_set_direct.restype = _error_code

623

652

624

653

init = _library.gnutls_init

625

654

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

626

655

init.restype = _error_code

627

656

628

657

set_default_priority = _library.gnutls_set_default_priority

629

658

set_default_priority.argtypes = [session_t]

630

659

set_default_priority.restype = _error_code

631

660

632

661

record_send = _library.gnutls_record_send

633

662

record_send.argtypes = [session_t, ctypes.c_void_p,

634

663

ctypes.c_size_t]

635

664

record_send.restype = ctypes.c_ssize_t

636

665

record_send.errcheck = _retry_on_error

637

666

638

667

certificate_allocate_credentials = (

639

668

_library.gnutls_certificate_allocate_credentials)

640

669

certificate_allocate_credentials.argtypes = [

641

670

ctypes.POINTER(certificate_credentials_t)]

642

671

certificate_allocate_credentials.restype = _error_code

643

672

644

673

certificate_free_credentials = (

645

674

_library.gnutls_certificate_free_credentials)

646

certificate_free_credentials.argtypes = [certificate_credentials_t]

675

certificate_free_credentials.argtypes = [

676

certificate_credentials_t]

647

677

certificate_free_credentials.restype = None

648

678

649

679

handshake_set_private_extensions = (

650

680

_library.gnutls_handshake_set_private_extensions)

651

681

handshake_set_private_extensions.argtypes = [session_t,

652

682

ctypes.c_int]

653

683

handshake_set_private_extensions.restype = None

654

684

655

685

credentials_set = _library.gnutls_credentials_set

656

686

credentials_set.argtypes = [session_t, credentials_type_t,

657

687

ctypes.c_void_p]

658

688

credentials_set.restype = _error_code

659

689

660

690

strerror = _library.gnutls_strerror

661

691

strerror.argtypes = [ctypes.c_int]

662

692

strerror.restype = ctypes.c_char_p

663

693

664

694

certificate_type_get = _library.gnutls_certificate_type_get

665

695

certificate_type_get.argtypes = [session_t]

666

696

certificate_type_get.restype = _error_code

667

697

668

698

certificate_get_peers = _library.gnutls_certificate_get_peers

669

699

certificate_get_peers.argtypes = [session_t,

670

700

ctypes.POINTER(ctypes.c_uint)]

671

701

certificate_get_peers.restype = ctypes.POINTER(datum_t)

672

702

673

703

global_set_log_level = _library.gnutls_global_set_log_level

674

704

global_set_log_level.argtypes = [ctypes.c_int]

675

705

global_set_log_level.restype = None

676

706

677

707

global_set_log_function = _library.gnutls_global_set_log_function

678

708

global_set_log_function.argtypes = [log_func]

679

709

global_set_log_function.restype = None

680

710

681

711

deinit = _library.gnutls_deinit

682

712

deinit.argtypes = [session_t]

683

713

deinit.restype = None

684

714

685

715

handshake = _library.gnutls_handshake

686

716

handshake.argtypes = [session_t]

687

717

handshake.restype = _error_code

688

718

handshake.errcheck = _retry_on_error

689

719

690

720

transport_set_ptr = _library.gnutls_transport_set_ptr

691

721

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

692

722

transport_set_ptr.restype = None

693

723

694

724

bye = _library.gnutls_bye

695

725

bye.argtypes = [session_t, close_request_t]

696

726

bye.restype = _error_code

697

727

bye.errcheck = _retry_on_error

698

728

699

729

check_version = _library.gnutls_check_version

700

730

check_version.argtypes = [ctypes.c_char_p]

701

731

check_version.restype = ctypes.c_char_p

702

732

703

733

# All the function declarations below are from gnutls/openpgp.h

704

734

705

735

openpgp_crt_init = _library.gnutls_openpgp_crt_init

706

736

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

707

737

openpgp_crt_init.restype = _error_code

708

738

709

739

openpgp_crt_import = _library.gnutls_openpgp_crt_import

710

740

openpgp_crt_import.argtypes = [openpgp_crt_t,

711

741

ctypes.POINTER(datum_t),

712

742

openpgp_crt_fmt_t]

713

743

openpgp_crt_import.restype = _error_code

714

744

715

745

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

716

746

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

717

747

ctypes.POINTER(ctypes.c_uint)]

718

748

openpgp_crt_verify_self.restype = _error_code

719

749

720

750

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

721

751

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

722

752

openpgp_crt_deinit.restype = None

723

753

724

754

openpgp_crt_get_fingerprint = (

725

755

_library.gnutls_openpgp_crt_get_fingerprint)

726

756

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

728

758

ctypes.POINTER(

729

759

ctypes.c_size_t)]

730

760

openpgp_crt_get_fingerprint.restype = _error_code

731

761

732

762

# Remove non-public functions

733

763

del _error_code, _retry_on_error

734

764

# Create the global "gnutls" object, simulating a module

735

765

gnutls = GnuTLS()

736

766

767

737

768

def call_pipe(connection, # : multiprocessing.Connection

738

769

func, *args, **kwargs):

739

770

"""This function is meant to be called by multiprocessing.Process

740

771

741

772

This function runs func(*args, **kwargs), and writes the resulting

742

773

return value on the provided multiprocessing.Connection.

743

774

"""

744

775

connection.send(func(*args, **kwargs))

745

776

connection.close()

746

777

778

747

779

class Client(object):

748

780

"""A representation of a client host served by this server.

749

781

750

782

Attributes:

751

783

approved: bool(); 'None' if not yet approved/disapproved

752

784

approval_delay: datetime.timedelta(); Time to wait for approval

789

821

disabled, or None

790

822

server_settings: The server_settings dict from main()

791

823

"""

792

824

793

825

runtime_expansions = ("approval_delay", "approval_duration",

794

826

"created", "enabled", "expires",

795

827

"fingerprint", "host", "interval",

806

838

"approved_by_default": "True",

807

839

"enabled": "True",

808

840

}

809

841

810

842

@staticmethod

811

843

def config_parser(config):

812

844

"""Construct a new dict of client settings of this form:

819

851

for client_name in config.sections():

820

852

section = dict(config.items(client_name))

821

853

client = settings[client_name] = {}

822

854

823

855

client["host"] = section["host"]

824

856

# Reformat values from string types to Python types

825

857

client["approved_by_default"] = config.getboolean(

826

858

client_name, "approved_by_default")

827

859

client["enabled"] = config.getboolean(client_name,

828

860

"enabled")

829

861

830

862

# Uppercase and remove spaces from fingerprint for later

831

863

# comparison purposes with return value from the

832

864

# fingerprint() function

856

888

client["last_approval_request"] = None

857

889

client["last_checked_ok"] = None

858

890

client["last_checker_status"] = -2

859

891

860

892

return settings

861

862

def __init__(self, settings, name = None, server_settings=None):

893

894

def __init__(self, settings, name=None, server_settings=None):

863

895

self.name = name

864

896

if server_settings is None:

865

897

server_settings = {}

867

899

# adding all client settings

868

900

for setting, value in settings.items():

869

901

setattr(self, setting, value)

870

902

871

903

if self.enabled:

872

904

if not hasattr(self, "last_enabled"):

873

905

self.last_enabled = datetime.datetime.utcnow()

877

909

else:

878

910

self.last_enabled = None

879

911

self.expires = None

880

912

881

913

logger.debug("Creating client %r", self.name)

882

914

logger.debug(" Fingerprint: %s", self.fingerprint)

883

915

self.created = settings.get("created",

884

916

datetime.datetime.utcnow())

885

917

886

918

# attributes specific for this server instance

887

919

self.checker = None

888

920

self.checker_initiator_tag = None

897

929

for attr in self.__dict__.keys()

898

930

if not attr.startswith("_")]

899

931

self.client_structure.append("client_structure")

900

932

901

933

for name, t in inspect.getmembers(

902

934

type(self), lambda obj: isinstance(obj, property)):

903

935

if not name.startswith("_"):

904

936

self.client_structure.append(name)

905

937

906

938

# Send notice to process children that client state has changed

907

939

def send_changedstate(self):

908

940

with self.changedstate:

909

941

self.changedstate.notify_all()

910

942

911

943

def enable(self):

912

944

"""Start this client's checker and timeout hooks"""

913

945

if getattr(self, "enabled", False):

918

950

self.last_enabled = datetime.datetime.utcnow()

919

951

self.init_checker()

920

952

self.send_changedstate()

921

953

922

954

def disable(self, quiet=True):

923

955

"""Disable this client."""

924

956

if not getattr(self, "enabled", False):

938

970

self.send_changedstate()

939

971

# Do not run this again if called by a GLib.timeout_add

940

972

return False

941

973

942

974

def __del__(self):

943

975

self.disable()

944

976

945

977

def init_checker(self):

946

978

# Schedule a new checker to be started an 'interval' from now,

947

979

# and every interval from then on.

957

989

int(self.timeout.total_seconds() * 1000), self.disable)

958

990

# Also start a new checker *right now*.

959

991

self.start_checker()

960

992

961

993

def checker_callback(self, source, condition, connection,

962

994

command):

963

995

"""The checker has completed, so take appropriate actions."""

966

998

# Read return code from connection (see call_pipe)

967

999

returncode = connection.recv()

968

1000

connection.close()

969

1001

970

1002

if returncode >= 0:

971

1003

self.last_checker_status = returncode

972

1004

self.last_checker_signal = None

982

1014

logger.warning("Checker for %(name)s crashed?",

983

1015

vars(self))

984

1016

return False

985

1017

986

1018

def checked_ok(self):

987

1019

"""Assert that the client has been seen, alive and well."""

988

1020

self.last_checked_ok = datetime.datetime.utcnow()

989

1021

self.last_checker_status = 0

990

1022

self.last_checker_signal = None

991

1023

self.bump_timeout()

992

1024

993

1025

def bump_timeout(self, timeout=None):

994

1026

"""Bump up the timeout for this client."""

995

1027

if timeout is None:

1001

1033

self.disable_initiator_tag = GLib.timeout_add(

1002

1034

int(timeout.total_seconds() * 1000), self.disable)

1003

1035

self.expires = datetime.datetime.utcnow() + timeout

1004

1036

1005

1037

def need_approval(self):

1006

1038

self.last_approval_request = datetime.datetime.utcnow()

1007

1039

1008

1040

def start_checker(self):

1009

1041

"""Start a new checker subprocess if one is not running.

1010

1042

1011

1043

If a checker already exists, leave it running and do

1012

1044

nothing."""

1013

1045

# The reason for not killing a running checker is that if we

1018

1050

# checkers alone, the checker would have to take more time

1019

1051

# than 'timeout' for the client to be disabled, which is as it

1020

1052

# should be.

1021

1053

1022

1054

if self.checker is not None and not self.checker.is_alive():

1023

1055

logger.warning("Checker was not alive; joining")

1024

1056

self.checker.join()

1028

1060

# Escape attributes for the shell

1029

1061

escaped_attrs = {

1030

1062

attr: re.escape(str(getattr(self, attr)))

1031

for attr in self.runtime_expansions }

1063

for attr in self.runtime_expansions}

1032

1064

try:

1033

1065

command = self.checker_command % escaped_attrs

1034

1066

except TypeError as error:

1046

1078

# The exception is when not debugging but nevertheless

1047

1079

# running in the foreground; use the previously

1048

1080

# created wnull.

1049

popen_args = { "close_fds": True,

1050

"shell": True,

1051

"cwd": "/" }

1081

popen_args = {"close_fds": True,

1082

"shell": True,

1083

"cwd": "/"}

1052

1084

if (not self.server_settings["debug"]

1053

1085

and self.server_settings["foreground"]):

1054

1086

popen_args.update({"stdout": wnull,

1055

"stderr": wnull })

1056

pipe = multiprocessing.Pipe(duplex = False)

1087

"stderr": wnull})

1088

pipe = multiprocessing.Pipe(duplex=False)

1057

1089

self.checker = multiprocessing.Process(

1058

target = call_pipe,

1059

args = (pipe[1], subprocess.call, command),

1060

kwargs = popen_args)

1090

target=call_pipe,

1091

args=(pipe[1], subprocess.call, command),

1092

kwargs=popen_args)

1061

1093

self.checker.start()

1062

1094

self.checker_callback_tag = GLib.io_add_watch(

1063

1095

pipe[0].fileno(), GLib.IO_IN,

1064

1096

self.checker_callback, pipe[0], command)

1065

1097

# Re-run this periodically if run by GLib.timeout_add

1066

1098

return True

1067

1099

1068

1100

def stop_checker(self):

1069

1101

"""Force the checker process, if any, to stop."""

1070

1102

if self.checker_callback_tag:

1083

1115

byte_arrays=False):

1084

1116

"""Decorators for marking methods of a DBusObjectWithProperties to

1085

1117

become properties on the D-Bus.

1086

1118

1087

1119

The decorated method will be called with no arguments by "Get"

1088

1120

and with one argument by "Set".

1089

1121

1090

1122

The parameters, where they are supported, are the same as

1091

1123

dbus.service.method, except there is only "signature", since the

1092

1124

type from Get() and the type sent to Set() is the same.

1096

1128

if byte_arrays and signature != "ay":

1097

1129

raise ValueError("Byte arrays not supported for non-'ay'"

1098

1130

" signature {!r}".format(signature))

1099

1131

1100

1132

def decorator(func):

1101

1133

func._dbus_is_property = True

1102

1134

func._dbus_interface = dbus_interface

1105

1137

func._dbus_name = func.__name__

1106

1138

if func._dbus_name.endswith("_dbus_property"):

1107

1139

func._dbus_name = func._dbus_name[:-14]

1108

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1140

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

1109

1141

return func

1110

1142

1111

1143

return decorator

1112

1144

1113

1145

1114

1146

def dbus_interface_annotations(dbus_interface):

1115

1147

"""Decorator for marking functions returning interface annotations

1116

1148

1117

1149

Usage:

1118

1150

1119

1151

@dbus_interface_annotations("org.example.Interface")

1120

1152

def _foo(self): # Function name does not matter

1121

1153

return {"org.freedesktop.DBus.Deprecated": "true",

1122

1154

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1123

1155

"false"}

1124

1156

"""

1125

1157

1126

1158

def decorator(func):

1127

1159

func._dbus_is_interface = True

1128

1160

func._dbus_interface = dbus_interface

1129

1161

func._dbus_name = dbus_interface

1130

1162

return func

1131

1163

1132

1164

return decorator

1133

1165

1134

1166

1135

1167

def dbus_annotations(annotations):

1136

1168

"""Decorator to annotate D-Bus methods, signals or properties

1137

1169

Usage:

1138

1170

1139

1171

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1140

1172

"org.freedesktop.DBus.Property."

1141

1173

"EmitsChangedSignal": "false"})

1143

1175

access="r")

1144

1176

def Property_dbus_property(self):

1145

1177

return dbus.Boolean(False)

1146

1178

1147

1179

See also the DBusObjectWithAnnotations class.

1148

1180

"""

1149

1181

1150

1182

def decorator(func):

1151

1183

func._dbus_annotations = annotations

1152

1184

return func

1153

1185

1154

1186

return decorator

1155

1187

1156

1188

1174

1206

1175

1207

class DBusObjectWithAnnotations(dbus.service.Object):

1176

1208

"""A D-Bus object with annotations.

1177

1209

1178

1210

Classes inheriting from this can use the dbus_annotations

1179

1211

decorator to add annotations to methods or signals.

1180

1212

"""

1181

1213

1182

1214

@staticmethod

1183

1215

def _is_dbus_thing(thing):

1184

1216

"""Returns a function testing if an attribute is a D-Bus thing

1185

1217

1186

1218

If called like _is_dbus_thing("method") it returns a function

1187

1219

suitable for use as predicate to inspect.getmembers().

1188

1220

"""

1189

1221

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

1190

1222

False)

1191

1223

1192

1224

def _get_all_dbus_things(self, thing):

1193

1225

"""Returns a generator of (name, attribute) pairs

1194

1226

"""

1197

1229

for cls in self.__class__.__mro__

1198

1230

for name, athing in

1199

1231

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1200

1232

1201

1233

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1202

out_signature = "s",

1203

path_keyword = 'object_path',

1204

connection_keyword = 'connection')

1234

out_signature="s",

1235

path_keyword='object_path',

1236

connection_keyword='connection')

1205

1237

def Introspect(self, object_path, connection):

1206

1238

"""Overloading of standard D-Bus method.

1207

1239

1208

1240

Inserts annotation tags on methods and signals.

1209

1241

"""

1210

1242

xmlstring = dbus.service.Object.Introspect(self, object_path,

1211

1243

connection)

1212

1244

try:

1213

1245

document = xml.dom.minidom.parseString(xmlstring)

1214

1246

1215

1247

for if_tag in document.getElementsByTagName("interface"):

1216

1248

# Add annotation tags

1217

1249

for typ in ("method", "signal"):

1244

1276

if_tag.appendChild(ann_tag)

1245

1277

# Fix argument name for the Introspect method itself

1246

1278

if (if_tag.getAttribute("name")

1247

== dbus.INTROSPECTABLE_IFACE):

1279

== dbus.INTROSPECTABLE_IFACE):

1248

1280

for cn in if_tag.getElementsByTagName("method"):

1249

1281

if cn.getAttribute("name") == "Introspect":

1250

1282

for arg in cn.getElementsByTagName("arg"):

1263

1295

1264

1296

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1265

1297

"""A D-Bus object with properties.

1266

1298

1267

1299

Classes inheriting from this can use the dbus_service_property

1268

1300

decorator to expose methods as D-Bus properties. It exposes the

1269

1301

standard Get(), Set(), and GetAll() methods on the D-Bus.

1270

1302

"""

1271

1303

1272

1304

def _get_dbus_property(self, interface_name, property_name):

1273

1305

"""Returns a bound method if one exists which is a D-Bus

1274

1306

property with the specified name and interface.

1279

1311

if (value._dbus_name == property_name

1280

1312

and value._dbus_interface == interface_name):

1281

1313

return value.__get__(self)

1282

1314

1283

1315

# No such property

1284

1316

raise DBusPropertyNotFound("{}:{}.{}".format(

1285

1317

self.dbus_object_path, interface_name, property_name))

1286

1318

1287

1319

@classmethod

1288

1320

def _get_all_interface_names(cls):

1289

1321

"""Get a sequence of all interfaces supported by an object"""

1292

1324

for x in (inspect.getmro(cls))

1293

1325

for attr in dir(x))

1294

1326

if name is not None)

1295

1327

1296

1328

@dbus.service.method(dbus.PROPERTIES_IFACE,

1297

1329

in_signature="ss",

1298

1330

out_signature="v")

1306

1338

if not hasattr(value, "variant_level"):

1307

1339

return value

1308

1340

return type(value)(value, variant_level=value.variant_level+1)

1309

1341

1310

1342

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1311

1343

def Set(self, interface_name, property_name, value):

1312

1344

"""Standard D-Bus property Set() method, see D-Bus standard.

1324

1356

value = dbus.ByteArray(b''.join(chr(byte)

1325

1357

for byte in value))

1326

1358

prop(value)

1327

1359

1328

1360

@dbus.service.method(dbus.PROPERTIES_IFACE,

1329

1361

in_signature="s",

1330

1362

out_signature="a{sv}")

1331

1363

def GetAll(self, interface_name):

1332

1364

"""Standard D-Bus property GetAll() method, see D-Bus

1333

1365

standard.

1334

1366

1335

1367

Note: Will not include properties with access="write".

1336

1368

"""

1337

1369

properties = {}

1348

1380

properties[name] = value

1349

1381

continue

1350

1382

properties[name] = type(value)(

1351

value, variant_level = value.variant_level + 1)

1383

value, variant_level=value.variant_level + 1)

1352

1384

return dbus.Dictionary(properties, signature="sv")

1353

1385

1354

1386

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1355

1387

def PropertiesChanged(self, interface_name, changed_properties,

1356

1388

invalidated_properties):

1358

1390

standard.

1359

1391

"""

1360

1392

pass

1361

1393

1362

1394

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1363

1395

out_signature="s",

1364

1396

path_keyword='object_path',

1365

1397

connection_keyword='connection')

1366

1398

def Introspect(self, object_path, connection):

1367

1399

"""Overloading of standard D-Bus method.

1368

1400

1369

1401

Inserts property tags and interface annotation tags.

1370

1402

"""

1371

1403

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1373

1405

connection)

1374

1406

try:

1375

1407

document = xml.dom.minidom.parseString(xmlstring)

1376

1408

1377

1409

def make_tag(document, name, prop):

1378

1410

e = document.createElement("property")

1379

1411

e.setAttribute("name", name)

1380

1412

e.setAttribute("type", prop._dbus_signature)

1381

1413

e.setAttribute("access", prop._dbus_access)

1382

1414

return e

1383

1415

1384

1416

for if_tag in document.getElementsByTagName("interface"):

1385

1417

# Add property tags

1386

1418

for tag in (make_tag(document, name, prop)

1433

1465

except AttributeError:

1434

1466

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1435

1467

1468

1436

1469

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1437

1470

"""A D-Bus object with an ObjectManager.

1438

1471

1439

1472

Classes inheriting from this exposes the standard

1440

1473

GetManagedObjects call and the InterfacesAdded and

1441

1474

InterfacesRemoved signals on the standard

1442

1475

"org.freedesktop.DBus.ObjectManager" interface.

1443

1476

1444

1477

Note: No signals are sent automatically; they must be sent

1445

1478

manually.

1446

1479

"""

1447

1480

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1448

out_signature = "a{oa{sa{sv}}}")

1481

out_signature="a{oa{sa{sv}}}")

1449

1482

def GetManagedObjects(self):

1450

1483

"""This function must be overridden"""

1451

1484

raise NotImplementedError()

1452

1485

1453

1486

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1454

signature = "oa{sa{sv}}")

1487

signature="oa{sa{sv}}")

1455

1488

def InterfacesAdded(self, object_path, interfaces_and_properties):

1456

1489

pass

1457

1458

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1490

1491

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1459

1492

def InterfacesRemoved(self, object_path, interfaces):

1460

1493

pass

1461

1494

1462

1495

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1463

out_signature = "s",

1464

path_keyword = 'object_path',

1465

connection_keyword = 'connection')

1496

out_signature="s",

1497

path_keyword='object_path',

1498

connection_keyword='connection')

1466

1499

def Introspect(self, object_path, connection):

1467

1500

"""Overloading of standard D-Bus method.

1468

1501

1469

1502

Override return argument name of GetManagedObjects to be

1470

1503

"objpath_interfaces_and_properties"

1471

1504

"""

1474

1507

connection)

1475

1508

try:

1476

1509

document = xml.dom.minidom.parseString(xmlstring)

1477

1510

1478

1511

for if_tag in document.getElementsByTagName("interface"):

1479

1512

# Fix argument name for the GetManagedObjects method

1480

1513

if (if_tag.getAttribute("name")

1481

== dbus.OBJECT_MANAGER_IFACE):

1514

== dbus.OBJECT_MANAGER_IFACE):

1482

1515

for cn in if_tag.getElementsByTagName("method"):

1483

1516

if (cn.getAttribute("name")

1484

1517

== "GetManagedObjects"):

1494

1527

except (AttributeError, xml.dom.DOMException,

1495

1528

xml.parsers.expat.ExpatError) as error:

1496

1529

logger.error("Failed to override Introspection method",

1497

exc_info = error)

1530

exc_info=error)

1498

1531

return xmlstring

1499

1532

1533

1500

1534

def datetime_to_dbus(dt, variant_level=0):

1501

1535

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1502

1536

if dt is None:

1503

return dbus.String("", variant_level = variant_level)

1537

return dbus.String("", variant_level=variant_level)

1504

1538

return dbus.String(dt.isoformat(), variant_level=variant_level)

1505

1539

1506

1540

1509

1543

dbus.service.Object, it will add alternate D-Bus attributes with

1510

1544

interface names according to the "alt_interface_names" mapping.

1511

1545

Usage:

1512

1546

1513

1547

@alternate_dbus_interfaces({"org.example.Interface":

1514

1548

"net.example.AlternateInterface"})

1515

1549

class SampleDBusObject(dbus.service.Object):

1516

1550

@dbus.service.method("org.example.Interface")

1517

1551

def SampleDBusMethod():

1518

1552

pass

1519

1553

1520

1554

The above "SampleDBusMethod" on "SampleDBusObject" will be

1521

1555

reachable via two interfaces: "org.example.Interface" and

1522

1556

"net.example.AlternateInterface", the latter of which will have

1523

1557

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1524

1558

"true", unless "deprecate" is passed with a False value.

1525

1559

1526

1560

This works for methods and signals, and also for D-Bus properties

1527

1561

(from DBusObjectWithProperties) and interfaces (from the

1528

1562

dbus_interface_annotations decorator).

1529

1563

"""

1530

1564

1531

1565

def wrapper(cls):

1532

1566

for orig_interface_name, alt_interface_name in (

1533

1567

alt_interface_names.items()):

1573

1607

attribute._dbus_annotations)

1574

1608

except AttributeError:

1575

1609

pass

1610

1576

1611

# Define a creator of a function to call both the

1577

1612

# original and alternate functions, so both the

1578

1613

# original and alternate signals gets sent when

1581

1616

"""This function is a scope container to pass

1582

1617

func1 and func2 to the "call_both" function

1583

1618

outside of its arguments"""

1584

1619

1585

1620

@functools.wraps(func2)

1586

1621

def call_both(*args, **kwargs):

1587

1622

"""This function will emit two D-Bus

1588

1623

signals by calling func1 and func2"""

1589

1624

func1(*args, **kwargs)

1590

1625

func2(*args, **kwargs)

1591

# Make wrapper function look like a D-Bus signal

1626

# Make wrapper function look like a D-Bus

1627

# signal

1592

1628

for name, attr in inspect.getmembers(func2):

1593

1629

if name.startswith("_dbus_"):

1594

1630

setattr(call_both, name, attr)

1595

1631

1596

1632

return call_both

1597

1633

# Create the "call_both" function and add it to

1598

1634

# the class

1644

1680

(copy_function(attribute)))

1645

1681

if deprecate:

1646

1682

# Deprecate all alternate interfaces

1647

iname="_AlternateDBusNames_interface_annotation{}"

1683

iname = "_AlternateDBusNames_interface_annotation{}"

1648

1684

for interface_name in interface_names:

1649

1685

1650

1686

@dbus_interface_annotations(interface_name)

1651

1687

def func(self):

1652

return { "org.freedesktop.DBus.Deprecated":

1653

"true" }

1688

return {"org.freedesktop.DBus.Deprecated":

1689

"true"}

1654

1690

# Find an unused name

1655

1691

for aname in (iname.format(i)

1656

1692

for i in itertools.count()):

1667

1703

cls = type("{}Alternate".format(cls.__name__),

1668

1704

(cls, ), attr)

1669

1705

return cls

1670

1706

1671

1707

return wrapper

1672

1708

1673

1709

1675

1711

"se.bsnet.fukt.Mandos"})

1676

1712

class ClientDBus(Client, DBusObjectWithProperties):

1677

1713

"""A Client class using D-Bus

1678

1714

1679

1715

Attributes:

1680

1716

dbus_object_path: dbus.ObjectPath

1681

1717

bus: dbus.SystemBus()

1682

1718

"""

1683

1719

1684

1720

runtime_expansions = (Client.runtime_expansions

1685

1721

+ ("dbus_object_path", ))

1686

1722

1687

1723

_interface = "se.recompile.Mandos.Client"

1688

1724

1689

1725

# dbus.service.Object doesn't use super(), so we can't either.

1690

1691

def __init__(self, bus = None, *args, **kwargs):

1726

1727

def __init__(self, bus=None, *args, **kwargs):

1692

1728

self.bus = bus

1693

1729

Client.__init__(self, *args, **kwargs)

1694

1730

# Only now, when this client is initialized, can it show up on

1700

1736

"/clients/" + client_object_name)

1701

1737

DBusObjectWithProperties.__init__(self, self.bus,

1702

1738

self.dbus_object_path)

1703

1739

1704

1740

def notifychangeproperty(transform_func, dbus_name,

1705

1741

type_func=lambda x: x,

1706

1742

variant_level=1,

1708

1744

_interface=_interface):

1709

1745

""" Modify a variable so that it's a property which announces

1710

1746

its changes to DBus.

1711

1747

1712

1748

transform_fun: Function that takes a value and a variant_level

1713

1749

and transforms it to a D-Bus type.

1714

1750

dbus_name: D-Bus name of the variable

1717

1753

variant_level: D-Bus variant level. Default: 1

1718

1754

"""

1719

1755

attrname = "_{}".format(dbus_name)

1720

1756

1721

1757

def setter(self, value):

1722

1758

if hasattr(self, "dbus_object_path"):

1723

1759

if (not hasattr(self, attrname) or

1730

1766

else:

1731

1767

dbus_value = transform_func(

1732

1768

type_func(value),

1733

variant_level = variant_level)

1769

variant_level=variant_level)

1734

1770

self.PropertyChanged(dbus.String(dbus_name),

1735

1771

dbus_value)

1736

1772

self.PropertiesChanged(

1737

1773

_interface,

1738

dbus.Dictionary({ dbus.String(dbus_name):

1739

dbus_value }),

1774

dbus.Dictionary({dbus.String(dbus_name):

1775

dbus_value}),

1740

1776

dbus.Array())

1741

1777

setattr(self, attrname, value)

1742

1778

1743

1779

return property(lambda self: getattr(self, attrname), setter)

1744

1780

1745

1781

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1746

1782

approvals_pending = notifychangeproperty(dbus.Boolean,

1747

1783

"ApprovalPending",

1748

type_func = bool)

1784

type_func=bool)

1749

1785

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1750

1786

last_enabled = notifychangeproperty(datetime_to_dbus,

1751

1787

"LastEnabled")

1752

1788

checker = notifychangeproperty(

1753

1789

dbus.Boolean, "CheckerRunning",

1754

type_func = lambda checker: checker is not None)

1790

type_func=lambda checker: checker is not None)

1755

1791

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1756

1792

"LastCheckedOK")

1757

1793

last_checker_status = notifychangeproperty(dbus.Int16,

1762

1798

"ApprovedByDefault")

1763

1799

approval_delay = notifychangeproperty(

1764

1800

dbus.UInt64, "ApprovalDelay",

1765

type_func = lambda td: td.total_seconds() * 1000)

1801

type_func=lambda td: td.total_seconds() * 1000)

1766

1802

approval_duration = notifychangeproperty(

1767

1803

dbus.UInt64, "ApprovalDuration",

1768

type_func = lambda td: td.total_seconds() * 1000)

1804

type_func=lambda td: td.total_seconds() * 1000)

1769

1805

host = notifychangeproperty(dbus.String, "Host")

1770

1806

timeout = notifychangeproperty(

1771

1807

dbus.UInt64, "Timeout",

1772

type_func = lambda td: td.total_seconds() * 1000)

1808

type_func=lambda td: td.total_seconds() * 1000)

1773

1809

extended_timeout = notifychangeproperty(

1774

1810

dbus.UInt64, "ExtendedTimeout",

1775

type_func = lambda td: td.total_seconds() * 1000)

1811

type_func=lambda td: td.total_seconds() * 1000)

1776

1812

interval = notifychangeproperty(

1777

1813

dbus.UInt64, "Interval",

1778

type_func = lambda td: td.total_seconds() * 1000)

1814

type_func=lambda td: td.total_seconds() * 1000)

1779

1815

checker_command = notifychangeproperty(dbus.String, "Checker")

1780

1816

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1781

1817

invalidate_only=True)

1782

1818

1783

1819

del notifychangeproperty

1784

1820

1785

1821

def __del__(self, *args, **kwargs):

1786

1822

try:

1787

1823

self.remove_from_connection()

1790

1826

if hasattr(DBusObjectWithProperties, "__del__"):

1791

1827

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1792

1828

Client.__del__(self, *args, **kwargs)

1793

1829

1794

1830

def checker_callback(self, source, condition,

1795

1831

connection, command, *args, **kwargs):

1796

1832

ret = Client.checker_callback(self, source, condition,

1812

1848

| self.last_checker_signal),

1813

1849

dbus.String(command))

1814

1850

return ret

1815

1851

1816

1852

def start_checker(self, *args, **kwargs):

1817

1853

old_checker_pid = getattr(self.checker, "pid", None)

1818

1854

r = Client.start_checker(self, *args, **kwargs)

1822

1858

# Emit D-Bus signal

1823

1859

self.CheckerStarted(self.current_checker_command)

1824

1860

return r

1825

1861

1826

1862

def _reset_approved(self):

1827

1863

self.approved = None

1828

1864

return False

1829

1865

1830

1866

def approve(self, value=True):

1831

1867

self.approved = value

1832

1868

GLib.timeout_add(int(self.approval_duration.total_seconds()

1833

1869

* 1000), self._reset_approved)

1834

1870

self.send_changedstate()

1835

1836

## D-Bus methods, signals & properties

1837

1838

## Interfaces

1839

1840

## Signals

1841

1871

1872

# D-Bus methods, signals & properties

1873

1874

# Interfaces

1875

1876

# Signals

1877

1842

1878

# CheckerCompleted - signal

1843

1879

@dbus.service.signal(_interface, signature="nxs")

1844

1880

def CheckerCompleted(self, exitcode, waitstatus, command):

1845

1881

"D-Bus signal"

1846

1882

pass

1847

1883

1848

1884

# CheckerStarted - signal

1849

1885

@dbus.service.signal(_interface, signature="s")

1850

1886

def CheckerStarted(self, command):

1851

1887

"D-Bus signal"

1852

1888

pass

1853

1889

1854

1890

# PropertyChanged - signal

1855

1891

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1856

1892

@dbus.service.signal(_interface, signature="sv")

1857

1893

def PropertyChanged(self, property, value):

1858

1894

"D-Bus signal"

1859

1895

pass

1860

1896

1861

1897

# GotSecret - signal

1862

1898

@dbus.service.signal(_interface)

1863

1899

def GotSecret(self):

1866

1902

server to mandos-client

1867

1903

"""

1868

1904

pass

1869

1905

1870

1906

# Rejected - signal

1871

1907

@dbus.service.signal(_interface, signature="s")

1872

1908

def Rejected(self, reason):

1873

1909

"D-Bus signal"

1874

1910

pass

1875

1911

1876

1912

# NeedApproval - signal

1877

1913

@dbus.service.signal(_interface, signature="tb")

1878

1914

def NeedApproval(self, timeout, default):

1879

1915

"D-Bus signal"

1880

1916

return self.need_approval()

1881

1882

## Methods

1883

1917

1918

# Methods

1919

1884

1920

# Approve - method

1885

1921

@dbus.service.method(_interface, in_signature="b")

1886

1922

def Approve(self, value):

1887

1923

self.approve(value)

1888

1924

1889

1925

# CheckedOK - method

1890

1926

@dbus.service.method(_interface)

1891

1927

def CheckedOK(self):

1892

1928

self.checked_ok()

1893

1929

1894

1930

# Enable - method

1895

1931

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1896

1932

@dbus.service.method(_interface)

1897

1933

def Enable(self):

1898

1934

"D-Bus method"

1899

1935

self.enable()

1900

1936

1901

1937

# StartChecker - method

1902

1938

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1903

1939

@dbus.service.method(_interface)

1904

1940

def StartChecker(self):

1905

1941

"D-Bus method"

1906

1942

self.start_checker()

1907

1943

1908

1944

# Disable - method

1909

1945

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1910

1946

@dbus.service.method(_interface)

1911

1947

def Disable(self):

1912

1948

"D-Bus method"

1913

1949

self.disable()

1914

1950

1915

1951

# StopChecker - method

1916

1952

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1917

1953

@dbus.service.method(_interface)

1918

1954

def StopChecker(self):

1919

1955

self.stop_checker()

1920

1921

## Properties

1922

1956

1957

# Properties

1958

1923

1959

# ApprovalPending - property

1924

1960

@dbus_service_property(_interface, signature="b", access="read")

1925

1961

def ApprovalPending_dbus_property(self):

1926

1962

return dbus.Boolean(bool(self.approvals_pending))

1927

1963

1928

1964

# ApprovedByDefault - property

1929

1965

@dbus_service_property(_interface,

1930

1966

signature="b",

1933

1969

if value is None: # get

1934

1970

return dbus.Boolean(self.approved_by_default)

1935

1971

self.approved_by_default = bool(value)

1936

1972

1937

1973

# ApprovalDelay - property

1938

1974

@dbus_service_property(_interface,

1939

1975

signature="t",

1943

1979

return dbus.UInt64(self.approval_delay.total_seconds()

1944

1980

* 1000)

1945

1981

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1946

1982

1947

1983

# ApprovalDuration - property

1948

1984

@dbus_service_property(_interface,

1949

1985

signature="t",

1953

1989

return dbus.UInt64(self.approval_duration.total_seconds()

1954

1990

* 1000)

1955

1991

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1956

1992

1957

1993

# Name - property

1958

1994

@dbus_annotations(

1959

1995

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1960

1996

@dbus_service_property(_interface, signature="s", access="read")

1961

1997

def Name_dbus_property(self):

1962

1998

return dbus.String(self.name)

1963

1999

1964

2000

# Fingerprint - property

1965

2001

@dbus_annotations(

1966

2002

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1967

2003

@dbus_service_property(_interface, signature="s", access="read")

1968

2004

def Fingerprint_dbus_property(self):

1969

2005

return dbus.String(self.fingerprint)

1970

2006

1971

2007

# Host - property

1972

2008

@dbus_service_property(_interface,

1973

2009

signature="s",

1976

2012

if value is None: # get

1977

2013

return dbus.String(self.host)

1978

2014

self.host = str(value)

1979

2015

1980

2016

# Created - property

1981

2017

@dbus_annotations(

1982

2018

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1983

2019

@dbus_service_property(_interface, signature="s", access="read")

1984

2020

def Created_dbus_property(self):

1985

2021

return datetime_to_dbus(self.created)

1986

2022

1987

2023

# LastEnabled - property

1988

2024

@dbus_service_property(_interface, signature="s", access="read")

1989

2025

def LastEnabled_dbus_property(self):

1990

2026

return datetime_to_dbus(self.last_enabled)

1991

2027

1992

2028

# Enabled - property

1993

2029

@dbus_service_property(_interface,

1994

2030

signature="b",

2000

2036

self.enable()

2001

2037

else:

2002

2038

self.disable()

2003

2039

2004

2040

# LastCheckedOK - property

2005

2041

@dbus_service_property(_interface,

2006

2042

signature="s",

2010

2046

self.checked_ok()

2011

2047

return

2012

2048

return datetime_to_dbus(self.last_checked_ok)

2013

2049

2014

2050

# LastCheckerStatus - property

2015

2051

@dbus_service_property(_interface, signature="n", access="read")

2016

2052

def LastCheckerStatus_dbus_property(self):

2017

2053

return dbus.Int16(self.last_checker_status)

2018

2054

2019

2055

# Expires - property

2020

2056

@dbus_service_property(_interface, signature="s", access="read")

2021

2057

def Expires_dbus_property(self):

2022

2058

return datetime_to_dbus(self.expires)

2023

2059

2024

2060

# LastApprovalRequest - property

2025

2061

@dbus_service_property(_interface, signature="s", access="read")

2026

2062

def LastApprovalRequest_dbus_property(self):

2027

2063

return datetime_to_dbus(self.last_approval_request)

2028

2064

2029

2065

# Timeout - property

2030

2066

@dbus_service_property(_interface,

2031

2067

signature="t",

2050

2086

self.disable_initiator_tag = GLib.timeout_add(

2051

2087

int((self.expires - now).total_seconds() * 1000),

2052

2088

self.disable)

2053

2089

2054

2090

# ExtendedTimeout - property

2055

2091

@dbus_service_property(_interface,

2056

2092

signature="t",

2060

2096

return dbus.UInt64(self.extended_timeout.total_seconds()

2061

2097

* 1000)

2062

2098

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2063

2099

2064

2100

# Interval - property

2065

2101

@dbus_service_property(_interface,

2066

2102

signature="t",

2076

2112

GLib.source_remove(self.checker_initiator_tag)

2077

2113

self.checker_initiator_tag = GLib.timeout_add(

2078

2114

value, self.start_checker)

2079

self.start_checker() # Start one now, too

2080

2115

self.start_checker() # Start one now, too

2116

2081

2117

# Checker - property

2082

2118

@dbus_service_property(_interface,

2083

2119

signature="s",

2086

2122

if value is None: # get

2087

2123

return dbus.String(self.checker_command)

2088

2124

self.checker_command = str(value)

2089

2125

2090

2126

# CheckerRunning - property

2091

2127

@dbus_service_property(_interface,

2092

2128

signature="b",

2098

2134

self.start_checker()

2099

2135

else:

2100

2136

self.stop_checker()

2101

2137

2102

2138

# ObjectPath - property

2103

2139

@dbus_annotations(

2104

2140

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2105

2141

"org.freedesktop.DBus.Deprecated": "true"})

2106

2142

@dbus_service_property(_interface, signature="o", access="read")

2107

2143

def ObjectPath_dbus_property(self):

2108

return self.dbus_object_path # is already a dbus.ObjectPath

2109

2144

return self.dbus_object_path # is already a dbus.ObjectPath

2145

2110

2146

# Secret = property

2111

2147

@dbus_annotations(

2112

2148

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2117

2153

byte_arrays=True)

2118

2154

def Secret_dbus_property(self, value):

2119

2155

self.secret = bytes(value)

2120

2156

2121

2157

del _interface

2122

2158

2123

2159

2127

2163

self._pipe.send(('init', fpr, address))

2128

2164

if not self._pipe.recv():

2129

2165

raise KeyError(fpr)

2130

2166

2131

2167

def __getattribute__(self, name):

2132

2168

if name == '_pipe':

2133

2169

return super(ProxyClient, self).__getattribute__(name)

2136

2172

if data[0] == 'data':

2137

2173

return data[1]

2138

2174

if data[0] == 'function':

2139

2175

2140

2176

def func(*args, **kwargs):

2141

2177

self._pipe.send(('funcall', name, args, kwargs))

2142

2178

return self._pipe.recv()[1]

2143

2179

2144

2180

return func

2145

2181

2146

2182

def __setattr__(self, name, value):

2147

2183

if name == '_pipe':

2148

2184

return super(ProxyClient, self).__setattr__(name, value)

2151

2187

2152

2188

class ClientHandler(socketserver.BaseRequestHandler, object):

2153

2189

"""A class to handle client connections.

2154

2190

2155

2191

Instantiated once for each connection to handle it.

2156

2192

Note: This will run in its own forked process."""

2157

2193

2158

2194

def handle(self):

2159

2195

with contextlib.closing(self.server.child_pipe) as child_pipe:

2160

2196

logger.info("TCP connection from: %s",

2161

2197

str(self.client_address))

2162

2198

logger.debug("Pipe FD: %d",

2163

2199

self.server.child_pipe.fileno())

2164

2200

2165

2201

session = gnutls.ClientSession(self.request)

2166

2167

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

2168

# "+AES-256-CBC", "+SHA1",

2169

# "+COMP-NULL", "+CTYPE-OPENPGP",

2170

# "+DHE-DSS"))

2202

2203

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2204

# "+AES-256-CBC", "+SHA1",

2205

# "+COMP-NULL", "+CTYPE-OPENPGP",

2206

# "+DHE-DSS"))

2171

2207

# Use a fallback default, since this MUST be set.

2172

2208

priority = self.server.gnutls_priority

2173

2209

if priority is None:

2174

2210

priority = "NORMAL"

2175

gnutls.priority_set_direct(session._c_object, priority,

2211

gnutls.priority_set_direct(session._c_object,

2212

priority.encode("utf-8"),

2176

2213

None)

2177

2214

2178

2215

# Start communication using the Mandos protocol

2179

2216

# Get protocol number

2180

2217

line = self.request.makefile().readline()

2185

2222

except (ValueError, IndexError, RuntimeError) as error:

2186

2223

logger.error("Unknown protocol version: %s", error)

2187

2224

return

2188

2225

2189

2226

# Start GnuTLS connection

2190

2227

try:

2191

2228

session.handshake()

2195

2232

# established. Just abandon the request.

2196

2233

return

2197

2234

logger.debug("Handshake succeeded")

2198

2235

2199

2236

approval_required = False

2200

2237

try:

2201

2238

try:

2205

2242

logger.warning("Bad certificate: %s", error)

2206

2243

return

2207

2244

logger.debug("Fingerprint: %s", fpr)

2208

2245

2209

2246

try:

2210

2247

client = ProxyClient(child_pipe, fpr,

2211

2248

self.client_address)

2212

2249

except KeyError:

2213

2250

return

2214

2251

2215

2252

if client.approval_delay:

2216

2253

delay = client.approval_delay

2217

2254

client.approvals_pending += 1

2218

2255

approval_required = True

2219

2256

2220

2257

while True:

2221

2258

if not client.enabled:

2222

2259

logger.info("Client %s is disabled",

2225

2262

# Emit D-Bus signal

2226

2263

client.Rejected("Disabled")

2227

2264

return

2228

2265

2229

2266

if client.approved or not client.approval_delay:

2230

#We are approved or approval is disabled

2267

# We are approved or approval is disabled

2231

2268

break

2232

2269

elif client.approved is None:

2233

2270

logger.info("Client %s needs approval",

2244

2281

# Emit D-Bus signal

2245

2282

client.Rejected("Denied")

2246

2283

return

2247

2248

#wait until timeout or approved

2284

2285

# wait until timeout or approved

2249

2286

time = datetime.datetime.now()

2250

2287

client.changedstate.acquire()

2251

2288

client.changedstate.wait(delay.total_seconds())

2264

2301

break

2265

2302

else:

2266

2303

delay -= time2 - time

2267

2304

2268

2305

try:

2269

2306

session.send(client.secret)

2270

2307

except gnutls.Error as error:

2271

2308

logger.warning("gnutls send failed",

2272

exc_info = error)

2309

exc_info=error)

2273

2310

return

2274

2311

2275

2312

logger.info("Sending secret to %s", client.name)

2276

2313

# bump the timeout using extended_timeout

2277

2314

client.bump_timeout(client.extended_timeout)

2278

2315

if self.server.use_dbus:

2279

2316

# Emit D-Bus signal

2280

2317

client.GotSecret()

2281

2318

2282

2319

finally:

2283

2320

if approval_required:

2284

2321

client.approvals_pending -= 1

2287

2324

except gnutls.Error as error:

2288

2325

logger.warning("GnuTLS bye failed",

2289

2326

exc_info=error)

2290

2327

2291

2328

@staticmethod

2292

2329

def peer_certificate(session):

2293

2330

"Return the peer's OpenPGP certificate as a bytestring"

2305

2342

return None

2306

2343

cert = cert_list[0]

2307

2344

return ctypes.string_at(cert.data, cert.size)

2308

2345

2309

2346

@staticmethod

2310

2347

def fingerprint(openpgp):

2311

2348

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2344

2381

2345

2382

class MultiprocessingMixIn(object):

2346

2383

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2347

2384

2348

2385

def sub_process_main(self, request, address):

2349

2386

try:

2350

2387

self.finish_request(request, address)

2351

2388

except Exception:

2352

2389

self.handle_error(request, address)

2353

2390

self.close_request(request)

2354

2391

2355

2392

def process_request(self, request, address):

2356

2393

"""Start a new process to process the request."""

2357

proc = multiprocessing.Process(target = self.sub_process_main,

2358

args = (request, address))

2394

proc = multiprocessing.Process(target=self.sub_process_main,

2395

args=(request, address))

2359

2396

proc.start()

2360

2397

return proc

2361

2398

2362

2399

2363

2400

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2364

2401

""" adds a pipe to the MixIn """

2365

2402

2366

2403

def process_request(self, request, client_address):

2367

2404

"""Overrides and wraps the original process_request().

2368

2405

2369

2406

This function creates a new pipe in self.pipe

2370

2407

"""

2371

2408

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2372

2409

2373

2410

proc = MultiprocessingMixIn.process_request(self, request,

2374

2411

client_address)

2375

2412

self.child_pipe.close()

2376

2413

self.add_pipe(parent_pipe, proc)

2377

2414

2378

2415

def add_pipe(self, parent_pipe, proc):

2379

2416

"""Dummy function; override as necessary"""

2380

2417

raise NotImplementedError()

2383

2420

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2384

2421

socketserver.TCPServer, object):

2385

2422

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2386

2423

2387

2424

Attributes:

2388

2425

enabled: Boolean; whether this server is activated yet

2389

2426

interface: None or a network interface name (string)

2390

2427

use_ipv6: Boolean; to use IPv6 or not

2391

2428

"""

2392

2429

2393

2430

def __init__(self, server_address, RequestHandlerClass,

2394

2431

interface=None,

2395

2432

use_ipv6=True,

2405

2442

self.socketfd = socketfd

2406

2443

# Save the original socket.socket() function

2407

2444

self.socket_socket = socket.socket

2445

2408

2446

# To implement --socket, we monkey patch socket.socket.

2409

#

2447

#

2410

2448

# (When socketserver.TCPServer is a new-style class, we

2411

2449

# could make self.socket into a property instead of monkey

2412

2450

# patching socket.socket.)

2413

#

2451

#

2414

2452

# Create a one-time-only replacement for socket.socket()

2415

2453

@functools.wraps(socket.socket)

2416

2454

def socket_wrapper(*args, **kwargs):

2428

2466

# socket_wrapper(), if socketfd was set.

2429

2467

socketserver.TCPServer.__init__(self, server_address,

2430

2468

RequestHandlerClass)

2431

2469

2432

2470

def server_bind(self):

2433

2471

"""This overrides the normal server_bind() function

2434

2472

to bind to an interface if one was specified, and also NOT to

2435

2473

bind to an address or port if they were not specified."""

2474

global SO_BINDTODEVICE

2436

2475

if self.interface is not None:

2437

2476

if SO_BINDTODEVICE is None:

2438

logger.error("SO_BINDTODEVICE does not exist;"

2439

" cannot bind to interface %s",

2440

self.interface)

2441

else:

2442

try:

2443

self.socket.setsockopt(

2444

socket.SOL_SOCKET, SO_BINDTODEVICE,

2445

(self.interface + "\0").encode("utf-8"))

2446

except socket.error as error:

2447

if error.errno == errno.EPERM:

2448

logger.error("No permission to bind to"

2449

" interface %s", self.interface)

2450

elif error.errno == errno.ENOPROTOOPT:

2451

logger.error("SO_BINDTODEVICE not available;"

2452

" cannot bind to interface %s",

2453

self.interface)

2454

elif error.errno == errno.ENODEV:

2455

logger.error("Interface %s does not exist,"

2456

" cannot bind", self.interface)

2457

else:

2458

raise

2477

# Fall back to a hard-coded value which seems to be

2478

# common enough.

2479

logger.warning("SO_BINDTODEVICE not found, trying 25")

2480

SO_BINDTODEVICE = 25

2481

try:

2482

self.socket.setsockopt(

2483

socket.SOL_SOCKET, SO_BINDTODEVICE,

2484

(self.interface + "\0").encode("utf-8"))

2485

except socket.error as error:

2486

if error.errno == errno.EPERM:

2487

logger.error("No permission to bind to"

2488

" interface %s", self.interface)

2489

elif error.errno == errno.ENOPROTOOPT:

2490

logger.error("SO_BINDTODEVICE not available;"

2491

" cannot bind to interface %s",

2492

self.interface)

2493

elif error.errno == errno.ENODEV:

2494

logger.error("Interface %s does not exist,"

2495

" cannot bind", self.interface)

2496

else:

2497

raise

2459

2498

# Only bind(2) the socket if we really need to.

2460

2499

if self.server_address[0] or self.server_address[1]:

2461

2500

if not self.server_address[0]:

2462

2501

if self.address_family == socket.AF_INET6:

2463

any_address = "::" # in6addr_any

2502

any_address = "::" # in6addr_any

2464

2503

else:

2465

any_address = "0.0.0.0" # INADDR_ANY

2504

any_address = "0.0.0.0" # INADDR_ANY

2466

2505

self.server_address = (any_address,

2467

2506

self.server_address[1])

2468

2507

elif not self.server_address[1]:

2478

2517

2479

2518

class MandosServer(IPv6_TCPServer):

2480

2519

"""Mandos server.

2481

2520

2482

2521

Attributes:

2483

2522

clients: set of Client objects

2484

2523

gnutls_priority GnuTLS priority string

2485

2524

use_dbus: Boolean; to emit D-Bus signals or not

2486

2525

2487

2526

Assumes a GLib.MainLoop event loop.

2488

2527

"""

2489

2528

2490

2529

def __init__(self, server_address, RequestHandlerClass,

2491

2530

interface=None,

2492

2531

use_ipv6=True,

2502

2541

self.gnutls_priority = gnutls_priority

2503

2542

IPv6_TCPServer.__init__(self, server_address,

2504

2543

RequestHandlerClass,

2505

interface = interface,

2506

use_ipv6 = use_ipv6,

2507

socketfd = socketfd)

2508

2544

interface=interface,

2545

use_ipv6=use_ipv6,

2546

socketfd=socketfd)

2547

2509

2548

def server_activate(self):

2510

2549

if self.enabled:

2511

2550

return socketserver.TCPServer.server_activate(self)

2512

2551

2513

2552

def enable(self):

2514

2553

self.enabled = True

2515

2554

2516

2555

def add_pipe(self, parent_pipe, proc):

2517

2556

# Call "handle_ipc" for both data and EOF events

2518

2557

GLib.io_add_watch(

2519

2558

parent_pipe.fileno(),

2520

2559

GLib.IO_IN | GLib.IO_HUP,

2521

2560

functools.partial(self.handle_ipc,

2522

parent_pipe = parent_pipe,

2523

proc = proc))

2524

2561

parent_pipe=parent_pipe,

2562

proc=proc))

2563

2525

2564

def handle_ipc(self, source, condition,

2526

2565

parent_pipe=None,

2527

proc = None,

2566

proc=None,

2528

2567

client_object=None):

2529

2568

# error, or the other end of multiprocessing.Pipe has closed

2530

2569

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2531

2570

# Wait for other process to exit

2532

2571

proc.join()

2533

2572

return False

2534

2573

2535

2574

# Read a request from the child

2536

2575

request = parent_pipe.recv()

2537

2576

command = request[0]

2538

2577

2539

2578

if command == 'init':

2540

2579

fpr = request[1]

2541

2580

address = request[2]

2542

2581

2543

2582

for c in self.clients.values():

2544

2583

if c.fingerprint == fpr:

2545

2584

client = c

2553

2592

address[0])

2554

2593

parent_pipe.send(False)

2555

2594

return False

2556

2595

2557

2596

GLib.io_add_watch(

2558

2597

parent_pipe.fileno(),

2559

2598

GLib.IO_IN | GLib.IO_HUP,

2560

2599

functools.partial(self.handle_ipc,

2561

parent_pipe = parent_pipe,

2562

proc = proc,

2563

client_object = client))

2600

parent_pipe=parent_pipe,

2601

proc=proc,

2602

client_object=client))

2564

2603

parent_pipe.send(True)

2565

2604

# remove the old hook in favor of the new above hook on

2566

2605

# same fileno

2569

2608

funcname = request[1]

2570

2609

args = request[2]

2571

2610

kwargs = request[3]

2572

2611

2573

2612

parent_pipe.send(('data', getattr(client_object,

2574

2613

funcname)(*args,

2575

2614

**kwargs)))

2576

2615

2577

2616

if command == 'getattr':

2578

2617

attrname = request[1]

2579

2618

if isinstance(client_object.__getattribute__(attrname),

2582

2621

else:

2583

2622

parent_pipe.send((

2584

2623

'data', client_object.__getattribute__(attrname)))

2585

2624

2586

2625

if command == 'setattr':

2587

2626

attrname = request[1]

2588

2627

value = request[2]

2589

2628

setattr(client_object, attrname, value)

2590

2629

2591

2630

return True

2592

2631

2593

2632

2594

2633

def rfc3339_duration_to_delta(duration):

2595

2634

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2596

2635

2597

2636

>>> rfc3339_duration_to_delta("P7D")

2598

2637

datetime.timedelta(7)

2599

2638

>>> rfc3339_duration_to_delta("PT60S")

2609

2648

>>> rfc3339_duration_to_delta("P1DT3M20S")

2610

2649

datetime.timedelta(1, 200)

2611

2650

"""

2612

2651

2613

2652

# Parsing an RFC 3339 duration with regular expressions is not

2614

2653

# possible - there would have to be multiple places for the same

2615

2654

# values, like seconds. The current code, while more esoteric, is

2616

2655

# cleaner without depending on a parsing library. If Python had a

2617

2656

# built-in library for parsing we would use it, but we'd like to

2618

2657

# avoid excessive use of external libraries.

2619

2658

2620

2659

# New type for defining tokens, syntax, and semantics all-in-one

2621

2660

Token = collections.namedtuple("Token", (

2622

2661

"regexp", # To match token; if "value" is not None, must have

2655

2694

frozenset((token_year, token_month,

2656

2695

token_day, token_time,

2657

2696

token_week)))

2658

# Define starting values

2659

value = datetime.timedelta() # Value so far

2697

# Define starting values:

2698

# Value so far

2699

value = datetime.timedelta()

2660

2700

found_token = None

2661

followers = frozenset((token_duration, )) # Following valid tokens

2662

s = duration # String left to parse

2701

# Following valid tokens

2702

followers = frozenset((token_duration, ))

2703

# String left to parse

2704

s = duration

2663

2705

# Loop until end token is found

2664

2706

while found_token is not token_end:

2665

2707

# Search for any currently valid tokens

2689

2731

2690

2732

def string_to_delta(interval):

2691

2733

"""Parse a string and return a datetime.timedelta

2692

2734

2693

2735

>>> string_to_delta('7d')

2694

2736

datetime.timedelta(7)

2695

2737

>>> string_to_delta('60s')

2703

2745

>>> string_to_delta('5m 30s')

2704

2746

datetime.timedelta(0, 330)

2705

2747

"""

2706

2748

2707

2749

try:

2708

2750

return rfc3339_duration_to_delta(interval)

2709

2751

except ValueError:

2710

2752

pass

2711

2753

2712

2754

timevalue = datetime.timedelta(0)

2713

2755

for s in interval.split():

2714

2756

try:

2732

2774

return timevalue

2733

2775

2734

2776

2735

def daemon(nochdir = False, noclose = False):

2777

def daemon(nochdir=False, noclose=False):

2736

2778

"""See daemon(3). Standard BSD Unix function.

2737

2779

2738

2780

This should really exist as os.daemon, but it doesn't (yet)."""

2739

2781

if os.fork():

2740

2782

sys.exit()

2758

2800

2759

2801

2760

2802

def main():

2761

2803

2762

2804

##################################################################

2763

2805

# Parsing of options, both command line and config file

2764

2806

2765

2807

parser = argparse.ArgumentParser()

2766

2808

parser.add_argument("-v", "--version", action="version",

2767

version = "%(prog)s {}".format(version),

2809

version="%(prog)s {}".format(version),

2768

2810

help="show version number and exit")

2769

2811

parser.add_argument("-i", "--interface", metavar="IF",

2770

2812

help="Bind to interface IF")

2806

2848

parser.add_argument("--no-zeroconf", action="store_false",

2807

2849

dest="zeroconf", help="Do not use Zeroconf",

2808

2850

default=None)

2809

2851

2810

2852

options = parser.parse_args()

2811

2853

2812

2854

if options.check:

2813

2855

import doctest

2814

2856

fail_count, test_count = doctest.testmod()

2815

2857

sys.exit(os.EX_OK if fail_count == 0 else 1)

2816

2858

2817

2859

# Default values for config file for server-global settings

2818

server_defaults = { "interface": "",

2819

"address": "",

2820

"port": "",

2821

"debug": "False",

2822

"priority":

2823

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2824

":+SIGN-DSA-SHA256",

2825

"servicename": "Mandos",

2826

"use_dbus": "True",

2827

"use_ipv6": "True",

2828

"debuglevel": "",

2829

"restore": "True",

2830

"socket": "",

2831

"statedir": "/var/lib/mandos",

2832

"foreground": "False",

2833

"zeroconf": "True",

2834

}

2835

2860

server_defaults = {"interface": "",

2861

"address": "",

2862

"port": "",

2863

"debug": "False",

2864

"priority":

2865

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2866

":+SIGN-DSA-SHA256",

2867

"servicename": "Mandos",

2868

"use_dbus": "True",

2869

"use_ipv6": "True",

2870

"debuglevel": "",

2871

"restore": "True",

2872

"socket": "",

2873

"statedir": "/var/lib/mandos",

2874

"foreground": "False",

2875

"zeroconf": "True",

2876

}

2877

2836

2878

# Parse config file for server-global settings

2837

2879

server_config = configparser.SafeConfigParser(server_defaults)

2838

2880

del server_defaults

2856

2898

server_settings["socket"] = os.dup(server_settings

2857

2899

["socket"])

2858

2900

del server_config

2859

2901

2860

2902

# Override the settings from the config file with command line

2861

2903

# options, if set.

2862

2904

for option in ("interface", "address", "port", "debug",

2880

2922

if server_settings["debug"]:

2881

2923

server_settings["foreground"] = True

2882

2924

# Now we have our good server settings in "server_settings"

2883

2925

2884

2926

##################################################################

2885

2927

2886

2928

if (not server_settings["zeroconf"]

2887

2929

and not (server_settings["port"]

2888

2930

or server_settings["socket"] != "")):

2889

2931

parser.error("Needs port or socket to work without Zeroconf")

2890

2932

2891

2933

# For convenience

2892

2934

debug = server_settings["debug"]

2893

2935

debuglevel = server_settings["debuglevel"]

2897

2939

stored_state_file)

2898

2940

foreground = server_settings["foreground"]

2899

2941

zeroconf = server_settings["zeroconf"]

2900

2942

2901

2943

if debug:

2902

2944

initlogger(debug, logging.DEBUG)

2903

2945

else:

2906

2948

else:

2907

2949

level = getattr(logging, debuglevel.upper())

2908

2950

initlogger(debug, level)

2909

2951

2910

2952

if server_settings["servicename"] != "Mandos":

2911

2953

syslogger.setFormatter(

2912

2954

logging.Formatter('Mandos ({}) [%(process)d]:'

2913

2955

' %(levelname)s: %(message)s'.format(

2914

2956

server_settings["servicename"])))

2915

2957

2916

2958

# Parse config file with clients

2917

2959

client_config = configparser.SafeConfigParser(Client

2918

2960

.client_defaults)

2919

2961

client_config.read(os.path.join(server_settings["configdir"],

2920

2962

"clients.conf"))

2921

2963

2922

2964

global mandos_dbus_service

2923

2965

mandos_dbus_service = None

2924

2966

2925

2967

socketfd = None

2926

2968

if server_settings["socket"] != "":

2927

2969

socketfd = server_settings["socket"]

2943

2985

except IOError as e:

2944

2986

logger.error("Could not open file %r", pidfilename,

2945

2987

exc_info=e)

2946

2988

2947

2989

for name, group in (("_mandos", "_mandos"),

2948

2990

("mandos", "mandos"),

2949

2991

("nobody", "nogroup")):

2967

3009

.format(uid, gid, os.strerror(error.errno)))

2968

3010

if error.errno != errno.EPERM:

2969

3011

raise

2970

3012

2971

3013

if debug:

2972

3014

# Enable all possible GnuTLS debugging

2973

3015

2974

3016

# "Use a log level over 10 to enable all debugging options."

2975

3017

# - GnuTLS manual

2976

3018

gnutls.global_set_log_level(11)

2977

3019

2978

3020

@gnutls.log_func

2979

3021

def debug_gnutls(level, string):

2980

3022

logger.debug("GnuTLS: %s", string[:-1])

2981

3023

2982

3024

gnutls.global_set_log_function(debug_gnutls)

2983

3025

2984

3026

# Redirect stdin so all checkers get /dev/null

2985

3027

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2986

3028

os.dup2(null, sys.stdin.fileno())

2987

3029

if null > 2:

2988

3030

os.close(null)

2989

3031

2990

3032

# Need to fork before connecting to D-Bus

2991

3033

if not foreground:

2992

3034

# Close all input and output, do double fork, etc.

2993

3035

daemon()

2994

3036

2995

3037

# multiprocessing will use threads, so before we use GLib we need

2996

3038

# to inform GLib that threads will be used.

2997

3039

GLib.threads_init()

2998

3040

2999

3041

global main_loop

3000

3042

# From the Avahi example code

3001

3043

DBusGMainLoop(set_as_default=True)

3018

3060

if zeroconf:

3019

3061

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3020

3062

service = AvahiServiceToSyslog(

3021

name = server_settings["servicename"],

3022

servicetype = "_mandos._tcp",

3023

protocol = protocol,

3024

bus = bus)

3063

name=server_settings["servicename"],

3064

servicetype="_mandos._tcp",

3065

protocol=protocol,

3066

bus=bus)

3025

3067

if server_settings["interface"]:

3026

3068

service.interface = if_nametoindex(

3027

3069

server_settings["interface"].encode("utf-8"))

3028

3070

3029

3071

global multiprocessing_manager

3030

3072

multiprocessing_manager = multiprocessing.Manager()

3031

3073

3032

3074

client_class = Client

3033

3075

if use_dbus:

3034

client_class = functools.partial(ClientDBus, bus = bus)

3035

3076

client_class = functools.partial(ClientDBus, bus=bus)

3077

3036

3078

client_settings = Client.config_parser(client_config)

3037

3079

old_client_settings = {}

3038

3080

clients_data = {}

3039

3081

3040

3082

# This is used to redirect stdout and stderr for checker processes

3041

3083

global wnull

3042

wnull = open(os.devnull, "w") # A writable /dev/null

3084

wnull = open(os.devnull, "w") # A writable /dev/null

3043

3085

# Only used if server is running in foreground but not in debug

3044

3086

# mode

3045

3087

if debug or not foreground:

3046

3088

wnull.close()

3047

3089

3048

3090

# Get client data and settings from last running state.

3049

3091

if server_settings["restore"]:

3050

3092

try:

3051

3093

with open(stored_state_path, "rb") as stored_state:

3052

if sys.version_info.major == 2:

3094

if sys.version_info.major == 2:

3053

3095

clients_data, old_client_settings = pickle.load(

3054

3096

stored_state)

3055

3097

else:

3056

3098

bytes_clients_data, bytes_old_client_settings = (

3057

pickle.load(stored_state, encoding = "bytes"))

3058

### Fix bytes to strings

3059

## clients_data

3099

pickle.load(stored_state, encoding="bytes"))

3100

# Fix bytes to strings

3101

# clients_data

3060

3102

# .keys()

3061

clients_data = { (key.decode("utf-8")

3062

if isinstance(key, bytes)

3063

else key): value

3064

for key, value in

3065

bytes_clients_data.items() }

3103

clients_data = {(key.decode("utf-8")

3104

if isinstance(key, bytes)

3105

else key): value

3106

for key, value in

3107

bytes_clients_data.items()}

3066

3108

del bytes_clients_data

3067

3109

for key in clients_data:

3068

value = { (k.decode("utf-8")

3069

if isinstance(k, bytes) else k): v

3070

for k, v in

3071

clients_data[key].items() }

3110

value = {(k.decode("utf-8")

3111

if isinstance(k, bytes) else k): v

3112

for k, v in

3113

clients_data[key].items()}

3072

3114

clients_data[key] = value

3073

3115

# .client_structure

3074

3116

value["client_structure"] = [

3075

3117

(s.decode("utf-8")

3076

3118

if isinstance(s, bytes)

3077

3119

else s) for s in

3078

value["client_structure"] ]

3120

value["client_structure"]]

3079

3121

# .name & .host

3080

3122

for k in ("name", "host"):

3081

3123

if isinstance(value[k], bytes):

3082

3124

value[k] = value[k].decode("utf-8")

3083

## old_client_settings

3125

# old_client_settings

3084

3126

# .keys()

3085

3127

old_client_settings = {

3086

3128

(key.decode("utf-8")

3087

3129

if isinstance(key, bytes)

3088

3130

else key): value

3089

3131

for key, value in

3090

bytes_old_client_settings.items() }

3132

bytes_old_client_settings.items()}

3091

3133

del bytes_old_client_settings

3092

3134

# .host

3093

3135

for value in old_client_settings.values():

3107

3149

logger.warning("Could not load persistent state: "

3108

3150

"EOFError:",

3109

3151

exc_info=e)

3110

3152

3111

3153

with PGPEngine() as pgp:

3112

3154

for client_name, client in clients_data.items():

3113

3155

# Skip removed clients

3114

3156

if client_name not in client_settings:

3115

3157

continue

3116

3158

3117

3159

# Decide which value to use after restoring saved state.

3118

3160

# We have three different values: Old config file,

3119

3161

# new config file, and saved state.

3130

3172

client[name] = value

3131

3173

except KeyError:

3132

3174

pass

3133

3175

3134

3176

# Clients who has passed its expire date can still be

3135

3177

# enabled if its last checker was successful. A Client

3136

3178

# whose checker succeeded before we stored its state is

3169

3211

client_name))

3170

3212

client["secret"] = (client_settings[client_name]

3171

3213

["secret"])

3172

3214

3173

3215

# Add/remove clients based on new changes made to config

3174

3216

for client_name in (set(old_client_settings)

3175

3217

- set(client_settings)):

3177

3219

for client_name in (set(client_settings)

3178

3220

- set(old_client_settings)):

3179

3221

clients_data[client_name] = client_settings[client_name]

3180

3222

3181

3223

# Create all client objects

3182

3224

for client_name, client in clients_data.items():

3183

3225

tcp_server.clients[client_name] = client_class(

3184

name = client_name,

3185

settings = client,

3186

server_settings = server_settings)

3187

3226

name=client_name,

3227

settings=client,

3228

server_settings=server_settings)

3229

3188

3230

if not tcp_server.clients:

3189

3231

logger.warning("No clients defined")

3190

3232

3191

3233

if not foreground:

3192

3234

if pidfile is not None:

3193

3235

pid = os.getpid()

3199

3241

pidfilename, pid)

3200

3242

del pidfile

3201

3243

del pidfilename

3202

3244

3203

3245

for termsig in (signal.SIGHUP, signal.SIGTERM):

3204

3246

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3205

3247

lambda: main_loop.quit() and False)

3206

3248

3207

3249

if use_dbus:

3208

3250

3209

3251

@alternate_dbus_interfaces(

3210

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3252

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3211

3253

class MandosDBusService(DBusObjectWithObjectManager):

3212

3254

"""A D-Bus proxy object"""

3213

3255

3214

3256

def __init__(self):

3215

3257

dbus.service.Object.__init__(self, bus, "/")

3216

3258

3217

3259

_interface = "se.recompile.Mandos"

3218

3260

3219

3261

@dbus.service.signal(_interface, signature="o")

3220

3262

def ClientAdded(self, objpath):

3221

3263

"D-Bus signal"

3222

3264

pass

3223

3265

3224

3266

@dbus.service.signal(_interface, signature="ss")

3225

3267

def ClientNotFound(self, fingerprint, address):

3226

3268

"D-Bus signal"

3227

3269

pass

3228

3270

3229

3271

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3230

3272

"true"})

3231

3273

@dbus.service.signal(_interface, signature="os")

3232

3274

def ClientRemoved(self, objpath, name):

3233

3275

"D-Bus signal"

3234

3276

pass

3235

3277

3236

3278

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3237

3279

"true"})

3238

3280

@dbus.service.method(_interface, out_signature="ao")

3240

3282

"D-Bus method"

3241

3283

return dbus.Array(c.dbus_object_path for c in

3242

3284

tcp_server.clients.values())

3243

3285

3244

3286

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3245

3287

"true"})

3246

3288

@dbus.service.method(_interface,

3248

3290

def GetAllClientsWithProperties(self):

3249

3291

"D-Bus method"

3250

3292

return dbus.Dictionary(

3251

{ c.dbus_object_path: c.GetAll(

3293

{c.dbus_object_path: c.GetAll(

3252

3294

"se.recompile.Mandos.Client")

3253

for c in tcp_server.clients.values() },

3295

for c in tcp_server.clients.values()},

3254

3296

signature="oa{sv}")

3255

3297

3256

3298

@dbus.service.method(_interface, in_signature="o")

3257

3299

def RemoveClient(self, object_path):

3258

3300

"D-Bus method"

3266

3308

self.client_removed_signal(c)

3267

3309

return

3268

3310

raise KeyError(object_path)

3269

3311

3270

3312

del _interface

3271

3313

3272

3314

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3273

out_signature = "a{oa{sa{sv}}}")

3315

out_signature="a{oa{sa{sv}}}")

3274

3316

def GetManagedObjects(self):

3275

3317

"""D-Bus method"""

3276

3318

return dbus.Dictionary(

3277

{ client.dbus_object_path:

3278

dbus.Dictionary(

3279

{ interface: client.GetAll(interface)

3280

for interface in

3281

client._get_all_interface_names()})

3282

for client in tcp_server.clients.values()})

3283

3319

{client.dbus_object_path:

3320

dbus.Dictionary(

3321

{interface: client.GetAll(interface)

3322

for interface in

3323

client._get_all_interface_names()})

3324

for client in tcp_server.clients.values()})

3325

3284

3326

def client_added_signal(self, client):

3285

3327

"""Send the new standard signal and the old signal"""

3286

3328

if use_dbus:

3288

3330

self.InterfacesAdded(

3289

3331

client.dbus_object_path,

3290

3332

dbus.Dictionary(

3291

{ interface: client.GetAll(interface)

3292

for interface in

3293

client._get_all_interface_names()}))

3333

{interface: client.GetAll(interface)

3334

for interface in

3335

client._get_all_interface_names()}))

3294

3336

# Old signal

3295

3337

self.ClientAdded(client.dbus_object_path)

3296

3338

3297

3339

def client_removed_signal(self, client):

3298

3340

"""Send the new standard signal and the old signal"""

3299

3341

if use_dbus:

3304

3346

# Old signal

3305

3347

self.ClientRemoved(client.dbus_object_path,

3306

3348

client.name)

3307

3349

3308

3350

mandos_dbus_service = MandosDBusService()

3309

3351

3352

# Save modules to variables to exempt the modules from being

3353

# unloaded before the function registered with atexit() is run.

3354

mp = multiprocessing

3355

wn = wnull

3356

3310

3357

def cleanup():

3311

3358

"Cleanup function; run on exit"

3312

3359

if zeroconf:

3313

3360

service.cleanup()

3314

3315

multiprocessing.active_children()

3316

wnull.close()

3361

3362

mp.active_children()

3363

wn.close()

3317

3364

if not (tcp_server.clients or client_settings):

3318

3365

return

3319

3366

3320

3367

# Store client before exiting. Secrets are encrypted with key

3321

3368

# based on what config file has. If config file is

3322

3369

# removed/edited, old secret will thus be unrecovable.

3327

3374

client.encrypted_secret = pgp.encrypt(client.secret,

3328

3375

key)

3329

3376

client_dict = {}

3330

3377

3331

3378

# A list of attributes that can not be pickled

3332

3379

# + secret.

3333

exclude = { "bus", "changedstate", "secret",

3334

"checker", "server_settings" }

3380

exclude = {"bus", "changedstate", "secret",

3381

"checker", "server_settings"}

3335

3382

for name, typ in inspect.getmembers(dbus.service

3336

3383

.Object):

3337

3384

exclude.add(name)

3338

3385

3339

3386

client_dict["encrypted_secret"] = (client

3340

3387

.encrypted_secret)

3341

3388

for attr in client.client_structure:

3342

3389

if attr not in exclude:

3343

3390

client_dict[attr] = getattr(client, attr)

3344

3391

3345

3392

clients[client.name] = client_dict

3346

3393

del client_settings[client.name]["secret"]

3347

3394

3348

3395

try:

3349

3396

with tempfile.NamedTemporaryFile(

3350

3397

mode='wb',

3353

3400

dir=os.path.dirname(stored_state_path),

3354

3401

delete=False) as stored_state:

3355

3402

pickle.dump((clients, client_settings), stored_state,

3356

protocol = 2)

3403

protocol=2)

3357

3404

tempname = stored_state.name

3358

3405

os.rename(tempname, stored_state_path)

3359

3406

except (IOError, OSError) as e:

3369

3416

logger.warning("Could not save persistent state:",

3370

3417

exc_info=e)

3371

3418

raise

3372

3419

3373

3420

# Delete all clients, and settings from config

3374

3421

while tcp_server.clients:

3375

3422

name, client = tcp_server.clients.popitem()

3381

3428

if use_dbus:

3382

3429

mandos_dbus_service.client_removed_signal(client)

3383

3430

client_settings.clear()

3384

3431

3385

3432

atexit.register(cleanup)

3386

3433

3387

3434

for client in tcp_server.clients.values():

3388

3435

if use_dbus:

3389

3436

# Emit D-Bus signal for adding

3391

3438

# Need to initiate checking of clients

3392

3439

if client.enabled:

3393

3440

client.init_checker()

3394

3441

3395

3442

tcp_server.enable()

3396

3443

tcp_server.server_activate()

3397

3444

3398

3445

# Find out what port we got

3399

3446

if zeroconf:

3400

3447

service.port = tcp_server.socket.getsockname()[1]

3405

3452

else: # IPv4

3406

3453

logger.info("Now listening on address %r, port %d",

3407

3454

*tcp_server.socket.getsockname())

3408

3409

#service.interface = tcp_server.socket.getsockname()[3]

3410

3455

3456

# service.interface = tcp_server.socket.getsockname()[3]

3457

3411

3458

try:

3412

3459

if zeroconf:

3413

3460

# From the Avahi example code

3418

3465

cleanup()

3419

3466

sys.exit(1)

3420

3467

# End of Avahi example code

3421

3468

3422

3469

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3423

3470

lambda *args, **kwargs:

3424

3471

(tcp_server.handle_request

3425

3472

(*args[2:], **kwargs) or True))

3426

3473

3427

3474

logger.debug("Starting main loop")

3428

3475

main_loop.run()

3429

3476

except AvahiError as error: