/mandos/release : revision 237.7.475

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

19

21

# the Free Software Foundation, either version 3 of the License, or

20

22

# (at your option) any later version.

21

23

#

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

24

26

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

25

27

# GNU General Public License for more details.

26

#

28

#

27

29

# You should have received a copy of the GNU General Public License

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

31

32

# Contact the authors at <mandos@recompile.se>.

32

#

33

#

33

34

35

from __future__ import (division, absolute_import, print_function,

35

36

unicode_literals)

36

37

from future_builtins import *

38

try:

39

from future_builtins import *

40

except ImportError:

41

pass

38

42

39

43

try:

40

44

import SocketServer as socketserver

76

80

77

81

import dbus

78

82

import dbus.service

79

try:

80

import gobject

81

except ImportError:

82

from gi.repository import GObject as gobject

83

import avahi

83

from gi.repository import GLib

84

from dbus.mainloop.glib import DBusGMainLoop

85

import ctypes

86

import ctypes.util

87

import xml.dom.minidom

88

import inspect

89

90

# Try to find the value of SO_BINDTODEVICE:

90

91

try:

92

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

93

# newer, and it is also the most natural place for it:

91

94

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

92

95

except AttributeError:

93

96

try:

97

# This is where SO_BINDTODEVICE was up to and including Python

98

# 2.6, and also 3.2:

94

99

from IN import SO_BINDTODEVICE

95

100

except ImportError:

96

SO_BINDTODEVICE = None

101

# In Python 2.7 it seems to have been removed entirely.

102

# Try running the C preprocessor:

103

try:

104

cc = subprocess.Popen(["cc", "--language=c", "-E",

105

"/dev/stdin"],

106

stdin=subprocess.PIPE,

107

stdout=subprocess.PIPE)

108

stdout = cc.communicate(

109

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

110

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

111

except (OSError, ValueError, IndexError):

112

# No value found

113

SO_BINDTODEVICE = None

97

114

98

115

if sys.version_info.major == 2:

99

116

str = unicode

100

117

101

version = "1.7.3"

118

version = "1.7.16"

102

119

stored_state_file = "clients.pickle"

103

120

104

121

logger = logging.getLogger()

108

125

if_nametoindex = ctypes.cdll.LoadLibrary(

109

126

ctypes.util.find_library("c")).if_nametoindex

110

127

except (OSError, AttributeError):

111

128

112

129

def if_nametoindex(interface):

113

130

"Get an interface index the hard way, i.e. using fcntl()"

114

131

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

119

136

return interface_index

120

137

121

138

139

def copy_function(func):

140

"""Make a copy of a function"""

141

if sys.version_info.major == 2:

142

return types.FunctionType(func.func_code,

143

func.func_globals,

144

func.func_name,

145

func.func_defaults,

146

func.func_closure)

147

else:

148

return types.FunctionType(func.__code__,

149

func.__globals__,

150

func.__name__,

151

func.__defaults__,

152

func.__closure__)

153

154

122

155

def initlogger(debug, level=logging.WARNING):

123

156

"""init logger and add loglevel"""

124

157

125

158

global syslogger

126

159

syslogger = (logging.handlers.SysLogHandler(

127

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

128

address = "/dev/log"))

160

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

161

address="/dev/log"))

129

162

syslogger.setFormatter(logging.Formatter

130

163

('Mandos [%(process)d]: %(levelname)s:'

131

164

' %(message)s'))

132

165

logger.addHandler(syslogger)

133

166

134

167

if debug:

135

168

console = logging.StreamHandler()

136

169

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

148

181

149

182

class PGPEngine(object):

150

183

"""A simple class for OpenPGP symmetric encryption & decryption"""

151

184

152

185

def __init__(self):

153

186

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

154

187

self.gpg = "gpg"

155

188

try:

156

189

output = subprocess.check_output(["gpgconf"])

157

190

for line in output.splitlines():

158

name, text, path = line.split(":")

191

name, text, path = line.split(b":")

159

192

if name == "gpg":

160

193

self.gpg = path

161

194

break

165

198

self.gnupgargs = ['--batch',

166

199

'--homedir', self.tempdir,

167

200

'--force-mdc',

168

'--quiet',

169

'--no-use-agent']

170

201

'--quiet']

202

# Only GPG version 1 has the --no-use-agent option.

203

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

204

self.gnupgargs.append("--no-use-agent")

205

171

206

def __enter__(self):

172

207

return self

173

208

174

209

def __exit__(self, exc_type, exc_value, traceback):

175

210

self._cleanup()

176

211

return False

177

212

178

213

def __del__(self):

179

214

self._cleanup()

180

215

181

216

def _cleanup(self):

182

217

if self.tempdir is not None:

183

218

# Delete contents of tempdir

184

219

for root, dirs, files in os.walk(self.tempdir,

185

topdown = False):

220

topdown=False):

186

221

for filename in files:

187

222

os.remove(os.path.join(root, filename))

188

223

for dirname in dirs:

190

225

# Remove tempdir

191

226

os.rmdir(self.tempdir)

192

227

self.tempdir = None

193

228

194

229

def password_encode(self, password):

195

230

# Passphrase can not be empty and can not contain newlines or

196

231

# NUL bytes. So we prefix it and hex encode it.

201

236

.replace(b"\n", b"\\n")

202

237

.replace(b"\0", b"\\x00"))

203

238

return encoded

204

239

205

240

def encrypt(self, data, password):

206

241

passphrase = self.password_encode(password)

207

242

with tempfile.NamedTemporaryFile(

212

247

'--passphrase-file',

213

248

passfile.name]

214

249

+ self.gnupgargs,

215

stdin = subprocess.PIPE,

216

stdout = subprocess.PIPE,

217

stderr = subprocess.PIPE)

218

ciphertext, err = proc.communicate(input = data)

250

stdin=subprocess.PIPE,

251

stdout=subprocess.PIPE,

252

stderr=subprocess.PIPE)

253

ciphertext, err = proc.communicate(input=data)

219

254

if proc.returncode != 0:

220

255

raise PGPError(err)

221

256

return ciphertext

222

257

223

258

def decrypt(self, data, password):

224

259

passphrase = self.password_encode(password)

225

260

with tempfile.NamedTemporaryFile(

226

dir = self.tempdir) as passfile:

261

dir=self.tempdir) as passfile:

227

262

passfile.write(passphrase)

228

263

passfile.flush()

229

264

proc = subprocess.Popen([self.gpg, '--decrypt',

230

265

'--passphrase-file',

231

266

passfile.name]

232

267

+ self.gnupgargs,

233

stdin = subprocess.PIPE,

234

stdout = subprocess.PIPE,

235

stderr = subprocess.PIPE)

236

decrypted_plaintext, err = proc.communicate(input = data)

268

stdin=subprocess.PIPE,

269

stdout=subprocess.PIPE,

270

stderr=subprocess.PIPE)

271

decrypted_plaintext, err = proc.communicate(input=data)

237

272

if proc.returncode != 0:

238

273

raise PGPError(err)

239

274

return decrypted_plaintext

240

275

241

276

277

# Pretend that we have an Avahi module

278

class Avahi(object):

279

"""This isn't so much a class as it is a module-like namespace.

280

It is instantiated once, and simulates having an Avahi module."""

281

IF_UNSPEC = -1 # avahi-common/address.h

282

PROTO_UNSPEC = -1 # avahi-common/address.h

283

PROTO_INET = 0 # avahi-common/address.h

284

PROTO_INET6 = 1 # avahi-common/address.h

285

DBUS_NAME = "org.freedesktop.Avahi"

286

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

287

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

288

DBUS_PATH_SERVER = "/"

289

290

def string_array_to_txt_array(self, t):

291

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

292

for s in t), signature="ay")

293

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

294

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

295

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

296

SERVER_INVALID = 0 # avahi-common/defs.h

297

SERVER_REGISTERING = 1 # avahi-common/defs.h

298

SERVER_RUNNING = 2 # avahi-common/defs.h

299

SERVER_COLLISION = 3 # avahi-common/defs.h

300

SERVER_FAILURE = 4 # avahi-common/defs.h

301

avahi = Avahi()

302

303

242

304

class AvahiError(Exception):

243

305

def __init__(self, value, *args, **kwargs):

244

306

self.value = value

256

318

257

319

class AvahiService(object):

258

320

"""An Avahi (Zeroconf) service.

259

321

260

322

Attributes:

261

323

interface: integer; avahi.IF_UNSPEC or an interface index.

262

324

Used to optionally bind to the specified interface.

274

336

server: D-Bus Server

275

337

bus: dbus.SystemBus()

276

338

"""

277

339

278

340

def __init__(self,

279

interface = avahi.IF_UNSPEC,

280

name = None,

281

servicetype = None,

282

port = None,

283

TXT = None,

284

domain = "",

285

host = "",

286

max_renames = 32768,

287

protocol = avahi.PROTO_UNSPEC,

288

bus = None):

341

interface=avahi.IF_UNSPEC,

342

name=None,

343

servicetype=None,

344

port=None,

345

TXT=None,

346

domain="",

347

host="",

348

max_renames=32768,

349

protocol=avahi.PROTO_UNSPEC,

350

bus=None):

289

351

self.interface = interface

290

352

self.name = name

291

353

self.type = servicetype

300

362

self.server = None

301

363

self.bus = bus

302

364

self.entry_group_state_changed_match = None

303

365

304

366

def rename(self, remove=True):

305

367

"""Derived from the Avahi example code"""

306

368

if self.rename_count >= self.max_renames:

326

388

logger.critical("D-Bus Exception", exc_info=error)

327

389

self.cleanup()

328

390

os._exit(1)

329

391

330

392

def remove(self):

331

393

"""Derived from the Avahi example code"""

332

394

if self.entry_group_state_changed_match is not None:

334

396

self.entry_group_state_changed_match = None

335

397

if self.group is not None:

336

398

self.group.Reset()

337

399

338

400

def add(self):

339

401

"""Derived from the Avahi example code"""

340

402

self.remove()

357

419

dbus.UInt16(self.port),

358

420

avahi.string_array_to_txt_array(self.TXT))

359

421

self.group.Commit()

360

422

361

423

def entry_group_state_changed(self, state, error):

362

424

"""Derived from the Avahi example code"""

363

425

logger.debug("Avahi entry group state change: %i", state)

364

426

365

427

if state == avahi.ENTRY_GROUP_ESTABLISHED:

366

428

logger.debug("Zeroconf service established.")

367

429

elif state == avahi.ENTRY_GROUP_COLLISION:

371

433

logger.critical("Avahi: Error in group state changed %s",

372

434

str(error))

373

435

raise AvahiGroupError("State changed: {!s}".format(error))

374

436

375

437

def cleanup(self):

376

438

"""Derived from the Avahi example code"""

377

439

if self.group is not None:

382

444

pass

383

445

self.group = None

384

446

self.remove()

385

447

386

448

def server_state_changed(self, state, error=None):

387

449

"""Derived from the Avahi example code"""

388

450

logger.debug("Avahi server state change: %i", state)

417

479

logger.debug("Unknown state: %r", state)

418

480

else:

419

481

logger.debug("Unknown state: %r: %r", state, error)

420

482

421

483

def activate(self):

422

484

"""Derived from the Avahi example code"""

423

485

if self.server is None:

434

496

class AvahiServiceToSyslog(AvahiService):

435

497

def rename(self, *args, **kwargs):

436

498

"""Add the new name to the syslog messages"""

437

ret = AvahiService.rename(self, *args, **kwargs)

499

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

438

500

syslogger.setFormatter(logging.Formatter(

439

501

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

440

502

.format(self.name)))

441

503

return ret

442

504

505

443

506

# Pretend that we have a GnuTLS module

444

507

class GnuTLS(object):

445

508

"""This isn't so much a class as it is a module-like namespace.

446

509

It is instantiated once, and simulates having a GnuTLS module."""

447

448

_library = ctypes.cdll.LoadLibrary(

449

ctypes.util.find_library("gnutls"))

450

_need_version = "3.3.0"

510

511

library = ctypes.util.find_library("gnutls")

512

if library is None:

513

library = ctypes.util.find_library("gnutls-deb0")

514

_library = ctypes.cdll.LoadLibrary(library)

515

del library

516

_need_version = b"3.3.0"

517

451

518

def __init__(self):

452

# Need to use class name "GnuTLS" here, since this method is

453

# called before the assignment to the "gnutls" global variable

454

# happens.

455

if GnuTLS.check_version(self._need_version) is None:

456

raise GnuTLS.Error("Needs GnuTLS {} or later"

457

.format(self._need_version))

458

519

# Need to use "self" here, since this method is called before

520

# the assignment to the "gnutls" global variable happens.

521

if self.check_version(self._need_version) is None:

522

raise self.Error("Needs GnuTLS {} or later"

523

.format(self._need_version))

524

459

525

# Unless otherwise indicated, the constants and types below are

460

526

# all from the gnutls/gnutls.h C header file.

461

527

462

528

# Constants

463

529

E_SUCCESS = 0

464

530

E_INTERRUPTED = -52

469

535

CRD_CERTIFICATE = 1

470

536

E_NO_CERTIFICATE_FOUND = -49

471

537

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

472

538

473

539

# Types

474

540

class session_int(ctypes.Structure):

475

541

_fields_ = []

476

542

session_t = ctypes.POINTER(session_int)

543

477

544

class certificate_credentials_st(ctypes.Structure):

478

545

_fields_ = []

479

546

certificate_credentials_t = ctypes.POINTER(

480

547

certificate_credentials_st)

481

548

certificate_type_t = ctypes.c_int

549

482

550

class datum_t(ctypes.Structure):

483

551

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

484

552

('size', ctypes.c_uint)]

553

485

554

class openpgp_crt_int(ctypes.Structure):

486

555

_fields_ = []

487

556

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

488

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

557

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

489

558

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

490

credentials_type_t = ctypes.c_int #

559

credentials_type_t = ctypes.c_int

491

560

transport_ptr_t = ctypes.c_void_p

492

561

close_request_t = ctypes.c_int

493

562

494

563

# Exceptions

495

564

class Error(Exception):

496

565

# We need to use the class name "GnuTLS" here, since this

497

566

# exception might be raised from within GnuTLS.__init__,

498

567

# which is called before the assignment to the "gnutls"

499

568

# global variable has happened.

500

def __init__(self, message = None, code = None, args=()):

569

def __init__(self, message=None, code=None, args=()):

501

570

# Default usage is by a message string, but if a return

502

571

# code is passed, convert it to a string with

503

572

# gnutls.strerror()

506

575

message = GnuTLS.strerror(code)

507

576

return super(GnuTLS.Error, self).__init__(

508

577

message, *args)

509

578

510

579

class CertificateSecurityError(Error):

511

580

pass

512

581

513

582

# Classes

514

583

class Credentials(object):

515

584

def __init__(self):

517

586

gnutls.certificate_allocate_credentials(

518

587

ctypes.byref(self._c_object))

519

588

self.type = gnutls.CRD_CERTIFICATE

520

589

521

590

def __del__(self):

522

591

gnutls.certificate_free_credentials(self._c_object)

523

592

524

593

class ClientSession(object):

525

def __init__(self, socket, credentials = None):

594

def __init__(self, socket, credentials=None):

526

595

self._c_object = gnutls.session_t()

527

596

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

528

597

gnutls.set_default_priority(self._c_object)

536

605

ctypes.cast(credentials._c_object,

537

606

ctypes.c_void_p))

538

607

self.credentials = credentials

539

608

540

609

def __del__(self):

541

610

gnutls.deinit(self._c_object)

542

611

543

612

def handshake(self):

544

613

return gnutls.handshake(self._c_object)

545

614

546

615

def send(self, data):

547

616

data = bytes(data)

548

617

data_len = len(data)

550

619

data_len -= gnutls.record_send(self._c_object,

551

620

data[-data_len:],

552

621

data_len)

553

622

554

623

def bye(self):

555

624

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

556

625

557

626

# Error handling functions

558

627

def _error_code(result):

559

628

"""A function to raise exceptions on errors, suitable

561

630

if result >= 0:

562

631

return result

563

632

if result == gnutls.E_NO_CERTIFICATE_FOUND:

564

raise gnutls.CertificateSecurityError(code = result)

565

raise gnutls.Error(code = result)

566

633

raise gnutls.CertificateSecurityError(code=result)

634

raise gnutls.Error(code=result)

635

567

636

def _retry_on_error(result, func, arguments):

568

637

"""A function to retry on some errors, suitable

569

638

for the 'errcheck' attribute on ctypes functions"""

572

641

return _error_code(result)

573

642

result = func(*arguments)

574

643

return result

575

644

576

645

# Unless otherwise indicated, the function declarations below are

577

646

# all from the gnutls/gnutls.h C header file.

578

647

579

648

# Functions

580

649

priority_set_direct = _library.gnutls_priority_set_direct

581

650

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

582

651

ctypes.POINTER(ctypes.c_char_p)]

583

652

priority_set_direct.restype = _error_code

584

653

585

654

init = _library.gnutls_init

586

655

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

587

656

init.restype = _error_code

588

657

589

658

set_default_priority = _library.gnutls_set_default_priority

590

659

set_default_priority.argtypes = [session_t]

591

660

set_default_priority.restype = _error_code

592

661

593

662

record_send = _library.gnutls_record_send

594

663

record_send.argtypes = [session_t, ctypes.c_void_p,

595

664

ctypes.c_size_t]

596

665

record_send.restype = ctypes.c_ssize_t

597

666

record_send.errcheck = _retry_on_error

598

667

599

668

certificate_allocate_credentials = (

600

669

_library.gnutls_certificate_allocate_credentials)

601

670

certificate_allocate_credentials.argtypes = [

602

671

ctypes.POINTER(certificate_credentials_t)]

603

672

certificate_allocate_credentials.restype = _error_code

604

673

605

674

certificate_free_credentials = (

606

675

_library.gnutls_certificate_free_credentials)

607

certificate_free_credentials.argtypes = [certificate_credentials_t]

676

certificate_free_credentials.argtypes = [

677

certificate_credentials_t]

608

678

certificate_free_credentials.restype = None

609

679

610

680

handshake_set_private_extensions = (

611

681

_library.gnutls_handshake_set_private_extensions)

612

682

handshake_set_private_extensions.argtypes = [session_t,

613

683

ctypes.c_int]

614

684

handshake_set_private_extensions.restype = None

615

685

616

686

credentials_set = _library.gnutls_credentials_set

617

687

credentials_set.argtypes = [session_t, credentials_type_t,

618

688

ctypes.c_void_p]

619

689

credentials_set.restype = _error_code

620

690

621

691

strerror = _library.gnutls_strerror

622

692

strerror.argtypes = [ctypes.c_int]

623

693

strerror.restype = ctypes.c_char_p

624

694

625

695

certificate_type_get = _library.gnutls_certificate_type_get

626

696

certificate_type_get.argtypes = [session_t]

627

697

certificate_type_get.restype = _error_code

628

698

629

699

certificate_get_peers = _library.gnutls_certificate_get_peers

630

700

certificate_get_peers.argtypes = [session_t,

631

701

ctypes.POINTER(ctypes.c_uint)]

632

702

certificate_get_peers.restype = ctypes.POINTER(datum_t)

633

703

634

704

global_set_log_level = _library.gnutls_global_set_log_level

635

705

global_set_log_level.argtypes = [ctypes.c_int]

636

706

global_set_log_level.restype = None

637

707

638

708

global_set_log_function = _library.gnutls_global_set_log_function

639

709

global_set_log_function.argtypes = [log_func]

640

710

global_set_log_function.restype = None

641

711

642

712

deinit = _library.gnutls_deinit

643

713

deinit.argtypes = [session_t]

644

714

deinit.restype = None

645

715

646

716

handshake = _library.gnutls_handshake

647

717

handshake.argtypes = [session_t]

648

718

handshake.restype = _error_code

649

719

handshake.errcheck = _retry_on_error

650

720

651

721

transport_set_ptr = _library.gnutls_transport_set_ptr

652

722

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

653

723

transport_set_ptr.restype = None

654

724

655

725

bye = _library.gnutls_bye

656

726

bye.argtypes = [session_t, close_request_t]

657

727

bye.restype = _error_code

658

728

bye.errcheck = _retry_on_error

659

729

660

730

check_version = _library.gnutls_check_version

661

731

check_version.argtypes = [ctypes.c_char_p]

662

732

check_version.restype = ctypes.c_char_p

663

733

664

734

# All the function declarations below are from gnutls/openpgp.h

665

735

666

736

openpgp_crt_init = _library.gnutls_openpgp_crt_init

667

737

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

668

738

openpgp_crt_init.restype = _error_code

669

739

670

740

openpgp_crt_import = _library.gnutls_openpgp_crt_import

671

741

openpgp_crt_import.argtypes = [openpgp_crt_t,

672

742

ctypes.POINTER(datum_t),

673

743

openpgp_crt_fmt_t]

674

744

openpgp_crt_import.restype = _error_code

675

745

676

746

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

677

747

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

678

748

ctypes.POINTER(ctypes.c_uint)]

679

749

openpgp_crt_verify_self.restype = _error_code

680

750

681

751

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

682

752

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

683

753

openpgp_crt_deinit.restype = None

684

754

685

755

openpgp_crt_get_fingerprint = (

686

756

_library.gnutls_openpgp_crt_get_fingerprint)

687

757

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

689

759

ctypes.POINTER(

690

760

ctypes.c_size_t)]

691

761

openpgp_crt_get_fingerprint.restype = _error_code

692

762

693

763

# Remove non-public functions

694

764

del _error_code, _retry_on_error

695

765

# Create the global "gnutls" object, simulating a module

696

766

gnutls = GnuTLS()

697

767

768

698

769

def call_pipe(connection, # : multiprocessing.Connection

699

770

func, *args, **kwargs):

700

771

"""This function is meant to be called by multiprocessing.Process

701

772

702

773

This function runs func(*args, **kwargs), and writes the resulting

703

774

return value on the provided multiprocessing.Connection.

704

775

"""

705

776

connection.send(func(*args, **kwargs))

706

777

connection.close()

707

778

779

708

780

class Client(object):

709

781

"""A representation of a client host served by this server.

710

782

711

783

Attributes:

712

784

approved: bool(); 'None' if not yet approved/disapproved

713

785

approval_delay: datetime.timedelta(); Time to wait for approval

715

787

checker: subprocess.Popen(); a running checker process used

716

788

to see if the client lives.

717

789

'None' if no process is running.

718

checker_callback_tag: a gobject event source tag, or None

790

checker_callback_tag: a GLib event source tag, or None

719

791

checker_command: string; External command which is run to check

720

792

if client lives. %() expansions are done at

721

793

runtime with vars(self) as dict, so that for

722

794

instance %(name)s can be used in the command.

723

checker_initiator_tag: a gobject event source tag, or None

795

checker_initiator_tag: a GLib event source tag, or None

724

796

created: datetime.datetime(); (UTC) object creation

725

797

client_structure: Object describing what attributes a client has

726

798

and is used for storing the client at exit

727

799

current_checker_command: string; current running checker_command

728

disable_initiator_tag: a gobject event source tag, or None

800

disable_initiator_tag: a GLib event source tag, or None

729

801

enabled: bool()

730

802

fingerprint: string (40 or 32 hexadecimal digits); used to

731

803

uniquely identify the client

750

822

disabled, or None

751

823

server_settings: The server_settings dict from main()

752

824

"""

753

825

754

826

runtime_expansions = ("approval_delay", "approval_duration",

755

827

"created", "enabled", "expires",

756

828

"fingerprint", "host", "interval",

767

839

"approved_by_default": "True",

768

840

"enabled": "True",

769

841

}

770

842

771

843

@staticmethod

772

844

def config_parser(config):

773

845

"""Construct a new dict of client settings of this form:

780

852

for client_name in config.sections():

781

853

section = dict(config.items(client_name))

782

854

client = settings[client_name] = {}

783

855

784

856

client["host"] = section["host"]

785

857

# Reformat values from string types to Python types

786

858

client["approved_by_default"] = config.getboolean(

787

859

client_name, "approved_by_default")

788

860

client["enabled"] = config.getboolean(client_name,

789

861

"enabled")

790

862

791

863

# Uppercase and remove spaces from fingerprint for later

792

864

# comparison purposes with return value from the

793

865

# fingerprint() function

794

866

client["fingerprint"] = (section["fingerprint"].upper()

795

867

.replace(" ", ""))

796

868

if "secret" in section:

797

client["secret"] = section["secret"].decode("base64")

869

client["secret"] = codecs.decode(section["secret"]

870

.encode("utf-8"),

871

"base64")

798

872

elif "secfile" in section:

799

873

with open(os.path.expanduser(os.path.expandvars

800

874

(section["secfile"])),

815

889

client["last_approval_request"] = None

816

890

client["last_checked_ok"] = None

817

891

client["last_checker_status"] = -2

818

892

819

893

return settings

820

821

def __init__(self, settings, name = None, server_settings=None):

894

895

def __init__(self, settings, name=None, server_settings=None):

822

896

self.name = name

823

897

if server_settings is None:

824

898

server_settings = {}

826

900

# adding all client settings

827

901

for setting, value in settings.items():

828

902

setattr(self, setting, value)

829

903

830

904

if self.enabled:

831

905

if not hasattr(self, "last_enabled"):

832

906

self.last_enabled = datetime.datetime.utcnow()

836

910

else:

837

911

self.last_enabled = None

838

912

self.expires = None

839

913

840

914

logger.debug("Creating client %r", self.name)

841

915

logger.debug(" Fingerprint: %s", self.fingerprint)

842

916

self.created = settings.get("created",

843

917

datetime.datetime.utcnow())

844

918

845

919

# attributes specific for this server instance

846

920

self.checker = None

847

921

self.checker_initiator_tag = None

853

927

self.changedstate = multiprocessing_manager.Condition(

854

928

multiprocessing_manager.Lock())

855

929

self.client_structure = [attr

856

for attr in self.__dict__.iterkeys()

930

for attr in self.__dict__.keys()

857

931

if not attr.startswith("_")]

858

932

self.client_structure.append("client_structure")

859

933

860

934

for name, t in inspect.getmembers(

861

935

type(self), lambda obj: isinstance(obj, property)):

862

936

if not name.startswith("_"):

863

937

self.client_structure.append(name)

864

938

865

939

# Send notice to process children that client state has changed

866

940

def send_changedstate(self):

867

941

with self.changedstate:

868

942

self.changedstate.notify_all()

869

943

870

944

def enable(self):

871

945

"""Start this client's checker and timeout hooks"""

872

946

if getattr(self, "enabled", False):

877

951

self.last_enabled = datetime.datetime.utcnow()

878

952

self.init_checker()

879

953

self.send_changedstate()

880

954

881

955

def disable(self, quiet=True):

882

956

"""Disable this client."""

883

957

if not getattr(self, "enabled", False):

885

959

if not quiet:

886

960

logger.info("Disabling client %s", self.name)

887

961

if getattr(self, "disable_initiator_tag", None) is not None:

888

gobject.source_remove(self.disable_initiator_tag)

962

GLib.source_remove(self.disable_initiator_tag)

889

963

self.disable_initiator_tag = None

890

964

self.expires = None

891

965

if getattr(self, "checker_initiator_tag", None) is not None:

892

gobject.source_remove(self.checker_initiator_tag)

966

GLib.source_remove(self.checker_initiator_tag)

893

967

self.checker_initiator_tag = None

894

968

self.stop_checker()

895

969

self.enabled = False

896

970

if not quiet:

897

971

self.send_changedstate()

898

# Do not run this again if called by a gobject.timeout_add

972

# Do not run this again if called by a GLib.timeout_add

899

973

return False

900

974

901

975

def __del__(self):

902

976

self.disable()

903

977

904

978

def init_checker(self):

905

979

# Schedule a new checker to be started an 'interval' from now,

906

980

# and every interval from then on.

907

981

if self.checker_initiator_tag is not None:

908

gobject.source_remove(self.checker_initiator_tag)

909

self.checker_initiator_tag = gobject.timeout_add(

982

GLib.source_remove(self.checker_initiator_tag)

983

self.checker_initiator_tag = GLib.timeout_add(

910

984

int(self.interval.total_seconds() * 1000),

911

985

self.start_checker)

912

986

# Schedule a disable() when 'timeout' has passed

913

987

if self.disable_initiator_tag is not None:

914

gobject.source_remove(self.disable_initiator_tag)

915

self.disable_initiator_tag = gobject.timeout_add(

988

GLib.source_remove(self.disable_initiator_tag)

989

self.disable_initiator_tag = GLib.timeout_add(

916

990

int(self.timeout.total_seconds() * 1000), self.disable)

917

991

# Also start a new checker *right now*.

918

992

self.start_checker()

919

993

920

994

def checker_callback(self, source, condition, connection,

921

995

command):

922

996

"""The checker has completed, so take appropriate actions."""

925

999

# Read return code from connection (see call_pipe)

926

1000

returncode = connection.recv()

927

1001

connection.close()

928

1002

929

1003

if returncode >= 0:

930

1004

self.last_checker_status = returncode

931

1005

self.last_checker_signal = None

941

1015

logger.warning("Checker for %(name)s crashed?",

942

1016

vars(self))

943

1017

return False

944

1018

945

1019

def checked_ok(self):

946

1020

"""Assert that the client has been seen, alive and well."""

947

1021

self.last_checked_ok = datetime.datetime.utcnow()

948

1022

self.last_checker_status = 0

949

1023

self.last_checker_signal = None

950

1024

self.bump_timeout()

951

1025

952

1026

def bump_timeout(self, timeout=None):

953

1027

"""Bump up the timeout for this client."""

954

1028

if timeout is None:

955

1029

timeout = self.timeout

956

1030

if self.disable_initiator_tag is not None:

957

gobject.source_remove(self.disable_initiator_tag)

1031

GLib.source_remove(self.disable_initiator_tag)

958

1032

self.disable_initiator_tag = None

959

1033

if getattr(self, "enabled", False):

960

self.disable_initiator_tag = gobject.timeout_add(

1034

self.disable_initiator_tag = GLib.timeout_add(

961

1035

int(timeout.total_seconds() * 1000), self.disable)

962

1036

self.expires = datetime.datetime.utcnow() + timeout

963

1037

964

1038

def need_approval(self):

965

1039

self.last_approval_request = datetime.datetime.utcnow()

966

1040

967

1041

def start_checker(self):

968

1042

"""Start a new checker subprocess if one is not running.

969

1043

970

1044

If a checker already exists, leave it running and do

971

1045

nothing."""

972

1046

# The reason for not killing a running checker is that if we

977

1051

# checkers alone, the checker would have to take more time

978

1052

# than 'timeout' for the client to be disabled, which is as it

979

1053

# should be.

980

1054

981

1055

if self.checker is not None and not self.checker.is_alive():

982

1056

logger.warning("Checker was not alive; joining")

983

1057

self.checker.join()

987

1061

# Escape attributes for the shell

988

1062

escaped_attrs = {

989

1063

attr: re.escape(str(getattr(self, attr)))

990

for attr in self.runtime_expansions }

1064

for attr in self.runtime_expansions}

991

1065

try:

992

1066

command = self.checker_command % escaped_attrs

993

1067

except TypeError as error:

1005

1079

# The exception is when not debugging but nevertheless

1006

1080

# running in the foreground; use the previously

1007

1081

# created wnull.

1008

popen_args = { "close_fds": True,

1009

"shell": True,

1010

"cwd": "/" }

1082

popen_args = {"close_fds": True,

1083

"shell": True,

1084

"cwd": "/"}

1011

1085

if (not self.server_settings["debug"]

1012

1086

and self.server_settings["foreground"]):

1013

1087

popen_args.update({"stdout": wnull,

1014

"stderr": wnull })

1015

pipe = multiprocessing.Pipe(duplex = False)

1088

"stderr": wnull})

1089

pipe = multiprocessing.Pipe(duplex=False)

1016

1090

self.checker = multiprocessing.Process(

1017

target = call_pipe,

1018

args = (pipe[1], subprocess.call, command),

1019

kwargs = popen_args)

1091

target=call_pipe,

1092

args=(pipe[1], subprocess.call, command),

1093

kwargs=popen_args)

1020

1094

self.checker.start()

1021

self.checker_callback_tag = gobject.io_add_watch(

1022

pipe[0].fileno(), gobject.IO_IN,

1095

self.checker_callback_tag = GLib.io_add_watch(

1096

pipe[0].fileno(), GLib.IO_IN,

1023

1097

self.checker_callback, pipe[0], command)

1024

# Re-run this periodically if run by gobject.timeout_add

1098

# Re-run this periodically if run by GLib.timeout_add

1025

1099

return True

1026

1100

1027

1101

def stop_checker(self):

1028

1102

"""Force the checker process, if any, to stop."""

1029

1103

if self.checker_callback_tag:

1030

gobject.source_remove(self.checker_callback_tag)

1104

GLib.source_remove(self.checker_callback_tag)

1031

1105

self.checker_callback_tag = None

1032

1106

if getattr(self, "checker", None) is None:

1033

1107

return

1042

1116

byte_arrays=False):

1043

1117

"""Decorators for marking methods of a DBusObjectWithProperties to

1044

1118

become properties on the D-Bus.

1045

1119

1046

1120

The decorated method will be called with no arguments by "Get"

1047

1121

and with one argument by "Set".

1048

1122

1049

1123

The parameters, where they are supported, are the same as

1050

1124

dbus.service.method, except there is only "signature", since the

1051

1125

type from Get() and the type sent to Set() is the same.

1055

1129

if byte_arrays and signature != "ay":

1056

1130

raise ValueError("Byte arrays not supported for non-'ay'"

1057

1131

" signature {!r}".format(signature))

1058

1132

1059

1133

def decorator(func):

1060

1134

func._dbus_is_property = True

1061

1135

func._dbus_interface = dbus_interface

1064

1138

func._dbus_name = func.__name__

1065

1139

if func._dbus_name.endswith("_dbus_property"):

1066

1140

func._dbus_name = func._dbus_name[:-14]

1067

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1141

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

1068

1142

return func

1069

1143

1070

1144

return decorator

1071

1145

1072

1146

1073

1147

def dbus_interface_annotations(dbus_interface):

1074

1148

"""Decorator for marking functions returning interface annotations

1075

1149

1076

1150

Usage:

1077

1151

1078

1152

@dbus_interface_annotations("org.example.Interface")

1079

1153

def _foo(self): # Function name does not matter

1080

1154

return {"org.freedesktop.DBus.Deprecated": "true",

1081

1155

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1082

1156

"false"}

1083

1157

"""

1084

1158

1085

1159

def decorator(func):

1086

1160

func._dbus_is_interface = True

1087

1161

func._dbus_interface = dbus_interface

1088

1162

func._dbus_name = dbus_interface

1089

1163

return func

1090

1164

1091

1165

return decorator

1092

1166

1093

1167

1094

1168

def dbus_annotations(annotations):

1095

1169

"""Decorator to annotate D-Bus methods, signals or properties

1096

1170

Usage:

1097

1171

1098

1172

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1099

1173

"org.freedesktop.DBus.Property."

1100

1174

"EmitsChangedSignal": "false"})

1102

1176

access="r")

1103

1177

def Property_dbus_property(self):

1104

1178

return dbus.Boolean(False)

1105

1179

1106

1180

See also the DBusObjectWithAnnotations class.

1107

1181

"""

1108

1182

1109

1183

def decorator(func):

1110

1184

func._dbus_annotations = annotations

1111

1185

return func

1112

1186

1113

1187

return decorator

1114

1188

1115

1189

1133

1207

1134

1208

class DBusObjectWithAnnotations(dbus.service.Object):

1135

1209

"""A D-Bus object with annotations.

1136

1210

1137

1211

Classes inheriting from this can use the dbus_annotations

1138

1212

decorator to add annotations to methods or signals.

1139

1213

"""

1140

1214

1141

1215

@staticmethod

1142

1216

def _is_dbus_thing(thing):

1143

1217

"""Returns a function testing if an attribute is a D-Bus thing

1144

1218

1145

1219

If called like _is_dbus_thing("method") it returns a function

1146

1220

suitable for use as predicate to inspect.getmembers().

1147

1221

"""

1148

1222

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

1149

1223

False)

1150

1224

1151

1225

def _get_all_dbus_things(self, thing):

1152

1226

"""Returns a generator of (name, attribute) pairs

1153

1227

"""

1156

1230

for cls in self.__class__.__mro__

1157

1231

for name, athing in

1158

1232

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1159

1233

1160

1234

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1161

out_signature = "s",

1162

path_keyword = 'object_path',

1163

connection_keyword = 'connection')

1235

out_signature="s",

1236

path_keyword='object_path',

1237

connection_keyword='connection')

1164

1238

def Introspect(self, object_path, connection):

1165

1239

"""Overloading of standard D-Bus method.

1166

1240

1167

1241

Inserts annotation tags on methods and signals.

1168

1242

"""

1169

1243

xmlstring = dbus.service.Object.Introspect(self, object_path,

1170

1244

connection)

1171

1245

try:

1172

1246

document = xml.dom.minidom.parseString(xmlstring)

1173

1247

1174

1248

for if_tag in document.getElementsByTagName("interface"):

1175

1249

# Add annotation tags

1176

1250

for typ in ("method", "signal"):

1203

1277

if_tag.appendChild(ann_tag)

1204

1278

# Fix argument name for the Introspect method itself

1205

1279

if (if_tag.getAttribute("name")

1206

== dbus.INTROSPECTABLE_IFACE):

1280

== dbus.INTROSPECTABLE_IFACE):

1207

1281

for cn in if_tag.getElementsByTagName("method"):

1208

1282

if cn.getAttribute("name") == "Introspect":

1209

1283

for arg in cn.getElementsByTagName("arg"):

1222

1296

1223

1297

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1224

1298

"""A D-Bus object with properties.

1225

1299

1226

1300

Classes inheriting from this can use the dbus_service_property

1227

1301

decorator to expose methods as D-Bus properties. It exposes the

1228

1302

standard Get(), Set(), and GetAll() methods on the D-Bus.

1229

1303

"""

1230

1304

1231

1305

def _get_dbus_property(self, interface_name, property_name):

1232

1306

"""Returns a bound method if one exists which is a D-Bus

1233

1307

property with the specified name and interface.

1238

1312

if (value._dbus_name == property_name

1239

1313

and value._dbus_interface == interface_name):

1240

1314

return value.__get__(self)

1241

1315

1242

1316

# No such property

1243

1317

raise DBusPropertyNotFound("{}:{}.{}".format(

1244

1318

self.dbus_object_path, interface_name, property_name))

1245

1319

1246

1320

@classmethod

1247

1321

def _get_all_interface_names(cls):

1248

1322

"""Get a sequence of all interfaces supported by an object"""

1251

1325

for x in (inspect.getmro(cls))

1252

1326

for attr in dir(x))

1253

1327

if name is not None)

1254

1328

1255

1329

@dbus.service.method(dbus.PROPERTIES_IFACE,

1256

1330

in_signature="ss",

1257

1331

out_signature="v")

1265

1339

if not hasattr(value, "variant_level"):

1266

1340

return value

1267

1341

return type(value)(value, variant_level=value.variant_level+1)

1268

1342

1269

1343

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1270

1344

def Set(self, interface_name, property_name, value):

1271

1345

"""Standard D-Bus property Set() method, see D-Bus standard.

1283

1357

value = dbus.ByteArray(b''.join(chr(byte)

1284

1358

for byte in value))

1285

1359

prop(value)

1286

1360

1287

1361

@dbus.service.method(dbus.PROPERTIES_IFACE,

1288

1362

in_signature="s",

1289

1363

out_signature="a{sv}")

1290

1364

def GetAll(self, interface_name):

1291

1365

"""Standard D-Bus property GetAll() method, see D-Bus

1292

1366

standard.

1293

1367

1294

1368

Note: Will not include properties with access="write".

1295

1369

"""

1296

1370

properties = {}

1307

1381

properties[name] = value

1308

1382

continue

1309

1383

properties[name] = type(value)(

1310

value, variant_level = value.variant_level + 1)

1384

value, variant_level=value.variant_level + 1)

1311

1385

return dbus.Dictionary(properties, signature="sv")

1312

1386

1313

1387

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1314

1388

def PropertiesChanged(self, interface_name, changed_properties,

1315

1389

invalidated_properties):

1317

1391

standard.

1318

1392

"""

1319

1393

pass

1320

1394

1321

1395

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1322

1396

out_signature="s",

1323

1397

path_keyword='object_path',

1324

1398

connection_keyword='connection')

1325

1399

def Introspect(self, object_path, connection):

1326

1400

"""Overloading of standard D-Bus method.

1327

1401

1328

1402

Inserts property tags and interface annotation tags.

1329

1403

"""

1330

1404

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1332

1406

connection)

1333

1407

try:

1334

1408

document = xml.dom.minidom.parseString(xmlstring)

1335

1409

1336

1410

def make_tag(document, name, prop):

1337

1411

e = document.createElement("property")

1338

1412

e.setAttribute("name", name)

1339

1413

e.setAttribute("type", prop._dbus_signature)

1340

1414

e.setAttribute("access", prop._dbus_access)

1341

1415

return e

1342

1416

1343

1417

for if_tag in document.getElementsByTagName("interface"):

1344

1418

# Add property tags

1345

1419

for tag in (make_tag(document, name, prop)

1387

1461

exc_info=error)

1388

1462

return xmlstring

1389

1463

1464

1390

1465

try:

1391

1466

dbus.OBJECT_MANAGER_IFACE

1392

1467

except AttributeError:

1393

1468

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1394

1469

1470

1395

1471

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1396

1472

"""A D-Bus object with an ObjectManager.

1397

1473

1398

1474

Classes inheriting from this exposes the standard

1399

1475

GetManagedObjects call and the InterfacesAdded and

1400

1476

InterfacesRemoved signals on the standard

1401

1477

"org.freedesktop.DBus.ObjectManager" interface.

1402

1478

1403

1479

Note: No signals are sent automatically; they must be sent

1404

1480

manually.

1405

1481

"""

1406

1482

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1407

out_signature = "a{oa{sa{sv}}}")

1483

out_signature="a{oa{sa{sv}}}")

1408

1484

def GetManagedObjects(self):

1409

1485

"""This function must be overridden"""

1410

1486

raise NotImplementedError()

1411

1487

1412

1488

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1413

signature = "oa{sa{sv}}")

1489

signature="oa{sa{sv}}")

1414

1490

def InterfacesAdded(self, object_path, interfaces_and_properties):

1415

1491

pass

1416

1417

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1492

1493

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1418

1494

def InterfacesRemoved(self, object_path, interfaces):

1419

1495

pass

1420

1496

1421

1497

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1422

out_signature = "s",

1423

path_keyword = 'object_path',

1424

connection_keyword = 'connection')

1498

out_signature="s",

1499

path_keyword='object_path',

1500

connection_keyword='connection')

1425

1501

def Introspect(self, object_path, connection):

1426

1502

"""Overloading of standard D-Bus method.

1427

1503

1428

1504

Override return argument name of GetManagedObjects to be

1429

1505

"objpath_interfaces_and_properties"

1430

1506

"""

1433

1509

connection)

1434

1510

try:

1435

1511

document = xml.dom.minidom.parseString(xmlstring)

1436

1512

1437

1513

for if_tag in document.getElementsByTagName("interface"):

1438

1514

# Fix argument name for the GetManagedObjects method

1439

1515

if (if_tag.getAttribute("name")

1440

== dbus.OBJECT_MANAGER_IFACE):

1516

== dbus.OBJECT_MANAGER_IFACE):

1441

1517

for cn in if_tag.getElementsByTagName("method"):

1442

1518

if (cn.getAttribute("name")

1443

1519

== "GetManagedObjects"):

1453

1529

except (AttributeError, xml.dom.DOMException,

1454

1530

xml.parsers.expat.ExpatError) as error:

1455

1531

logger.error("Failed to override Introspection method",

1456

exc_info = error)

1532

exc_info=error)

1457

1533

return xmlstring

1458

1534

1535

1459

1536

def datetime_to_dbus(dt, variant_level=0):

1460

1537

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1461

1538

if dt is None:

1462

return dbus.String("", variant_level = variant_level)

1539

return dbus.String("", variant_level=variant_level)

1463

1540

return dbus.String(dt.isoformat(), variant_level=variant_level)

1464

1541

1465

1542

1468

1545

dbus.service.Object, it will add alternate D-Bus attributes with

1469

1546

interface names according to the "alt_interface_names" mapping.

1470

1547

Usage:

1471

1548

1472

1549

@alternate_dbus_interfaces({"org.example.Interface":

1473

1550

"net.example.AlternateInterface"})

1474

1551

class SampleDBusObject(dbus.service.Object):

1475

1552

@dbus.service.method("org.example.Interface")

1476

1553

def SampleDBusMethod():

1477

1554

pass

1478

1555

1479

1556

The above "SampleDBusMethod" on "SampleDBusObject" will be

1480

1557

reachable via two interfaces: "org.example.Interface" and

1481

1558

"net.example.AlternateInterface", the latter of which will have

1482

1559

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1483

1560

"true", unless "deprecate" is passed with a False value.

1484

1561

1485

1562

This works for methods and signals, and also for D-Bus properties

1486

1563

(from DBusObjectWithProperties) and interfaces (from the

1487

1564

dbus_interface_annotations decorator).

1488

1565

"""

1489

1566

1490

1567

def wrapper(cls):

1491

1568

for orig_interface_name, alt_interface_name in (

1492

1569

alt_interface_names.items()):

1507

1584

interface_names.add(alt_interface)

1508

1585

# Is this a D-Bus signal?

1509

1586

if getattr(attribute, "_dbus_is_signal", False):

1587

# Extract the original non-method undecorated

1588

# function by black magic

1510

1589

if sys.version_info.major == 2:

1511

# Extract the original non-method undecorated

1512

# function by black magic

1513

1590

nonmethod_func = (dict(

1514

1591

zip(attribute.func_code.co_freevars,

1515

1592

attribute.__closure__))

1516

1593

["func"].cell_contents)

1517

1594

else:

1518

nonmethod_func = attribute

1595

nonmethod_func = (dict(

1596

zip(attribute.__code__.co_freevars,

1597

attribute.__closure__))

1598

["func"].cell_contents)

1519

1599

# Create a new, but exactly alike, function

1520

1600

# object, and decorate it to be a new D-Bus signal

1521

1601

# with the alternate D-Bus interface name

1522

if sys.version_info.major == 2:

1523

new_function = types.FunctionType(

1524

nonmethod_func.func_code,

1525

nonmethod_func.func_globals,

1526

nonmethod_func.func_name,

1527

nonmethod_func.func_defaults,

1528

nonmethod_func.func_closure)

1529

else:

1530

new_function = types.FunctionType(

1531

nonmethod_func.__code__,

1532

nonmethod_func.__globals__,

1533

nonmethod_func.__name__,

1534

nonmethod_func.__defaults__,

1535

nonmethod_func.__closure__)

1602

new_function = copy_function(nonmethod_func)

1536

1603

new_function = (dbus.service.signal(

1537

1604

alt_interface,

1538

1605

attribute._dbus_signature)(new_function))

1542

1609

attribute._dbus_annotations)

1543

1610

except AttributeError:

1544

1611

pass

1612

1545

1613

# Define a creator of a function to call both the

1546

1614

# original and alternate functions, so both the

1547

1615

# original and alternate signals gets sent when

1550

1618

"""This function is a scope container to pass

1551

1619

func1 and func2 to the "call_both" function

1552

1620

outside of its arguments"""

1553

1621

1554

1622

@functools.wraps(func2)

1555

1623

def call_both(*args, **kwargs):

1556

1624

"""This function will emit two D-Bus

1557

1625

signals by calling func1 and func2"""

1558

1626

func1(*args, **kwargs)

1559

1627

func2(*args, **kwargs)

1560

# Make wrapper function look like a D-Bus signal

1628

# Make wrapper function look like a D-Bus

1629

# signal

1561

1630

for name, attr in inspect.getmembers(func2):

1562

1631

if name.startswith("_dbus_"):

1563

1632

setattr(call_both, name, attr)

1564

1633

1565

1634

return call_both

1566

1635

# Create the "call_both" function and add it to

1567

1636

# the class

1577

1646

alt_interface,

1578

1647

attribute._dbus_in_signature,

1579

1648

attribute._dbus_out_signature)

1580

(types.FunctionType(attribute.func_code,

1581

attribute.func_globals,

1582

attribute.func_name,

1583

attribute.func_defaults,

1584

attribute.func_closure)))

1649

(copy_function(attribute)))

1585

1650

# Copy annotations, if any

1586

1651

try:

1587

1652

attr[attrname]._dbus_annotations = dict(

1599

1664

attribute._dbus_access,

1600

1665

attribute._dbus_get_args_options

1601

1666

["byte_arrays"])

1602

(types.FunctionType(

1603

attribute.func_code,

1604

attribute.func_globals,

1605

attribute.func_name,

1606

attribute.func_defaults,

1607

attribute.func_closure)))

1667

(copy_function(attribute)))

1608

1668

# Copy annotations, if any

1609

1669

try:

1610

1670

attr[attrname]._dbus_annotations = dict(

1619

1679

# to the class.

1620

1680

attr[attrname] = (

1621

1681

dbus_interface_annotations(alt_interface)

1622

(types.FunctionType(attribute.func_code,

1623

attribute.func_globals,

1624

attribute.func_name,

1625

attribute.func_defaults,

1626

attribute.func_closure)))

1682

(copy_function(attribute)))

1627

1683

if deprecate:

1628

1684

# Deprecate all alternate interfaces

1629

iname="_AlternateDBusNames_interface_annotation{}"

1685

iname = "_AlternateDBusNames_interface_annotation{}"

1630

1686

for interface_name in interface_names:

1631

1687

1632

1688

@dbus_interface_annotations(interface_name)

1633

1689

def func(self):

1634

return { "org.freedesktop.DBus.Deprecated":

1635

"true" }

1690

return {"org.freedesktop.DBus.Deprecated":

1691

"true"}

1636

1692

# Find an unused name

1637

1693

for aname in (iname.format(i)

1638

1694

for i in itertools.count()):

1642

1698

if interface_names:

1643

1699

# Replace the class with a new subclass of it with

1644

1700

# methods, signals, etc. as created above.

1645

cls = type(b"{}Alternate".format(cls.__name__),

1646

(cls, ), attr)

1701

if sys.version_info.major == 2:

1702

cls = type(b"{}Alternate".format(cls.__name__),

1703

(cls, ), attr)

1704

else:

1705

cls = type("{}Alternate".format(cls.__name__),

1706

(cls, ), attr)

1647

1707

return cls

1648

1708

1649

1709

return wrapper

1650

1710

1651

1711

1653

1713

"se.bsnet.fukt.Mandos"})

1654

1714

class ClientDBus(Client, DBusObjectWithProperties):

1655

1715

"""A Client class using D-Bus

1656

1716

1657

1717

Attributes:

1658

1718

dbus_object_path: dbus.ObjectPath

1659

1719

bus: dbus.SystemBus()

1660

1720

"""

1661

1721

1662

1722

runtime_expansions = (Client.runtime_expansions

1663

1723

+ ("dbus_object_path", ))

1664

1724

1665

1725

_interface = "se.recompile.Mandos.Client"

1666

1726

1667

1727

# dbus.service.Object doesn't use super(), so we can't either.

1668

1669

def __init__(self, bus = None, *args, **kwargs):

1728

1729

def __init__(self, bus=None, *args, **kwargs):

1670

1730

self.bus = bus

1671

1731

Client.__init__(self, *args, **kwargs)

1672

1732

# Only now, when this client is initialized, can it show up on

1678

1738

"/clients/" + client_object_name)

1679

1739

DBusObjectWithProperties.__init__(self, self.bus,

1680

1740

self.dbus_object_path)

1681

1741

1682

1742

def notifychangeproperty(transform_func, dbus_name,

1683

1743

type_func=lambda x: x,

1684

1744

variant_level=1,

1686

1746

_interface=_interface):

1687

1747

""" Modify a variable so that it's a property which announces

1688

1748

its changes to DBus.

1689

1749

1690

1750

transform_fun: Function that takes a value and a variant_level

1691

1751

and transforms it to a D-Bus type.

1692

1752

dbus_name: D-Bus name of the variable

1695

1755

variant_level: D-Bus variant level. Default: 1

1696

1756

"""

1697

1757

attrname = "_{}".format(dbus_name)

1698

1758

1699

1759

def setter(self, value):

1700

1760

if hasattr(self, "dbus_object_path"):

1701

1761

if (not hasattr(self, attrname) or

1708

1768

else:

1709

1769

dbus_value = transform_func(

1710

1770

type_func(value),

1711

variant_level = variant_level)

1771

variant_level=variant_level)

1712

1772

self.PropertyChanged(dbus.String(dbus_name),

1713

1773

dbus_value)

1714

1774

self.PropertiesChanged(

1715

1775

_interface,

1716

dbus.Dictionary({ dbus.String(dbus_name):

1717

dbus_value }),

1776

dbus.Dictionary({dbus.String(dbus_name):

1777

dbus_value}),

1718

1778

dbus.Array())

1719

1779

setattr(self, attrname, value)

1720

1780

1721

1781

return property(lambda self: getattr(self, attrname), setter)

1722

1782

1723

1783

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1724

1784

approvals_pending = notifychangeproperty(dbus.Boolean,

1725

1785

"ApprovalPending",

1726

type_func = bool)

1786

type_func=bool)

1727

1787

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1728

1788

last_enabled = notifychangeproperty(datetime_to_dbus,

1729

1789

"LastEnabled")

1730

1790

checker = notifychangeproperty(

1731

1791

dbus.Boolean, "CheckerRunning",

1732

type_func = lambda checker: checker is not None)

1792

type_func=lambda checker: checker is not None)

1733

1793

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1734

1794

"LastCheckedOK")

1735

1795

last_checker_status = notifychangeproperty(dbus.Int16,

1740

1800

"ApprovedByDefault")

1741

1801

approval_delay = notifychangeproperty(

1742

1802

dbus.UInt64, "ApprovalDelay",

1743

type_func = lambda td: td.total_seconds() * 1000)

1803

type_func=lambda td: td.total_seconds() * 1000)

1744

1804

approval_duration = notifychangeproperty(

1745

1805

dbus.UInt64, "ApprovalDuration",

1746

type_func = lambda td: td.total_seconds() * 1000)

1806

type_func=lambda td: td.total_seconds() * 1000)

1747

1807

host = notifychangeproperty(dbus.String, "Host")

1748

1808

timeout = notifychangeproperty(

1749

1809

dbus.UInt64, "Timeout",

1750

type_func = lambda td: td.total_seconds() * 1000)

1810

type_func=lambda td: td.total_seconds() * 1000)

1751

1811

extended_timeout = notifychangeproperty(

1752

1812

dbus.UInt64, "ExtendedTimeout",

1753

type_func = lambda td: td.total_seconds() * 1000)

1813

type_func=lambda td: td.total_seconds() * 1000)

1754

1814

interval = notifychangeproperty(

1755

1815

dbus.UInt64, "Interval",

1756

type_func = lambda td: td.total_seconds() * 1000)

1816

type_func=lambda td: td.total_seconds() * 1000)

1757

1817

checker_command = notifychangeproperty(dbus.String, "Checker")

1758

1818

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1759

1819

invalidate_only=True)

1760

1820

1761

1821

del notifychangeproperty

1762

1822

1763

1823

def __del__(self, *args, **kwargs):

1764

1824

try:

1765

1825

self.remove_from_connection()

1768

1828

if hasattr(DBusObjectWithProperties, "__del__"):

1769

1829

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1770

1830

Client.__del__(self, *args, **kwargs)

1771

1831

1772

1832

def checker_callback(self, source, condition,

1773

1833

connection, command, *args, **kwargs):

1774

1834

ret = Client.checker_callback(self, source, condition,

1790

1850

| self.last_checker_signal),

1791

1851

dbus.String(command))

1792

1852

return ret

1793

1853

1794

1854

def start_checker(self, *args, **kwargs):

1795

1855

old_checker_pid = getattr(self.checker, "pid", None)

1796

1856

r = Client.start_checker(self, *args, **kwargs)

1800

1860

# Emit D-Bus signal

1801

1861

self.CheckerStarted(self.current_checker_command)

1802

1862

return r

1803

1863

1804

1864

def _reset_approved(self):

1805

1865

self.approved = None

1806

1866

return False

1807

1867

1808

1868

def approve(self, value=True):

1809

1869

self.approved = value

1810

gobject.timeout_add(int(self.approval_duration.total_seconds()

1811

* 1000), self._reset_approved)

1870

GLib.timeout_add(int(self.approval_duration.total_seconds()

1871

* 1000), self._reset_approved)

1812

1872

self.send_changedstate()

1813

1814

## D-Bus methods, signals & properties

1815

1816

## Interfaces

1817

1818

## Signals

1819

1873

1874

# D-Bus methods, signals & properties

1875

1876

# Interfaces

1877

1878

# Signals

1879

1820

1880

# CheckerCompleted - signal

1821

1881

@dbus.service.signal(_interface, signature="nxs")

1822

1882

def CheckerCompleted(self, exitcode, waitstatus, command):

1823

1883

"D-Bus signal"

1824

1884

pass

1825

1885

1826

1886

# CheckerStarted - signal

1827

1887

@dbus.service.signal(_interface, signature="s")

1828

1888

def CheckerStarted(self, command):

1829

1889

"D-Bus signal"

1830

1890

pass

1831

1891

1832

1892

# PropertyChanged - signal

1833

1893

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1834

1894

@dbus.service.signal(_interface, signature="sv")

1835

1895

def PropertyChanged(self, property, value):

1836

1896

"D-Bus signal"

1837

1897

pass

1838

1898

1839

1899

# GotSecret - signal

1840

1900

@dbus.service.signal(_interface)

1841

1901

def GotSecret(self):

1844

1904

server to mandos-client

1845

1905

"""

1846

1906

pass

1847

1907

1848

1908

# Rejected - signal

1849

1909

@dbus.service.signal(_interface, signature="s")

1850

1910

def Rejected(self, reason):

1851

1911

"D-Bus signal"

1852

1912

pass

1853

1913

1854

1914

# NeedApproval - signal

1855

1915

@dbus.service.signal(_interface, signature="tb")

1856

1916

def NeedApproval(self, timeout, default):

1857

1917

"D-Bus signal"

1858

1918

return self.need_approval()

1859

1860

## Methods

1861

1919

1920

# Methods

1921

1862

1922

# Approve - method

1863

1923

@dbus.service.method(_interface, in_signature="b")

1864

1924

def Approve(self, value):

1865

1925

self.approve(value)

1866

1926

1867

1927

# CheckedOK - method

1868

1928

@dbus.service.method(_interface)

1869

1929

def CheckedOK(self):

1870

1930

self.checked_ok()

1871

1931

1872

1932

# Enable - method

1873

1933

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1874

1934

@dbus.service.method(_interface)

1875

1935

def Enable(self):

1876

1936

"D-Bus method"

1877

1937

self.enable()

1878

1938

1879

1939

# StartChecker - method

1880

1940

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1881

1941

@dbus.service.method(_interface)

1882

1942

def StartChecker(self):

1883

1943

"D-Bus method"

1884

1944

self.start_checker()

1885

1945

1886

1946

# Disable - method

1887

1947

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1888

1948

@dbus.service.method(_interface)

1889

1949

def Disable(self):

1890

1950

"D-Bus method"

1891

1951

self.disable()

1892

1952

1893

1953

# StopChecker - method

1894

1954

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1895

1955

@dbus.service.method(_interface)

1896

1956

def StopChecker(self):

1897

1957

self.stop_checker()

1898

1899

## Properties

1900

1958

1959

# Properties

1960

1901

1961

# ApprovalPending - property

1902

1962

@dbus_service_property(_interface, signature="b", access="read")

1903

1963

def ApprovalPending_dbus_property(self):

1904

1964

return dbus.Boolean(bool(self.approvals_pending))

1905

1965

1906

1966

# ApprovedByDefault - property

1907

1967

@dbus_service_property(_interface,

1908

1968

signature="b",

1911

1971

if value is None: # get

1912

1972

return dbus.Boolean(self.approved_by_default)

1913

1973

self.approved_by_default = bool(value)

1914

1974

1915

1975

# ApprovalDelay - property

1916

1976

@dbus_service_property(_interface,

1917

1977

signature="t",

1921

1981

return dbus.UInt64(self.approval_delay.total_seconds()

1922

1982

* 1000)

1923

1983

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1924

1984

1925

1985

# ApprovalDuration - property

1926

1986

@dbus_service_property(_interface,

1927

1987

signature="t",

1931

1991

return dbus.UInt64(self.approval_duration.total_seconds()

1932

1992

* 1000)

1933

1993

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1934

1994

1935

1995

# Name - property

1936

1996

@dbus_annotations(

1937

1997

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1938

1998

@dbus_service_property(_interface, signature="s", access="read")

1939

1999

def Name_dbus_property(self):

1940

2000

return dbus.String(self.name)

1941

2001

1942

2002

# Fingerprint - property

1943

2003

@dbus_annotations(

1944

2004

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1945

2005

@dbus_service_property(_interface, signature="s", access="read")

1946

2006

def Fingerprint_dbus_property(self):

1947

2007

return dbus.String(self.fingerprint)

1948

2008

1949

2009

# Host - property

1950

2010

@dbus_service_property(_interface,

1951

2011

signature="s",

1954

2014

if value is None: # get

1955

2015

return dbus.String(self.host)

1956

2016

self.host = str(value)

1957

2017

1958

2018

# Created - property

1959

2019

@dbus_annotations(

1960

2020

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1961

2021

@dbus_service_property(_interface, signature="s", access="read")

1962

2022

def Created_dbus_property(self):

1963

2023

return datetime_to_dbus(self.created)

1964

2024

1965

2025

# LastEnabled - property

1966

2026

@dbus_service_property(_interface, signature="s", access="read")

1967

2027

def LastEnabled_dbus_property(self):

1968

2028

return datetime_to_dbus(self.last_enabled)

1969

2029

1970

2030

# Enabled - property

1971

2031

@dbus_service_property(_interface,

1972

2032

signature="b",

1978

2038

self.enable()

1979

2039

else:

1980

2040

self.disable()

1981

2041

1982

2042

# LastCheckedOK - property

1983

2043

@dbus_service_property(_interface,

1984

2044

signature="s",

1988

2048

self.checked_ok()

1989

2049

return

1990

2050

return datetime_to_dbus(self.last_checked_ok)

1991

2051

1992

2052

# LastCheckerStatus - property

1993

2053

@dbus_service_property(_interface, signature="n", access="read")

1994

2054

def LastCheckerStatus_dbus_property(self):

1995

2055

return dbus.Int16(self.last_checker_status)

1996

2056

1997

2057

# Expires - property

1998

2058

@dbus_service_property(_interface, signature="s", access="read")

1999

2059

def Expires_dbus_property(self):

2000

2060

return datetime_to_dbus(self.expires)

2001

2061

2002

2062

# LastApprovalRequest - property

2003

2063

@dbus_service_property(_interface, signature="s", access="read")

2004

2064

def LastApprovalRequest_dbus_property(self):

2005

2065

return datetime_to_dbus(self.last_approval_request)

2006

2066

2007

2067

# Timeout - property

2008

2068

@dbus_service_property(_interface,

2009

2069

signature="t",

2024

2084

if (getattr(self, "disable_initiator_tag", None)

2025

2085

is None):

2026

2086

return

2027

gobject.source_remove(self.disable_initiator_tag)

2028

self.disable_initiator_tag = gobject.timeout_add(

2087

GLib.source_remove(self.disable_initiator_tag)

2088

self.disable_initiator_tag = GLib.timeout_add(

2029

2089

int((self.expires - now).total_seconds() * 1000),

2030

2090

self.disable)

2031

2091

2032

2092

# ExtendedTimeout - property

2033

2093

@dbus_service_property(_interface,

2034

2094

signature="t",

2038

2098

return dbus.UInt64(self.extended_timeout.total_seconds()

2039

2099

* 1000)

2040

2100

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2041

2101

2042

2102

# Interval - property

2043

2103

@dbus_service_property(_interface,

2044

2104

signature="t",

2051

2111

return

2052

2112

if self.enabled:

2053

2113

# Reschedule checker run

2054

gobject.source_remove(self.checker_initiator_tag)

2055

self.checker_initiator_tag = gobject.timeout_add(

2114

GLib.source_remove(self.checker_initiator_tag)

2115

self.checker_initiator_tag = GLib.timeout_add(

2056

2116

value, self.start_checker)

2057

self.start_checker() # Start one now, too

2058

2117

self.start_checker() # Start one now, too

2118

2059

2119

# Checker - property

2060

2120

@dbus_service_property(_interface,

2061

2121

signature="s",

2064

2124

if value is None: # get

2065

2125

return dbus.String(self.checker_command)

2066

2126

self.checker_command = str(value)

2067

2127

2068

2128

# CheckerRunning - property

2069

2129

@dbus_service_property(_interface,

2070

2130

signature="b",

2076

2136

self.start_checker()

2077

2137

else:

2078

2138

self.stop_checker()

2079

2139

2080

2140

# ObjectPath - property

2081

2141

@dbus_annotations(

2082

2142

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2083

2143

"org.freedesktop.DBus.Deprecated": "true"})

2084

2144

@dbus_service_property(_interface, signature="o", access="read")

2085

2145

def ObjectPath_dbus_property(self):

2086

return self.dbus_object_path # is already a dbus.ObjectPath

2087

2146

return self.dbus_object_path # is already a dbus.ObjectPath

2147

2088

2148

# Secret = property

2089

2149

@dbus_annotations(

2090

2150

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2095

2155

byte_arrays=True)

2096

2156

def Secret_dbus_property(self, value):

2097

2157

self.secret = bytes(value)

2098

2158

2099

2159

del _interface

2100

2160

2101

2161

2105

2165

self._pipe.send(('init', fpr, address))

2106

2166

if not self._pipe.recv():

2107

2167

raise KeyError(fpr)

2108

2168

2109

2169

def __getattribute__(self, name):

2110

2170

if name == '_pipe':

2111

2171

return super(ProxyClient, self).__getattribute__(name)

2114

2174

if data[0] == 'data':

2115

2175

return data[1]

2116

2176

if data[0] == 'function':

2117

2177

2118

2178

def func(*args, **kwargs):

2119

2179

self._pipe.send(('funcall', name, args, kwargs))

2120

2180

return self._pipe.recv()[1]

2121

2181

2122

2182

return func

2123

2183

2124

2184

def __setattr__(self, name, value):

2125

2185

if name == '_pipe':

2126

2186

return super(ProxyClient, self).__setattr__(name, value)

2129

2189

2130

2190

class ClientHandler(socketserver.BaseRequestHandler, object):

2131

2191

"""A class to handle client connections.

2132

2192

2133

2193

Instantiated once for each connection to handle it.

2134

2194

Note: This will run in its own forked process."""

2135

2195

2136

2196

def handle(self):

2137

2197

with contextlib.closing(self.server.child_pipe) as child_pipe:

2138

2198

logger.info("TCP connection from: %s",

2139

2199

str(self.client_address))

2140

2200

logger.debug("Pipe FD: %d",

2141

2201

self.server.child_pipe.fileno())

2142

2202

2143

2203

session = gnutls.ClientSession(self.request)

2144

2145

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

2146

# "+AES-256-CBC", "+SHA1",

2147

# "+COMP-NULL", "+CTYPE-OPENPGP",

2148

# "+DHE-DSS"))

2204

2205

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2206

# "+AES-256-CBC", "+SHA1",

2207

# "+COMP-NULL", "+CTYPE-OPENPGP",

2208

# "+DHE-DSS"))

2149

2209

# Use a fallback default, since this MUST be set.

2150

2210

priority = self.server.gnutls_priority

2151

2211

if priority is None:

2152

2212

priority = "NORMAL"

2153

gnutls.priority_set_direct(session._c_object, priority,

2213

gnutls.priority_set_direct(session._c_object,

2214

priority.encode("utf-8"),

2154

2215

None)

2155

2216

2156

2217

# Start communication using the Mandos protocol

2157

2218

# Get protocol number

2158

2219

line = self.request.makefile().readline()

2163

2224

except (ValueError, IndexError, RuntimeError) as error:

2164

2225

logger.error("Unknown protocol version: %s", error)

2165

2226

return

2166

2227

2167

2228

# Start GnuTLS connection

2168

2229

try:

2169

2230

session.handshake()

2173

2234

# established. Just abandon the request.

2174

2235

return

2175

2236

logger.debug("Handshake succeeded")

2176

2237

2177

2238

approval_required = False

2178

2239

try:

2179

2240

try:

2183

2244

logger.warning("Bad certificate: %s", error)

2184

2245

return

2185

2246

logger.debug("Fingerprint: %s", fpr)

2186

2247

2187

2248

try:

2188

2249

client = ProxyClient(child_pipe, fpr,

2189

2250

self.client_address)

2190

2251

except KeyError:

2191

2252

return

2192

2253

2193

2254

if client.approval_delay:

2194

2255

delay = client.approval_delay

2195

2256

client.approvals_pending += 1

2196

2257

approval_required = True

2197

2258

2198

2259

while True:

2199

2260

if not client.enabled:

2200

2261

logger.info("Client %s is disabled",

2203

2264

# Emit D-Bus signal

2204

2265

client.Rejected("Disabled")

2205

2266

return

2206

2267

2207

2268

if client.approved or not client.approval_delay:

2208

#We are approved or approval is disabled

2269

# We are approved or approval is disabled

2209

2270

break

2210

2271

elif client.approved is None:

2211

2272

logger.info("Client %s needs approval",

2222

2283

# Emit D-Bus signal

2223

2284

client.Rejected("Denied")

2224

2285

return

2225

2226

#wait until timeout or approved

2286

2287

# wait until timeout or approved

2227

2288

time = datetime.datetime.now()

2228

2289

client.changedstate.acquire()

2229

2290

client.changedstate.wait(delay.total_seconds())

2242

2303

break

2243

2304

else:

2244

2305

delay -= time2 - time

2245

2306

2246

2307

try:

2247

2308

session.send(client.secret)

2248

2309

except gnutls.Error as error:

2249

2310

logger.warning("gnutls send failed",

2250

exc_info = error)

2311

exc_info=error)

2251

2312

return

2252

2313

2253

2314

logger.info("Sending secret to %s", client.name)

2254

2315

# bump the timeout using extended_timeout

2255

2316

client.bump_timeout(client.extended_timeout)

2256

2317

if self.server.use_dbus:

2257

2318

# Emit D-Bus signal

2258

2319

client.GotSecret()

2259

2320

2260

2321

finally:

2261

2322

if approval_required:

2262

2323

client.approvals_pending -= 1

2265

2326

except gnutls.Error as error:

2266

2327

logger.warning("GnuTLS bye failed",

2267

2328

exc_info=error)

2268

2329

2269

2330

@staticmethod

2270

2331

def peer_certificate(session):

2271

2332

"Return the peer's OpenPGP certificate as a bytestring"

2283

2344

return None

2284

2345

cert = cert_list[0]

2285

2346

return ctypes.string_at(cert.data, cert.size)

2286

2347

2287

2348

@staticmethod

2288

2349

def fingerprint(openpgp):

2289

2350

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2322

2383

2323

2384

class MultiprocessingMixIn(object):

2324

2385

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2325

2386

2326

2387

def sub_process_main(self, request, address):

2327

2388

try:

2328

2389

self.finish_request(request, address)

2329

2390

except Exception:

2330

2391

self.handle_error(request, address)

2331

2392

self.close_request(request)

2332

2393

2333

2394

def process_request(self, request, address):

2334

2395

"""Start a new process to process the request."""

2335

proc = multiprocessing.Process(target = self.sub_process_main,

2336

args = (request, address))

2396

proc = multiprocessing.Process(target=self.sub_process_main,

2397

args=(request, address))

2337

2398

proc.start()

2338

2399

return proc

2339

2400

2340

2401

2341

2402

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2342

2403

""" adds a pipe to the MixIn """

2343

2404

2344

2405

def process_request(self, request, client_address):

2345

2406

"""Overrides and wraps the original process_request().

2346

2407

2347

2408

This function creates a new pipe in self.pipe

2348

2409

"""

2349

2410

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2350

2411

2351

2412

proc = MultiprocessingMixIn.process_request(self, request,

2352

2413

client_address)

2353

2414

self.child_pipe.close()

2354

2415

self.add_pipe(parent_pipe, proc)

2355

2416

2356

2417

def add_pipe(self, parent_pipe, proc):

2357

2418

"""Dummy function; override as necessary"""

2358

2419

raise NotImplementedError()

2361

2422

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2362

2423

socketserver.TCPServer, object):

2363

2424

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2364

2425

2365

2426

Attributes:

2366

2427

enabled: Boolean; whether this server is activated yet

2367

2428

interface: None or a network interface name (string)

2368

2429

use_ipv6: Boolean; to use IPv6 or not

2369

2430

"""

2370

2431

2371

2432

def __init__(self, server_address, RequestHandlerClass,

2372

2433

interface=None,

2373

2434

use_ipv6=True,

2383

2444

self.socketfd = socketfd

2384

2445

# Save the original socket.socket() function

2385

2446

self.socket_socket = socket.socket

2447

2386

2448

# To implement --socket, we monkey patch socket.socket.

2387

#

2449

#

2388

2450

# (When socketserver.TCPServer is a new-style class, we

2389

2451

# could make self.socket into a property instead of monkey

2390

2452

# patching socket.socket.)

2391

#

2453

#

2392

2454

# Create a one-time-only replacement for socket.socket()

2393

2455

@functools.wraps(socket.socket)

2394

2456

def socket_wrapper(*args, **kwargs):

2406

2468

# socket_wrapper(), if socketfd was set.

2407

2469

socketserver.TCPServer.__init__(self, server_address,

2408

2470

RequestHandlerClass)

2409

2471

2410

2472

def server_bind(self):

2411

2473

"""This overrides the normal server_bind() function

2412

2474

to bind to an interface if one was specified, and also NOT to

2413

2475

bind to an address or port if they were not specified."""

2476

global SO_BINDTODEVICE

2414

2477

if self.interface is not None:

2415

2478

if SO_BINDTODEVICE is None:

2416

logger.error("SO_BINDTODEVICE does not exist;"

2417

" cannot bind to interface %s",

2418

self.interface)

2419

else:

2420

try:

2421

self.socket.setsockopt(

2422

socket.SOL_SOCKET, SO_BINDTODEVICE,

2423

(self.interface + "\0").encode("utf-8"))

2424

except socket.error as error:

2425

if error.errno == errno.EPERM:

2426

logger.error("No permission to bind to"

2427

" interface %s", self.interface)

2428

elif error.errno == errno.ENOPROTOOPT:

2429

logger.error("SO_BINDTODEVICE not available;"

2430

" cannot bind to interface %s",

2431

self.interface)

2432

elif error.errno == errno.ENODEV:

2433

logger.error("Interface %s does not exist,"

2434

" cannot bind", self.interface)

2435

else:

2436

raise

2479

# Fall back to a hard-coded value which seems to be

2480

# common enough.

2481

logger.warning("SO_BINDTODEVICE not found, trying 25")

2482

SO_BINDTODEVICE = 25

2483

try:

2484

self.socket.setsockopt(

2485

socket.SOL_SOCKET, SO_BINDTODEVICE,

2486

(self.interface + "\0").encode("utf-8"))

2487

except socket.error as error:

2488

if error.errno == errno.EPERM:

2489

logger.error("No permission to bind to"

2490

" interface %s", self.interface)

2491

elif error.errno == errno.ENOPROTOOPT:

2492

logger.error("SO_BINDTODEVICE not available;"

2493

" cannot bind to interface %s",

2494

self.interface)

2495

elif error.errno == errno.ENODEV:

2496

logger.error("Interface %s does not exist,"

2497

" cannot bind", self.interface)

2498

else:

2499

raise

2437

2500

# Only bind(2) the socket if we really need to.

2438

2501

if self.server_address[0] or self.server_address[1]:

2439

2502

if not self.server_address[0]:

2440

2503

if self.address_family == socket.AF_INET6:

2441

any_address = "::" # in6addr_any

2504

any_address = "::" # in6addr_any

2442

2505

else:

2443

any_address = "0.0.0.0" # INADDR_ANY

2506

any_address = "0.0.0.0" # INADDR_ANY

2444

2507

self.server_address = (any_address,

2445

2508

self.server_address[1])

2446

2509

elif not self.server_address[1]:

2456

2519

2457

2520

class MandosServer(IPv6_TCPServer):

2458

2521

"""Mandos server.

2459

2522

2460

2523

Attributes:

2461

2524

clients: set of Client objects

2462

2525

gnutls_priority GnuTLS priority string

2463

2526

use_dbus: Boolean; to emit D-Bus signals or not

2464

2465

Assumes a gobject.MainLoop event loop.

2527

2528

Assumes a GLib.MainLoop event loop.

2466

2529

"""

2467

2530

2468

2531

def __init__(self, server_address, RequestHandlerClass,

2469

2532

interface=None,

2470

2533

use_ipv6=True,

2480

2543

self.gnutls_priority = gnutls_priority

2481

2544

IPv6_TCPServer.__init__(self, server_address,

2482

2545

RequestHandlerClass,

2483

interface = interface,

2484

use_ipv6 = use_ipv6,

2485

socketfd = socketfd)

2486

2546

interface=interface,

2547

use_ipv6=use_ipv6,

2548

socketfd=socketfd)

2549

2487

2550

def server_activate(self):

2488

2551

if self.enabled:

2489

2552

return socketserver.TCPServer.server_activate(self)

2490

2553

2491

2554

def enable(self):

2492

2555

self.enabled = True

2493

2556

2494

2557

def add_pipe(self, parent_pipe, proc):

2495

2558

# Call "handle_ipc" for both data and EOF events

2496

gobject.io_add_watch(

2559

GLib.io_add_watch(

2497

2560

parent_pipe.fileno(),

2498

gobject.IO_IN | gobject.IO_HUP,

2561

GLib.IO_IN | GLib.IO_HUP,

2499

2562

functools.partial(self.handle_ipc,

2500

parent_pipe = parent_pipe,

2501

proc = proc))

2502

2563

parent_pipe=parent_pipe,

2564

proc=proc))

2565

2503

2566

def handle_ipc(self, source, condition,

2504

2567

parent_pipe=None,

2505

proc = None,

2568

proc=None,

2506

2569

client_object=None):

2507

2570

# error, or the other end of multiprocessing.Pipe has closed

2508

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2571

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2509

2572

# Wait for other process to exit

2510

2573

proc.join()

2511

2574

return False

2512

2575

2513

2576

# Read a request from the child

2514

2577

request = parent_pipe.recv()

2515

2578

command = request[0]

2516

2579

2517

2580

if command == 'init':

2518

fpr = request[1]

2581

fpr = request[1].decode("ascii")

2519

2582

address = request[2]

2520

2521

for c in self.clients.itervalues():

2583

2584

for c in self.clients.values():

2522

2585

if c.fingerprint == fpr:

2523

2586

client = c

2524

2587

break

2531

2594

address[0])

2532

2595

parent_pipe.send(False)

2533

2596

return False

2534

2535

gobject.io_add_watch(

2597

2598

GLib.io_add_watch(

2536

2599

parent_pipe.fileno(),

2537

gobject.IO_IN | gobject.IO_HUP,

2600

GLib.IO_IN | GLib.IO_HUP,

2538

2601

functools.partial(self.handle_ipc,

2539

parent_pipe = parent_pipe,

2540

proc = proc,

2541

client_object = client))

2602

parent_pipe=parent_pipe,

2603

proc=proc,

2604

client_object=client))

2542

2605

parent_pipe.send(True)

2543

2606

# remove the old hook in favor of the new above hook on

2544

2607

# same fileno

2547

2610

funcname = request[1]

2548

2611

args = request[2]

2549

2612

kwargs = request[3]

2550

2613

2551

2614

parent_pipe.send(('data', getattr(client_object,

2552

2615

funcname)(*args,

2553

2616

**kwargs)))

2554

2617

2555

2618

if command == 'getattr':

2556

2619

attrname = request[1]

2557

2620

if isinstance(client_object.__getattribute__(attrname),

2560

2623

else:

2561

2624

parent_pipe.send((

2562

2625

'data', client_object.__getattribute__(attrname)))

2563

2626

2564

2627

if command == 'setattr':

2565

2628

attrname = request[1]

2566

2629

value = request[2]

2567

2630

setattr(client_object, attrname, value)

2568

2631

2569

2632

return True

2570

2633

2571

2634

2572

2635

def rfc3339_duration_to_delta(duration):

2573

2636

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2574

2637

2575

2638

>>> rfc3339_duration_to_delta("P7D")

2576

2639

datetime.timedelta(7)

2577

2640

>>> rfc3339_duration_to_delta("PT60S")

2587

2650

>>> rfc3339_duration_to_delta("P1DT3M20S")

2588

2651

datetime.timedelta(1, 200)

2589

2652

"""

2590

2653

2591

2654

# Parsing an RFC 3339 duration with regular expressions is not

2592

2655

# possible - there would have to be multiple places for the same

2593

2656

# values, like seconds. The current code, while more esoteric, is

2594

2657

# cleaner without depending on a parsing library. If Python had a

2595

2658

# built-in library for parsing we would use it, but we'd like to

2596

2659

# avoid excessive use of external libraries.

2597

2660

2598

2661

# New type for defining tokens, syntax, and semantics all-in-one

2599

2662

Token = collections.namedtuple("Token", (

2600

2663

"regexp", # To match token; if "value" is not None, must have

2633

2696

frozenset((token_year, token_month,

2634

2697

token_day, token_time,

2635

2698

token_week)))

2636

# Define starting values

2637

value = datetime.timedelta() # Value so far

2699

# Define starting values:

2700

# Value so far

2701

value = datetime.timedelta()

2638

2702

found_token = None

2639

followers = frozenset((token_duration, )) # Following valid tokens

2640

s = duration # String left to parse

2703

# Following valid tokens

2704

followers = frozenset((token_duration, ))

2705

# String left to parse

2706

s = duration

2641

2707

# Loop until end token is found

2642

2708

while found_token is not token_end:

2643

2709

# Search for any currently valid tokens

2667

2733

2668

2734

def string_to_delta(interval):

2669

2735

"""Parse a string and return a datetime.timedelta

2670

2736

2671

2737

>>> string_to_delta('7d')

2672

2738

datetime.timedelta(7)

2673

2739

>>> string_to_delta('60s')

2681

2747

>>> string_to_delta('5m 30s')

2682

2748

datetime.timedelta(0, 330)

2683

2749

"""

2684

2750

2685

2751

try:

2686

2752

return rfc3339_duration_to_delta(interval)

2687

2753

except ValueError:

2688

2754

pass

2689

2755

2690

2756

timevalue = datetime.timedelta(0)

2691

2757

for s in interval.split():

2692

2758

try:

2710

2776

return timevalue

2711

2777

2712

2778

2713

def daemon(nochdir = False, noclose = False):

2779

def daemon(nochdir=False, noclose=False):

2714

2780

"""See daemon(3). Standard BSD Unix function.

2715

2781

2716

2782

This should really exist as os.daemon, but it doesn't (yet)."""

2717

2783

if os.fork():

2718

2784

sys.exit()

2736

2802

2737

2803

2738

2804

def main():

2739

2805

2740

2806

##################################################################

2741

2807

# Parsing of options, both command line and config file

2742

2808

2743

2809

parser = argparse.ArgumentParser()

2744

2810

parser.add_argument("-v", "--version", action="version",

2745

version = "%(prog)s {}".format(version),

2811

version="%(prog)s {}".format(version),

2746

2812

help="show version number and exit")

2747

2813

parser.add_argument("-i", "--interface", metavar="IF",

2748

2814

help="Bind to interface IF")

2784

2850

parser.add_argument("--no-zeroconf", action="store_false",

2785

2851

dest="zeroconf", help="Do not use Zeroconf",

2786

2852

default=None)

2787

2853

2788

2854

options = parser.parse_args()

2789

2855

2790

2856

if options.check:

2791

2857

import doctest

2792

2858

fail_count, test_count = doctest.testmod()

2793

2859

sys.exit(os.EX_OK if fail_count == 0 else 1)

2794

2860

2795

2861

# Default values for config file for server-global settings

2796

server_defaults = { "interface": "",

2797

"address": "",

2798

"port": "",

2799

"debug": "False",

2800

"priority":

2801

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2802

":+SIGN-DSA-SHA256",

2803

"servicename": "Mandos",

2804

"use_dbus": "True",

2805

"use_ipv6": "True",

2806

"debuglevel": "",

2807

"restore": "True",

2808

"socket": "",

2809

"statedir": "/var/lib/mandos",

2810

"foreground": "False",

2811

"zeroconf": "True",

2812

}

2813

2862

server_defaults = {"interface": "",

2863

"address": "",

2864

"port": "",

2865

"debug": "False",

2866

"priority":

2867

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2868

":+SIGN-DSA-SHA256",

2869

"servicename": "Mandos",

2870

"use_dbus": "True",

2871

"use_ipv6": "True",

2872

"debuglevel": "",

2873

"restore": "True",

2874

"socket": "",

2875

"statedir": "/var/lib/mandos",

2876

"foreground": "False",

2877

"zeroconf": "True",

2878

}

2879

2814

2880

# Parse config file for server-global settings

2815

2881

server_config = configparser.SafeConfigParser(server_defaults)

2816

2882

del server_defaults

2818

2884

# Convert the SafeConfigParser object to a dict

2819

2885

server_settings = server_config.defaults()

2820

2886

# Use the appropriate methods on the non-string config options

2821

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

2887

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2888

"foreground", "zeroconf"):

2822

2889

server_settings[option] = server_config.getboolean("DEFAULT",

2823

2890

option)

2824

2891

if server_settings["port"]:

2834

2901

server_settings["socket"] = os.dup(server_settings

2835

2902

["socket"])

2836

2903

del server_config

2837

2904

2838

2905

# Override the settings from the config file with command line

2839

2906

# options, if set.

2840

2907

for option in ("interface", "address", "port", "debug",

2858

2925

if server_settings["debug"]:

2859

2926

server_settings["foreground"] = True

2860

2927

# Now we have our good server settings in "server_settings"

2861

2928

2862

2929

##################################################################

2863

2930

2864

2931

if (not server_settings["zeroconf"]

2865

2932

and not (server_settings["port"]

2866

2933

or server_settings["socket"] != "")):

2867

2934

parser.error("Needs port or socket to work without Zeroconf")

2868

2935

2869

2936

# For convenience

2870

2937

debug = server_settings["debug"]

2871

2938

debuglevel = server_settings["debuglevel"]

2875

2942

stored_state_file)

2876

2943

foreground = server_settings["foreground"]

2877

2944

zeroconf = server_settings["zeroconf"]

2878

2945

2879

2946

if debug:

2880

2947

initlogger(debug, logging.DEBUG)

2881

2948

else:

2884

2951

else:

2885

2952

level = getattr(logging, debuglevel.upper())

2886

2953

initlogger(debug, level)

2887

2954

2888

2955

if server_settings["servicename"] != "Mandos":

2889

2956

syslogger.setFormatter(

2890

2957

logging.Formatter('Mandos ({}) [%(process)d]:'

2891

2958

' %(levelname)s: %(message)s'.format(

2892

2959

server_settings["servicename"])))

2893

2960

2894

2961

# Parse config file with clients

2895

2962

client_config = configparser.SafeConfigParser(Client

2896

2963

.client_defaults)

2897

2964

client_config.read(os.path.join(server_settings["configdir"],

2898

2965

"clients.conf"))

2899

2966

2900

2967

global mandos_dbus_service

2901

2968

mandos_dbus_service = None

2902

2969

2903

2970

socketfd = None

2904

2971

if server_settings["socket"] != "":

2905

2972

socketfd = server_settings["socket"]

2921

2988

except IOError as e:

2922

2989

logger.error("Could not open file %r", pidfilename,

2923

2990

exc_info=e)

2924

2925

for name in ("_mandos", "mandos", "nobody"):

2991

2992

for name, group in (("_mandos", "_mandos"),

2993

("mandos", "mandos"),

2994

("nobody", "nogroup")):

2926

2995

try:

2927

2996

uid = pwd.getpwnam(name).pw_uid

2928

gid = pwd.getpwnam(name).pw_gid

2997

gid = pwd.getpwnam(group).pw_gid

2929

2998

break

2930

2999

except KeyError:

2931

3000

continue

2935

3004

try:

2936

3005

os.setgid(gid)

2937

3006

os.setuid(uid)

3007

if debug:

3008

logger.debug("Did setuid/setgid to {}:{}".format(uid,

3009

gid))

2938

3010

except OSError as error:

3011

logger.warning("Failed to setuid/setgid to {}:{}: {}"

3012

.format(uid, gid, os.strerror(error.errno)))

2939

3013

if error.errno != errno.EPERM:

2940

3014

raise

2941

3015

2942

3016

if debug:

2943

3017

# Enable all possible GnuTLS debugging

2944

3018

2945

3019

# "Use a log level over 10 to enable all debugging options."

2946

3020

# - GnuTLS manual

2947

3021

gnutls.global_set_log_level(11)

2948

3022

2949

3023

@gnutls.log_func

2950

3024

def debug_gnutls(level, string):

2951

3025

logger.debug("GnuTLS: %s", string[:-1])

2952

3026

2953

3027

gnutls.global_set_log_function(debug_gnutls)

2954

3028

2955

3029

# Redirect stdin so all checkers get /dev/null

2956

3030

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2957

3031

os.dup2(null, sys.stdin.fileno())

2958

3032

if null > 2:

2959

3033

os.close(null)

2960

3034

2961

3035

# Need to fork before connecting to D-Bus

2962

3036

if not foreground:

2963

3037

# Close all input and output, do double fork, etc.

2964

3038

daemon()

2965

2966

# multiprocessing will use threads, so before we use gobject we

2967

# need to inform gobject that threads will be used.

2968

gobject.threads_init()

2969

3039

3040

# multiprocessing will use threads, so before we use GLib we need

3041

# to inform GLib that threads will be used.

3042

GLib.threads_init()

3043

2970

3044

global main_loop

2971

3045

# From the Avahi example code

2972

3046

DBusGMainLoop(set_as_default=True)

2973

main_loop = gobject.MainLoop()

3047

main_loop = GLib.MainLoop()

2974

3048

bus = dbus.SystemBus()

2975

3049

# End of Avahi example code

2976

3050

if use_dbus:

2989

3063

if zeroconf:

2990

3064

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2991

3065

service = AvahiServiceToSyslog(

2992

name = server_settings["servicename"],

2993

servicetype = "_mandos._tcp",

2994

protocol = protocol,

2995

bus = bus)

3066

name=server_settings["servicename"],

3067

servicetype="_mandos._tcp",

3068

protocol=protocol,

3069

bus=bus)

2996

3070

if server_settings["interface"]:

2997

3071

service.interface = if_nametoindex(

2998

3072

server_settings["interface"].encode("utf-8"))

2999

3073

3000

3074

global multiprocessing_manager

3001

3075

multiprocessing_manager = multiprocessing.Manager()

3002

3076

3003

3077

client_class = Client

3004

3078

if use_dbus:

3005

client_class = functools.partial(ClientDBus, bus = bus)

3006

3079

client_class = functools.partial(ClientDBus, bus=bus)

3080

3007

3081

client_settings = Client.config_parser(client_config)

3008

3082

old_client_settings = {}

3009

3083

clients_data = {}

3010

3084

3011

3085

# This is used to redirect stdout and stderr for checker processes

3012

3086

global wnull

3013

wnull = open(os.devnull, "w") # A writable /dev/null

3087

wnull = open(os.devnull, "w") # A writable /dev/null

3014

3088

# Only used if server is running in foreground but not in debug

3015

3089

# mode

3016

3090

if debug or not foreground:

3017

3091

wnull.close()

3018

3092

3019

3093

# Get client data and settings from last running state.

3020

3094

if server_settings["restore"]:

3021

3095

try:

3022

3096

with open(stored_state_path, "rb") as stored_state:

3023

clients_data, old_client_settings = pickle.load(

3024

stored_state)

3097

if sys.version_info.major == 2:

3098

clients_data, old_client_settings = pickle.load(

3099

stored_state)

3100

else:

3101

bytes_clients_data, bytes_old_client_settings = (

3102

pickle.load(stored_state, encoding="bytes"))

3103

# Fix bytes to strings

3104

# clients_data

3105

# .keys()

3106

clients_data = {(key.decode("utf-8")

3107

if isinstance(key, bytes)

3108

else key): value

3109

for key, value in

3110

bytes_clients_data.items()}

3111

del bytes_clients_data

3112

for key in clients_data:

3113

value = {(k.decode("utf-8")

3114

if isinstance(k, bytes) else k): v

3115

for k, v in

3116

clients_data[key].items()}

3117

clients_data[key] = value

3118

# .client_structure

3119

value["client_structure"] = [

3120

(s.decode("utf-8")

3121

if isinstance(s, bytes)

3122

else s) for s in

3123

value["client_structure"]]

3124

# .name & .host

3125

for k in ("name", "host"):

3126

if isinstance(value[k], bytes):

3127

value[k] = value[k].decode("utf-8")

3128

# old_client_settings

3129

# .keys()

3130

old_client_settings = {

3131

(key.decode("utf-8")

3132

if isinstance(key, bytes)

3133

else key): value

3134

for key, value in

3135

bytes_old_client_settings.items()}

3136

del bytes_old_client_settings

3137

# .host

3138

for value in old_client_settings.values():

3139

if isinstance(value["host"], bytes):

3140

value["host"] = (value["host"]

3141

.decode("utf-8"))

3025

3142

os.remove(stored_state_path)

3026

3143

except IOError as e:

3027

3144

if e.errno == errno.ENOENT:

3035

3152

logger.warning("Could not load persistent state: "

3036

3153

"EOFError:",

3037

3154

exc_info=e)

3038

3155

3039

3156

with PGPEngine() as pgp:

3040

3157

for client_name, client in clients_data.items():

3041

3158

# Skip removed clients

3042

3159

if client_name not in client_settings:

3043

3160

continue

3044

3161

3045

3162

# Decide which value to use after restoring saved state.

3046

3163

# We have three different values: Old config file,

3047

3164

# new config file, and saved state.

3058

3175

client[name] = value

3059

3176

except KeyError:

3060

3177

pass

3061

3178

3062

3179

# Clients who has passed its expire date can still be

3063

3180

# enabled if its last checker was successful. A Client

3064

3181

# whose checker succeeded before we stored its state is

3097

3214

client_name))

3098

3215

client["secret"] = (client_settings[client_name]

3099

3216

["secret"])

3100

3217

3101

3218

# Add/remove clients based on new changes made to config

3102

3219

for client_name in (set(old_client_settings)

3103

3220

- set(client_settings)):

3105

3222

for client_name in (set(client_settings)

3106

3223

- set(old_client_settings)):

3107

3224

clients_data[client_name] = client_settings[client_name]

3108

3225

3109

3226

# Create all client objects

3110

3227

for client_name, client in clients_data.items():

3111

3228

tcp_server.clients[client_name] = client_class(

3112

name = client_name,

3113

settings = client,

3114

server_settings = server_settings)

3115

3229

name=client_name,

3230

settings=client,

3231

server_settings=server_settings)

3232

3116

3233

if not tcp_server.clients:

3117

3234

logger.warning("No clients defined")

3118

3235

3119

3236

if not foreground:

3120

3237

if pidfile is not None:

3121

3238

pid = os.getpid()

3127

3244

pidfilename, pid)

3128

3245

del pidfile

3129

3246

del pidfilename

3130

3131

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

3132

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

3133

3247

3248

for termsig in (signal.SIGHUP, signal.SIGTERM):

3249

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3250

lambda: main_loop.quit() and False)

3251

3134

3252

if use_dbus:

3135

3253

3136

3254

@alternate_dbus_interfaces(

3137

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3255

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3138

3256

class MandosDBusService(DBusObjectWithObjectManager):

3139

3257

"""A D-Bus proxy object"""

3140

3258

3141

3259

def __init__(self):

3142

3260

dbus.service.Object.__init__(self, bus, "/")

3143

3261

3144

3262

_interface = "se.recompile.Mandos"

3145

3263

3146

3264

@dbus.service.signal(_interface, signature="o")

3147

3265

def ClientAdded(self, objpath):

3148

3266

"D-Bus signal"

3149

3267

pass

3150

3268

3151

3269

@dbus.service.signal(_interface, signature="ss")

3152

3270

def ClientNotFound(self, fingerprint, address):

3153

3271

"D-Bus signal"

3154

3272

pass

3155

3273

3156

3274

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3157

3275

"true"})

3158

3276

@dbus.service.signal(_interface, signature="os")

3159

3277

def ClientRemoved(self, objpath, name):

3160

3278

"D-Bus signal"

3161

3279

pass

3162

3280

3163

3281

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3164

3282

"true"})

3165

3283

@dbus.service.method(_interface, out_signature="ao")

3166

3284

def GetAllClients(self):

3167

3285

"D-Bus method"

3168

3286

return dbus.Array(c.dbus_object_path for c in

3169

tcp_server.clients.itervalues())

3170

3287

tcp_server.clients.values())

3288

3171

3289

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3172

3290

"true"})

3173

3291

@dbus.service.method(_interface,

3175

3293

def GetAllClientsWithProperties(self):

3176

3294

"D-Bus method"

3177

3295

return dbus.Dictionary(

3178

{ c.dbus_object_path: c.GetAll(

3296

{c.dbus_object_path: c.GetAll(

3179

3297

"se.recompile.Mandos.Client")

3180

for c in tcp_server.clients.itervalues() },

3298

for c in tcp_server.clients.values()},

3181

3299

signature="oa{sv}")

3182

3300

3183

3301

@dbus.service.method(_interface, in_signature="o")

3184

3302

def RemoveClient(self, object_path):

3185

3303

"D-Bus method"

3186

for c in tcp_server.clients.itervalues():

3304

for c in tcp_server.clients.values():

3187

3305

if c.dbus_object_path == object_path:

3188

3306

del tcp_server.clients[c.name]

3189

3307

c.remove_from_connection()

3193

3311

self.client_removed_signal(c)

3194

3312

return

3195

3313

raise KeyError(object_path)

3196

3314

3197

3315

del _interface

3198

3316

3199

3317

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3200

out_signature = "a{oa{sa{sv}}}")

3318

out_signature="a{oa{sa{sv}}}")

3201

3319

def GetManagedObjects(self):

3202

3320

"""D-Bus method"""

3203

3321

return dbus.Dictionary(

3204

{ client.dbus_object_path:

3205

dbus.Dictionary(

3206

{ interface: client.GetAll(interface)

3207

for interface in

3208

client._get_all_interface_names()})

3209

for client in tcp_server.clients.values()})

3210

3322

{client.dbus_object_path:

3323

dbus.Dictionary(

3324

{interface: client.GetAll(interface)

3325

for interface in

3326

client._get_all_interface_names()})

3327

for client in tcp_server.clients.values()})

3328

3211

3329

def client_added_signal(self, client):

3212

3330

"""Send the new standard signal and the old signal"""

3213

3331

if use_dbus:

3215

3333

self.InterfacesAdded(

3216

3334

client.dbus_object_path,

3217

3335

dbus.Dictionary(

3218

{ interface: client.GetAll(interface)

3219

for interface in

3220

client._get_all_interface_names()}))

3336

{interface: client.GetAll(interface)

3337

for interface in

3338

client._get_all_interface_names()}))

3221

3339

# Old signal

3222

3340

self.ClientAdded(client.dbus_object_path)

3223

3341

3224

3342

def client_removed_signal(self, client):

3225

3343

"""Send the new standard signal and the old signal"""

3226

3344

if use_dbus:

3231

3349

# Old signal

3232

3350

self.ClientRemoved(client.dbus_object_path,

3233

3351

client.name)

3234

3352

3235

3353

mandos_dbus_service = MandosDBusService()

3236

3354

3355

# Save modules to variables to exempt the modules from being

3356

# unloaded before the function registered with atexit() is run.

3357

mp = multiprocessing

3358

wn = wnull

3359

3237

3360

def cleanup():

3238

3361

"Cleanup function; run on exit"

3239

3362

if zeroconf:

3240

3363

service.cleanup()

3241

3242

multiprocessing.active_children()

3243

wnull.close()

3364

3365

mp.active_children()

3366

wn.close()

3244

3367

if not (tcp_server.clients or client_settings):

3245

3368

return

3246

3369

3247

3370

# Store client before exiting. Secrets are encrypted with key

3248

3371

# based on what config file has. If config file is

3249

3372

# removed/edited, old secret will thus be unrecovable.

3250

3373

clients = {}

3251

3374

with PGPEngine() as pgp:

3252

for client in tcp_server.clients.itervalues():

3375

for client in tcp_server.clients.values():

3253

3376

key = client_settings[client.name]["secret"]

3254

3377

client.encrypted_secret = pgp.encrypt(client.secret,

3255

3378

key)

3256

3379

client_dict = {}

3257

3380

3258

3381

# A list of attributes that can not be pickled

3259

3382

# + secret.

3260

exclude = { "bus", "changedstate", "secret",

3261

"checker", "server_settings" }

3383

exclude = {"bus", "changedstate", "secret",

3384

"checker", "server_settings"}

3262

3385

for name, typ in inspect.getmembers(dbus.service

3263

3386

.Object):

3264

3387

exclude.add(name)

3265

3388

3266

3389

client_dict["encrypted_secret"] = (client

3267

3390

.encrypted_secret)

3268

3391

for attr in client.client_structure:

3269

3392

if attr not in exclude:

3270

3393

client_dict[attr] = getattr(client, attr)

3271

3394

3272

3395

clients[client.name] = client_dict

3273

3396

del client_settings[client.name]["secret"]

3274

3397

3275

3398

try:

3276

3399

with tempfile.NamedTemporaryFile(

3277

3400

mode='wb',

3279

3402

prefix='clients-',

3280

3403

dir=os.path.dirname(stored_state_path),

3281

3404

delete=False) as stored_state:

3282

pickle.dump((clients, client_settings), stored_state)

3405

pickle.dump((clients, client_settings), stored_state,

3406

protocol=2)

3283

3407

tempname = stored_state.name

3284

3408

os.rename(tempname, stored_state_path)

3285

3409

except (IOError, OSError) as e:

3295

3419

logger.warning("Could not save persistent state:",

3296

3420

exc_info=e)

3297

3421

raise

3298

3422

3299

3423

# Delete all clients, and settings from config

3300

3424

while tcp_server.clients:

3301

3425

name, client = tcp_server.clients.popitem()

3307

3431

if use_dbus:

3308

3432

mandos_dbus_service.client_removed_signal(client)

3309

3433

client_settings.clear()

3310

3434

3311

3435

atexit.register(cleanup)

3312

3313

for client in tcp_server.clients.itervalues():

3436

3437

for client in tcp_server.clients.values():

3314

3438

if use_dbus:

3315

3439

# Emit D-Bus signal for adding

3316

3440

mandos_dbus_service.client_added_signal(client)

3317

3441

# Need to initiate checking of clients

3318

3442

if client.enabled:

3319

3443

client.init_checker()

3320

3444

3321

3445

tcp_server.enable()

3322

3446

tcp_server.server_activate()

3323

3447

3324

3448

# Find out what port we got

3325

3449

if zeroconf:

3326

3450

service.port = tcp_server.socket.getsockname()[1]

3331

3455

else: # IPv4

3332

3456

logger.info("Now listening on address %r, port %d",

3333

3457

*tcp_server.socket.getsockname())

3334

3335

#service.interface = tcp_server.socket.getsockname()[3]

3336

3458

3459

# service.interface = tcp_server.socket.getsockname()[3]

3460

3337

3461

try:

3338

3462

if zeroconf:

3339

3463

# From the Avahi example code

3344

3468

cleanup()

3345

3469

sys.exit(1)

3346

3470

# End of Avahi example code

3347

3348

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

3349

lambda *args, **kwargs:

3350

(tcp_server.handle_request

3351

(*args[2:], **kwargs) or True))

3352

3471

3472

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3473

lambda *args, **kwargs:

3474

(tcp_server.handle_request

3475

(*args[2:], **kwargs) or True))

3476

3353

3477

logger.debug("Starting main loop")

3354

3478

main_loop.run()

3355

3479

except AvahiError as error: