/mandos/release : revision 237.7.475

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

19

21

# the Free Software Foundation, either version 3 of the License, or

20

22

# (at your option) any later version.

21

23

#

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

24

26

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

25

27

# GNU General Public License for more details.

26

#

28

#

27

29

# You should have received a copy of the GNU General Public License

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

31

32

# Contact the authors at <mandos@recompile.se>.

32

#

33

#

33

34

35

from __future__ import (division, absolute_import, print_function,

35

36

unicode_literals)

86

87

import xml.dom.minidom

87

88

import inspect

88

89

90

# Try to find the value of SO_BINDTODEVICE:

89

91

try:

92

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

93

# newer, and it is also the most natural place for it:

90

94

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

91

95

except AttributeError:

92

96

try:

97

# This is where SO_BINDTODEVICE was up to and including Python

98

# 2.6, and also 3.2:

93

99

from IN import SO_BINDTODEVICE

94

100

except ImportError:

95

SO_BINDTODEVICE = None

101

# In Python 2.7 it seems to have been removed entirely.

102

# Try running the C preprocessor:

103

try:

104

cc = subprocess.Popen(["cc", "--language=c", "-E",

105

"/dev/stdin"],

106

stdin=subprocess.PIPE,

107

stdout=subprocess.PIPE)

108

stdout = cc.communicate(

109

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

110

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

111

except (OSError, ValueError, IndexError):

112

# No value found

113

SO_BINDTODEVICE = None

96

114

97

115

if sys.version_info.major == 2:

98

116

str = unicode

99

117

100

version = "1.7.6"

118

version = "1.7.16"

101

119

stored_state_file = "clients.pickle"

102

120

103

121

logger = logging.getLogger()

107

125

if_nametoindex = ctypes.cdll.LoadLibrary(

108

126

ctypes.util.find_library("c")).if_nametoindex

109

127

except (OSError, AttributeError):

110

128

111

129

def if_nametoindex(interface):

112

130

"Get an interface index the hard way, i.e. using fcntl()"

113

131

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

136

154

137

155

def initlogger(debug, level=logging.WARNING):

138

156

"""init logger and add loglevel"""

139

157

140

158

global syslogger

141

159

syslogger = (logging.handlers.SysLogHandler(

142

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

143

address = "/dev/log"))

160

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

161

address="/dev/log"))

144

162

syslogger.setFormatter(logging.Formatter

145

163

('Mandos [%(process)d]: %(levelname)s:'

146

164

' %(message)s'))

147

165

logger.addHandler(syslogger)

148

166

149

167

if debug:

150

168

console = logging.StreamHandler()

151

169

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

163

181

164

182

class PGPEngine(object):

165

183

"""A simple class for OpenPGP symmetric encryption & decryption"""

166

184

167

185

def __init__(self):

168

186

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

169

187

self.gpg = "gpg"

180

198

self.gnupgargs = ['--batch',

181

199

'--homedir', self.tempdir,

182

200

'--force-mdc',

183

'--quiet',

184

'--no-use-agent']

185

201

'--quiet']

202

# Only GPG version 1 has the --no-use-agent option.

203

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

204

self.gnupgargs.append("--no-use-agent")

205

186

206

def __enter__(self):

187

207

return self

188

208

189

209

def __exit__(self, exc_type, exc_value, traceback):

190

210

self._cleanup()

191

211

return False

192

212

193

213

def __del__(self):

194

214

self._cleanup()

195

215

196

216

def _cleanup(self):

197

217

if self.tempdir is not None:

198

218

# Delete contents of tempdir

199

219

for root, dirs, files in os.walk(self.tempdir,

200

topdown = False):

220

topdown=False):

201

221

for filename in files:

202

222

os.remove(os.path.join(root, filename))

203

223

for dirname in dirs:

205

225

# Remove tempdir

206

226

os.rmdir(self.tempdir)

207

227

self.tempdir = None

208

228

209

229

def password_encode(self, password):

210

230

# Passphrase can not be empty and can not contain newlines or

211

231

# NUL bytes. So we prefix it and hex encode it.

216

236

.replace(b"\n", b"\\n")

217

237

.replace(b"\0", b"\\x00"))

218

238

return encoded

219

239

220

240

def encrypt(self, data, password):

221

241

passphrase = self.password_encode(password)

222

242

with tempfile.NamedTemporaryFile(

227

247

'--passphrase-file',

228

248

passfile.name]

229

249

+ self.gnupgargs,

230

stdin = subprocess.PIPE,

231

stdout = subprocess.PIPE,

232

stderr = subprocess.PIPE)

233

ciphertext, err = proc.communicate(input = data)

250

stdin=subprocess.PIPE,

251

stdout=subprocess.PIPE,

252

stderr=subprocess.PIPE)

253

ciphertext, err = proc.communicate(input=data)

234

254

if proc.returncode != 0:

235

255

raise PGPError(err)

236

256

return ciphertext

237

257

238

258

def decrypt(self, data, password):

239

259

passphrase = self.password_encode(password)

240

260

with tempfile.NamedTemporaryFile(

241

dir = self.tempdir) as passfile:

261

dir=self.tempdir) as passfile:

242

262

passfile.write(passphrase)

243

263

passfile.flush()

244

264

proc = subprocess.Popen([self.gpg, '--decrypt',

245

265

'--passphrase-file',

246

266

passfile.name]

247

267

+ self.gnupgargs,

248

stdin = subprocess.PIPE,

249

stdout = subprocess.PIPE,

250

stderr = subprocess.PIPE)

251

decrypted_plaintext, err = proc.communicate(input = data)

268

stdin=subprocess.PIPE,

269

stdout=subprocess.PIPE,

270

stderr=subprocess.PIPE)

271

decrypted_plaintext, err = proc.communicate(input=data)

252

272

if proc.returncode != 0:

253

273

raise PGPError(err)

254

274

return decrypted_plaintext

255

275

276

256

277

# Pretend that we have an Avahi module

257

278

class Avahi(object):

258

279

"""This isn't so much a class as it is a module-like namespace.

259

280

It is instantiated once, and simulates having an Avahi module."""

260

IF_UNSPEC = -1 # avahi-common/address.h

261

PROTO_UNSPEC = -1 # avahi-common/address.h

262

PROTO_INET = 0 # avahi-common/address.h

263

PROTO_INET6 = 1 # avahi-common/address.h

281

IF_UNSPEC = -1 # avahi-common/address.h

282

PROTO_UNSPEC = -1 # avahi-common/address.h

283

PROTO_INET = 0 # avahi-common/address.h

284

PROTO_INET6 = 1 # avahi-common/address.h

264

285

DBUS_NAME = "org.freedesktop.Avahi"

265

286

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

266

287

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

267

288

DBUS_PATH_SERVER = "/"

289

268

290

def string_array_to_txt_array(self, t):

269

291

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

270

292

for s in t), signature="ay")

271

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

272

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

273

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

274

SERVER_INVALID = 0 # avahi-common/defs.h

275

SERVER_REGISTERING = 1 # avahi-common/defs.h

276

SERVER_RUNNING = 2 # avahi-common/defs.h

277

SERVER_COLLISION = 3 # avahi-common/defs.h

278

SERVER_FAILURE = 4 # avahi-common/defs.h

293

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

294

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

295

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

296

SERVER_INVALID = 0 # avahi-common/defs.h

297

SERVER_REGISTERING = 1 # avahi-common/defs.h

298

SERVER_RUNNING = 2 # avahi-common/defs.h

299

SERVER_COLLISION = 3 # avahi-common/defs.h

300

SERVER_FAILURE = 4 # avahi-common/defs.h

279

301

avahi = Avahi()

280

302

303

281

304

class AvahiError(Exception):

282

305

def __init__(self, value, *args, **kwargs):

283

306

self.value = value

295

318

296

319

class AvahiService(object):

297

320

"""An Avahi (Zeroconf) service.

298

321

299

322

Attributes:

300

323

interface: integer; avahi.IF_UNSPEC or an interface index.

301

324

Used to optionally bind to the specified interface.

313

336

server: D-Bus Server

314

337

bus: dbus.SystemBus()

315

338

"""

316

339

317

340

def __init__(self,

318

interface = avahi.IF_UNSPEC,

319

name = None,

320

servicetype = None,

321

port = None,

322

TXT = None,

323

domain = "",

324

host = "",

325

max_renames = 32768,

326

protocol = avahi.PROTO_UNSPEC,

327

bus = None):

341

interface=avahi.IF_UNSPEC,

342

name=None,

343

servicetype=None,

344

port=None,

345

TXT=None,

346

domain="",

347

host="",

348

max_renames=32768,

349

protocol=avahi.PROTO_UNSPEC,

350

bus=None):

328

351

self.interface = interface

329

352

self.name = name

330

353

self.type = servicetype

339

362

self.server = None

340

363

self.bus = bus

341

364

self.entry_group_state_changed_match = None

342

365

343

366

def rename(self, remove=True):

344

367

"""Derived from the Avahi example code"""

345

368

if self.rename_count >= self.max_renames:

365

388

logger.critical("D-Bus Exception", exc_info=error)

366

389

self.cleanup()

367

390

os._exit(1)

368

391

369

392

def remove(self):

370

393

"""Derived from the Avahi example code"""

371

394

if self.entry_group_state_changed_match is not None:

373

396

self.entry_group_state_changed_match = None

374

397

if self.group is not None:

375

398

self.group.Reset()

376

399

377

400

def add(self):

378

401

"""Derived from the Avahi example code"""

379

402

self.remove()

396

419

dbus.UInt16(self.port),

397

420

avahi.string_array_to_txt_array(self.TXT))

398

421

self.group.Commit()

399

422

400

423

def entry_group_state_changed(self, state, error):

401

424

"""Derived from the Avahi example code"""

402

425

logger.debug("Avahi entry group state change: %i", state)

403

426

404

427

if state == avahi.ENTRY_GROUP_ESTABLISHED:

405

428

logger.debug("Zeroconf service established.")

406

429

elif state == avahi.ENTRY_GROUP_COLLISION:

410

433

logger.critical("Avahi: Error in group state changed %s",

411

434

str(error))

412

435

raise AvahiGroupError("State changed: {!s}".format(error))

413

436

414

437

def cleanup(self):

415

438

"""Derived from the Avahi example code"""

416

439

if self.group is not None:

421

444

pass

422

445

self.group = None

423

446

self.remove()

424

447

425

448

def server_state_changed(self, state, error=None):

426

449

"""Derived from the Avahi example code"""

427

450

logger.debug("Avahi server state change: %i", state)

456

479

logger.debug("Unknown state: %r", state)

457

480

else:

458

481

logger.debug("Unknown state: %r: %r", state, error)

459

482

460

483

def activate(self):

461

484

"""Derived from the Avahi example code"""

462

485

if self.server is None:

473

496

class AvahiServiceToSyslog(AvahiService):

474

497

def rename(self, *args, **kwargs):

475

498

"""Add the new name to the syslog messages"""

476

ret = AvahiService.rename(self, *args, **kwargs)

499

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

477

500

syslogger.setFormatter(logging.Formatter(

478

501

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

479

502

.format(self.name)))

480

503

return ret

481

504

505

482

506

# Pretend that we have a GnuTLS module

483

507

class GnuTLS(object):

484

508

"""This isn't so much a class as it is a module-like namespace.

485

509

It is instantiated once, and simulates having a GnuTLS module."""

486

487

_library = ctypes.cdll.LoadLibrary(

488

ctypes.util.find_library("gnutls"))

510

511

library = ctypes.util.find_library("gnutls")

512

if library is None:

513

library = ctypes.util.find_library("gnutls-deb0")

514

_library = ctypes.cdll.LoadLibrary(library)

515

del library

489

516

_need_version = b"3.3.0"

517

490

518

def __init__(self):

491

# Need to use class name "GnuTLS" here, since this method is

492

# called before the assignment to the "gnutls" global variable

493

# happens.

494

if GnuTLS.check_version(self._need_version) is None:

495

raise GnuTLS.Error("Needs GnuTLS {} or later"

496

.format(self._need_version))

497

519

# Need to use "self" here, since this method is called before

520

# the assignment to the "gnutls" global variable happens.

521

if self.check_version(self._need_version) is None:

522

raise self.Error("Needs GnuTLS {} or later"

523

.format(self._need_version))

524

498

525

# Unless otherwise indicated, the constants and types below are

499

526

# all from the gnutls/gnutls.h C header file.

500

527

501

528

# Constants

502

529

E_SUCCESS = 0

503

530

E_INTERRUPTED = -52

508

535

CRD_CERTIFICATE = 1

509

536

E_NO_CERTIFICATE_FOUND = -49

510

537

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

511

538

512

539

# Types

513

540

class session_int(ctypes.Structure):

514

541

_fields_ = []

515

542

session_t = ctypes.POINTER(session_int)

543

516

544

class certificate_credentials_st(ctypes.Structure):

517

545

_fields_ = []

518

546

certificate_credentials_t = ctypes.POINTER(

519

547

certificate_credentials_st)

520

548

certificate_type_t = ctypes.c_int

549

521

550

class datum_t(ctypes.Structure):

522

551

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

523

552

('size', ctypes.c_uint)]

553

524

554

class openpgp_crt_int(ctypes.Structure):

525

555

_fields_ = []

526

556

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

527

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

557

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

528

558

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

529

559

credentials_type_t = ctypes.c_int

530

560

transport_ptr_t = ctypes.c_void_p

531

561

close_request_t = ctypes.c_int

532

562

533

563

# Exceptions

534

564

class Error(Exception):

535

565

# We need to use the class name "GnuTLS" here, since this

536

566

# exception might be raised from within GnuTLS.__init__,

537

567

# which is called before the assignment to the "gnutls"

538

568

# global variable has happened.

539

def __init__(self, message = None, code = None, args=()):

569

def __init__(self, message=None, code=None, args=()):

540

570

# Default usage is by a message string, but if a return

541

571

# code is passed, convert it to a string with

542

572

# gnutls.strerror()

545

575

message = GnuTLS.strerror(code)

546

576

return super(GnuTLS.Error, self).__init__(

547

577

message, *args)

548

578

549

579

class CertificateSecurityError(Error):

550

580

pass

551

581

552

582

# Classes

553

583

class Credentials(object):

554

584

def __init__(self):

556

586

gnutls.certificate_allocate_credentials(

557

587

ctypes.byref(self._c_object))

558

588

self.type = gnutls.CRD_CERTIFICATE

559

589

560

590

def __del__(self):

561

591

gnutls.certificate_free_credentials(self._c_object)

562

592

563

593

class ClientSession(object):

564

def __init__(self, socket, credentials = None):

594

def __init__(self, socket, credentials=None):

565

595

self._c_object = gnutls.session_t()

566

596

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

567

597

gnutls.set_default_priority(self._c_object)

575

605

ctypes.cast(credentials._c_object,

576

606

ctypes.c_void_p))

577

607

self.credentials = credentials

578

608

579

609

def __del__(self):

580

610

gnutls.deinit(self._c_object)

581

611

582

612

def handshake(self):

583

613

return gnutls.handshake(self._c_object)

584

614

585

615

def send(self, data):

586

616

data = bytes(data)

587

617

data_len = len(data)

589

619

data_len -= gnutls.record_send(self._c_object,

590

620

data[-data_len:],

591

621

data_len)

592

622

593

623

def bye(self):

594

624

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

595

625

596

626

# Error handling functions

597

627

def _error_code(result):

598

628

"""A function to raise exceptions on errors, suitable

600

630

if result >= 0:

601

631

return result

602

632

if result == gnutls.E_NO_CERTIFICATE_FOUND:

603

raise gnutls.CertificateSecurityError(code = result)

604

raise gnutls.Error(code = result)

605

633

raise gnutls.CertificateSecurityError(code=result)

634

raise gnutls.Error(code=result)

635

606

636

def _retry_on_error(result, func, arguments):

607

637

"""A function to retry on some errors, suitable

608

638

for the 'errcheck' attribute on ctypes functions"""

611

641

return _error_code(result)

612

642

result = func(*arguments)

613

643

return result

614

644

615

645

# Unless otherwise indicated, the function declarations below are

616

646

# all from the gnutls/gnutls.h C header file.

617

647

618

648

# Functions

619

649

priority_set_direct = _library.gnutls_priority_set_direct

620

650

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

621

651

ctypes.POINTER(ctypes.c_char_p)]

622

652

priority_set_direct.restype = _error_code

623

653

624

654

init = _library.gnutls_init

625

655

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

626

656

init.restype = _error_code

627

657

628

658

set_default_priority = _library.gnutls_set_default_priority

629

659

set_default_priority.argtypes = [session_t]

630

660

set_default_priority.restype = _error_code

631

661

632

662

record_send = _library.gnutls_record_send

633

663

record_send.argtypes = [session_t, ctypes.c_void_p,

634

664

ctypes.c_size_t]

635

665

record_send.restype = ctypes.c_ssize_t

636

666

record_send.errcheck = _retry_on_error

637

667

638

668

certificate_allocate_credentials = (

639

669

_library.gnutls_certificate_allocate_credentials)

640

670

certificate_allocate_credentials.argtypes = [

641

671

ctypes.POINTER(certificate_credentials_t)]

642

672

certificate_allocate_credentials.restype = _error_code

643

673

644

674

certificate_free_credentials = (

645

675

_library.gnutls_certificate_free_credentials)

646

certificate_free_credentials.argtypes = [certificate_credentials_t]

676

certificate_free_credentials.argtypes = [

677

certificate_credentials_t]

647

678

certificate_free_credentials.restype = None

648

679

649

680

handshake_set_private_extensions = (

650

681

_library.gnutls_handshake_set_private_extensions)

651

682

handshake_set_private_extensions.argtypes = [session_t,

652

683

ctypes.c_int]

653

684

handshake_set_private_extensions.restype = None

654

685

655

686

credentials_set = _library.gnutls_credentials_set

656

687

credentials_set.argtypes = [session_t, credentials_type_t,

657

688

ctypes.c_void_p]

658

689

credentials_set.restype = _error_code

659

690

660

691

strerror = _library.gnutls_strerror

661

692

strerror.argtypes = [ctypes.c_int]

662

693

strerror.restype = ctypes.c_char_p

663

694

664

695

certificate_type_get = _library.gnutls_certificate_type_get

665

696

certificate_type_get.argtypes = [session_t]

666

697

certificate_type_get.restype = _error_code

667

698

668

699

certificate_get_peers = _library.gnutls_certificate_get_peers

669

700

certificate_get_peers.argtypes = [session_t,

670

701

ctypes.POINTER(ctypes.c_uint)]

671

702

certificate_get_peers.restype = ctypes.POINTER(datum_t)

672

703

673

704

global_set_log_level = _library.gnutls_global_set_log_level

674

705

global_set_log_level.argtypes = [ctypes.c_int]

675

706

global_set_log_level.restype = None

676

707

677

708

global_set_log_function = _library.gnutls_global_set_log_function

678

709

global_set_log_function.argtypes = [log_func]

679

710

global_set_log_function.restype = None

680

711

681

712

deinit = _library.gnutls_deinit

682

713

deinit.argtypes = [session_t]

683

714

deinit.restype = None

684

715

685

716

handshake = _library.gnutls_handshake

686

717

handshake.argtypes = [session_t]

687

718

handshake.restype = _error_code

688

719

handshake.errcheck = _retry_on_error

689

720

690

721

transport_set_ptr = _library.gnutls_transport_set_ptr

691

722

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

692

723

transport_set_ptr.restype = None

693

724

694

725

bye = _library.gnutls_bye

695

726

bye.argtypes = [session_t, close_request_t]

696

727

bye.restype = _error_code

697

728

bye.errcheck = _retry_on_error

698

729

699

730

check_version = _library.gnutls_check_version

700

731

check_version.argtypes = [ctypes.c_char_p]

701

732

check_version.restype = ctypes.c_char_p

702

733

703

734

# All the function declarations below are from gnutls/openpgp.h

704

735

705

736

openpgp_crt_init = _library.gnutls_openpgp_crt_init

706

737

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

707

738

openpgp_crt_init.restype = _error_code

708

739

709

740

openpgp_crt_import = _library.gnutls_openpgp_crt_import

710

741

openpgp_crt_import.argtypes = [openpgp_crt_t,

711

742

ctypes.POINTER(datum_t),

712

743

openpgp_crt_fmt_t]

713

744

openpgp_crt_import.restype = _error_code

714

745

715

746

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

716

747

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

717

748

ctypes.POINTER(ctypes.c_uint)]

718

749

openpgp_crt_verify_self.restype = _error_code

719

750

720

751

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

721

752

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

722

753

openpgp_crt_deinit.restype = None

723

754

724

755

openpgp_crt_get_fingerprint = (

725

756

_library.gnutls_openpgp_crt_get_fingerprint)

726

757

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

728

759

ctypes.POINTER(

729

760

ctypes.c_size_t)]

730

761

openpgp_crt_get_fingerprint.restype = _error_code

731

762

732

763

# Remove non-public functions

733

764

del _error_code, _retry_on_error

734

765

# Create the global "gnutls" object, simulating a module

735

766

gnutls = GnuTLS()

736

767

768

737

769

def call_pipe(connection, # : multiprocessing.Connection

738

770

func, *args, **kwargs):

739

771

"""This function is meant to be called by multiprocessing.Process

740

772

741

773

This function runs func(*args, **kwargs), and writes the resulting

742

774

return value on the provided multiprocessing.Connection.

743

775

"""

744

776

connection.send(func(*args, **kwargs))

745

777

connection.close()

746

778

779

747

780

class Client(object):

748

781

"""A representation of a client host served by this server.

749

782

750

783

Attributes:

751

784

approved: bool(); 'None' if not yet approved/disapproved

752

785

approval_delay: datetime.timedelta(); Time to wait for approval

789

822

disabled, or None

790

823

server_settings: The server_settings dict from main()

791

824

"""

792

825

793

826

runtime_expansions = ("approval_delay", "approval_duration",

794

827

"created", "enabled", "expires",

795

828

"fingerprint", "host", "interval",

806

839

"approved_by_default": "True",

807

840

"enabled": "True",

808

841

}

809

842

810

843

@staticmethod

811

844

def config_parser(config):

812

845

"""Construct a new dict of client settings of this form:

819

852

for client_name in config.sections():

820

853

section = dict(config.items(client_name))

821

854

client = settings[client_name] = {}

822

855

823

856

client["host"] = section["host"]

824

857

# Reformat values from string types to Python types

825

858

client["approved_by_default"] = config.getboolean(

826

859

client_name, "approved_by_default")

827

860

client["enabled"] = config.getboolean(client_name,

828

861

"enabled")

829

862

830

863

# Uppercase and remove spaces from fingerprint for later

831

864

# comparison purposes with return value from the

832

865

# fingerprint() function

856

889

client["last_approval_request"] = None

857

890

client["last_checked_ok"] = None

858

891

client["last_checker_status"] = -2

859

892

860

893

return settings

861

862

def __init__(self, settings, name = None, server_settings=None):

894

895

def __init__(self, settings, name=None, server_settings=None):

863

896

self.name = name

864

897

if server_settings is None:

865

898

server_settings = {}

867

900

# adding all client settings

868

901

for setting, value in settings.items():

869

902

setattr(self, setting, value)

870

903

871

904

if self.enabled:

872

905

if not hasattr(self, "last_enabled"):

873

906

self.last_enabled = datetime.datetime.utcnow()

877

910

else:

878

911

self.last_enabled = None

879

912

self.expires = None

880

913

881

914

logger.debug("Creating client %r", self.name)

882

915

logger.debug(" Fingerprint: %s", self.fingerprint)

883

916

self.created = settings.get("created",

884

917

datetime.datetime.utcnow())

885

918

886

919

# attributes specific for this server instance

887

920

self.checker = None

888

921

self.checker_initiator_tag = None

897

930

for attr in self.__dict__.keys()

898

931

if not attr.startswith("_")]

899

932

self.client_structure.append("client_structure")

900

933

901

934

for name, t in inspect.getmembers(

902

935

type(self), lambda obj: isinstance(obj, property)):

903

936

if not name.startswith("_"):

904

937

self.client_structure.append(name)

905

938

906

939

# Send notice to process children that client state has changed

907

940

def send_changedstate(self):

908

941

with self.changedstate:

909

942

self.changedstate.notify_all()

910

943

911

944

def enable(self):

912

945

"""Start this client's checker and timeout hooks"""

913

946

if getattr(self, "enabled", False):

918

951

self.last_enabled = datetime.datetime.utcnow()

919

952

self.init_checker()

920

953

self.send_changedstate()

921

954

922

955

def disable(self, quiet=True):

923

956

"""Disable this client."""

924

957

if not getattr(self, "enabled", False):

938

971

self.send_changedstate()

939

972

# Do not run this again if called by a GLib.timeout_add

940

973

return False

941

974

942

975

def __del__(self):

943

976

self.disable()

944

977

945

978

def init_checker(self):

946

979

# Schedule a new checker to be started an 'interval' from now,

947

980

# and every interval from then on.

957

990

int(self.timeout.total_seconds() * 1000), self.disable)

958

991

# Also start a new checker *right now*.

959

992

self.start_checker()

960

993

961

994

def checker_callback(self, source, condition, connection,

962

995

command):

963

996

"""The checker has completed, so take appropriate actions."""

966

999

# Read return code from connection (see call_pipe)

967

1000

returncode = connection.recv()

968

1001

connection.close()

969

1002

970

1003

if returncode >= 0:

971

1004

self.last_checker_status = returncode

972

1005

self.last_checker_signal = None

982

1015

logger.warning("Checker for %(name)s crashed?",

983

1016

vars(self))

984

1017

return False

985

1018

986

1019

def checked_ok(self):

987

1020

"""Assert that the client has been seen, alive and well."""

988

1021

self.last_checked_ok = datetime.datetime.utcnow()

989

1022

self.last_checker_status = 0

990

1023

self.last_checker_signal = None

991

1024

self.bump_timeout()

992

1025

993

1026

def bump_timeout(self, timeout=None):

994

1027

"""Bump up the timeout for this client."""

995

1028

if timeout is None:

1001

1034

self.disable_initiator_tag = GLib.timeout_add(

1002

1035

int(timeout.total_seconds() * 1000), self.disable)

1003

1036

self.expires = datetime.datetime.utcnow() + timeout

1004

1037

1005

1038

def need_approval(self):

1006

1039

self.last_approval_request = datetime.datetime.utcnow()

1007

1040

1008

1041

def start_checker(self):

1009

1042

"""Start a new checker subprocess if one is not running.

1010

1043

1011

1044

If a checker already exists, leave it running and do

1012

1045

nothing."""

1013

1046

# The reason for not killing a running checker is that if we

1018

1051

# checkers alone, the checker would have to take more time

1019

1052

# than 'timeout' for the client to be disabled, which is as it

1020

1053

# should be.

1021

1054

1022

1055

if self.checker is not None and not self.checker.is_alive():

1023

1056

logger.warning("Checker was not alive; joining")

1024

1057

self.checker.join()

1028

1061

# Escape attributes for the shell

1029

1062

escaped_attrs = {

1030

1063

attr: re.escape(str(getattr(self, attr)))

1031

for attr in self.runtime_expansions }

1064

for attr in self.runtime_expansions}

1032

1065

try:

1033

1066

command = self.checker_command % escaped_attrs

1034

1067

except TypeError as error:

1046

1079

# The exception is when not debugging but nevertheless

1047

1080

# running in the foreground; use the previously

1048

1081

# created wnull.

1049

popen_args = { "close_fds": True,

1050

"shell": True,

1051

"cwd": "/" }

1082

popen_args = {"close_fds": True,

1083

"shell": True,

1084

"cwd": "/"}

1052

1085

if (not self.server_settings["debug"]

1053

1086

and self.server_settings["foreground"]):

1054

1087

popen_args.update({"stdout": wnull,

1055

"stderr": wnull })

1056

pipe = multiprocessing.Pipe(duplex = False)

1088

"stderr": wnull})

1089

pipe = multiprocessing.Pipe(duplex=False)

1057

1090

self.checker = multiprocessing.Process(

1058

target = call_pipe,

1059

args = (pipe[1], subprocess.call, command),

1060

kwargs = popen_args)

1091

target=call_pipe,

1092

args=(pipe[1], subprocess.call, command),

1093

kwargs=popen_args)

1061

1094

self.checker.start()

1062

1095

self.checker_callback_tag = GLib.io_add_watch(

1063

1096

pipe[0].fileno(), GLib.IO_IN,

1064

1097

self.checker_callback, pipe[0], command)

1065

1098

# Re-run this periodically if run by GLib.timeout_add

1066

1099

return True

1067

1100

1068

1101

def stop_checker(self):

1069

1102

"""Force the checker process, if any, to stop."""

1070

1103

if self.checker_callback_tag:

1083

1116

byte_arrays=False):

1084

1117

"""Decorators for marking methods of a DBusObjectWithProperties to

1085

1118

become properties on the D-Bus.

1086

1119

1087

1120

The decorated method will be called with no arguments by "Get"

1088

1121

and with one argument by "Set".

1089

1122

1090

1123

The parameters, where they are supported, are the same as

1091

1124

dbus.service.method, except there is only "signature", since the

1092

1125

type from Get() and the type sent to Set() is the same.

1096

1129

if byte_arrays and signature != "ay":

1097

1130

raise ValueError("Byte arrays not supported for non-'ay'"

1098

1131

" signature {!r}".format(signature))

1099

1132

1100

1133

def decorator(func):

1101

1134

func._dbus_is_property = True

1102

1135

func._dbus_interface = dbus_interface

1105

1138

func._dbus_name = func.__name__

1106

1139

if func._dbus_name.endswith("_dbus_property"):

1107

1140

func._dbus_name = func._dbus_name[:-14]

1108

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1141

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

1109

1142

return func

1110

1143

1111

1144

return decorator

1112

1145

1113

1146

1114

1147

def dbus_interface_annotations(dbus_interface):

1115

1148

"""Decorator for marking functions returning interface annotations

1116

1149

1117

1150

Usage:

1118

1151

1119

1152

@dbus_interface_annotations("org.example.Interface")

1120

1153

def _foo(self): # Function name does not matter

1121

1154

return {"org.freedesktop.DBus.Deprecated": "true",

1122

1155

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1123

1156

"false"}

1124

1157

"""

1125

1158

1126

1159

def decorator(func):

1127

1160

func._dbus_is_interface = True

1128

1161

func._dbus_interface = dbus_interface

1129

1162

func._dbus_name = dbus_interface

1130

1163

return func

1131

1164

1132

1165

return decorator

1133

1166

1134

1167

1135

1168

def dbus_annotations(annotations):

1136

1169

"""Decorator to annotate D-Bus methods, signals or properties

1137

1170

Usage:

1138

1171

1139

1172

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1140

1173

"org.freedesktop.DBus.Property."

1141

1174

"EmitsChangedSignal": "false"})

1143

1176

access="r")

1144

1177

def Property_dbus_property(self):

1145

1178

return dbus.Boolean(False)

1146

1179

1147

1180

See also the DBusObjectWithAnnotations class.

1148

1181

"""

1149

1182

1150

1183

def decorator(func):

1151

1184

func._dbus_annotations = annotations

1152

1185

return func

1153

1186

1154

1187

return decorator

1155

1188

1156

1189

1174

1207

1175

1208

class DBusObjectWithAnnotations(dbus.service.Object):

1176

1209

"""A D-Bus object with annotations.

1177

1210

1178

1211

Classes inheriting from this can use the dbus_annotations

1179

1212

decorator to add annotations to methods or signals.

1180

1213

"""

1181

1214

1182

1215

@staticmethod

1183

1216

def _is_dbus_thing(thing):

1184

1217

"""Returns a function testing if an attribute is a D-Bus thing

1185

1218

1186

1219

If called like _is_dbus_thing("method") it returns a function

1187

1220

suitable for use as predicate to inspect.getmembers().

1188

1221

"""

1189

1222

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

1190

1223

False)

1191

1224

1192

1225

def _get_all_dbus_things(self, thing):

1193

1226

"""Returns a generator of (name, attribute) pairs

1194

1227

"""

1197

1230

for cls in self.__class__.__mro__

1198

1231

for name, athing in

1199

1232

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1200

1233

1201

1234

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1202

out_signature = "s",

1203

path_keyword = 'object_path',

1204

connection_keyword = 'connection')

1235

out_signature="s",

1236

path_keyword='object_path',

1237

connection_keyword='connection')

1205

1238

def Introspect(self, object_path, connection):

1206

1239

"""Overloading of standard D-Bus method.

1207

1240

1208

1241

Inserts annotation tags on methods and signals.

1209

1242

"""

1210

1243

xmlstring = dbus.service.Object.Introspect(self, object_path,

1211

1244

connection)

1212

1245

try:

1213

1246

document = xml.dom.minidom.parseString(xmlstring)

1214

1247

1215

1248

for if_tag in document.getElementsByTagName("interface"):

1216

1249

# Add annotation tags

1217

1250

for typ in ("method", "signal"):

1244

1277

if_tag.appendChild(ann_tag)

1245

1278

# Fix argument name for the Introspect method itself

1246

1279

if (if_tag.getAttribute("name")

1247

== dbus.INTROSPECTABLE_IFACE):

1280

== dbus.INTROSPECTABLE_IFACE):

1248

1281

for cn in if_tag.getElementsByTagName("method"):

1249

1282

if cn.getAttribute("name") == "Introspect":

1250

1283

for arg in cn.getElementsByTagName("arg"):

1263

1296

1264

1297

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1265

1298

"""A D-Bus object with properties.

1266

1299

1267

1300

Classes inheriting from this can use the dbus_service_property

1268

1301

decorator to expose methods as D-Bus properties. It exposes the

1269

1302

standard Get(), Set(), and GetAll() methods on the D-Bus.

1270

1303

"""

1271

1304

1272

1305

def _get_dbus_property(self, interface_name, property_name):

1273

1306

"""Returns a bound method if one exists which is a D-Bus

1274

1307

property with the specified name and interface.

1279

1312

if (value._dbus_name == property_name

1280

1313

and value._dbus_interface == interface_name):

1281

1314

return value.__get__(self)

1282

1315

1283

1316

# No such property

1284

1317

raise DBusPropertyNotFound("{}:{}.{}".format(

1285

1318

self.dbus_object_path, interface_name, property_name))

1286

1319

1287

1320

@classmethod

1288

1321

def _get_all_interface_names(cls):

1289

1322

"""Get a sequence of all interfaces supported by an object"""

1292

1325

for x in (inspect.getmro(cls))

1293

1326

for attr in dir(x))

1294

1327

if name is not None)

1295

1328

1296

1329

@dbus.service.method(dbus.PROPERTIES_IFACE,

1297

1330

in_signature="ss",

1298

1331

out_signature="v")

1306

1339

if not hasattr(value, "variant_level"):

1307

1340

return value

1308

1341

return type(value)(value, variant_level=value.variant_level+1)

1309

1342

1310

1343

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1311

1344

def Set(self, interface_name, property_name, value):

1312

1345

"""Standard D-Bus property Set() method, see D-Bus standard.

1324

1357

value = dbus.ByteArray(b''.join(chr(byte)

1325

1358

for byte in value))

1326

1359

prop(value)

1327

1360

1328

1361

@dbus.service.method(dbus.PROPERTIES_IFACE,

1329

1362

in_signature="s",

1330

1363

out_signature="a{sv}")

1331

1364

def GetAll(self, interface_name):

1332

1365

"""Standard D-Bus property GetAll() method, see D-Bus

1333

1366

standard.

1334

1367

1335

1368

Note: Will not include properties with access="write".

1336

1369

"""

1337

1370

properties = {}

1348

1381

properties[name] = value

1349

1382

continue

1350

1383

properties[name] = type(value)(

1351

value, variant_level = value.variant_level + 1)

1384

value, variant_level=value.variant_level + 1)

1352

1385

return dbus.Dictionary(properties, signature="sv")

1353

1386

1354

1387

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1355

1388

def PropertiesChanged(self, interface_name, changed_properties,

1356

1389

invalidated_properties):

1358

1391

standard.

1359

1392

"""

1360

1393

pass

1361

1394

1362

1395

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1363

1396

out_signature="s",

1364

1397

path_keyword='object_path',

1365

1398

connection_keyword='connection')

1366

1399

def Introspect(self, object_path, connection):

1367

1400

"""Overloading of standard D-Bus method.

1368

1401

1369

1402

Inserts property tags and interface annotation tags.

1370

1403

"""

1371

1404

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1373

1406

connection)

1374

1407

try:

1375

1408

document = xml.dom.minidom.parseString(xmlstring)

1376

1409

1377

1410

def make_tag(document, name, prop):

1378

1411

e = document.createElement("property")

1379

1412

e.setAttribute("name", name)

1380

1413

e.setAttribute("type", prop._dbus_signature)

1381

1414

e.setAttribute("access", prop._dbus_access)

1382

1415

return e

1383

1416

1384

1417

for if_tag in document.getElementsByTagName("interface"):

1385

1418

# Add property tags

1386

1419

for tag in (make_tag(document, name, prop)

1428

1461

exc_info=error)

1429

1462

return xmlstring

1430

1463

1464

1431

1465

try:

1432

1466

dbus.OBJECT_MANAGER_IFACE

1433

1467

except AttributeError:

1434

1468

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1435

1469

1470

1436

1471

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1437

1472

"""A D-Bus object with an ObjectManager.

1438

1473

1439

1474

Classes inheriting from this exposes the standard

1440

1475

GetManagedObjects call and the InterfacesAdded and

1441

1476

InterfacesRemoved signals on the standard

1442

1477

"org.freedesktop.DBus.ObjectManager" interface.

1443

1478

1444

1479

Note: No signals are sent automatically; they must be sent

1445

1480

manually.

1446

1481

"""

1447

1482

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1448

out_signature = "a{oa{sa{sv}}}")

1483

out_signature="a{oa{sa{sv}}}")

1449

1484

def GetManagedObjects(self):

1450

1485

"""This function must be overridden"""

1451

1486

raise NotImplementedError()

1452

1487

1453

1488

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1454

signature = "oa{sa{sv}}")

1489

signature="oa{sa{sv}}")

1455

1490

def InterfacesAdded(self, object_path, interfaces_and_properties):

1456

1491

pass

1457

1458

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1492

1493

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1459

1494

def InterfacesRemoved(self, object_path, interfaces):

1460

1495

pass

1461

1496

1462

1497

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1463

out_signature = "s",

1464

path_keyword = 'object_path',

1465

connection_keyword = 'connection')

1498

out_signature="s",

1499

path_keyword='object_path',

1500

connection_keyword='connection')

1466

1501

def Introspect(self, object_path, connection):

1467

1502

"""Overloading of standard D-Bus method.

1468

1503

1469

1504

Override return argument name of GetManagedObjects to be

1470

1505

"objpath_interfaces_and_properties"

1471

1506

"""

1474

1509

connection)

1475

1510

try:

1476

1511

document = xml.dom.minidom.parseString(xmlstring)

1477

1512

1478

1513

for if_tag in document.getElementsByTagName("interface"):

1479

1514

# Fix argument name for the GetManagedObjects method

1480

1515

if (if_tag.getAttribute("name")

1481

== dbus.OBJECT_MANAGER_IFACE):

1516

== dbus.OBJECT_MANAGER_IFACE):

1482

1517

for cn in if_tag.getElementsByTagName("method"):

1483

1518

if (cn.getAttribute("name")

1484

1519

== "GetManagedObjects"):

1494

1529

except (AttributeError, xml.dom.DOMException,

1495

1530

xml.parsers.expat.ExpatError) as error:

1496

1531

logger.error("Failed to override Introspection method",

1497

exc_info = error)

1532

exc_info=error)

1498

1533

return xmlstring

1499

1534

1535

1500

1536

def datetime_to_dbus(dt, variant_level=0):

1501

1537

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1502

1538

if dt is None:

1503

return dbus.String("", variant_level = variant_level)

1539

return dbus.String("", variant_level=variant_level)

1504

1540

return dbus.String(dt.isoformat(), variant_level=variant_level)

1505

1541

1506

1542

1509

1545

dbus.service.Object, it will add alternate D-Bus attributes with

1510

1546

interface names according to the "alt_interface_names" mapping.

1511

1547

Usage:

1512

1548

1513

1549

@alternate_dbus_interfaces({"org.example.Interface":

1514

1550

"net.example.AlternateInterface"})

1515

1551

class SampleDBusObject(dbus.service.Object):

1516

1552

@dbus.service.method("org.example.Interface")

1517

1553

def SampleDBusMethod():

1518

1554

pass

1519

1555

1520

1556

The above "SampleDBusMethod" on "SampleDBusObject" will be

1521

1557

reachable via two interfaces: "org.example.Interface" and

1522

1558

"net.example.AlternateInterface", the latter of which will have

1523

1559

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1524

1560

"true", unless "deprecate" is passed with a False value.

1525

1561

1526

1562

This works for methods and signals, and also for D-Bus properties

1527

1563

(from DBusObjectWithProperties) and interfaces (from the

1528

1564

dbus_interface_annotations decorator).

1529

1565

"""

1530

1566

1531

1567

def wrapper(cls):

1532

1568

for orig_interface_name, alt_interface_name in (

1533

1569

alt_interface_names.items()):

1573

1609

attribute._dbus_annotations)

1574

1610

except AttributeError:

1575

1611

pass

1612

1576

1613

# Define a creator of a function to call both the

1577

1614

# original and alternate functions, so both the

1578

1615

# original and alternate signals gets sent when

1581

1618

"""This function is a scope container to pass

1582

1619

func1 and func2 to the "call_both" function

1583

1620

outside of its arguments"""

1584

1621

1585

1622

@functools.wraps(func2)

1586

1623

def call_both(*args, **kwargs):

1587

1624

"""This function will emit two D-Bus

1588

1625

signals by calling func1 and func2"""

1589

1626

func1(*args, **kwargs)

1590

1627

func2(*args, **kwargs)

1591

# Make wrapper function look like a D-Bus signal

1628

# Make wrapper function look like a D-Bus

1629

# signal

1592

1630

for name, attr in inspect.getmembers(func2):

1593

1631

if name.startswith("_dbus_"):

1594

1632

setattr(call_both, name, attr)

1595

1633

1596

1634

return call_both

1597

1635

# Create the "call_both" function and add it to

1598

1636

# the class

1644

1682

(copy_function(attribute)))

1645

1683

if deprecate:

1646

1684

# Deprecate all alternate interfaces

1647

iname="_AlternateDBusNames_interface_annotation{}"

1685

iname = "_AlternateDBusNames_interface_annotation{}"

1648

1686

for interface_name in interface_names:

1649

1687

1650

1688

@dbus_interface_annotations(interface_name)

1651

1689

def func(self):

1652

return { "org.freedesktop.DBus.Deprecated":

1653

"true" }

1690

return {"org.freedesktop.DBus.Deprecated":

1691

"true"}

1654

1692

# Find an unused name

1655

1693

for aname in (iname.format(i)

1656

1694

for i in itertools.count()):

1667

1705

cls = type("{}Alternate".format(cls.__name__),

1668

1706

(cls, ), attr)

1669

1707

return cls

1670

1708

1671

1709

return wrapper

1672

1710

1673

1711

1675

1713

"se.bsnet.fukt.Mandos"})

1676

1714

class ClientDBus(Client, DBusObjectWithProperties):

1677

1715

"""A Client class using D-Bus

1678

1716

1679

1717

Attributes:

1680

1718

dbus_object_path: dbus.ObjectPath

1681

1719

bus: dbus.SystemBus()

1682

1720

"""

1683

1721

1684

1722

runtime_expansions = (Client.runtime_expansions

1685

1723

+ ("dbus_object_path", ))

1686

1724

1687

1725

_interface = "se.recompile.Mandos.Client"

1688

1726

1689

1727

# dbus.service.Object doesn't use super(), so we can't either.

1690

1691

def __init__(self, bus = None, *args, **kwargs):

1728

1729

def __init__(self, bus=None, *args, **kwargs):

1692

1730

self.bus = bus

1693

1731

Client.__init__(self, *args, **kwargs)

1694

1732

# Only now, when this client is initialized, can it show up on

1700

1738

"/clients/" + client_object_name)

1701

1739

DBusObjectWithProperties.__init__(self, self.bus,

1702

1740

self.dbus_object_path)

1703

1741

1704

1742

def notifychangeproperty(transform_func, dbus_name,

1705

1743

type_func=lambda x: x,

1706

1744

variant_level=1,

1708

1746

_interface=_interface):

1709

1747

""" Modify a variable so that it's a property which announces

1710

1748

its changes to DBus.

1711

1749

1712

1750

transform_fun: Function that takes a value and a variant_level

1713

1751

and transforms it to a D-Bus type.

1714

1752

dbus_name: D-Bus name of the variable

1717

1755

variant_level: D-Bus variant level. Default: 1

1718

1756

"""

1719

1757

attrname = "_{}".format(dbus_name)

1720

1758

1721

1759

def setter(self, value):

1722

1760

if hasattr(self, "dbus_object_path"):

1723

1761

if (not hasattr(self, attrname) or

1730

1768

else:

1731

1769

dbus_value = transform_func(

1732

1770

type_func(value),

1733

variant_level = variant_level)

1771

variant_level=variant_level)

1734

1772

self.PropertyChanged(dbus.String(dbus_name),

1735

1773

dbus_value)

1736

1774

self.PropertiesChanged(

1737

1775

_interface,

1738

dbus.Dictionary({ dbus.String(dbus_name):

1739

dbus_value }),

1776

dbus.Dictionary({dbus.String(dbus_name):

1777

dbus_value}),

1740

1778

dbus.Array())

1741

1779

setattr(self, attrname, value)

1742

1780

1743

1781

return property(lambda self: getattr(self, attrname), setter)

1744

1782

1745

1783

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1746

1784

approvals_pending = notifychangeproperty(dbus.Boolean,

1747

1785

"ApprovalPending",

1748

type_func = bool)

1786

type_func=bool)

1749

1787

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1750

1788

last_enabled = notifychangeproperty(datetime_to_dbus,

1751

1789

"LastEnabled")

1752

1790

checker = notifychangeproperty(

1753

1791

dbus.Boolean, "CheckerRunning",

1754

type_func = lambda checker: checker is not None)

1792

type_func=lambda checker: checker is not None)

1755

1793

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1756

1794

"LastCheckedOK")

1757

1795

last_checker_status = notifychangeproperty(dbus.Int16,

1762

1800

"ApprovedByDefault")

1763

1801

approval_delay = notifychangeproperty(

1764

1802

dbus.UInt64, "ApprovalDelay",

1765

type_func = lambda td: td.total_seconds() * 1000)

1803

type_func=lambda td: td.total_seconds() * 1000)

1766

1804

approval_duration = notifychangeproperty(

1767

1805

dbus.UInt64, "ApprovalDuration",

1768

type_func = lambda td: td.total_seconds() * 1000)

1806

type_func=lambda td: td.total_seconds() * 1000)

1769

1807

host = notifychangeproperty(dbus.String, "Host")

1770

1808

timeout = notifychangeproperty(

1771

1809

dbus.UInt64, "Timeout",

1772

type_func = lambda td: td.total_seconds() * 1000)

1810

type_func=lambda td: td.total_seconds() * 1000)

1773

1811

extended_timeout = notifychangeproperty(

1774

1812

dbus.UInt64, "ExtendedTimeout",

1775

type_func = lambda td: td.total_seconds() * 1000)

1813

type_func=lambda td: td.total_seconds() * 1000)

1776

1814

interval = notifychangeproperty(

1777

1815

dbus.UInt64, "Interval",

1778

type_func = lambda td: td.total_seconds() * 1000)

1816

type_func=lambda td: td.total_seconds() * 1000)

1779

1817

checker_command = notifychangeproperty(dbus.String, "Checker")

1780

1818

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1781

1819

invalidate_only=True)

1782

1820

1783

1821

del notifychangeproperty

1784

1822

1785

1823

def __del__(self, *args, **kwargs):

1786

1824

try:

1787

1825

self.remove_from_connection()

1790

1828

if hasattr(DBusObjectWithProperties, "__del__"):

1791

1829

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1792

1830

Client.__del__(self, *args, **kwargs)

1793

1831

1794

1832

def checker_callback(self, source, condition,

1795

1833

connection, command, *args, **kwargs):

1796

1834

ret = Client.checker_callback(self, source, condition,

1812

1850

| self.last_checker_signal),

1813

1851

dbus.String(command))

1814

1852

return ret

1815

1853

1816

1854

def start_checker(self, *args, **kwargs):

1817

1855

old_checker_pid = getattr(self.checker, "pid", None)

1818

1856

r = Client.start_checker(self, *args, **kwargs)

1822

1860

# Emit D-Bus signal

1823

1861

self.CheckerStarted(self.current_checker_command)

1824

1862

return r

1825

1863

1826

1864

def _reset_approved(self):

1827

1865

self.approved = None

1828

1866

return False

1829

1867

1830

1868

def approve(self, value=True):

1831

1869

self.approved = value

1832

1870

GLib.timeout_add(int(self.approval_duration.total_seconds()

1833

1871

* 1000), self._reset_approved)

1834

1872

self.send_changedstate()

1835

1836

## D-Bus methods, signals & properties

1837

1838

## Interfaces

1839

1840

## Signals

1841

1873

1874

# D-Bus methods, signals & properties

1875

1876

# Interfaces

1877

1878

# Signals

1879

1842

1880

# CheckerCompleted - signal

1843

1881

@dbus.service.signal(_interface, signature="nxs")

1844

1882

def CheckerCompleted(self, exitcode, waitstatus, command):

1845

1883

"D-Bus signal"

1846

1884

pass

1847

1885

1848

1886

# CheckerStarted - signal

1849

1887

@dbus.service.signal(_interface, signature="s")

1850

1888

def CheckerStarted(self, command):

1851

1889

"D-Bus signal"

1852

1890

pass

1853

1891

1854

1892

# PropertyChanged - signal

1855

1893

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1856

1894

@dbus.service.signal(_interface, signature="sv")

1857

1895

def PropertyChanged(self, property, value):

1858

1896

"D-Bus signal"

1859

1897

pass

1860

1898

1861

1899

# GotSecret - signal

1862

1900

@dbus.service.signal(_interface)

1863

1901

def GotSecret(self):

1866

1904

server to mandos-client

1867

1905

"""

1868

1906

pass

1869

1907

1870

1908

# Rejected - signal

1871

1909

@dbus.service.signal(_interface, signature="s")

1872

1910

def Rejected(self, reason):

1873

1911

"D-Bus signal"

1874

1912

pass

1875

1913

1876

1914

# NeedApproval - signal

1877

1915

@dbus.service.signal(_interface, signature="tb")

1878

1916

def NeedApproval(self, timeout, default):

1879

1917

"D-Bus signal"

1880

1918

return self.need_approval()

1881

1882

## Methods

1883

1919

1920

# Methods

1921

1884

1922

# Approve - method

1885

1923

@dbus.service.method(_interface, in_signature="b")

1886

1924

def Approve(self, value):

1887

1925

self.approve(value)

1888

1926

1889

1927

# CheckedOK - method

1890

1928

@dbus.service.method(_interface)

1891

1929

def CheckedOK(self):

1892

1930

self.checked_ok()

1893

1931

1894

1932

# Enable - method

1895

1933

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1896

1934

@dbus.service.method(_interface)

1897

1935

def Enable(self):

1898

1936

"D-Bus method"

1899

1937

self.enable()

1900

1938

1901

1939

# StartChecker - method

1902

1940

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1903

1941

@dbus.service.method(_interface)

1904

1942

def StartChecker(self):

1905

1943

"D-Bus method"

1906

1944

self.start_checker()

1907

1945

1908

1946

# Disable - method

1909

1947

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1910

1948

@dbus.service.method(_interface)

1911

1949

def Disable(self):

1912

1950

"D-Bus method"

1913

1951

self.disable()

1914

1952

1915

1953

# StopChecker - method

1916

1954

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1917

1955

@dbus.service.method(_interface)

1918

1956

def StopChecker(self):

1919

1957

self.stop_checker()

1920

1921

## Properties

1922

1958

1959

# Properties

1960

1923

1961

# ApprovalPending - property

1924

1962

@dbus_service_property(_interface, signature="b", access="read")

1925

1963

def ApprovalPending_dbus_property(self):

1926

1964

return dbus.Boolean(bool(self.approvals_pending))

1927

1965

1928

1966

# ApprovedByDefault - property

1929

1967

@dbus_service_property(_interface,

1930

1968

signature="b",

1933

1971

if value is None: # get

1934

1972

return dbus.Boolean(self.approved_by_default)

1935

1973

self.approved_by_default = bool(value)

1936

1974

1937

1975

# ApprovalDelay - property

1938

1976

@dbus_service_property(_interface,

1939

1977

signature="t",

1943

1981

return dbus.UInt64(self.approval_delay.total_seconds()

1944

1982

* 1000)

1945

1983

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1946

1984

1947

1985

# ApprovalDuration - property

1948

1986

@dbus_service_property(_interface,

1949

1987

signature="t",

1953

1991

return dbus.UInt64(self.approval_duration.total_seconds()

1954

1992

* 1000)

1955

1993

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1956

1994

1957

1995

# Name - property

1958

1996

@dbus_annotations(

1959

1997

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1960

1998

@dbus_service_property(_interface, signature="s", access="read")

1961

1999

def Name_dbus_property(self):

1962

2000

return dbus.String(self.name)

1963

2001

1964

2002

# Fingerprint - property

1965

2003

@dbus_annotations(

1966

2004

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1967

2005

@dbus_service_property(_interface, signature="s", access="read")

1968

2006

def Fingerprint_dbus_property(self):

1969

2007

return dbus.String(self.fingerprint)

1970

2008

1971

2009

# Host - property

1972

2010

@dbus_service_property(_interface,

1973

2011

signature="s",

1976

2014

if value is None: # get

1977

2015

return dbus.String(self.host)

1978

2016

self.host = str(value)

1979

2017

1980

2018

# Created - property

1981

2019

@dbus_annotations(

1982

2020

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1983

2021

@dbus_service_property(_interface, signature="s", access="read")

1984

2022

def Created_dbus_property(self):

1985

2023

return datetime_to_dbus(self.created)

1986

2024

1987

2025

# LastEnabled - property

1988

2026

@dbus_service_property(_interface, signature="s", access="read")

1989

2027

def LastEnabled_dbus_property(self):

1990

2028

return datetime_to_dbus(self.last_enabled)

1991

2029

1992

2030

# Enabled - property

1993

2031

@dbus_service_property(_interface,

1994

2032

signature="b",

2000

2038

self.enable()

2001

2039

else:

2002

2040

self.disable()

2003

2041

2004

2042

# LastCheckedOK - property

2005

2043

@dbus_service_property(_interface,

2006

2044

signature="s",

2010

2048

self.checked_ok()

2011

2049

return

2012

2050

return datetime_to_dbus(self.last_checked_ok)

2013

2051

2014

2052

# LastCheckerStatus - property

2015

2053

@dbus_service_property(_interface, signature="n", access="read")

2016

2054

def LastCheckerStatus_dbus_property(self):

2017

2055

return dbus.Int16(self.last_checker_status)

2018

2056

2019

2057

# Expires - property

2020

2058

@dbus_service_property(_interface, signature="s", access="read")

2021

2059

def Expires_dbus_property(self):

2022

2060

return datetime_to_dbus(self.expires)

2023

2061

2024

2062

# LastApprovalRequest - property

2025

2063

@dbus_service_property(_interface, signature="s", access="read")

2026

2064

def LastApprovalRequest_dbus_property(self):

2027

2065

return datetime_to_dbus(self.last_approval_request)

2028

2066

2029

2067

# Timeout - property

2030

2068

@dbus_service_property(_interface,

2031

2069

signature="t",

2050

2088

self.disable_initiator_tag = GLib.timeout_add(

2051

2089

int((self.expires - now).total_seconds() * 1000),

2052

2090

self.disable)

2053

2091

2054

2092

# ExtendedTimeout - property

2055

2093

@dbus_service_property(_interface,

2056

2094

signature="t",

2060

2098

return dbus.UInt64(self.extended_timeout.total_seconds()

2061

2099

* 1000)

2062

2100

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2063

2101

2064

2102

# Interval - property

2065

2103

@dbus_service_property(_interface,

2066

2104

signature="t",

2076

2114

GLib.source_remove(self.checker_initiator_tag)

2077

2115

self.checker_initiator_tag = GLib.timeout_add(

2078

2116

value, self.start_checker)

2079

self.start_checker() # Start one now, too

2080

2117

self.start_checker() # Start one now, too

2118

2081

2119

# Checker - property

2082

2120

@dbus_service_property(_interface,

2083

2121

signature="s",

2086

2124

if value is None: # get

2087

2125

return dbus.String(self.checker_command)

2088

2126

self.checker_command = str(value)

2089

2127

2090

2128

# CheckerRunning - property

2091

2129

@dbus_service_property(_interface,

2092

2130

signature="b",

2098

2136

self.start_checker()

2099

2137

else:

2100

2138

self.stop_checker()

2101

2139

2102

2140

# ObjectPath - property

2103

2141

@dbus_annotations(

2104

2142

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2105

2143

"org.freedesktop.DBus.Deprecated": "true"})

2106

2144

@dbus_service_property(_interface, signature="o", access="read")

2107

2145

def ObjectPath_dbus_property(self):

2108

return self.dbus_object_path # is already a dbus.ObjectPath

2109

2146

return self.dbus_object_path # is already a dbus.ObjectPath

2147

2110

2148

# Secret = property

2111

2149

@dbus_annotations(

2112

2150

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2117

2155

byte_arrays=True)

2118

2156

def Secret_dbus_property(self, value):

2119

2157

self.secret = bytes(value)

2120

2158

2121

2159

del _interface

2122

2160

2123

2161

2127

2165

self._pipe.send(('init', fpr, address))

2128

2166

if not self._pipe.recv():

2129

2167

raise KeyError(fpr)

2130

2168

2131

2169

def __getattribute__(self, name):

2132

2170

if name == '_pipe':

2133

2171

return super(ProxyClient, self).__getattribute__(name)

2136

2174

if data[0] == 'data':

2137

2175

return data[1]

2138

2176

if data[0] == 'function':

2139

2177

2140

2178

def func(*args, **kwargs):

2141

2179

self._pipe.send(('funcall', name, args, kwargs))

2142

2180

return self._pipe.recv()[1]

2143

2181

2144

2182

return func

2145

2183

2146

2184

def __setattr__(self, name, value):

2147

2185

if name == '_pipe':

2148

2186

return super(ProxyClient, self).__setattr__(name, value)

2151

2189

2152

2190

class ClientHandler(socketserver.BaseRequestHandler, object):

2153

2191

"""A class to handle client connections.

2154

2192

2155

2193

Instantiated once for each connection to handle it.

2156

2194

Note: This will run in its own forked process."""

2157

2195

2158

2196

def handle(self):

2159

2197

with contextlib.closing(self.server.child_pipe) as child_pipe:

2160

2198

logger.info("TCP connection from: %s",

2161

2199

str(self.client_address))

2162

2200

logger.debug("Pipe FD: %d",

2163

2201

self.server.child_pipe.fileno())

2164

2202

2165

2203

session = gnutls.ClientSession(self.request)

2166

2167

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

2168

# "+AES-256-CBC", "+SHA1",

2169

# "+COMP-NULL", "+CTYPE-OPENPGP",

2170

# "+DHE-DSS"))

2204

2205

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2206

# "+AES-256-CBC", "+SHA1",

2207

# "+COMP-NULL", "+CTYPE-OPENPGP",

2208

# "+DHE-DSS"))

2171

2209

# Use a fallback default, since this MUST be set.

2172

2210

priority = self.server.gnutls_priority

2173

2211

if priority is None:

2174

2212

priority = "NORMAL"

2175

gnutls.priority_set_direct(session._c_object, priority,

2213

gnutls.priority_set_direct(session._c_object,

2214

priority.encode("utf-8"),

2176

2215

None)

2177

2216

2178

2217

# Start communication using the Mandos protocol

2179

2218

# Get protocol number

2180

2219

line = self.request.makefile().readline()

2185

2224

except (ValueError, IndexError, RuntimeError) as error:

2186

2225

logger.error("Unknown protocol version: %s", error)

2187

2226

return

2188

2227

2189

2228

# Start GnuTLS connection

2190

2229

try:

2191

2230

session.handshake()

2195

2234

# established. Just abandon the request.

2196

2235

return

2197

2236

logger.debug("Handshake succeeded")

2198

2237

2199

2238

approval_required = False

2200

2239

try:

2201

2240

try:

2205

2244

logger.warning("Bad certificate: %s", error)

2206

2245

return

2207

2246

logger.debug("Fingerprint: %s", fpr)

2208

2247

2209

2248

try:

2210

2249

client = ProxyClient(child_pipe, fpr,

2211

2250

self.client_address)

2212

2251

except KeyError:

2213

2252

return

2214

2253

2215

2254

if client.approval_delay:

2216

2255

delay = client.approval_delay

2217

2256

client.approvals_pending += 1

2218

2257

approval_required = True

2219

2258

2220

2259

while True:

2221

2260

if not client.enabled:

2222

2261

logger.info("Client %s is disabled",

2225

2264

# Emit D-Bus signal

2226

2265

client.Rejected("Disabled")

2227

2266

return

2228

2267

2229

2268

if client.approved or not client.approval_delay:

2230

#We are approved or approval is disabled

2269

# We are approved or approval is disabled

2231

2270

break

2232

2271

elif client.approved is None:

2233

2272

logger.info("Client %s needs approval",

2244

2283

# Emit D-Bus signal

2245

2284

client.Rejected("Denied")

2246

2285

return

2247

2248

#wait until timeout or approved

2286

2287

# wait until timeout or approved

2249

2288

time = datetime.datetime.now()

2250

2289

client.changedstate.acquire()

2251

2290

client.changedstate.wait(delay.total_seconds())

2264

2303

break

2265

2304

else:

2266

2305

delay -= time2 - time

2267

2306

2268

2307

try:

2269

2308

session.send(client.secret)

2270

2309

except gnutls.Error as error:

2271

2310

logger.warning("gnutls send failed",

2272

exc_info = error)

2311

exc_info=error)

2273

2312

return

2274

2313

2275

2314

logger.info("Sending secret to %s", client.name)

2276

2315

# bump the timeout using extended_timeout

2277

2316

client.bump_timeout(client.extended_timeout)

2278

2317

if self.server.use_dbus:

2279

2318

# Emit D-Bus signal

2280

2319

client.GotSecret()

2281

2320

2282

2321

finally:

2283

2322

if approval_required:

2284

2323

client.approvals_pending -= 1

2287

2326

except gnutls.Error as error:

2288

2327

logger.warning("GnuTLS bye failed",

2289

2328

exc_info=error)

2290

2329

2291

2330

@staticmethod

2292

2331

def peer_certificate(session):

2293

2332

"Return the peer's OpenPGP certificate as a bytestring"

2305

2344

return None

2306

2345

cert = cert_list[0]

2307

2346

return ctypes.string_at(cert.data, cert.size)

2308

2347

2309

2348

@staticmethod

2310

2349

def fingerprint(openpgp):

2311

2350

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2344

2383

2345

2384

class MultiprocessingMixIn(object):

2346

2385

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2347

2386

2348

2387

def sub_process_main(self, request, address):

2349

2388

try:

2350

2389

self.finish_request(request, address)

2351

2390

except Exception:

2352

2391

self.handle_error(request, address)

2353

2392

self.close_request(request)

2354

2393

2355

2394

def process_request(self, request, address):

2356

2395

"""Start a new process to process the request."""

2357

proc = multiprocessing.Process(target = self.sub_process_main,

2358

args = (request, address))

2396

proc = multiprocessing.Process(target=self.sub_process_main,

2397

args=(request, address))

2359

2398

proc.start()

2360

2399

return proc

2361

2400

2362

2401

2363

2402

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2364

2403

""" adds a pipe to the MixIn """

2365

2404

2366

2405

def process_request(self, request, client_address):

2367

2406

"""Overrides and wraps the original process_request().

2368

2407

2369

2408

This function creates a new pipe in self.pipe

2370

2409

"""

2371

2410

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2372

2411

2373

2412

proc = MultiprocessingMixIn.process_request(self, request,

2374

2413

client_address)

2375

2414

self.child_pipe.close()

2376

2415

self.add_pipe(parent_pipe, proc)

2377

2416

2378

2417

def add_pipe(self, parent_pipe, proc):

2379

2418

"""Dummy function; override as necessary"""

2380

2419

raise NotImplementedError()

2383

2422

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2384

2423

socketserver.TCPServer, object):

2385

2424

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2386

2425

2387

2426

Attributes:

2388

2427

enabled: Boolean; whether this server is activated yet

2389

2428

interface: None or a network interface name (string)

2390

2429

use_ipv6: Boolean; to use IPv6 or not

2391

2430

"""

2392

2431

2393

2432

def __init__(self, server_address, RequestHandlerClass,

2394

2433

interface=None,

2395

2434

use_ipv6=True,

2405

2444

self.socketfd = socketfd

2406

2445

# Save the original socket.socket() function

2407

2446

self.socket_socket = socket.socket

2447

2408

2448

# To implement --socket, we monkey patch socket.socket.

2409

#

2449

#

2410

2450

# (When socketserver.TCPServer is a new-style class, we

2411

2451

# could make self.socket into a property instead of monkey

2412

2452

# patching socket.socket.)

2413

#

2453

#

2414

2454

# Create a one-time-only replacement for socket.socket()

2415

2455

@functools.wraps(socket.socket)

2416

2456

def socket_wrapper(*args, **kwargs):

2428

2468

# socket_wrapper(), if socketfd was set.

2429

2469

socketserver.TCPServer.__init__(self, server_address,

2430

2470

RequestHandlerClass)

2431

2471

2432

2472

def server_bind(self):

2433

2473

"""This overrides the normal server_bind() function

2434

2474

to bind to an interface if one was specified, and also NOT to

2435

2475

bind to an address or port if they were not specified."""

2476

global SO_BINDTODEVICE

2436

2477

if self.interface is not None:

2437

2478

if SO_BINDTODEVICE is None:

2438

logger.error("SO_BINDTODEVICE does not exist;"

2439

" cannot bind to interface %s",

2440

self.interface)

2441

else:

2442

try:

2443

self.socket.setsockopt(

2444

socket.SOL_SOCKET, SO_BINDTODEVICE,

2445

(self.interface + "\0").encode("utf-8"))

2446

except socket.error as error:

2447

if error.errno == errno.EPERM:

2448

logger.error("No permission to bind to"

2449

" interface %s", self.interface)

2450

elif error.errno == errno.ENOPROTOOPT:

2451

logger.error("SO_BINDTODEVICE not available;"

2452

" cannot bind to interface %s",

2453

self.interface)

2454

elif error.errno == errno.ENODEV:

2455

logger.error("Interface %s does not exist,"

2456

" cannot bind", self.interface)

2457

else:

2458

raise

2479

# Fall back to a hard-coded value which seems to be

2480

# common enough.

2481

logger.warning("SO_BINDTODEVICE not found, trying 25")

2482

SO_BINDTODEVICE = 25

2483

try:

2484

self.socket.setsockopt(

2485

socket.SOL_SOCKET, SO_BINDTODEVICE,

2486

(self.interface + "\0").encode("utf-8"))

2487

except socket.error as error:

2488

if error.errno == errno.EPERM:

2489

logger.error("No permission to bind to"

2490

" interface %s", self.interface)

2491

elif error.errno == errno.ENOPROTOOPT:

2492

logger.error("SO_BINDTODEVICE not available;"

2493

" cannot bind to interface %s",

2494

self.interface)

2495

elif error.errno == errno.ENODEV:

2496

logger.error("Interface %s does not exist,"

2497

" cannot bind", self.interface)

2498

else:

2499

raise

2459

2500

# Only bind(2) the socket if we really need to.

2460

2501

if self.server_address[0] or self.server_address[1]:

2461

2502

if not self.server_address[0]:

2462

2503

if self.address_family == socket.AF_INET6:

2463

any_address = "::" # in6addr_any

2504

any_address = "::" # in6addr_any

2464

2505

else:

2465

any_address = "0.0.0.0" # INADDR_ANY

2506

any_address = "0.0.0.0" # INADDR_ANY

2466

2507

self.server_address = (any_address,

2467

2508

self.server_address[1])

2468

2509

elif not self.server_address[1]:

2478

2519

2479

2520

class MandosServer(IPv6_TCPServer):

2480

2521

"""Mandos server.

2481

2522

2482

2523

Attributes:

2483

2524

clients: set of Client objects

2484

2525

gnutls_priority GnuTLS priority string

2485

2526

use_dbus: Boolean; to emit D-Bus signals or not

2486

2527

2487

2528

Assumes a GLib.MainLoop event loop.

2488

2529

"""

2489

2530

2490

2531

def __init__(self, server_address, RequestHandlerClass,

2491

2532

interface=None,

2492

2533

use_ipv6=True,

2502

2543

self.gnutls_priority = gnutls_priority

2503

2544

IPv6_TCPServer.__init__(self, server_address,

2504

2545

RequestHandlerClass,

2505

interface = interface,

2506

use_ipv6 = use_ipv6,

2507

socketfd = socketfd)

2508

2546

interface=interface,

2547

use_ipv6=use_ipv6,

2548

socketfd=socketfd)

2549

2509

2550

def server_activate(self):

2510

2551

if self.enabled:

2511

2552

return socketserver.TCPServer.server_activate(self)

2512

2553

2513

2554

def enable(self):

2514

2555

self.enabled = True

2515

2556

2516

2557

def add_pipe(self, parent_pipe, proc):

2517

2558

# Call "handle_ipc" for both data and EOF events

2518

2559

GLib.io_add_watch(

2519

2560

parent_pipe.fileno(),

2520

2561

GLib.IO_IN | GLib.IO_HUP,

2521

2562

functools.partial(self.handle_ipc,

2522

parent_pipe = parent_pipe,

2523

proc = proc))

2524

2563

parent_pipe=parent_pipe,

2564

proc=proc))

2565

2525

2566

def handle_ipc(self, source, condition,

2526

2567

parent_pipe=None,

2527

proc = None,

2568

proc=None,

2528

2569

client_object=None):

2529

2570

# error, or the other end of multiprocessing.Pipe has closed

2530

2571

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2531

2572

# Wait for other process to exit

2532

2573

proc.join()

2533

2574

return False

2534

2575

2535

2576

# Read a request from the child

2536

2577

request = parent_pipe.recv()

2537

2578

command = request[0]

2538

2579

2539

2580

if command == 'init':

2540

fpr = request[1]

2581

fpr = request[1].decode("ascii")

2541

2582

address = request[2]

2542

2583

2543

2584

for c in self.clients.values():

2544

2585

if c.fingerprint == fpr:

2545

2586

client = c

2553

2594

address[0])

2554

2595

parent_pipe.send(False)

2555

2596

return False

2556

2597

2557

2598

GLib.io_add_watch(

2558

2599

parent_pipe.fileno(),

2559

2600

GLib.IO_IN | GLib.IO_HUP,

2560

2601

functools.partial(self.handle_ipc,

2561

parent_pipe = parent_pipe,

2562

proc = proc,

2563

client_object = client))

2602

parent_pipe=parent_pipe,

2603

proc=proc,

2604

client_object=client))

2564

2605

parent_pipe.send(True)

2565

2606

# remove the old hook in favor of the new above hook on

2566

2607

# same fileno

2569

2610

funcname = request[1]

2570

2611

args = request[2]

2571

2612

kwargs = request[3]

2572

2613

2573

2614

parent_pipe.send(('data', getattr(client_object,

2574

2615

funcname)(*args,

2575

2616

**kwargs)))

2576

2617

2577

2618

if command == 'getattr':

2578

2619

attrname = request[1]

2579

2620

if isinstance(client_object.__getattribute__(attrname),

2582

2623

else:

2583

2624

parent_pipe.send((

2584

2625

'data', client_object.__getattribute__(attrname)))

2585

2626

2586

2627

if command == 'setattr':

2587

2628

attrname = request[1]

2588

2629

value = request[2]

2589

2630

setattr(client_object, attrname, value)

2590

2631

2591

2632

return True

2592

2633

2593

2634

2594

2635

def rfc3339_duration_to_delta(duration):

2595

2636

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2596

2637

2597

2638

>>> rfc3339_duration_to_delta("P7D")

2598

2639

datetime.timedelta(7)

2599

2640

>>> rfc3339_duration_to_delta("PT60S")

2609

2650

>>> rfc3339_duration_to_delta("P1DT3M20S")

2610

2651

datetime.timedelta(1, 200)

2611

2652

"""

2612

2653

2613

2654

# Parsing an RFC 3339 duration with regular expressions is not

2614

2655

# possible - there would have to be multiple places for the same

2615

2656

# values, like seconds. The current code, while more esoteric, is

2616

2657

# cleaner without depending on a parsing library. If Python had a

2617

2658

# built-in library for parsing we would use it, but we'd like to

2618

2659

# avoid excessive use of external libraries.

2619

2660

2620

2661

# New type for defining tokens, syntax, and semantics all-in-one

2621

2662

Token = collections.namedtuple("Token", (

2622

2663

"regexp", # To match token; if "value" is not None, must have

2655

2696

frozenset((token_year, token_month,

2656

2697

token_day, token_time,

2657

2698

token_week)))

2658

# Define starting values

2659

value = datetime.timedelta() # Value so far

2699

# Define starting values:

2700

# Value so far

2701

value = datetime.timedelta()

2660

2702

found_token = None

2661

followers = frozenset((token_duration, )) # Following valid tokens

2662

s = duration # String left to parse

2703

# Following valid tokens

2704

followers = frozenset((token_duration, ))

2705

# String left to parse

2706

s = duration

2663

2707

# Loop until end token is found

2664

2708

while found_token is not token_end:

2665

2709

# Search for any currently valid tokens

2689

2733

2690

2734

def string_to_delta(interval):

2691

2735

"""Parse a string and return a datetime.timedelta

2692

2736

2693

2737

>>> string_to_delta('7d')

2694

2738

datetime.timedelta(7)

2695

2739

>>> string_to_delta('60s')

2703

2747

>>> string_to_delta('5m 30s')

2704

2748

datetime.timedelta(0, 330)

2705

2749

"""

2706

2750

2707

2751

try:

2708

2752

return rfc3339_duration_to_delta(interval)

2709

2753

except ValueError:

2710

2754

pass

2711

2755

2712

2756

timevalue = datetime.timedelta(0)

2713

2757

for s in interval.split():

2714

2758

try:

2732

2776

return timevalue

2733

2777

2734

2778

2735

def daemon(nochdir = False, noclose = False):

2779

def daemon(nochdir=False, noclose=False):

2736

2780

"""See daemon(3). Standard BSD Unix function.

2737

2781

2738

2782

This should really exist as os.daemon, but it doesn't (yet)."""

2739

2783

if os.fork():

2740

2784

sys.exit()

2758

2802

2759

2803

2760

2804

def main():

2761

2805

2762

2806

##################################################################

2763

2807

# Parsing of options, both command line and config file

2764

2808

2765

2809

parser = argparse.ArgumentParser()

2766

2810

parser.add_argument("-v", "--version", action="version",

2767

version = "%(prog)s {}".format(version),

2811

version="%(prog)s {}".format(version),

2768

2812

help="show version number and exit")

2769

2813

parser.add_argument("-i", "--interface", metavar="IF",

2770

2814

help="Bind to interface IF")

2806

2850

parser.add_argument("--no-zeroconf", action="store_false",

2807

2851

dest="zeroconf", help="Do not use Zeroconf",

2808

2852

default=None)

2809

2853

2810

2854

options = parser.parse_args()

2811

2855

2812

2856

if options.check:

2813

2857

import doctest

2814

2858

fail_count, test_count = doctest.testmod()

2815

2859

sys.exit(os.EX_OK if fail_count == 0 else 1)

2816

2860

2817

2861

# Default values for config file for server-global settings

2818

server_defaults = { "interface": "",

2819

"address": "",

2820

"port": "",

2821

"debug": "False",

2822

"priority":

2823

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2824

":+SIGN-DSA-SHA256",

2825

"servicename": "Mandos",

2826

"use_dbus": "True",

2827

"use_ipv6": "True",

2828

"debuglevel": "",

2829

"restore": "True",

2830

"socket": "",

2831

"statedir": "/var/lib/mandos",

2832

"foreground": "False",

2833

"zeroconf": "True",

2834

}

2835

2862

server_defaults = {"interface": "",

2863

"address": "",

2864

"port": "",

2865

"debug": "False",

2866

"priority":

2867

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2868

":+SIGN-DSA-SHA256",

2869

"servicename": "Mandos",

2870

"use_dbus": "True",

2871

"use_ipv6": "True",

2872

"debuglevel": "",

2873

"restore": "True",

2874

"socket": "",

2875

"statedir": "/var/lib/mandos",

2876

"foreground": "False",

2877

"zeroconf": "True",

2878

}

2879

2836

2880

# Parse config file for server-global settings

2837

2881

server_config = configparser.SafeConfigParser(server_defaults)

2838

2882

del server_defaults

2840

2884

# Convert the SafeConfigParser object to a dict

2841

2885

server_settings = server_config.defaults()

2842

2886

# Use the appropriate methods on the non-string config options

2843

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

2887

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2888

"foreground", "zeroconf"):

2844

2889

server_settings[option] = server_config.getboolean("DEFAULT",

2845

2890

option)

2846

2891

if server_settings["port"]:

2856

2901

server_settings["socket"] = os.dup(server_settings

2857

2902

["socket"])

2858

2903

del server_config

2859

2904

2860

2905

# Override the settings from the config file with command line

2861

2906

# options, if set.

2862

2907

for option in ("interface", "address", "port", "debug",

2880

2925

if server_settings["debug"]:

2881

2926

server_settings["foreground"] = True

2882

2927

# Now we have our good server settings in "server_settings"

2883

2928

2884

2929

##################################################################

2885

2930

2886

2931

if (not server_settings["zeroconf"]

2887

2932

and not (server_settings["port"]

2888

2933

or server_settings["socket"] != "")):

2889

2934

parser.error("Needs port or socket to work without Zeroconf")

2890

2935

2891

2936

# For convenience

2892

2937

debug = server_settings["debug"]

2893

2938

debuglevel = server_settings["debuglevel"]

2897

2942

stored_state_file)

2898

2943

foreground = server_settings["foreground"]

2899

2944

zeroconf = server_settings["zeroconf"]

2900

2945

2901

2946

if debug:

2902

2947

initlogger(debug, logging.DEBUG)

2903

2948

else:

2906

2951

else:

2907

2952

level = getattr(logging, debuglevel.upper())

2908

2953

initlogger(debug, level)

2909

2954

2910

2955

if server_settings["servicename"] != "Mandos":

2911

2956

syslogger.setFormatter(

2912

2957

logging.Formatter('Mandos ({}) [%(process)d]:'

2913

2958

' %(levelname)s: %(message)s'.format(

2914

2959

server_settings["servicename"])))

2915

2960

2916

2961

# Parse config file with clients

2917

2962

client_config = configparser.SafeConfigParser(Client

2918

2963

.client_defaults)

2919

2964

client_config.read(os.path.join(server_settings["configdir"],

2920

2965

"clients.conf"))

2921

2966

2922

2967

global mandos_dbus_service

2923

2968

mandos_dbus_service = None

2924

2969

2925

2970

socketfd = None

2926

2971

if server_settings["socket"] != "":

2927

2972

socketfd = server_settings["socket"]

2943

2988

except IOError as e:

2944

2989

logger.error("Could not open file %r", pidfilename,

2945

2990

exc_info=e)

2946

2991

2947

2992

for name, group in (("_mandos", "_mandos"),

2948

2993

("mandos", "mandos"),

2949

2994

("nobody", "nogroup")):

2967

3012

.format(uid, gid, os.strerror(error.errno)))

2968

3013

if error.errno != errno.EPERM:

2969

3014

raise

2970

3015

2971

3016

if debug:

2972

3017

# Enable all possible GnuTLS debugging

2973

3018

2974

3019

# "Use a log level over 10 to enable all debugging options."

2975

3020

# - GnuTLS manual

2976

3021

gnutls.global_set_log_level(11)

2977

3022

2978

3023

@gnutls.log_func

2979

3024

def debug_gnutls(level, string):

2980

3025

logger.debug("GnuTLS: %s", string[:-1])

2981

3026

2982

3027

gnutls.global_set_log_function(debug_gnutls)

2983

3028

2984

3029

# Redirect stdin so all checkers get /dev/null

2985

3030

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2986

3031

os.dup2(null, sys.stdin.fileno())

2987

3032

if null > 2:

2988

3033

os.close(null)

2989

3034

2990

3035

# Need to fork before connecting to D-Bus

2991

3036

if not foreground:

2992

3037

# Close all input and output, do double fork, etc.

2993

3038

daemon()

2994

3039

2995

3040

# multiprocessing will use threads, so before we use GLib we need

2996

3041

# to inform GLib that threads will be used.

2997

3042

GLib.threads_init()

2998

3043

2999

3044

global main_loop

3000

3045

# From the Avahi example code

3001

3046

DBusGMainLoop(set_as_default=True)

3018

3063

if zeroconf:

3019

3064

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3020

3065

service = AvahiServiceToSyslog(

3021

name = server_settings["servicename"],

3022

servicetype = "_mandos._tcp",

3023

protocol = protocol,

3024

bus = bus)

3066

name=server_settings["servicename"],

3067

servicetype="_mandos._tcp",

3068

protocol=protocol,

3069

bus=bus)

3025

3070

if server_settings["interface"]:

3026

3071

service.interface = if_nametoindex(

3027

3072

server_settings["interface"].encode("utf-8"))

3028

3073

3029

3074

global multiprocessing_manager

3030

3075

multiprocessing_manager = multiprocessing.Manager()

3031

3076

3032

3077

client_class = Client

3033

3078

if use_dbus:

3034

client_class = functools.partial(ClientDBus, bus = bus)

3035

3079

client_class = functools.partial(ClientDBus, bus=bus)

3080

3036

3081

client_settings = Client.config_parser(client_config)

3037

3082

old_client_settings = {}

3038

3083

clients_data = {}

3039

3084

3040

3085

# This is used to redirect stdout and stderr for checker processes

3041

3086

global wnull

3042

wnull = open(os.devnull, "w") # A writable /dev/null

3087

wnull = open(os.devnull, "w") # A writable /dev/null

3043

3088

# Only used if server is running in foreground but not in debug

3044

3089

# mode

3045

3090

if debug or not foreground:

3046

3091

wnull.close()

3047

3092

3048

3093

# Get client data and settings from last running state.

3049

3094

if server_settings["restore"]:

3050

3095

try:

3051

3096

with open(stored_state_path, "rb") as stored_state:

3052

if sys.version_info.major == 2:

3097

if sys.version_info.major == 2:

3053

3098

clients_data, old_client_settings = pickle.load(

3054

3099

stored_state)

3055

3100

else:

3056

3101

bytes_clients_data, bytes_old_client_settings = (

3057

pickle.load(stored_state, encoding = "bytes"))

3058

### Fix bytes to strings

3059

## clients_data

3102

pickle.load(stored_state, encoding="bytes"))

3103

# Fix bytes to strings

3104

# clients_data

3060

3105

# .keys()

3061

clients_data = { (key.decode("utf-8")

3062

if isinstance(key, bytes)

3063

else key): value

3064

for key, value in

3065

bytes_clients_data.items() }

3106

clients_data = {(key.decode("utf-8")

3107

if isinstance(key, bytes)

3108

else key): value

3109

for key, value in

3110

bytes_clients_data.items()}

3066

3111

del bytes_clients_data

3067

3112

for key in clients_data:

3068

value = { (k.decode("utf-8")

3069

if isinstance(k, bytes) else k): v

3070

for k, v in

3071

clients_data[key].items() }

3113

value = {(k.decode("utf-8")

3114

if isinstance(k, bytes) else k): v

3115

for k, v in

3116

clients_data[key].items()}

3072

3117

clients_data[key] = value

3073

3118

# .client_structure

3074

3119

value["client_structure"] = [

3075

3120

(s.decode("utf-8")

3076

3121

if isinstance(s, bytes)

3077

3122

else s) for s in

3078

value["client_structure"] ]

3123

value["client_structure"]]

3079

3124

# .name & .host

3080

3125

for k in ("name", "host"):

3081

3126

if isinstance(value[k], bytes):

3082

3127

value[k] = value[k].decode("utf-8")

3083

## old_client_settings

3128

# old_client_settings

3084

3129

# .keys()

3085

3130

old_client_settings = {

3086

3131

(key.decode("utf-8")

3087

3132

if isinstance(key, bytes)

3088

3133

else key): value

3089

3134

for key, value in

3090

bytes_old_client_settings.items() }

3135

bytes_old_client_settings.items()}

3091

3136

del bytes_old_client_settings

3092

3137

# .host

3093

3138

for value in old_client_settings.values():

3107

3152

logger.warning("Could not load persistent state: "

3108

3153

"EOFError:",

3109

3154

exc_info=e)

3110

3155

3111

3156

with PGPEngine() as pgp:

3112

3157

for client_name, client in clients_data.items():

3113

3158

# Skip removed clients

3114

3159

if client_name not in client_settings:

3115

3160

continue

3116

3161

3117

3162

# Decide which value to use after restoring saved state.

3118

3163

# We have three different values: Old config file,

3119

3164

# new config file, and saved state.

3130

3175

client[name] = value

3131

3176

except KeyError:

3132

3177

pass

3133

3178

3134

3179

# Clients who has passed its expire date can still be

3135

3180

# enabled if its last checker was successful. A Client

3136

3181

# whose checker succeeded before we stored its state is

3169

3214

client_name))

3170

3215

client["secret"] = (client_settings[client_name]

3171

3216

["secret"])

3172

3217

3173

3218

# Add/remove clients based on new changes made to config

3174

3219

for client_name in (set(old_client_settings)

3175

3220

- set(client_settings)):

3177

3222

for client_name in (set(client_settings)

3178

3223

- set(old_client_settings)):

3179

3224

clients_data[client_name] = client_settings[client_name]

3180

3225

3181

3226

# Create all client objects

3182

3227

for client_name, client in clients_data.items():

3183

3228

tcp_server.clients[client_name] = client_class(

3184

name = client_name,

3185

settings = client,

3186

server_settings = server_settings)

3187

3229

name=client_name,

3230

settings=client,

3231

server_settings=server_settings)

3232

3188

3233

if not tcp_server.clients:

3189

3234

logger.warning("No clients defined")

3190

3235

3191

3236

if not foreground:

3192

3237

if pidfile is not None:

3193

3238

pid = os.getpid()

3199

3244

pidfilename, pid)

3200

3245

del pidfile

3201

3246

del pidfilename

3202

3247

3203

3248

for termsig in (signal.SIGHUP, signal.SIGTERM):

3204

3249

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3205

3250

lambda: main_loop.quit() and False)

3206

3251

3207

3252

if use_dbus:

3208

3253

3209

3254

@alternate_dbus_interfaces(

3210

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3255

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3211

3256

class MandosDBusService(DBusObjectWithObjectManager):

3212

3257

"""A D-Bus proxy object"""

3213

3258

3214

3259

def __init__(self):

3215

3260

dbus.service.Object.__init__(self, bus, "/")

3216

3261

3217

3262

_interface = "se.recompile.Mandos"

3218

3263

3219

3264

@dbus.service.signal(_interface, signature="o")

3220

3265

def ClientAdded(self, objpath):

3221

3266

"D-Bus signal"

3222

3267

pass

3223

3268

3224

3269

@dbus.service.signal(_interface, signature="ss")

3225

3270

def ClientNotFound(self, fingerprint, address):

3226

3271

"D-Bus signal"

3227

3272

pass

3228

3273

3229

3274

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3230

3275

"true"})

3231

3276

@dbus.service.signal(_interface, signature="os")

3232

3277

def ClientRemoved(self, objpath, name):

3233

3278

"D-Bus signal"

3234

3279

pass

3235

3280

3236

3281

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3237

3282

"true"})

3238

3283

@dbus.service.method(_interface, out_signature="ao")

3240

3285

"D-Bus method"

3241

3286

return dbus.Array(c.dbus_object_path for c in

3242

3287

tcp_server.clients.values())

3243

3288

3244

3289

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3245

3290

"true"})

3246

3291

@dbus.service.method(_interface,

3248

3293

def GetAllClientsWithProperties(self):

3249

3294

"D-Bus method"

3250

3295

return dbus.Dictionary(

3251

{ c.dbus_object_path: c.GetAll(

3296

{c.dbus_object_path: c.GetAll(

3252

3297

"se.recompile.Mandos.Client")

3253

for c in tcp_server.clients.values() },

3298

for c in tcp_server.clients.values()},

3254

3299

signature="oa{sv}")

3255

3300

3256

3301

@dbus.service.method(_interface, in_signature="o")

3257

3302

def RemoveClient(self, object_path):

3258

3303

"D-Bus method"

3266

3311

self.client_removed_signal(c)

3267

3312

return

3268

3313

raise KeyError(object_path)

3269

3314

3270

3315

del _interface

3271

3316

3272

3317

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3273

out_signature = "a{oa{sa{sv}}}")

3318

out_signature="a{oa{sa{sv}}}")

3274

3319

def GetManagedObjects(self):

3275

3320

"""D-Bus method"""

3276

3321

return dbus.Dictionary(

3277

{ client.dbus_object_path:

3278

dbus.Dictionary(

3279

{ interface: client.GetAll(interface)

3280

for interface in

3281

client._get_all_interface_names()})

3282

for client in tcp_server.clients.values()})

3283

3322

{client.dbus_object_path:

3323

dbus.Dictionary(

3324

{interface: client.GetAll(interface)

3325

for interface in

3326

client._get_all_interface_names()})

3327

for client in tcp_server.clients.values()})

3328

3284

3329

def client_added_signal(self, client):

3285

3330

"""Send the new standard signal and the old signal"""

3286

3331

if use_dbus:

3288

3333

self.InterfacesAdded(

3289

3334

client.dbus_object_path,

3290

3335

dbus.Dictionary(

3291

{ interface: client.GetAll(interface)

3292

for interface in

3293

client._get_all_interface_names()}))

3336

{interface: client.GetAll(interface)

3337

for interface in

3338

client._get_all_interface_names()}))

3294

3339

# Old signal

3295

3340

self.ClientAdded(client.dbus_object_path)

3296

3341

3297

3342

def client_removed_signal(self, client):

3298

3343

"""Send the new standard signal and the old signal"""

3299

3344

if use_dbus:

3304

3349

# Old signal

3305

3350

self.ClientRemoved(client.dbus_object_path,

3306

3351

client.name)

3307

3352

3308

3353

mandos_dbus_service = MandosDBusService()

3309

3354

3355

# Save modules to variables to exempt the modules from being

3356

# unloaded before the function registered with atexit() is run.

3357

mp = multiprocessing

3358

wn = wnull

3359

3310

3360

def cleanup():

3311

3361

"Cleanup function; run on exit"

3312

3362

if zeroconf:

3313

3363

service.cleanup()

3314

3315

multiprocessing.active_children()

3316

wnull.close()

3364

3365

mp.active_children()

3366

wn.close()

3317

3367

if not (tcp_server.clients or client_settings):

3318

3368

return

3319

3369

3320

3370

# Store client before exiting. Secrets are encrypted with key

3321

3371

# based on what config file has. If config file is

3322

3372

# removed/edited, old secret will thus be unrecovable.

3327

3377

client.encrypted_secret = pgp.encrypt(client.secret,

3328

3378

key)

3329

3379

client_dict = {}

3330

3380

3331

3381

# A list of attributes that can not be pickled

3332

3382

# + secret.

3333

exclude = { "bus", "changedstate", "secret",

3334

"checker", "server_settings" }

3383

exclude = {"bus", "changedstate", "secret",

3384

"checker", "server_settings"}

3335

3385

for name, typ in inspect.getmembers(dbus.service

3336

3386

.Object):

3337

3387

exclude.add(name)

3338

3388

3339

3389

client_dict["encrypted_secret"] = (client

3340

3390

.encrypted_secret)

3341

3391

for attr in client.client_structure:

3342

3392

if attr not in exclude:

3343

3393

client_dict[attr] = getattr(client, attr)

3344

3394

3345

3395

clients[client.name] = client_dict

3346

3396

del client_settings[client.name]["secret"]

3347

3397

3348

3398

try:

3349

3399

with tempfile.NamedTemporaryFile(

3350

3400

mode='wb',

3353

3403

dir=os.path.dirname(stored_state_path),

3354

3404

delete=False) as stored_state:

3355

3405

pickle.dump((clients, client_settings), stored_state,

3356

protocol = 2)

3406

protocol=2)

3357

3407

tempname = stored_state.name

3358

3408

os.rename(tempname, stored_state_path)

3359

3409

except (IOError, OSError) as e:

3369

3419

logger.warning("Could not save persistent state:",

3370

3420

exc_info=e)

3371

3421

raise

3372

3422

3373

3423

# Delete all clients, and settings from config

3374

3424

while tcp_server.clients:

3375

3425

name, client = tcp_server.clients.popitem()

3381

3431

if use_dbus:

3382

3432

mandos_dbus_service.client_removed_signal(client)

3383

3433

client_settings.clear()

3384

3434

3385

3435

atexit.register(cleanup)

3386

3436

3387

3437

for client in tcp_server.clients.values():

3388

3438

if use_dbus:

3389

3439

# Emit D-Bus signal for adding

3391

3441

# Need to initiate checking of clients

3392

3442

if client.enabled:

3393

3443

client.init_checker()

3394

3444

3395

3445

tcp_server.enable()

3396

3446

tcp_server.server_activate()

3397

3447

3398

3448

# Find out what port we got

3399

3449

if zeroconf:

3400

3450

service.port = tcp_server.socket.getsockname()[1]

3405

3455

else: # IPv4

3406

3456

logger.info("Now listening on address %r, port %d",

3407

3457

*tcp_server.socket.getsockname())

3408

3409

#service.interface = tcp_server.socket.getsockname()[3]

3410

3458

3459

# service.interface = tcp_server.socket.getsockname()[3]

3460

3411

3461

try:

3412

3462

if zeroconf:

3413

3463

# From the Avahi example code

3418

3468

cleanup()

3419

3469

sys.exit(1)

3420

3470

# End of Avahi example code

3421

3471

3422

3472

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3423

3473

lambda *args, **kwargs:

3424

3474

(tcp_server.handle_request

3425

3475

(*args[2:], **kwargs) or True))

3426

3476

3427

3477

logger.debug("Starting main loop")

3428

3478

main_loop.run()

3429

3479

except AvahiError as error: