/mandos/release : revision 292

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

37

import SocketServer as socketserver

43

38

import socket

44

39

import argparse

45

40

import datetime

46

41

import errno

47

try:

48

import ConfigParser as configparser

49

except ImportError:

50

import configparser

42

import gnutls.crypto

43

import gnutls.connection

44

import gnutls.errors

45

import gnutls.library.functions

46

import gnutls.library.constants

47

import gnutls.library.types

48

import ConfigParser as configparser

51

49

import sys

52

50

import re

53

51

import os

62

60

import struct

63

61

import fcntl

64

62

import functools

65

try:

66

import cPickle as pickle

67

except ImportError:

68

import pickle

63

import cPickle as pickle

69

64

import multiprocessing

70

65

import types

71

66

import binascii

72

67

import tempfile

73

import itertools

74

import collections

75

import codecs

76

68

77

69

import dbus

78

70

import dbus.service

79

try:

80

import gobject

81

except ImportError:

82

from gi.repository import GObject as gobject

71

import gobject

83

72

import avahi

84

73

from dbus.mainloop.glib import DBusGMainLoop

85

74

import ctypes

86

75

import ctypes.util

87

76

import xml.dom.minidom

88

77

import inspect

78

import GnuPGInterface

89

79

90

80

try:

91

81

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

95

85

except ImportError:

96

86

SO_BINDTODEVICE = None

97

87

98

if sys.version_info.major == 2:

99

str = unicode

100

101

version = "1.7.1"

88

version = "1.5.0"

102

89

stored_state_file = "clients.pickle"

103

90

104

91

logger = logging.getLogger()

105

syslogger = None

92

syslogger = (logging.handlers.SysLogHandler

93

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

94

address = str("/dev/log")))

106

95

107

96

try:

108

if_nametoindex = ctypes.cdll.LoadLibrary(

109

ctypes.util.find_library("c")).if_nametoindex

97

if_nametoindex = (ctypes.cdll.LoadLibrary

98

(ctypes.util.find_library("c"))

99

.if_nametoindex)

110

100

except (OSError, AttributeError):

111

112

101

def if_nametoindex(interface):

113

102

"Get an interface index the hard way, i.e. using fcntl()"

114

103

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

115

104

with contextlib.closing(socket.socket()) as s:

116

105

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

117

struct.pack(b"16s16x", interface))

118

interface_index = struct.unpack("I", ifreq[16:20])[0]

106

struct.pack(str("16s16x"),

107

interface))

108

interface_index = struct.unpack(str("I"),

109

ifreq[16:20])[0]

119

110

return interface_index

120

111

121

112

122

113

def initlogger(debug, level=logging.WARNING):

123

114

"""init logger and add loglevel"""

124

115

125

global syslogger

126

syslogger = (logging.handlers.SysLogHandler(

127

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

128

address = "/dev/log"))

129

116

syslogger.setFormatter(logging.Formatter

130

117

('Mandos [%(process)d]: %(levelname)s:'

131

118

' %(message)s'))

148

135

149

136

class PGPEngine(object):

150

137

"""A simple class for OpenPGP symmetric encryption & decryption"""

151

152

138

def __init__(self):

139

self.gnupg = GnuPGInterface.GnuPG()

153

140

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

154

self.gpg = "gpg"

155

try:

156

output = subprocess.check_output(["gpgconf"])

157

for line in output.splitlines():

158

name, text, path = line.split(":")

159

if name == "gpg":

160

self.gpg = path

161

break

162

except OSError as e:

163

if e.errno != errno.ENOENT:

164

raise

165

self.gnupgargs = ['--batch',

166

'--homedir', self.tempdir,

167

'--force-mdc',

168

'--quiet',

169

'--no-use-agent']

141

self.gnupg = GnuPGInterface.GnuPG()

142

self.gnupg.options.meta_interactive = False

143

self.gnupg.options.homedir = self.tempdir

144

self.gnupg.options.extra_args.extend(['--force-mdc',

145

'--quiet',

146

'--no-use-agent'])

170

147

171

148

def __enter__(self):

172

149

return self

173

150

174

def __exit__(self, exc_type, exc_value, traceback):

151

def __exit__ (self, exc_type, exc_value, traceback):

175

152

self._cleanup()

176

153

return False

177

154

194

171

def password_encode(self, password):

195

172

# Passphrase can not be empty and can not contain newlines or

196

173

# NUL bytes. So we prefix it and hex encode it.

197

encoded = b"mandos" + binascii.hexlify(password)

198

if len(encoded) > 2048:

199

# GnuPG can't handle long passwords, so encode differently

200

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

201

.replace(b"\n", b"\\n")

202

.replace(b"\0", b"\\x00"))

203

return encoded

174

return b"mandos" + binascii.hexlify(password)

204

175

205

176

def encrypt(self, data, password):

206

passphrase = self.password_encode(password)

207

with tempfile.NamedTemporaryFile(

208

dir=self.tempdir) as passfile:

209

passfile.write(passphrase)

210

passfile.flush()

211

proc = subprocess.Popen([self.gpg, '--symmetric',

212

'--passphrase-file',

213

passfile.name]

214

+ self.gnupgargs,

215

stdin = subprocess.PIPE,

216

stdout = subprocess.PIPE,

217

stderr = subprocess.PIPE)

218

ciphertext, err = proc.communicate(input = data)

219

if proc.returncode != 0:

220

raise PGPError(err)

177

self.gnupg.passphrase = self.password_encode(password)

178

with open(os.devnull) as devnull:

179

try:

180

proc = self.gnupg.run(['--symmetric'],

181

create_fhs=['stdin', 'stdout'],

182

attach_fhs={'stderr': devnull})

183

with contextlib.closing(proc.handles['stdin']) as f:

184

f.write(data)

185

with contextlib.closing(proc.handles['stdout']) as f:

186

ciphertext = f.read()

187

proc.wait()

188

except IOError as e:

189

raise PGPError(e)

190

self.gnupg.passphrase = None

221

191

return ciphertext

222

192

223

193

def decrypt(self, data, password):

224

passphrase = self.password_encode(password)

225

with tempfile.NamedTemporaryFile(

226

dir = self.tempdir) as passfile:

227

passfile.write(passphrase)

228

passfile.flush()

229

proc = subprocess.Popen([self.gpg, '--decrypt',

230

'--passphrase-file',

231

passfile.name]

232

+ self.gnupgargs,

233

stdin = subprocess.PIPE,

234

stdout = subprocess.PIPE,

235

stderr = subprocess.PIPE)

236

decrypted_plaintext, err = proc.communicate(input = data)

237

if proc.returncode != 0:

238

raise PGPError(err)

194

self.gnupg.passphrase = self.password_encode(password)

195

with open(os.devnull) as devnull:

196

try:

197

proc = self.gnupg.run(['--decrypt'],

198

create_fhs=['stdin', 'stdout'],

199

attach_fhs={'stderr': devnull})

200

with contextlib.closing(proc.handles['stdin'] ) as f:

201

f.write(data)

202

with contextlib.closing(proc.handles['stdout']) as f:

203

decrypted_plaintext = f.read()

204

proc.wait()

205

except IOError as e:

206

raise PGPError(e)

207

self.gnupg.passphrase = None

239

208

return decrypted_plaintext

240

209

241

210

211

242

212

class AvahiError(Exception):

243

213

def __init__(self, value, *args, **kwargs):

244

214

self.value = value

245

return super(AvahiError, self).__init__(value, *args,

246

**kwargs)

247

215

super(AvahiError, self).__init__(value, *args, **kwargs)

216

def __unicode__(self):

217

return unicode(repr(self.value))

248

218

249

219

class AvahiServiceError(AvahiError):

250

220

pass

251

221

252

253

222

class AvahiGroupError(AvahiError):

254

223

pass

255

224

262

231

Used to optionally bind to the specified interface.

263

232

name: string; Example: 'Mandos'

264

233

type: string; Example: '_mandos._tcp'.

265

See <https://www.iana.org/assignments/service-names-port-numbers>

234

See <http://www.dns-sd.org/ServiceTypes.html>

266

235

port: integer; what port to announce

267

236

TXT: list of strings; TXT record for the service

268

237

domain: string; Domain to publish on, default to .local if empty.

274

243

server: D-Bus Server

275

244

bus: dbus.SystemBus()

276

245

"""

277

278

def __init__(self,

279

interface = avahi.IF_UNSPEC,

280

name = None,

281

servicetype = None,

282

port = None,

283

TXT = None,

284

domain = "",

285

host = "",

286

max_renames = 32768,

287

protocol = avahi.PROTO_UNSPEC,

288

bus = None):

246

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

247

servicetype = None, port = None, TXT = None,

248

domain = "", host = "", max_renames = 32768,

249

protocol = avahi.PROTO_UNSPEC, bus = None):

289

250

self.interface = interface

290

251

self.name = name

291

252

self.type = servicetype

300

261

self.server = None

301

262

self.bus = bus

302

263

self.entry_group_state_changed_match = None

303

304

def rename(self, remove=True):

264

def rename(self):

305

265

"""Derived from the Avahi example code"""

306

266

if self.rename_count >= self.max_renames:

307

267

logger.critical("No suitable Zeroconf service name found"

308

268

" after %i retries, exiting.",

309

269

self.rename_count)

310

270

raise AvahiServiceError("Too many renames")

311

self.name = str(

312

self.server.GetAlternativeServiceName(self.name))

313

self.rename_count += 1

271

self.name = unicode(self.server

272

.GetAlternativeServiceName(self.name))

314

273

logger.info("Changing Zeroconf service name to %r ...",

315

274

self.name)

316

if remove:

317

self.remove()

275

self.remove()

318

276

try:

319

277

self.add()

320

278

except dbus.exceptions.DBusException as error:

321

if (error.get_dbus_name()

322

== "org.freedesktop.Avahi.CollisionError"):

323

logger.info("Local Zeroconf service name collision.")

324

return self.rename(remove=False)

325

else:

326

logger.critical("D-Bus Exception", exc_info=error)

327

self.cleanup()

328

os._exit(1)

329

279

logger.critical("DBusException: %s", error)

280

self.cleanup()

281

os._exit(1)

282

self.rename_count += 1

330

283

def remove(self):

331

284

"""Derived from the Avahi example code"""

332

285

if self.entry_group_state_changed_match is not None:

334

287

self.entry_group_state_changed_match = None

335

288

if self.group is not None:

336

289

self.group.Reset()

337

338

290

def add(self):

339

291

"""Derived from the Avahi example code"""

340

292

self.remove()

357

309

dbus.UInt16(self.port),

358

310

avahi.string_array_to_txt_array(self.TXT))

359

311

self.group.Commit()

360

361

312

def entry_group_state_changed(self, state, error):

362

313

"""Derived from the Avahi example code"""

363

314

logger.debug("Avahi entry group state change: %i", state)

369

320

self.rename()

370

321

elif state == avahi.ENTRY_GROUP_FAILURE:

371

322

logger.critical("Avahi: Error in group state changed %s",

372

str(error))

373

raise AvahiGroupError("State changed: {!s}".format(error))

374

323

unicode(error))

324

raise AvahiGroupError("State changed: %s"

325

% unicode(error))

375

326

def cleanup(self):

376

327

"""Derived from the Avahi example code"""

377

328

if self.group is not None:

382

333

pass

383

334

self.group = None

384

335

self.remove()

385

386

336

def server_state_changed(self, state, error=None):

387

337

"""Derived from the Avahi example code"""

388

338

logger.debug("Avahi server state change: %i", state)

389

bad_states = {

390

avahi.SERVER_INVALID: "Zeroconf server invalid",

391

avahi.SERVER_REGISTERING: None,

392

avahi.SERVER_COLLISION: "Zeroconf server name collision",

393

avahi.SERVER_FAILURE: "Zeroconf server failure",

394

}

339

bad_states = { avahi.SERVER_INVALID:

340

"Zeroconf server invalid",

341

avahi.SERVER_REGISTERING: None,

342

avahi.SERVER_COLLISION:

343

"Zeroconf server name collision",

344

avahi.SERVER_FAILURE:

345

"Zeroconf server failure" }

395

346

if state in bad_states:

396

347

if bad_states[state] is not None:

397

348

if error is None:

400

351

logger.error(bad_states[state] + ": %r", error)

401

352

self.cleanup()

402

353

elif state == avahi.SERVER_RUNNING:

403

try:

404

self.add()

405

except dbus.exceptions.DBusException as error:

406

if (error.get_dbus_name()

407

== "org.freedesktop.Avahi.CollisionError"):

408

logger.info("Local Zeroconf service name"

409

" collision.")

410

return self.rename(remove=False)

411

else:

412

logger.critical("D-Bus Exception", exc_info=error)

413

self.cleanup()

414

os._exit(1)

354

self.add()

415

355

else:

416

356

if error is None:

417

357

logger.debug("Unknown state: %r", state)

418

358

else:

419

359

logger.debug("Unknown state: %r: %r", state, error)

420

421

360

def activate(self):

422

361

"""Derived from the Avahi example code"""

423

362

if self.server is None:

427

366

follow_name_owner_changes=True),

428

367

avahi.DBUS_INTERFACE_SERVER)

429

368

self.server.connect_to_signal("StateChanged",

430

self.server_state_changed)

369

self.server_state_changed)

431

370

self.server_state_changed(self.server.GetState())

432

371

433

434

372

class AvahiServiceToSyslog(AvahiService):

435

def rename(self, *args, **kwargs):

373

def rename(self):

436

374

"""Add the new name to the syslog messages"""

437

ret = AvahiService.rename(self, *args, **kwargs)

438

syslogger.setFormatter(logging.Formatter(

439

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

440

.format(self.name)))

375

ret = AvahiService.rename(self)

376

syslogger.setFormatter(logging.Formatter

377

('Mandos (%s) [%%(process)d]:'

378

' %%(levelname)s: %%(message)s'

379

% self.name))

441

380

return ret

442

381

443

# Pretend that we have a GnuTLS module

444

class GnuTLS(object):

445

"""This isn't so much a class as it is a module-like namespace.

446

It is instantiated once, and simulates having a GnuTLS module."""

447

448

_library = ctypes.cdll.LoadLibrary(

449

ctypes.util.find_library("gnutls"))

450

_need_version = "3.3.0"

451

def __init__(self):

452

# Need to use class name "GnuTLS" here, since this method is

453

# called before the assignment to the "gnutls" global variable

454

# happens.

455

if GnuTLS.check_version(self._need_version) is None:

456

raise GnuTLS.Error("Needs GnuTLS {} or later"

457

.format(self._need_version))

458

459

# Unless otherwise indicated, the constants and types below are

460

# all from the gnutls/gnutls.h C header file.

461

462

# Constants

463

E_SUCCESS = 0

464

E_INTERRUPTED = -52

465

E_AGAIN = -28

466

CRT_OPENPGP = 2

467

CLIENT = 2

468

SHUT_RDWR = 0

469

CRD_CERTIFICATE = 1

470

E_NO_CERTIFICATE_FOUND = -49

471

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

472

473

# Types

474

class session_int(ctypes.Structure):

475

_fields_ = []

476

session_t = ctypes.POINTER(session_int)

477

class certificate_credentials_st(ctypes.Structure):

478

_fields_ = []

479

certificate_credentials_t = ctypes.POINTER(

480

certificate_credentials_st)

481

certificate_type_t = ctypes.c_int

482

class datum_t(ctypes.Structure):

483

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

484

('size', ctypes.c_uint)]

485

class openpgp_crt_int(ctypes.Structure):

486

_fields_ = []

487

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

488

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

489

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

490

credentials_type_t = ctypes.c_int #

491

transport_ptr_t = ctypes.c_void_p

492

close_request_t = ctypes.c_int

493

494

# Exceptions

495

class Error(Exception):

496

# We need to use the class name "GnuTLS" here, since this

497

# exception might be raised from within GnuTLS.__init__,

498

# which is called before the assignment to the "gnutls"

499

# global variable has happened.

500

def __init__(self, message = None, code = None, args=()):

501

# Default usage is by a message string, but if a return

502

# code is passed, convert it to a string with

503

# gnutls.strerror()

504

self.code = code

505

if message is None and code is not None:

506

message = GnuTLS.strerror(code)

507

return super(GnuTLS.Error, self).__init__(

508

message, *args)

509

510

class CertificateSecurityError(Error):

511

pass

512

513

# Classes

514

class Credentials(object):

515

def __init__(self):

516

self._c_object = gnutls.certificate_credentials_t()

517

gnutls.certificate_allocate_credentials(

518

ctypes.byref(self._c_object))

519

self.type = gnutls.CRD_CERTIFICATE

520

521

def __del__(self):

522

gnutls.certificate_free_credentials(self._c_object)

523

524

class ClientSession(object):

525

def __init__(self, socket, credentials = None):

526

self._c_object = gnutls.session_t()

527

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

528

gnutls.set_default_priority(self._c_object)

529

gnutls.transport_set_ptr(self._c_object, socket.fileno())

530

gnutls.handshake_set_private_extensions(self._c_object,

531

True)

532

self.socket = socket

533

if credentials is None:

534

credentials = gnutls.Credentials()

535

gnutls.credentials_set(self._c_object, credentials.type,

536

ctypes.cast(credentials._c_object,

537

ctypes.c_void_p))

538

self.credentials = credentials

539

540

def __del__(self):

541

gnutls.deinit(self._c_object)

542

543

def handshake(self):

544

return gnutls.handshake(self._c_object)

545

546

def send(self, data):

547

data = bytes(data)

548

data_len = len(data)

549

while data_len > 0:

550

data_len -= gnutls.record_send(self._c_object,

551

data[-data_len:],

552

data_len)

553

554

def bye(self):

555

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

556

557

# Error handling functions

558

def _error_code(result):

559

"""A function to raise exceptions on errors, suitable

560

for the 'restype' attribute on ctypes functions"""

561

if result >= 0:

562

return result

563

if result == gnutls.E_NO_CERTIFICATE_FOUND:

564

raise gnutls.CertificateSecurityError(code = result)

565

raise gnutls.Error(code = result)

566

567

def _retry_on_error(result, func, arguments):

568

"""A function to retry on some errors, suitable

569

for the 'errcheck' attribute on ctypes functions"""

570

while result < 0:

571

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

572

return _error_code(result)

573

result = func(*arguments)

574

return result

575

576

# Unless otherwise indicated, the function declarations below are

577

# all from the gnutls/gnutls.h C header file.

578

579

# Functions

580

priority_set_direct = _library.gnutls_priority_set_direct

581

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

582

ctypes.POINTER(ctypes.c_char_p)]

583

priority_set_direct.restype = _error_code

584

585

init = _library.gnutls_init

586

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

587

init.restype = _error_code

588

589

set_default_priority = _library.gnutls_set_default_priority

590

set_default_priority.argtypes = [session_t]

591

set_default_priority.restype = _error_code

592

593

record_send = _library.gnutls_record_send

594

record_send.argtypes = [session_t, ctypes.c_void_p,

595

ctypes.c_size_t]

596

record_send.restype = ctypes.c_ssize_t

597

record_send.errcheck = _retry_on_error

598

599

certificate_allocate_credentials = (

600

_library.gnutls_certificate_allocate_credentials)

601

certificate_allocate_credentials.argtypes = [

602

ctypes.POINTER(certificate_credentials_t)]

603

certificate_allocate_credentials.restype = _error_code

604

605

certificate_free_credentials = (

606

_library.gnutls_certificate_free_credentials)

607

certificate_free_credentials.argtypes = [certificate_credentials_t]

608

certificate_free_credentials.restype = None

609

610

handshake_set_private_extensions = (

611

_library.gnutls_handshake_set_private_extensions)

612

handshake_set_private_extensions.argtypes = [session_t,

613

ctypes.c_int]

614

handshake_set_private_extensions.restype = None

615

616

credentials_set = _library.gnutls_credentials_set

617

credentials_set.argtypes = [session_t, credentials_type_t,

618

ctypes.c_void_p]

619

credentials_set.restype = _error_code

620

621

strerror = _library.gnutls_strerror

622

strerror.argtypes = [ctypes.c_int]

623

strerror.restype = ctypes.c_char_p

624

625

certificate_type_get = _library.gnutls_certificate_type_get

626

certificate_type_get.argtypes = [session_t]

627

certificate_type_get.restype = _error_code

628

629

certificate_get_peers = _library.gnutls_certificate_get_peers

630

certificate_get_peers.argtypes = [session_t,

631

ctypes.POINTER(ctypes.c_uint)]

632

certificate_get_peers.restype = ctypes.POINTER(datum_t)

633

634

global_set_log_level = _library.gnutls_global_set_log_level

635

global_set_log_level.argtypes = [ctypes.c_int]

636

global_set_log_level.restype = None

637

638

global_set_log_function = _library.gnutls_global_set_log_function

639

global_set_log_function.argtypes = [log_func]

640

global_set_log_function.restype = None

641

642

deinit = _library.gnutls_deinit

643

deinit.argtypes = [session_t]

644

deinit.restype = None

645

646

handshake = _library.gnutls_handshake

647

handshake.argtypes = [session_t]

648

handshake.restype = _error_code

649

handshake.errcheck = _retry_on_error

650

651

transport_set_ptr = _library.gnutls_transport_set_ptr

652

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

653

transport_set_ptr.restype = None

654

655

bye = _library.gnutls_bye

656

bye.argtypes = [session_t, close_request_t]

657

bye.restype = _error_code

658

bye.errcheck = _retry_on_error

659

660

check_version = _library.gnutls_check_version

661

check_version.argtypes = [ctypes.c_char_p]

662

check_version.restype = ctypes.c_char_p

663

664

# All the function declarations below are from gnutls/openpgp.h

665

666

openpgp_crt_init = _library.gnutls_openpgp_crt_init

667

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

668

openpgp_crt_init.restype = _error_code

669

670

openpgp_crt_import = _library.gnutls_openpgp_crt_import

671

openpgp_crt_import.argtypes = [openpgp_crt_t,

672

ctypes.POINTER(datum_t),

673

openpgp_crt_fmt_t]

674

openpgp_crt_import.restype = _error_code

675

676

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

677

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

678

ctypes.POINTER(ctypes.c_uint)]

679

openpgp_crt_verify_self.restype = _error_code

680

681

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

682

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

683

openpgp_crt_deinit.restype = None

684

685

openpgp_crt_get_fingerprint = (

686

_library.gnutls_openpgp_crt_get_fingerprint)

687

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

688

ctypes.c_void_p,

689

ctypes.POINTER(

690

ctypes.c_size_t)]

691

openpgp_crt_get_fingerprint.restype = _error_code

692

693

# Remove non-public functions

694

del _error_code, _retry_on_error

695

# Create the global "gnutls" object, simulating a module

696

gnutls = GnuTLS()

697

698

def call_pipe(connection, # : multiprocessing.Connection

699

func, *args, **kwargs):

700

"""This function is meant to be called by multiprocessing.Process

701

702

This function runs func(*args, **kwargs), and writes the resulting

703

return value on the provided multiprocessing.Connection.

704

"""

705

connection.send(func(*args, **kwargs))

706

connection.close()

707

382

def timedelta_to_milliseconds(td):

383

"Convert a datetime.timedelta() to milliseconds"

384

return ((td.days * 24 * 60 * 60 * 1000)

385

+ (td.seconds * 1000)

386

+ (td.microseconds // 1000))

387

708

388

class Client(object):

709

389

"""A representation of a client host served by this server.

710

390

735

415

last_checked_ok: datetime.datetime(); (UTC) or None

736

416

last_checker_status: integer between 0 and 255 reflecting exit

737

417

status of last checker. -1 reflects crashed

738

checker, -2 means no checker completed yet.

739

last_checker_signal: The signal which killed the last checker, if

740

last_checker_status is -1

418

checker, or None.

741

419

last_enabled: datetime.datetime(); (UTC) or None

742

420

name: string; from the config file, used in log messages and

743

421

D-Bus identifiers

744

422

secret: bytestring; sent verbatim (over TLS) to client

745

423

timeout: datetime.timedelta(); How long from last_checked_ok

746

424

until this client is disabled

747

extended_timeout: extra long timeout when secret has been sent

425

extended_timeout: extra long timeout when password has been sent

748

426

runtime_expansions: Allowed attributes for runtime expansion.

749

427

expires: datetime.datetime(); time (UTC) when a client will be

750

428

disabled, or None

751

server_settings: The server_settings dict from main()

752

429

"""

753

430

754

431

runtime_expansions = ("approval_delay", "approval_duration",

755

"created", "enabled", "expires",

756

"fingerprint", "host", "interval",

757

"last_approval_request", "last_checked_ok",

432

"created", "enabled", "fingerprint",

433

"host", "interval", "last_checked_ok",

758

434

"last_enabled", "name", "timeout")

759

client_defaults = {

760

"timeout": "PT5M",

761

"extended_timeout": "PT15M",

762

"interval": "PT2M",

763

"checker": "fping -q -- %%(host)s",

764

"host": "",

765

"approval_delay": "PT0S",

766

"approval_duration": "PT1S",

767

"approved_by_default": "True",

768

"enabled": "True",

769

}

770

435

client_defaults = { "timeout": "5m",

436

"extended_timeout": "15m",

437

"interval": "2m",

438

"checker": "fping -q -- %%(host)s",

439

"host": "",

440

"approval_delay": "0s",

441

"approval_duration": "1s",

442

"approved_by_default": "True",

443

"enabled": "True",

444

}

445

446

def timeout_milliseconds(self):

447

"Return the 'timeout' attribute in milliseconds"

448

return timedelta_to_milliseconds(self.timeout)

449

450

def extended_timeout_milliseconds(self):

451

"Return the 'extended_timeout' attribute in milliseconds"

452

return timedelta_to_milliseconds(self.extended_timeout)

453

454

def interval_milliseconds(self):

455

"Return the 'interval' attribute in milliseconds"

456

return timedelta_to_milliseconds(self.interval)

457

458

def approval_delay_milliseconds(self):

459

return timedelta_to_milliseconds(self.approval_delay)

460

771

461

@staticmethod

772

462

def config_parser(config):

773

463

"""Construct a new dict of client settings of this form:

788

478

client["enabled"] = config.getboolean(client_name,

789

479

"enabled")

790

480

791

# Uppercase and remove spaces from fingerprint for later

792

# comparison purposes with return value from the

793

# fingerprint() function

794

481

client["fingerprint"] = (section["fingerprint"].upper()

795

482

.replace(" ", ""))

796

483

if "secret" in section:

801

488

"rb") as secfile:

802

489

client["secret"] = secfile.read()

803

490

else:

804

raise TypeError("No secret or secfile for section {}"

805

.format(section))

491

raise TypeError("No secret or secfile for section %s"

492

% section)

806

493

client["timeout"] = string_to_delta(section["timeout"])

807

494

client["extended_timeout"] = string_to_delta(

808

495

section["extended_timeout"])

814

501

client["checker_command"] = section["checker"]

815

502

client["last_approval_request"] = None

816

503

client["last_checked_ok"] = None

817

client["last_checker_status"] = -2

504

client["last_checker_status"] = None

818

505

819

506

return settings

820

821

def __init__(self, settings, name = None, server_settings=None):

507

508

509

def __init__(self, settings, name = None):

510

"""Note: the 'checker' key in 'config' sets the

511

'checker_command' attribute and *not* the 'checker'

512

attribute."""

822

513

self.name = name

823

if server_settings is None:

824

server_settings = {}

825

self.server_settings = server_settings

826

514

# adding all client settings

827

for setting, value in settings.items():

515

for setting, value in settings.iteritems():

828

516

setattr(self, setting, value)

829

517

830

518

if self.enabled:

836

524

else:

837

525

self.last_enabled = None

838

526

self.expires = None

839

527

840

528

logger.debug("Creating client %r", self.name)

529

# Uppercase and remove spaces from fingerprint for later

530

# comparison purposes with return value from the fingerprint()

531

# function

841

532

logger.debug(" Fingerprint: %s", self.fingerprint)

842

533

self.created = settings.get("created",

843

534

datetime.datetime.utcnow())

844

535

845

536

# attributes specific for this server instance

846

537

self.checker = None

847

538

self.checker_initiator_tag = None

850

541

self.current_checker_command = None

851

542

self.approved = None

852

543

self.approvals_pending = 0

853

self.changedstate = multiprocessing_manager.Condition(

854

multiprocessing_manager.Lock())

855

self.client_structure = [attr

856

for attr in self.__dict__.iterkeys()

544

self.changedstate = (multiprocessing_manager

545

.Condition(multiprocessing_manager

546

.Lock()))

547

self.client_structure = [attr for attr in

548

self.__dict__.iterkeys()

857

549

if not attr.startswith("_")]

858

550

self.client_structure.append("client_structure")

859

551

860

for name, t in inspect.getmembers(

861

type(self), lambda obj: isinstance(obj, property)):

552

for name, t in inspect.getmembers(type(self),

553

lambda obj:

554

isinstance(obj,

555

property)):

862

556

if not name.startswith("_"):

863

557

self.client_structure.append(name)

864

558

872

566

if getattr(self, "enabled", False):

873

567

# Already enabled

874

568

return

569

self.send_changedstate()

875

570

self.expires = datetime.datetime.utcnow() + self.timeout

876

571

self.enabled = True

877

572

self.last_enabled = datetime.datetime.utcnow()

878

573

self.init_checker()

879

self.send_changedstate()

880

574

881

575

def disable(self, quiet=True):

882

576

"""Disable this client."""

883

577

if not getattr(self, "enabled", False):

884

578

return False

885

579

if not quiet:

580

self.send_changedstate()

581

if not quiet:

886

582

logger.info("Disabling client %s", self.name)

887

if getattr(self, "disable_initiator_tag", None) is not None:

583

if getattr(self, "disable_initiator_tag", False):

888

584

gobject.source_remove(self.disable_initiator_tag)

889

585

self.disable_initiator_tag = None

890

586

self.expires = None

891

if getattr(self, "checker_initiator_tag", None) is not None:

587

if getattr(self, "checker_initiator_tag", False):

892

588

gobject.source_remove(self.checker_initiator_tag)

893

589

self.checker_initiator_tag = None

894

590

self.stop_checker()

895

591

self.enabled = False

896

if not quiet:

897

self.send_changedstate()

898

592

# Do not run this again if called by a gobject.timeout_add

899

593

return False

900

594

904

598

def init_checker(self):

905

599

# Schedule a new checker to be started an 'interval' from now,

906

600

# and every interval from then on.

907

if self.checker_initiator_tag is not None:

908

gobject.source_remove(self.checker_initiator_tag)

909

self.checker_initiator_tag = gobject.timeout_add(

910

int(self.interval.total_seconds() * 1000),

911

self.start_checker)

601

self.checker_initiator_tag = (gobject.timeout_add

602

(self.interval_milliseconds(),

603

self.start_checker))

912

604

# Schedule a disable() when 'timeout' has passed

913

if self.disable_initiator_tag is not None:

914

gobject.source_remove(self.disable_initiator_tag)

915

self.disable_initiator_tag = gobject.timeout_add(

916

int(self.timeout.total_seconds() * 1000), self.disable)

605

self.disable_initiator_tag = (gobject.timeout_add

606

(self.timeout_milliseconds(),

607

self.disable))

917

608

# Also start a new checker *right now*.

918

609

self.start_checker()

919

610

920

def checker_callback(self, source, condition, connection,

921

command):

611

def checker_callback(self, pid, condition, command):

922

612

"""The checker has completed, so take appropriate actions."""

923

613

self.checker_callback_tag = None

924

614

self.checker = None

925

# Read return code from connection (see call_pipe)

926

returncode = connection.recv()

927

connection.close()

928

929

if returncode >= 0:

930

self.last_checker_status = returncode

931

self.last_checker_signal = None

615

if os.WIFEXITED(condition):

616

self.last_checker_status = os.WEXITSTATUS(condition)

932

617

if self.last_checker_status == 0:

933

618

logger.info("Checker for %(name)s succeeded",

934

619

vars(self))

935

620

self.checked_ok()

936

621

else:

937

logger.info("Checker for %(name)s failed", vars(self))

622

logger.info("Checker for %(name)s failed",

623

vars(self))

938

624

else:

939

625

self.last_checker_status = -1

940

self.last_checker_signal = -returncode

941

626

logger.warning("Checker for %(name)s crashed?",

942

627

vars(self))

943

return False

944

945

def checked_ok(self):

946

"""Assert that the client has been seen, alive and well."""

947

self.last_checked_ok = datetime.datetime.utcnow()

948

self.last_checker_status = 0

949

self.last_checker_signal = None

950

self.bump_timeout()

951

952

def bump_timeout(self, timeout=None):

953

"""Bump up the timeout for this client."""

628

629

def checked_ok(self, timeout=None):

630

"""Bump up the timeout for this client.

631

632

This should only be called when the client has been seen,

633

alive and well.

634

"""

954

635

if timeout is None:

955

636

timeout = self.timeout

637

self.last_checked_ok = datetime.datetime.utcnow()

956

638

if self.disable_initiator_tag is not None:

957

639

gobject.source_remove(self.disable_initiator_tag)

958

self.disable_initiator_tag = None

959

640

if getattr(self, "enabled", False):

960

self.disable_initiator_tag = gobject.timeout_add(

961

int(timeout.total_seconds() * 1000), self.disable)

641

self.disable_initiator_tag = (gobject.timeout_add

642

(timedelta_to_milliseconds

643

(timeout), self.disable))

962

644

self.expires = datetime.datetime.utcnow() + timeout

963

645

964

646

def need_approval(self):

970

652

If a checker already exists, leave it running and do

971

653

nothing."""

972

654

# The reason for not killing a running checker is that if we

973

# did that, and if a checker (for some reason) started running

974

# slowly and taking more than 'interval' time, then the client

975

# would inevitably timeout, since no checker would get a

976

# chance to run to completion. If we instead leave running

655

# did that, then if a checker (for some reason) started

656

# running slowly and taking more than 'interval' time, the

657

# client would inevitably timeout, since no checker would get

658

# a chance to run to completion. If we instead leave running

977

659

# checkers alone, the checker would have to take more time

978

660

# than 'timeout' for the client to be disabled, which is as it

979

661

# should be.

980

662

981

if self.checker is not None and not self.checker.is_alive():

982

logger.warning("Checker was not alive; joining")

983

self.checker.join()

984

self.checker = None

663

# If a checker exists, make sure it is not a zombie

664

try:

665

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

666

except (AttributeError, OSError) as error:

667

if (isinstance(error, OSError)

668

and error.errno != errno.ECHILD):

669

raise error

670

else:

671

if pid:

672

logger.warning("Checker was a zombie")

673

gobject.source_remove(self.checker_callback_tag)

674

self.checker_callback(pid, status,

675

self.current_checker_command)

985

676

# Start a new checker if needed

986

677

if self.checker is None:

987

# Escape attributes for the shell

988

escaped_attrs = {

989

attr: re.escape(str(getattr(self, attr)))

990

for attr in self.runtime_expansions }

991

678

try:

992

command = self.checker_command % escaped_attrs

993

except TypeError as error:

994

logger.error('Could not format string "%s"',

995

self.checker_command,

996

exc_info=error)

997

return True # Try again later

679

# In case checker_command has exactly one % operator

680

command = self.checker_command % self.host

681

except TypeError:

682

# Escape attributes for the shell

683

escaped_attrs = dict(

684

(attr,

685

re.escape(unicode(str(getattr(self, attr, "")),

686

errors=

687

'replace')))

688

for attr in

689

self.runtime_expansions)

690

691

try:

692

command = self.checker_command % escaped_attrs

693

except TypeError as error:

694

logger.error('Could not format string "%s":'

695

' %s', self.checker_command, error)

696

return True # Try again later

998

697

self.current_checker_command = command

999

logger.info("Starting checker %r for %s", command,

1000

self.name)

1001

# We don't need to redirect stdout and stderr, since

1002

# in normal mode, that is already done by daemon(),

1003

# and in debug mode we don't want to. (Stdin is

1004

# always replaced by /dev/null.)

1005

# The exception is when not debugging but nevertheless

1006

# running in the foreground; use the previously

1007

# created wnull.

1008

popen_args = { "close_fds": True,

1009

"shell": True,

1010

"cwd": "/" }

1011

if (not self.server_settings["debug"]

1012

and self.server_settings["foreground"]):

1013

popen_args.update({"stdout": wnull,

1014

"stderr": wnull })

1015

pipe = multiprocessing.Pipe(duplex = False)

1016

self.checker = multiprocessing.Process(

1017

target = call_pipe,

1018

args = (pipe[1], subprocess.call, command),

1019

kwargs = popen_args)

1020

self.checker.start()

1021

self.checker_callback_tag = gobject.io_add_watch(

1022

pipe[0].fileno(), gobject.IO_IN,

1023

self.checker_callback, pipe[0], command)

698

try:

699

logger.info("Starting checker %r for %s",

700

command, self.name)

701

# We don't need to redirect stdout and stderr, since

702

# in normal mode, that is already done by daemon(),

703

# and in debug mode we don't want to. (Stdin is

704

# always replaced by /dev/null.)

705

self.checker = subprocess.Popen(command,

706

close_fds=True,

707

shell=True, cwd="/")

708

self.checker_callback_tag = (gobject.child_watch_add

709

(self.checker.pid,

710

self.checker_callback,

711

data=command))

712

# The checker may have completed before the gobject

713

# watch was added. Check for this.

714

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

715

if pid:

716

gobject.source_remove(self.checker_callback_tag)

717

self.checker_callback(pid, status, command)

718

except OSError as error:

719

logger.error("Failed to start subprocess: %s",

720

error)

1024

721

# Re-run this periodically if run by gobject.timeout_add

1025

722

return True

1026

723

1032

729

if getattr(self, "checker", None) is None:

1033

730

return

1034

731

logger.debug("Stopping checker for %(name)s", vars(self))

1035

self.checker.terminate()

732

try:

733

os.kill(self.checker.pid, signal.SIGTERM)

734

#time.sleep(0.5)

735

#if self.checker.poll() is None:

736

# os.kill(self.checker.pid, signal.SIGKILL)

737

except OSError as error:

738

if error.errno != errno.ESRCH: # No such process

739

raise

1036

740

self.checker = None

1037

741

1038

742

1039

def dbus_service_property(dbus_interface,

1040

signature="v",

1041

access="readwrite",

1042

byte_arrays=False):

743

def dbus_service_property(dbus_interface, signature="v",

744

access="readwrite", byte_arrays=False):

1043

745

"""Decorators for marking methods of a DBusObjectWithProperties to

1044

746

become properties on the D-Bus.

1045

747

1054

756

# "Set" method, so we fail early here:

1055

757

if byte_arrays and signature != "ay":

1056

758

raise ValueError("Byte arrays not supported for non-'ay'"

1057

" signature {!r}".format(signature))

1058

759

" signature %r" % signature)

1059

760

def decorator(func):

1060

761

func._dbus_is_property = True

1061

762

func._dbus_interface = dbus_interface

1066

767

func._dbus_name = func._dbus_name[:-14]

1067

768

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1068

769

return func

1069

1070

return decorator

1071

1072

1073

def dbus_interface_annotations(dbus_interface):

1074

"""Decorator for marking functions returning interface annotations

1075

1076

Usage:

1077

1078

@dbus_interface_annotations("org.example.Interface")

1079

def _foo(self): # Function name does not matter

1080

return {"org.freedesktop.DBus.Deprecated": "true",

1081

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1082

"false"}

1083

"""

1084

1085

def decorator(func):

1086

func._dbus_is_interface = True

1087

func._dbus_interface = dbus_interface

1088

func._dbus_name = dbus_interface

1089

return func

1090

1091

return decorator

1092

1093

1094

def dbus_annotations(annotations):

1095

"""Decorator to annotate D-Bus methods, signals or properties

1096

Usage:

1097

1098

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1099

"org.freedesktop.DBus.Property."

1100

"EmitsChangedSignal": "false"})

1101

@dbus_service_property("org.example.Interface", signature="b",

1102

access="r")

1103

def Property_dbus_property(self):

1104

return dbus.Boolean(False)

1105

1106

See also the DBusObjectWithAnnotations class.

1107

"""

1108

1109

def decorator(func):

1110

func._dbus_annotations = annotations

1111

return func

1112

1113

770

return decorator

1114

771

1115

772

1116

773

class DBusPropertyException(dbus.exceptions.DBusException):

1117

774

"""A base class for D-Bus property-related exceptions

1118

775

"""

1119

pass

776

def __unicode__(self):

777

return unicode(str(self))

1120

778

1121

779

1122

780

class DBusPropertyAccessException(DBusPropertyException):

1131

789

pass

1132

790

1133

791

1134

class DBusObjectWithAnnotations(dbus.service.Object):

1135

"""A D-Bus object with annotations.

1136

1137

Classes inheriting from this can use the dbus_annotations

1138

decorator to add annotations to methods or signals.

1139

"""

1140

1141

@staticmethod

1142

def _is_dbus_thing(thing):

1143

"""Returns a function testing if an attribute is a D-Bus thing

1144

1145

If called like _is_dbus_thing("method") it returns a function

1146

suitable for use as predicate to inspect.getmembers().

1147

"""

1148

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

1149

False)

1150

1151

def _get_all_dbus_things(self, thing):

1152

"""Returns a generator of (name, attribute) pairs

1153

"""

1154

return ((getattr(athing.__get__(self), "_dbus_name", name),

1155

athing.__get__(self))

1156

for cls in self.__class__.__mro__

1157

for name, athing in

1158

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1159

1160

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1161

out_signature = "s",

1162

path_keyword = 'object_path',

1163

connection_keyword = 'connection')

1164

def Introspect(self, object_path, connection):

1165

"""Overloading of standard D-Bus method.

1166

1167

Inserts annotation tags on methods and signals.

1168

"""

1169

xmlstring = dbus.service.Object.Introspect(self, object_path,

1170

connection)

1171

try:

1172

document = xml.dom.minidom.parseString(xmlstring)

1173

1174

for if_tag in document.getElementsByTagName("interface"):

1175

# Add annotation tags

1176

for typ in ("method", "signal"):

1177

for tag in if_tag.getElementsByTagName(typ):

1178

annots = dict()

1179

for name, prop in (self.

1180

_get_all_dbus_things(typ)):

1181

if (name == tag.getAttribute("name")

1182

and prop._dbus_interface

1183

== if_tag.getAttribute("name")):

1184

annots.update(getattr(

1185

prop, "_dbus_annotations", {}))

1186

for name, value in annots.items():

1187

ann_tag = document.createElement(

1188

"annotation")

1189

ann_tag.setAttribute("name", name)

1190

ann_tag.setAttribute("value", value)

1191

tag.appendChild(ann_tag)

1192

# Add interface annotation tags

1193

for annotation, value in dict(

1194

itertools.chain.from_iterable(

1195

annotations().items()

1196

for name, annotations

1197

in self._get_all_dbus_things("interface")

1198

if name == if_tag.getAttribute("name")

1199

)).items():

1200

ann_tag = document.createElement("annotation")

1201

ann_tag.setAttribute("name", annotation)

1202

ann_tag.setAttribute("value", value)

1203

if_tag.appendChild(ann_tag)

1204

# Fix argument name for the Introspect method itself

1205

if (if_tag.getAttribute("name")

1206

== dbus.INTROSPECTABLE_IFACE):

1207

for cn in if_tag.getElementsByTagName("method"):

1208

if cn.getAttribute("name") == "Introspect":

1209

for arg in cn.getElementsByTagName("arg"):

1210

if (arg.getAttribute("direction")

1211

== "out"):

1212

arg.setAttribute("name",

1213

"xml_data")

1214

xmlstring = document.toxml("utf-8")

1215

document.unlink()

1216

except (AttributeError, xml.dom.DOMException,

1217

xml.parsers.expat.ExpatError) as error:

1218

logger.error("Failed to override Introspection method",

1219

exc_info=error)

1220

return xmlstring

1221

1222

1223

class DBusObjectWithProperties(DBusObjectWithAnnotations):

792

class DBusObjectWithProperties(dbus.service.Object):

1224

793

"""A D-Bus object with properties.

1225

794

1226

795

Classes inheriting from this can use the dbus_service_property

1228

797

standard Get(), Set(), and GetAll() methods on the D-Bus.

1229

798

"""

1230

799

800

@staticmethod

801

def _is_dbus_property(obj):

802

return getattr(obj, "_dbus_is_property", False)

803

804

def _get_all_dbus_properties(self):

805

"""Returns a generator of (name, attribute) pairs

806

"""

807

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

808

for cls in self.__class__.__mro__

809

for name, prop in

810

inspect.getmembers(cls, self._is_dbus_property))

811

1231

812

def _get_dbus_property(self, interface_name, property_name):

1232

813

"""Returns a bound method if one exists which is a D-Bus

1233

814

property with the specified name and interface.

1234

815

"""

1235

for cls in self.__class__.__mro__:

1236

for name, value in inspect.getmembers(

1237

cls, self._is_dbus_thing("property")):

816

for cls in self.__class__.__mro__:

817

for name, value in (inspect.getmembers

818

(cls, self._is_dbus_property)):

1238

819

if (value._dbus_name == property_name

1239

820

and value._dbus_interface == interface_name):

1240

821

return value.__get__(self)

1241

822

1242

823

# No such property

1243

raise DBusPropertyNotFound("{}:{}.{}".format(

1244

self.dbus_object_path, interface_name, property_name))

1245

1246

@classmethod

1247

def _get_all_interface_names(cls):

1248

"""Get a sequence of all interfaces supported by an object"""

1249

return (name for name in set(getattr(getattr(x, attr),

1250

"_dbus_interface", None)

1251

for x in (inspect.getmro(cls))

1252

for attr in dir(x))

1253

if name is not None)

1254

1255

@dbus.service.method(dbus.PROPERTIES_IFACE,

1256

in_signature="ss",

824

raise DBusPropertyNotFound(self.dbus_object_path + ":"

825

+ interface_name + "."

826

+ property_name)

827

828

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1257

829

out_signature="v")

1258

830

def Get(self, interface_name, property_name):

1259

831

"""Standard D-Bus property Get() method, see D-Bus standard.

1277

849

# The byte_arrays option is not supported yet on

1278

850

# signatures other than "ay".

1279

851

if prop._dbus_signature != "ay":

1280

raise ValueError("Byte arrays not supported for non-"

1281

"'ay' signature {!r}"

1282

.format(prop._dbus_signature))

852

raise ValueError

1283

853

value = dbus.ByteArray(b''.join(chr(byte)

1284

854

for byte in value))

1285

855

prop(value)

1286

856

1287

@dbus.service.method(dbus.PROPERTIES_IFACE,

1288

in_signature="s",

857

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1289

858

out_signature="a{sv}")

1290

859

def GetAll(self, interface_name):

1291

860

"""Standard D-Bus property GetAll() method, see D-Bus

1294

863

Note: Will not include properties with access="write".

1295

864

"""

1296

865

properties = {}

1297

for name, prop in self._get_all_dbus_things("property"):

866

for name, prop in self._get_all_dbus_properties():

1298

867

if (interface_name

1299

868

and interface_name != prop._dbus_interface):

1300

869

# Interface non-empty but did not match

1306

875

if not hasattr(value, "variant_level"):

1307

876

properties[name] = value

1308

877

continue

1309

properties[name] = type(value)(

1310

value, variant_level = value.variant_level + 1)

878

properties[name] = type(value)(value, variant_level=

879

value.variant_level+1)

1311

880

return dbus.Dictionary(properties, signature="sv")

1312

881

1313

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1314

def PropertiesChanged(self, interface_name, changed_properties,

1315

invalidated_properties):

1316

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1317

standard.

1318

"""

1319

pass

1320

1321

882

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1322

883

out_signature="s",

1323

884

path_keyword='object_path',

1324

885

connection_keyword='connection')

1325

886

def Introspect(self, object_path, connection):

1326

"""Overloading of standard D-Bus method.

1327

1328

Inserts property tags and interface annotation tags.

887

"""Standard D-Bus method, overloaded to insert property tags.

1329

888

"""

1330

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1331

object_path,

1332

connection)

889

xmlstring = dbus.service.Object.Introspect(self, object_path,

890

connection)

1333

891

try:

1334

892

document = xml.dom.minidom.parseString(xmlstring)

1335

1336

893

def make_tag(document, name, prop):

1337

894

e = document.createElement("property")

1338

895

e.setAttribute("name", name)

1339

896

e.setAttribute("type", prop._dbus_signature)

1340

897

e.setAttribute("access", prop._dbus_access)

1341

898

return e

1342

1343

899

for if_tag in document.getElementsByTagName("interface"):

1344

# Add property tags

1345

900

for tag in (make_tag(document, name, prop)

1346

901

for name, prop

1347

in self._get_all_dbus_things("property")

902

in self._get_all_dbus_properties()

1348

903

if prop._dbus_interface

1349

904

== if_tag.getAttribute("name")):

1350

905

if_tag.appendChild(tag)

1351

# Add annotation tags for properties

1352

for tag in if_tag.getElementsByTagName("property"):

1353

annots = dict()

1354

for name, prop in self._get_all_dbus_things(

1355

"property"):

1356

if (name == tag.getAttribute("name")

1357

and prop._dbus_interface

1358

== if_tag.getAttribute("name")):

1359

annots.update(getattr(

1360

prop, "_dbus_annotations", {}))

1361

for name, value in annots.items():

1362

ann_tag = document.createElement(

1363

"annotation")

1364

ann_tag.setAttribute("name", name)

1365

ann_tag.setAttribute("value", value)

1366

tag.appendChild(ann_tag)

1367

906

# Add the names to the return values for the

1368

907

# "org.freedesktop.DBus.Properties" methods

1369

908

if (if_tag.getAttribute("name")

1384

923

except (AttributeError, xml.dom.DOMException,

1385

924

xml.parsers.expat.ExpatError) as error:

1386

925

logger.error("Failed to override Introspection method",

1387

exc_info=error)

1388

return xmlstring

1389

1390

try:

1391

dbus.OBJECT_MANAGER_IFACE

1392

except AttributeError:

1393

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1394

1395

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1396

"""A D-Bus object with an ObjectManager.

1397

1398

Classes inheriting from this exposes the standard

1399

GetManagedObjects call and the InterfacesAdded and

1400

InterfacesRemoved signals on the standard

1401

"org.freedesktop.DBus.ObjectManager" interface.

1402

1403

Note: No signals are sent automatically; they must be sent

1404

manually.

1405

"""

1406

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1407

out_signature = "a{oa{sa{sv}}}")

1408

def GetManagedObjects(self):

1409

"""This function must be overridden"""

1410

raise NotImplementedError()

1411

1412

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1413

signature = "oa{sa{sv}}")

1414

def InterfacesAdded(self, object_path, interfaces_and_properties):

1415

pass

1416

1417

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1418

def InterfacesRemoved(self, object_path, interfaces):

1419

pass

1420

1421

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1422

out_signature = "s",

1423

path_keyword = 'object_path',

1424

connection_keyword = 'connection')

1425

def Introspect(self, object_path, connection):

1426

"""Overloading of standard D-Bus method.

1427

1428

Override return argument name of GetManagedObjects to be

1429

"objpath_interfaces_and_properties"

1430

"""

1431

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1432

object_path,

1433

connection)

1434

try:

1435

document = xml.dom.minidom.parseString(xmlstring)

1436

1437

for if_tag in document.getElementsByTagName("interface"):

1438

# Fix argument name for the GetManagedObjects method

1439

if (if_tag.getAttribute("name")

1440

== dbus.OBJECT_MANAGER_IFACE):

1441

for cn in if_tag.getElementsByTagName("method"):

1442

if (cn.getAttribute("name")

1443

== "GetManagedObjects"):

1444

for arg in cn.getElementsByTagName("arg"):

1445

if (arg.getAttribute("direction")

1446

== "out"):

1447

arg.setAttribute(

1448

"name",

1449

"objpath_interfaces"

1450

"_and_properties")

1451

xmlstring = document.toxml("utf-8")

1452

document.unlink()

1453

except (AttributeError, xml.dom.DOMException,

1454

xml.parsers.expat.ExpatError) as error:

1455

logger.error("Failed to override Introspection method",

1456

exc_info = error)

1457

return xmlstring

1458

1459

def datetime_to_dbus(dt, variant_level=0):

926

error)

927

return xmlstring

928

929

930

def datetime_to_dbus (dt, variant_level=0):

1460

931

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1461

932

if dt is None:

1462

933

return dbus.String("", variant_level = variant_level)

1463

return dbus.String(dt.isoformat(), variant_level=variant_level)

1464

1465

1466

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1467

"""A class decorator; applied to a subclass of

1468

dbus.service.Object, it will add alternate D-Bus attributes with

1469

interface names according to the "alt_interface_names" mapping.

1470

Usage:

1471

1472

@alternate_dbus_interfaces({"org.example.Interface":

1473

"net.example.AlternateInterface"})

1474

class SampleDBusObject(dbus.service.Object):

1475

@dbus.service.method("org.example.Interface")

1476

def SampleDBusMethod():

1477

pass

1478

1479

The above "SampleDBusMethod" on "SampleDBusObject" will be

1480

reachable via two interfaces: "org.example.Interface" and

1481

"net.example.AlternateInterface", the latter of which will have

1482

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1483

"true", unless "deprecate" is passed with a False value.

1484

1485

This works for methods and signals, and also for D-Bus properties

1486

(from DBusObjectWithProperties) and interfaces (from the

1487

dbus_interface_annotations decorator).

934

return dbus.String(dt.isoformat(),

935

variant_level=variant_level)

936

937

938

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

939

.__metaclass__):

940

"""Applied to an empty subclass of a D-Bus object, this metaclass

941

will add additional D-Bus attributes matching a certain pattern.

1488

942

"""

1489

1490

def wrapper(cls):

1491

for orig_interface_name, alt_interface_name in (

1492

alt_interface_names.items()):

1493

attr = {}

1494

interface_names = set()

1495

# Go though all attributes of the class

1496

for attrname, attribute in inspect.getmembers(cls):

943

def __new__(mcs, name, bases, attr):

944

# Go through all the base classes which could have D-Bus

945

# methods, signals, or properties in them

946

for base in (b for b in bases

947

if issubclass(b, dbus.service.Object)):

948

# Go though all attributes of the base class

949

for attrname, attribute in inspect.getmembers(base):

1497

950

# Ignore non-D-Bus attributes, and D-Bus attributes

1498

951

# with the wrong interface name

1499

952

if (not hasattr(attribute, "_dbus_interface")

1500

or not attribute._dbus_interface.startswith(

1501

orig_interface_name)):

953

or not attribute._dbus_interface

954

.startswith("se.recompile.Mandos")):

1502

955

continue

1503

956

# Create an alternate D-Bus interface name based on

1504

957

# the current name

1505

alt_interface = attribute._dbus_interface.replace(

1506

orig_interface_name, alt_interface_name)

1507

interface_names.add(alt_interface)

958

alt_interface = (attribute._dbus_interface

959

.replace("se.recompile.Mandos",

960

"se.bsnet.fukt.Mandos"))

1508

961

# Is this a D-Bus signal?

1509

962

if getattr(attribute, "_dbus_is_signal", False):

1510

if sys.version_info.major == 2:

1511

# Extract the original non-method undecorated

1512

# function by black magic

1513

nonmethod_func = (dict(

963

# Extract the original non-method function by

964

# black magic

965

nonmethod_func = (dict(

1514

966

zip(attribute.func_code.co_freevars,

1515

attribute.__closure__))

1516

["func"].cell_contents)

1517

else:

1518

nonmethod_func = attribute

967

attribute.__closure__))["func"]

968

.cell_contents)

1519

969

# Create a new, but exactly alike, function

1520

970

# object, and decorate it to be a new D-Bus signal

1521

971

# with the alternate D-Bus interface name

1522

if sys.version_info.major == 2:

1523

new_function = types.FunctionType(

1524

nonmethod_func.func_code,

1525

nonmethod_func.func_globals,

1526

nonmethod_func.func_name,

1527

nonmethod_func.func_defaults,

1528

nonmethod_func.func_closure)

1529

else:

1530

new_function = types.FunctionType(

1531

nonmethod_func.__code__,

1532

nonmethod_func.__globals__,

1533

nonmethod_func.__name__,

1534

nonmethod_func.__defaults__,

1535

nonmethod_func.__closure__)

1536

new_function = (dbus.service.signal(

1537

alt_interface,

1538

attribute._dbus_signature)(new_function))

1539

# Copy annotations, if any

1540

try:

1541

new_function._dbus_annotations = dict(

1542

attribute._dbus_annotations)

1543

except AttributeError:

1544

pass

972

new_function = (dbus.service.signal

973

(alt_interface,

974

attribute._dbus_signature)

975

(types.FunctionType(

976

nonmethod_func.func_code,

977

nonmethod_func.func_globals,

978

nonmethod_func.func_name,

979

nonmethod_func.func_defaults,

980

nonmethod_func.func_closure)))

1545

981

# Define a creator of a function to call both the

1546

# original and alternate functions, so both the

1547

# original and alternate signals gets sent when

1548

# the function is called

982

# old and new functions, so both the old and new

983

# signals gets sent when the function is called

1549

984

def fixscope(func1, func2):

1550

985

"""This function is a scope container to pass

1551

986

func1 and func2 to the "call_both" function

1552

987

outside of its arguments"""

1553

1554

@functools.wraps(func2)

1555

988

def call_both(*args, **kwargs):

1556

989

"""This function will emit two D-Bus

1557

990

signals by calling func1 and func2"""

1558

991

func1(*args, **kwargs)

1559

992

func2(*args, **kwargs)

1560

# Make wrapper function look like a D-Bus signal

1561

for name, attr in inspect.getmembers(func2):

1562

if name.startswith("_dbus_"):

1563

setattr(call_both, name, attr)

1564

1565

993

return call_both

1566

994

# Create the "call_both" function and add it to

1567

995

# the class

1568

attr[attrname] = fixscope(attribute, new_function)

996

attr[attrname] = fixscope(attribute,

997

new_function)

1569

998

# Is this a D-Bus method?

1570

999

elif getattr(attribute, "_dbus_is_method", False):

1571

1000

# Create a new, but exactly alike, function

1572

1001

# object. Decorate it to be a new D-Bus method

1573

1002

# with the alternate D-Bus interface name. Add it

1574

1003

# to the class.

1575

attr[attrname] = (

1576

dbus.service.method(

1577

alt_interface,

1578

attribute._dbus_in_signature,

1579

attribute._dbus_out_signature)

1580

(types.FunctionType(attribute.func_code,

1581

attribute.func_globals,

1582

attribute.func_name,

1583

attribute.func_defaults,

1584

attribute.func_closure)))

1585

# Copy annotations, if any

1586

try:

1587

attr[attrname]._dbus_annotations = dict(

1588

attribute._dbus_annotations)

1589

except AttributeError:

1590

pass

1004

attr[attrname] = (dbus.service.method

1005

(alt_interface,

1006

attribute._dbus_in_signature,

1007

attribute._dbus_out_signature)

1008

(types.FunctionType

1009

(attribute.func_code,

1010

attribute.func_globals,

1011

attribute.func_name,

1012

attribute.func_defaults,

1013

attribute.func_closure)))

1591

1014

# Is this a D-Bus property?

1592

1015

elif getattr(attribute, "_dbus_is_property", False):

1593

1016

# Create a new, but exactly alike, function

1594

1017

# object, and decorate it to be a new D-Bus

1595

1018

# property with the alternate D-Bus interface

1596

1019

# name. Add it to the class.

1597

attr[attrname] = (dbus_service_property(

1598

alt_interface, attribute._dbus_signature,

1599

attribute._dbus_access,

1600

attribute._dbus_get_args_options

1601

["byte_arrays"])

1602

(types.FunctionType(

1603

attribute.func_code,

1604

attribute.func_globals,

1605

attribute.func_name,

1606

attribute.func_defaults,

1607

attribute.func_closure)))

1608

# Copy annotations, if any

1609

try:

1610

attr[attrname]._dbus_annotations = dict(

1611

attribute._dbus_annotations)

1612

except AttributeError:

1613

pass

1614

# Is this a D-Bus interface?

1615

elif getattr(attribute, "_dbus_is_interface", False):

1616

# Create a new, but exactly alike, function

1617

# object. Decorate it to be a new D-Bus interface

1618

# with the alternate D-Bus interface name. Add it

1619

# to the class.

1620

attr[attrname] = (

1621

dbus_interface_annotations(alt_interface)

1622

(types.FunctionType(attribute.func_code,

1623

attribute.func_globals,

1624

attribute.func_name,

1625

attribute.func_defaults,

1626

attribute.func_closure)))

1627

if deprecate:

1628

# Deprecate all alternate interfaces

1629

iname="_AlternateDBusNames_interface_annotation{}"

1630

for interface_name in interface_names:

1631

1632

@dbus_interface_annotations(interface_name)

1633

def func(self):

1634

return { "org.freedesktop.DBus.Deprecated":

1635

"true" }

1636

# Find an unused name

1637

for aname in (iname.format(i)

1638

for i in itertools.count()):

1639

if aname not in attr:

1640

attr[aname] = func

1641

break

1642

if interface_names:

1643

# Replace the class with a new subclass of it with

1644

# methods, signals, etc. as created above.

1645

cls = type(b"{}Alternate".format(cls.__name__),

1646

(cls, ), attr)

1647

return cls

1648

1649

return wrapper

1650

1651

1652

@alternate_dbus_interfaces({"se.recompile.Mandos":

1653

"se.bsnet.fukt.Mandos"})

1020

attr[attrname] = (dbus_service_property

1021

(alt_interface,

1022

attribute._dbus_signature,

1023

attribute._dbus_access,

1024

attribute

1025

._dbus_get_args_options

1026

["byte_arrays"])

1027

(types.FunctionType

1028

(attribute.func_code,

1029

attribute.func_globals,

1030

attribute.func_name,

1031

attribute.func_defaults,

1032

attribute.func_closure)))

1033

return type.__new__(mcs, name, bases, attr)

1034

1035

1654

1036

class ClientDBus(Client, DBusObjectWithProperties):

1655

1037

"""A Client class using D-Bus

1656

1038

1660

1042

"""

1661

1043

1662

1044

runtime_expansions = (Client.runtime_expansions

1663

+ ("dbus_object_path", ))

1664

1665

_interface = "se.recompile.Mandos.Client"

1045

+ ("dbus_object_path",))

1666

1046

1667

1047

# dbus.service.Object doesn't use super(), so we can't either.

1668

1048

1669

1049

def __init__(self, bus = None, *args, **kwargs):

1670

1050

self.bus = bus

1671

1051

Client.__init__(self, *args, **kwargs)

1052

self._approvals_pending = 0

1053

1054

self._approvals_pending = 0

1672

1055

# Only now, when this client is initialized, can it show up on

1673

1056

# the D-Bus

1674

client_object_name = str(self.name).translate(

1057

client_object_name = unicode(self.name).translate(

1675

1058

{ord("."): ord("_"),

1676

1059

ord("-"): ord("_")})

1677

self.dbus_object_path = dbus.ObjectPath(

1678

"/clients/" + client_object_name)

1060

self.dbus_object_path = (dbus.ObjectPath

1061

("/clients/" + client_object_name))

1679

1062

DBusObjectWithProperties.__init__(self, self.bus,

1680

1063

self.dbus_object_path)

1681

1682

def notifychangeproperty(transform_func, dbus_name,

1683

type_func=lambda x: x,

1684

variant_level=1,

1685

invalidate_only=False,

1686

_interface=_interface):

1064

1065

def notifychangeproperty(transform_func,

1066

dbus_name, type_func=lambda x: x,

1067

variant_level=1):

1687

1068

""" Modify a variable so that it's a property which announces

1688

1069

its changes to DBus.

1689

1070

1694

1075

to the D-Bus. Default: no transform

1695

1076

variant_level: D-Bus variant level. Default: 1

1696

1077

"""

1697

attrname = "_{}".format(dbus_name)

1698

1078

attrname = "_{0}".format(dbus_name)

1699

1079

def setter(self, value):

1700

1080

if hasattr(self, "dbus_object_path"):

1701

1081

if (not hasattr(self, attrname) or

1702

1082

type_func(getattr(self, attrname, None))

1703

1083

!= type_func(value)):

1704

if invalidate_only:

1705

self.PropertiesChanged(

1706

_interface, dbus.Dictionary(),

1707

dbus.Array((dbus_name, )))

1708

else:

1709

dbus_value = transform_func(

1710

type_func(value),

1711

variant_level = variant_level)

1712

self.PropertyChanged(dbus.String(dbus_name),

1713

dbus_value)

1714

self.PropertiesChanged(

1715

_interface,

1716

dbus.Dictionary({ dbus.String(dbus_name):

1717

dbus_value }),

1718

dbus.Array())

1084

dbus_value = transform_func(type_func(value),

1085

variant_level

1086

=variant_level)

1087

self.PropertyChanged(dbus.String(dbus_name),

1088

dbus_value)

1719

1089

setattr(self, attrname, value)

1720

1090

1721

1091

return property(lambda self: getattr(self, attrname), setter)

1722

1092

1093

1723

1094

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1724

1095

approvals_pending = notifychangeproperty(dbus.Boolean,

1725

1096

"ApprovalPending",

1727

1098

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1728

1099

last_enabled = notifychangeproperty(datetime_to_dbus,

1729

1100

"LastEnabled")

1730

checker = notifychangeproperty(

1731

dbus.Boolean, "CheckerRunning",

1732

type_func = lambda checker: checker is not None)

1101

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1102

type_func = lambda checker:

1103

checker is not None)

1733

1104

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1734

1105

"LastCheckedOK")

1735

last_checker_status = notifychangeproperty(dbus.Int16,

1736

"LastCheckerStatus")

1737

1106

last_approval_request = notifychangeproperty(

1738

1107

datetime_to_dbus, "LastApprovalRequest")

1739

1108

approved_by_default = notifychangeproperty(dbus.Boolean,

1740

1109

"ApprovedByDefault")

1741

approval_delay = notifychangeproperty(

1742

dbus.UInt64, "ApprovalDelay",

1743

type_func = lambda td: td.total_seconds() * 1000)

1110

approval_delay = notifychangeproperty(dbus.UInt64,

1111

"ApprovalDelay",

1112

type_func =

1113

timedelta_to_milliseconds)

1744

1114

approval_duration = notifychangeproperty(

1745

1115

dbus.UInt64, "ApprovalDuration",

1746

type_func = lambda td: td.total_seconds() * 1000)

1116

type_func = timedelta_to_milliseconds)

1747

1117

host = notifychangeproperty(dbus.String, "Host")

1748

timeout = notifychangeproperty(

1749

dbus.UInt64, "Timeout",

1750

type_func = lambda td: td.total_seconds() * 1000)

1118

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1119

type_func =

1120

timedelta_to_milliseconds)

1751

1121

extended_timeout = notifychangeproperty(

1752

1122

dbus.UInt64, "ExtendedTimeout",

1753

type_func = lambda td: td.total_seconds() * 1000)

1754

interval = notifychangeproperty(

1755

dbus.UInt64, "Interval",

1756

type_func = lambda td: td.total_seconds() * 1000)

1123

type_func = timedelta_to_milliseconds)

1124

interval = notifychangeproperty(dbus.UInt64,

1125

"Interval",

1126

type_func =

1127

timedelta_to_milliseconds)

1757

1128

checker_command = notifychangeproperty(dbus.String, "Checker")

1758

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1759

invalidate_only=True)

1760

1129

1761

1130

del notifychangeproperty

1762

1131

1769

1138

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1770

1139

Client.__del__(self, *args, **kwargs)

1771

1140

1772

def checker_callback(self, source, condition,

1773

connection, command, *args, **kwargs):

1774

ret = Client.checker_callback(self, source, condition,

1775

connection, command, *args,

1776

**kwargs)

1777

exitstatus = self.last_checker_status

1778

if exitstatus >= 0:

1141

def checker_callback(self, pid, condition, command,

1142

*args, **kwargs):

1143

self.checker_callback_tag = None

1144

self.checker = None

1145

if os.WIFEXITED(condition):

1146

exitstatus = os.WEXITSTATUS(condition)

1779

1147

# Emit D-Bus signal

1780

1148

self.CheckerCompleted(dbus.Int16(exitstatus),

1781

# This is specific to GNU libC

1782

dbus.Int64(exitstatus << 8),

1149

dbus.Int64(condition),

1783

1150

dbus.String(command))

1784

1151

else:

1785

1152

# Emit D-Bus signal

1786

1153

self.CheckerCompleted(dbus.Int16(-1),

1787

dbus.Int64(

1788

# This is specific to GNU libC

1789

(exitstatus << 8)

1790

| self.last_checker_signal),

1154

dbus.Int64(condition),

1791

1155

dbus.String(command))

1792

return ret

1156

1157

return Client.checker_callback(self, pid, condition, command,

1158

*args, **kwargs)

1793

1159

1794

1160

def start_checker(self, *args, **kwargs):

1795

old_checker_pid = getattr(self.checker, "pid", None)

1161

old_checker = self.checker

1162

if self.checker is not None:

1163

old_checker_pid = self.checker.pid

1164

else:

1165

old_checker_pid = None

1796

1166

r = Client.start_checker(self, *args, **kwargs)

1797

1167

# Only if new checker process was started

1798

1168

if (self.checker is not None

1806

1176

return False

1807

1177

1808

1178

def approve(self, value=True):

1179

self.send_changedstate()

1809

1180

self.approved = value

1810

gobject.timeout_add(int(self.approval_duration.total_seconds()

1811

* 1000), self._reset_approved)

1812

self.send_changedstate()

1181

gobject.timeout_add(timedelta_to_milliseconds

1182

(self.approval_duration),

1183

self._reset_approved)

1184

1813

1185

1814

1186

## D-Bus methods, signals & properties

1815

1816

## Interfaces

1187

_interface = "se.recompile.Mandos.Client"

1817

1188

1818

1189

## Signals

1819

1190

1830

1201

pass

1831

1202

1832

1203

# PropertyChanged - signal

1833

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1834

1204

@dbus.service.signal(_interface, signature="sv")

1835

1205

def PropertyChanged(self, property, value):

1836

1206

"D-Bus signal"

1857

1227

"D-Bus signal"

1858

1228

return self.need_approval()

1859

1229

1230

# NeRwequest - signal

1231

@dbus.service.signal(_interface, signature="s")

1232

def NewRequest(self, ip):

1233

"""D-Bus signal

1234

Is sent after a client request a password.

1235

"""

1236

pass

1237

1860

1238

## Methods

1861

1239

1862

1240

# Approve - method

1870

1248

self.checked_ok()

1871

1249

1872

1250

# Enable - method

1873

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1874

1251

@dbus.service.method(_interface)

1875

1252

def Enable(self):

1876

1253

"D-Bus method"

1877

1254

self.enable()

1878

1255

1879

1256

# StartChecker - method

1880

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1881

1257

@dbus.service.method(_interface)

1882

1258

def StartChecker(self):

1883

1259

"D-Bus method"

1884

1260

self.start_checker()

1885

1261

1886

1262

# Disable - method

1887

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1888

1263

@dbus.service.method(_interface)

1889

1264

def Disable(self):

1890

1265

"D-Bus method"

1891

1266

self.disable()

1892

1267

1893

1268

# StopChecker - method

1894

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1895

1269

@dbus.service.method(_interface)

1896

1270

def StopChecker(self):

1897

1271

self.stop_checker()

1904

1278

return dbus.Boolean(bool(self.approvals_pending))

1905

1279

1906

1280

# ApprovedByDefault - property

1907

@dbus_service_property(_interface,

1908

signature="b",

1281

@dbus_service_property(_interface, signature="b",

1909

1282

access="readwrite")

1910

1283

def ApprovedByDefault_dbus_property(self, value=None):

1911

1284

if value is None: # get

1913

1286

self.approved_by_default = bool(value)

1914

1287

1915

1288

# ApprovalDelay - property

1916

@dbus_service_property(_interface,

1917

signature="t",

1289

@dbus_service_property(_interface, signature="t",

1918

1290

access="readwrite")

1919

1291

def ApprovalDelay_dbus_property(self, value=None):

1920

1292

if value is None: # get

1921

return dbus.UInt64(self.approval_delay.total_seconds()

1922

* 1000)

1293

return dbus.UInt64(self.approval_delay_milliseconds())

1923

1294

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1924

1295

1925

1296

# ApprovalDuration - property

1926

@dbus_service_property(_interface,

1927

signature="t",

1297

@dbus_service_property(_interface, signature="t",

1928

1298

access="readwrite")

1929

1299

def ApprovalDuration_dbus_property(self, value=None):

1930

1300

if value is None: # get

1931

return dbus.UInt64(self.approval_duration.total_seconds()

1932

* 1000)

1301

return dbus.UInt64(timedelta_to_milliseconds(

1302

self.approval_duration))

1933

1303

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1934

1304

1935

1305

# Name - property

1936

@dbus_annotations(

1937

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1938

1306

@dbus_service_property(_interface, signature="s", access="read")

1939

1307

def Name_dbus_property(self):

1940

1308

return dbus.String(self.name)

1941

1309

1942

1310

# Fingerprint - property

1943

@dbus_annotations(

1944

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1945

1311

@dbus_service_property(_interface, signature="s", access="read")

1946

1312

def Fingerprint_dbus_property(self):

1947

1313

return dbus.String(self.fingerprint)

1948

1314

1949

1315

# Host - property

1950

@dbus_service_property(_interface,

1951

signature="s",

1316

@dbus_service_property(_interface, signature="s",

1952

1317

access="readwrite")

1953

1318

def Host_dbus_property(self, value=None):

1954

1319

if value is None: # get

1955

1320

return dbus.String(self.host)

1956

self.host = str(value)

1321

self.host = unicode(value)

1957

1322

1958

1323

# Created - property

1959

@dbus_annotations(

1960

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1961

1324

@dbus_service_property(_interface, signature="s", access="read")

1962

1325

def Created_dbus_property(self):

1963

1326

return datetime_to_dbus(self.created)

1968

1331

return datetime_to_dbus(self.last_enabled)

1969

1332

1970

1333

# Enabled - property

1971

@dbus_service_property(_interface,

1972

signature="b",

1334

@dbus_service_property(_interface, signature="b",

1973

1335

access="readwrite")

1974

1336

def Enabled_dbus_property(self, value=None):

1975

1337

if value is None: # get

1980

1342

self.disable()

1981

1343

1982

1344

# LastCheckedOK - property

1983

@dbus_service_property(_interface,

1984

signature="s",

1345

@dbus_service_property(_interface, signature="s",

1985

1346

access="readwrite")

1986

1347

def LastCheckedOK_dbus_property(self, value=None):

1987

1348

if value is not None:

1989

1350

return

1990

1351

return datetime_to_dbus(self.last_checked_ok)

1991

1352

1992

# LastCheckerStatus - property

1993

@dbus_service_property(_interface, signature="n", access="read")

1994

def LastCheckerStatus_dbus_property(self):

1995

return dbus.Int16(self.last_checker_status)

1996

1997

1353

# Expires - property

1998

1354

@dbus_service_property(_interface, signature="s", access="read")

1999

1355

def Expires_dbus_property(self):

2005

1361

return datetime_to_dbus(self.last_approval_request)

2006

1362

2007

1363

# Timeout - property

2008

@dbus_service_property(_interface,

2009

signature="t",

1364

@dbus_service_property(_interface, signature="t",

2010

1365

access="readwrite")

2011

1366

def Timeout_dbus_property(self, value=None):

2012

1367

if value is None: # get

2013

return dbus.UInt64(self.timeout.total_seconds() * 1000)

2014

old_timeout = self.timeout

1368

return dbus.UInt64(self.timeout_milliseconds())

2015

1369

self.timeout = datetime.timedelta(0, 0, 0, value)

2016

# Reschedule disabling

1370

# Reschedule timeout

2017

1371

if self.enabled:

2018

1372

now = datetime.datetime.utcnow()

2019

self.expires += self.timeout - old_timeout

2020

if self.expires <= now:

1373

time_to_die = timedelta_to_milliseconds(

1374

(self.last_checked_ok + self.timeout) - now)

1375

if time_to_die <= 0:

2021

1376

# The timeout has passed

2022

1377

self.disable()

2023

1378

else:

1379

self.expires = (now +

1380

datetime.timedelta(milliseconds =

1381

time_to_die))

2024

1382

if (getattr(self, "disable_initiator_tag", None)

2025

1383

is None):

2026

1384

return

2027

1385

gobject.source_remove(self.disable_initiator_tag)

2028

self.disable_initiator_tag = gobject.timeout_add(

2029

int((self.expires - now).total_seconds() * 1000),

2030

self.disable)

1386

self.disable_initiator_tag = (gobject.timeout_add

1387

(time_to_die,

1388

self.disable))

2031

1389

2032

1390

# ExtendedTimeout - property

2033

@dbus_service_property(_interface,

2034

signature="t",

1391

@dbus_service_property(_interface, signature="t",

2035

1392

access="readwrite")

2036

1393

def ExtendedTimeout_dbus_property(self, value=None):

2037

1394

if value is None: # get

2038

return dbus.UInt64(self.extended_timeout.total_seconds()

2039

* 1000)

1395

return dbus.UInt64(self.extended_timeout_milliseconds())

2040

1396

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2041

1397

2042

1398

# Interval - property

2043

@dbus_service_property(_interface,

2044

signature="t",

1399

@dbus_service_property(_interface, signature="t",

2045

1400

access="readwrite")

2046

1401

def Interval_dbus_property(self, value=None):

2047

1402

if value is None: # get

2048

return dbus.UInt64(self.interval.total_seconds() * 1000)

1403

return dbus.UInt64(self.interval_milliseconds())

2049

1404

self.interval = datetime.timedelta(0, 0, 0, value)

2050

1405

if getattr(self, "checker_initiator_tag", None) is None:

2051

1406

return

2052

1407

if self.enabled:

2053

1408

# Reschedule checker run

2054

1409

gobject.source_remove(self.checker_initiator_tag)

2055

self.checker_initiator_tag = gobject.timeout_add(

2056

value, self.start_checker)

2057

self.start_checker() # Start one now, too

1410

self.checker_initiator_tag = (gobject.timeout_add

1411

(value, self.start_checker))

1412

self.start_checker() # Start one now, too

2058

1413

2059

1414

# Checker - property

2060

@dbus_service_property(_interface,

2061

signature="s",

1415

@dbus_service_property(_interface, signature="s",

2062

1416

access="readwrite")

2063

1417

def Checker_dbus_property(self, value=None):

2064

1418

if value is None: # get

2065

1419

return dbus.String(self.checker_command)

2066

self.checker_command = str(value)

1420

self.checker_command = unicode(value)

2067

1421

2068

1422

# CheckerRunning - property

2069

@dbus_service_property(_interface,

2070

signature="b",

1423

@dbus_service_property(_interface, signature="b",

2071

1424

access="readwrite")

2072

1425

def CheckerRunning_dbus_property(self, value=None):

2073

1426

if value is None: # get

2078

1431

self.stop_checker()

2079

1432

2080

1433

# ObjectPath - property

2081

@dbus_annotations(

2082

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2083

"org.freedesktop.DBus.Deprecated": "true"})

2084

1434

@dbus_service_property(_interface, signature="o", access="read")

2085

1435

def ObjectPath_dbus_property(self):

2086

1436

return self.dbus_object_path # is already a dbus.ObjectPath

2087

1437

2088

1438

# Secret = property

2089

@dbus_annotations(

2090

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2091

"invalidates"})

2092

@dbus_service_property(_interface,

2093

signature="ay",

2094

access="write",

2095

byte_arrays=True)

1439

@dbus_service_property(_interface, signature="ay",

1440

access="write", byte_arrays=True)

2096

1441

def Secret_dbus_property(self, value):

2097

self.secret = bytes(value)

1442

self.secret = str(value)

2098

1443

2099

1444

del _interface

2100

1445

2104

1449

self._pipe = child_pipe

2105

1450

self._pipe.send(('init', fpr, address))

2106

1451

if not self._pipe.recv():

2107

raise KeyError(fpr)

1452

raise KeyError()

2108

1453

2109

1454

def __getattribute__(self, name):

2110

1455

if name == '_pipe':

2114

1459

if data[0] == 'data':

2115

1460

return data[1]

2116

1461

if data[0] == 'function':

2117

2118

1462

def func(*args, **kwargs):

2119

1463

self._pipe.send(('funcall', name, args, kwargs))

2120

1464

return self._pipe.recv()[1]

2121

2122

1465

return func

2123

1466

2124

1467

def __setattr__(self, name, value):

2127

1470

self._pipe.send(('setattr', name, value))

2128

1471

2129

1472

1473

class ClientDBusTransitional(ClientDBus):

1474

__metaclass__ = AlternateDBusNamesMetaclass

1475

1476

2130

1477

class ClientHandler(socketserver.BaseRequestHandler, object):

2131

1478

"""A class to handle client connections.

2132

1479

2136

1483

def handle(self):

2137

1484

with contextlib.closing(self.server.child_pipe) as child_pipe:

2138

1485

logger.info("TCP connection from: %s",

2139

str(self.client_address))

1486

unicode(self.client_address))

2140

1487

logger.debug("Pipe FD: %d",

2141

1488

self.server.child_pipe.fileno())

2142

1489

2143

session = gnutls.ClientSession(self.request)

1490

session = (gnutls.connection

1491

.ClientSession(self.request,

1492

gnutls.connection

1493

.X509Credentials()))

1494

1495

# Note: gnutls.connection.X509Credentials is really a

1496

# generic GnuTLS certificate credentials object so long as

1497

# no X.509 keys are added to it. Therefore, we can use it

1498

# here despite using OpenPGP certificates.

2144

1499

2145

1500

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

2146

1501

# "+AES-256-CBC", "+SHA1",

2150

1505

priority = self.server.gnutls_priority

2151

1506

if priority is None:

2152

1507

priority = "NORMAL"

2153

gnutls.priority_set_direct(session._c_object, priority,

2154

None)

1508

(gnutls.library.functions

1509

.gnutls_priority_set_direct(session._c_object,

1510

priority, None))

2155

1511

2156

1512

# Start communication using the Mandos protocol

2157

1513

# Get protocol number

2159

1515

logger.debug("Protocol version: %r", line)

2160

1516

try:

2161

1517

if int(line.strip().split()[0]) > 1:

2162

raise RuntimeError(line)

1518

raise RuntimeError

2163

1519

except (ValueError, IndexError, RuntimeError) as error:

2164

1520

logger.error("Unknown protocol version: %s", error)

2165

1521

return

2167

1523

# Start GnuTLS connection

2168

1524

try:

2169

1525

session.handshake()

2170

except gnutls.Error as error:

1526

except gnutls.errors.GNUTLSError as error:

2171

1527

logger.warning("Handshake failed: %s", error)

2172

1528

# Do not run session.bye() here: the session is not

2173

1529

# established. Just abandon the request.

2177

1533

approval_required = False

2178

1534

try:

2179

1535

try:

2180

fpr = self.fingerprint(

2181

self.peer_certificate(session))

2182

except (TypeError, gnutls.Error) as error:

1536

fpr = self.fingerprint(self.peer_certificate

1537

(session))

1538

except (TypeError,

1539

gnutls.errors.GNUTLSError) as error:

2183

1540

logger.warning("Bad certificate: %s", error)

2184

1541

return

2185

1542

logger.debug("Fingerprint: %s", fpr)

2190

1547

except KeyError:

2191

1548

return

2192

1549

1550

if self.server.use_dbus:

1551

# Emit D-Bus signal

1552

client.NewRequest(str(self.client_address))

1553

2193

1554

if client.approval_delay:

2194

1555

delay = client.approval_delay

2195

1556

client.approvals_pending += 1

2198

1559

while True:

2199

1560

if not client.enabled:

2200

1561

logger.info("Client %s is disabled",

2201

client.name)

1562

client.name)

2202

1563

if self.server.use_dbus:

2203

1564

# Emit D-Bus signal

2204

1565

client.Rejected("Disabled")

2213

1574

if self.server.use_dbus:

2214

1575

# Emit D-Bus signal

2215

1576

client.NeedApproval(

2216

client.approval_delay.total_seconds()

2217

* 1000, client.approved_by_default)

1577

client.approval_delay_milliseconds(),

1578

client.approved_by_default)

2218

1579

else:

2219

1580

logger.warning("Client %s was not approved",

2220

1581

client.name)

2226

1587

#wait until timeout or approved

2227

1588

time = datetime.datetime.now()

2228

1589

client.changedstate.acquire()

2229

client.changedstate.wait(delay.total_seconds())

1590

(client.changedstate.wait

1591

(float(client.timedelta_to_milliseconds(delay)

1592

/ 1000)))

2230

1593

client.changedstate.release()

2231

1594

time2 = datetime.datetime.now()

2232

1595

if (time2 - time) >= delay:

2243

1606

else:

2244

1607

delay -= time2 - time

2245

1608

2246

try:

2247

session.send(client.secret)

2248

except gnutls.Error as error:

2249

logger.warning("gnutls send failed",

2250

exc_info = error)

2251

return

1609

sent_size = 0

1610

while sent_size < len(client.secret):

1611

try:

1612

sent = session.send(client.secret[sent_size:])

1613

except gnutls.errors.GNUTLSError as error:

1614

logger.warning("gnutls send failed")

1615

return

1616

logger.debug("Sent: %d, remaining: %d",

1617

sent, len(client.secret)

1618

- (sent_size + sent))

1619

sent_size += sent

2252

1620

2253

1621

logger.info("Sending secret to %s", client.name)

2254

1622

# bump the timeout using extended_timeout

2255

client.bump_timeout(client.extended_timeout)

1623

client.checked_ok(client.extended_timeout)

2256

1624

if self.server.use_dbus:

2257

1625

# Emit D-Bus signal

2258

1626

client.GotSecret()

2262

1630

client.approvals_pending -= 1

2263

1631

try:

2264

1632

session.bye()

2265

except gnutls.Error as error:

2266

logger.warning("GnuTLS bye failed",

2267

exc_info=error)

1633

except gnutls.errors.GNUTLSError as error:

1634

logger.warning("GnuTLS bye failed")

2268

1635

2269

1636

@staticmethod

2270

1637

def peer_certificate(session):

2271

1638

"Return the peer's OpenPGP certificate as a bytestring"

2272

1639

# If not an OpenPGP certificate...

2273

if (gnutls.certificate_type_get(session._c_object)

2274

!= gnutls.CRT_OPENPGP):

2275

# ...return invalid data

2276

return b""

1640

if (gnutls.library.functions

1641

.gnutls_certificate_type_get(session._c_object)

1642

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1643

# ...do the normal thing

1644

return session.peer_certificate

2277

1645

list_size = ctypes.c_uint(1)

2278

cert_list = (gnutls.certificate_get_peers

1646

cert_list = (gnutls.library.functions

1647

.gnutls_certificate_get_peers

2279

1648

(session._c_object, ctypes.byref(list_size)))

2280

1649

if not bool(cert_list) and list_size.value != 0:

2281

raise gnutls.Error("error getting peer certificate")

1650

raise gnutls.errors.GNUTLSError("error getting peer"

1651

" certificate")

2282

1652

if list_size.value == 0:

2283

1653

return None

2284

1654

cert = cert_list[0]

2288

1658

def fingerprint(openpgp):

2289

1659

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2290

1660

# New GnuTLS "datum" with the OpenPGP public key

2291

datum = gnutls.datum_t(

2292

ctypes.cast(ctypes.c_char_p(openpgp),

2293

ctypes.POINTER(ctypes.c_ubyte)),

2294

ctypes.c_uint(len(openpgp)))

1661

datum = (gnutls.library.types

1662

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1663

ctypes.POINTER

1664

(ctypes.c_ubyte)),

1665

ctypes.c_uint(len(openpgp))))

2295

1666

# New empty GnuTLS certificate

2296

crt = gnutls.openpgp_crt_t()

2297

gnutls.openpgp_crt_init(ctypes.byref(crt))

1667

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1668

(gnutls.library.functions

1669

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2298

1670

# Import the OpenPGP public key into the certificate

2299

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2300

gnutls.OPENPGP_FMT_RAW)

1671

(gnutls.library.functions

1672

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1673

gnutls.library.constants

1674

.GNUTLS_OPENPGP_FMT_RAW))

2301

1675

# Verify the self signature in the key

2302

1676

crtverify = ctypes.c_uint()

2303

gnutls.openpgp_crt_verify_self(crt, 0,

2304

ctypes.byref(crtverify))

1677

(gnutls.library.functions

1678

.gnutls_openpgp_crt_verify_self(crt, 0,

1679

ctypes.byref(crtverify)))

2305

1680

if crtverify.value != 0:

2306

gnutls.openpgp_crt_deinit(crt)

2307

raise gnutls.CertificateSecurityError("Verify failed")

1681

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1682

raise (gnutls.errors.CertificateSecurityError

1683

("Verify failed"))

2308

1684

# New buffer for the fingerprint

2309

1685

buf = ctypes.create_string_buffer(20)

2310

1686

buf_len = ctypes.c_size_t()

2311

1687

# Get the fingerprint from the certificate into the buffer

2312

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2313

ctypes.byref(buf_len))

1688

(gnutls.library.functions

1689

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1690

ctypes.byref(buf_len)))

2314

1691

# Deinit the certificate

2315

gnutls.openpgp_crt_deinit(crt)

1692

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2316

1693

# Convert the buffer to a Python bytestring

2317

1694

fpr = ctypes.string_at(buf, buf_len.value)

2318

1695

# Convert the bytestring to hexadecimal notation

2322

1699

2323

1700

class MultiprocessingMixIn(object):

2324

1701

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2325

2326

1702

def sub_process_main(self, request, address):

2327

1703

try:

2328

1704

self.finish_request(request, address)

2333

1709

def process_request(self, request, address):

2334

1710

"""Start a new process to process the request."""

2335

1711

proc = multiprocessing.Process(target = self.sub_process_main,

2336

args = (request, address))

1712

args = (request,

1713

address))

2337

1714

proc.start()

2338

1715

return proc

2339

1716

2340

1717

2341

1718

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2342

1719

""" adds a pipe to the MixIn """

2343

2344

1720

def process_request(self, request, client_address):

2345

1721

"""Overrides and wraps the original process_request().

2346

1722

2355

1731

2356

1732

def add_pipe(self, parent_pipe, proc):

2357

1733

"""Dummy function; override as necessary"""

2358

raise NotImplementedError()

1734

raise NotImplementedError

2359

1735

2360

1736

2361

1737

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2367

1743

interface: None or a network interface name (string)

2368

1744

use_ipv6: Boolean; to use IPv6 or not

2369

1745

"""

2370

2371

1746

def __init__(self, server_address, RequestHandlerClass,

2372

interface=None,

2373

use_ipv6=True,

2374

socketfd=None):

2375

"""If socketfd is set, use that file descriptor instead of

2376

creating a new one with socket.socket().

2377

"""

1747

interface=None, use_ipv6=True):

2378

1748

self.interface = interface

2379

1749

if use_ipv6:

2380

1750

self.address_family = socket.AF_INET6

2381

if socketfd is not None:

2382

# Save the file descriptor

2383

self.socketfd = socketfd

2384

# Save the original socket.socket() function

2385

self.socket_socket = socket.socket

2386

# To implement --socket, we monkey patch socket.socket.

2387

#

2388

# (When socketserver.TCPServer is a new-style class, we

2389

# could make self.socket into a property instead of monkey

2390

# patching socket.socket.)

2391

#

2392

# Create a one-time-only replacement for socket.socket()

2393

@functools.wraps(socket.socket)

2394

def socket_wrapper(*args, **kwargs):

2395

# Restore original function so subsequent calls are

2396

# not affected.

2397

socket.socket = self.socket_socket

2398

del self.socket_socket

2399

# This time only, return a new socket object from the

2400

# saved file descriptor.

2401

return socket.fromfd(self.socketfd, *args, **kwargs)

2402

# Replace socket.socket() function with wrapper

2403

socket.socket = socket_wrapper

2404

# The socketserver.TCPServer.__init__ will call

2405

# socket.socket(), which might be our replacement,

2406

# socket_wrapper(), if socketfd was set.

2407

1751

socketserver.TCPServer.__init__(self, server_address,

2408

1752

RequestHandlerClass)

2409

2410

1753

def server_bind(self):

2411

1754

"""This overrides the normal server_bind() function

2412

1755

to bind to an interface if one was specified, and also NOT to

2418

1761

self.interface)

2419

1762

else:

2420

1763

try:

2421

self.socket.setsockopt(

2422

socket.SOL_SOCKET, SO_BINDTODEVICE,

2423

(self.interface + "\0").encode("utf-8"))

1764

self.socket.setsockopt(socket.SOL_SOCKET,

1765

SO_BINDTODEVICE,

1766

str(self.interface

1767

+ '\0'))

2424

1768

except socket.error as error:

2425

if error.errno == errno.EPERM:

2426

logger.error("No permission to bind to"

2427

" interface %s", self.interface)

2428

elif error.errno == errno.ENOPROTOOPT:

1769

if error[0] == errno.EPERM:

1770

logger.error("No permission to"

1771

" bind to interface %s",

1772

self.interface)

1773

elif error[0] == errno.ENOPROTOOPT:

2429

1774

logger.error("SO_BINDTODEVICE not available;"

2430

1775

" cannot bind to interface %s",

2431

1776

self.interface)

2432

elif error.errno == errno.ENODEV:

2433

logger.error("Interface %s does not exist,"

2434

" cannot bind", self.interface)

2435

1777

else:

2436

1778

raise

2437

1779

# Only bind(2) the socket if we really need to.

2440

1782

if self.address_family == socket.AF_INET6:

2441

1783

any_address = "::" # in6addr_any

2442

1784

else:

2443

any_address = "0.0.0.0" # INADDR_ANY

1785

any_address = socket.INADDR_ANY

2444

1786

self.server_address = (any_address,

2445

1787

self.server_address[1])

2446

1788

elif not self.server_address[1]:

2447

self.server_address = (self.server_address[0], 0)

1789

self.server_address = (self.server_address[0],

1790

0)

2448

1791

# if self.interface:

2449

1792

# self.server_address = (self.server_address[0],

2450

1793

# 0, # port

2464

1807

2465

1808

Assumes a gobject.MainLoop event loop.

2466

1809

"""

2467

2468

1810

def __init__(self, server_address, RequestHandlerClass,

2469

interface=None,

2470

use_ipv6=True,

2471

clients=None,

2472

gnutls_priority=None,

2473

use_dbus=True,

2474

socketfd=None):

1811

interface=None, use_ipv6=True, clients=None,

1812

gnutls_priority=None, use_dbus=True):

2475

1813

self.enabled = False

2476

1814

self.clients = clients

2477

1815

if self.clients is None:

2481

1819

IPv6_TCPServer.__init__(self, server_address,

2482

1820

RequestHandlerClass,

2483

1821

interface = interface,

2484

use_ipv6 = use_ipv6,

2485

socketfd = socketfd)

2486

1822

use_ipv6 = use_ipv6)

2487

1823

def server_activate(self):

2488

1824

if self.enabled:

2489

1825

return socketserver.TCPServer.server_activate(self)

2493

1829

2494

1830

def add_pipe(self, parent_pipe, proc):

2495

1831

# Call "handle_ipc" for both data and EOF events

2496

gobject.io_add_watch(

2497

parent_pipe.fileno(),

2498

gobject.IO_IN | gobject.IO_HUP,

2499

functools.partial(self.handle_ipc,

2500

parent_pipe = parent_pipe,

2501

proc = proc))

1832

gobject.io_add_watch(parent_pipe.fileno(),

1833

gobject.IO_IN | gobject.IO_HUP,

1834

functools.partial(self.handle_ipc,

1835

parent_pipe =

1836

parent_pipe,

1837

proc = proc))

2502

1838

2503

def handle_ipc(self, source, condition,

2504

parent_pipe=None,

2505

proc = None,

2506

client_object=None):

1839

def handle_ipc(self, source, condition, parent_pipe=None,

1840

proc = None, client_object=None):

1841

condition_names = {

1842

gobject.IO_IN: "IN", # There is data to read.

1843

gobject.IO_OUT: "OUT", # Data can be written (without

1844

# blocking).

1845

gobject.IO_PRI: "PRI", # There is urgent data to read.

1846

gobject.IO_ERR: "ERR", # Error condition.

1847

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1848

# broken, usually for pipes and

1849

# sockets).

1850

}

1851

conditions_string = ' | '.join(name

1852

for cond, name in

1853

condition_names.iteritems()

1854

if cond & condition)

2507

1855

# error, or the other end of multiprocessing.Pipe has closed

2508

if condition & (gobject.IO_ERR | gobject.IO_HUP):

1856

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2509

1857

# Wait for other process to exit

2510

1858

proc.join()

2511

1859

return False

2532

1880

parent_pipe.send(False)

2533

1881

return False

2534

1882

2535

gobject.io_add_watch(

2536

parent_pipe.fileno(),

2537

gobject.IO_IN | gobject.IO_HUP,

2538

functools.partial(self.handle_ipc,

2539

parent_pipe = parent_pipe,

2540

proc = proc,

2541

client_object = client))

1883

gobject.io_add_watch(parent_pipe.fileno(),

1884

gobject.IO_IN | gobject.IO_HUP,

1885

functools.partial(self.handle_ipc,

1886

parent_pipe =

1887

parent_pipe,

1888

proc = proc,

1889

client_object =

1890

client))

2542

1891

parent_pipe.send(True)

2543

1892

# remove the old hook in favor of the new above hook on

2544

1893

# same fileno

2550

1899

2551

1900

parent_pipe.send(('data', getattr(client_object,

2552

1901

funcname)(*args,

2553

**kwargs)))

1902

**kwargs)))

2554

1903

2555

1904

if command == 'getattr':

2556

1905

attrname = request[1]

2557

if isinstance(client_object.__getattribute__(attrname),

2558

collections.Callable):

2559

parent_pipe.send(('function', ))

1906

if callable(client_object.__getattribute__(attrname)):

1907

parent_pipe.send(('function',))

2560

1908

else:

2561

parent_pipe.send((

2562

'data', client_object.__getattribute__(attrname)))

1909

parent_pipe.send(('data', client_object

1910

.__getattribute__(attrname)))

2563

1911

2564

1912

if command == 'setattr':

2565

1913

attrname = request[1]

2569

1917

return True

2570

1918

2571

1919

2572

def rfc3339_duration_to_delta(duration):

2573

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2574

2575

>>> rfc3339_duration_to_delta("P7D")

2576

datetime.timedelta(7)

2577

>>> rfc3339_duration_to_delta("PT60S")

2578

datetime.timedelta(0, 60)

2579

>>> rfc3339_duration_to_delta("PT60M")

2580

datetime.timedelta(0, 3600)

2581

>>> rfc3339_duration_to_delta("PT24H")

2582

datetime.timedelta(1)

2583

>>> rfc3339_duration_to_delta("P1W")

2584

datetime.timedelta(7)

2585

>>> rfc3339_duration_to_delta("PT5M30S")

2586

datetime.timedelta(0, 330)

2587

>>> rfc3339_duration_to_delta("P1DT3M20S")

2588

datetime.timedelta(1, 200)

2589

"""

2590

2591

# Parsing an RFC 3339 duration with regular expressions is not

2592

# possible - there would have to be multiple places for the same

2593

# values, like seconds. The current code, while more esoteric, is

2594

# cleaner without depending on a parsing library. If Python had a

2595

# built-in library for parsing we would use it, but we'd like to

2596

# avoid excessive use of external libraries.

2597

2598

# New type for defining tokens, syntax, and semantics all-in-one

2599

Token = collections.namedtuple("Token", (

2600

"regexp", # To match token; if "value" is not None, must have

2601

# a "group" containing digits

2602

"value", # datetime.timedelta or None

2603

"followers")) # Tokens valid after this token

2604

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2605

# the "duration" ABNF definition in RFC 3339, Appendix A.

2606

token_end = Token(re.compile(r"$"), None, frozenset())

2607

token_second = Token(re.compile(r"(\d+)S"),

2608

datetime.timedelta(seconds=1),

2609

frozenset((token_end, )))

2610

token_minute = Token(re.compile(r"(\d+)M"),

2611

datetime.timedelta(minutes=1),

2612

frozenset((token_second, token_end)))

2613

token_hour = Token(re.compile(r"(\d+)H"),

2614

datetime.timedelta(hours=1),

2615

frozenset((token_minute, token_end)))

2616

token_time = Token(re.compile(r"T"),

2617

None,

2618

frozenset((token_hour, token_minute,

2619

token_second)))

2620

token_day = Token(re.compile(r"(\d+)D"),

2621

datetime.timedelta(days=1),

2622

frozenset((token_time, token_end)))

2623

token_month = Token(re.compile(r"(\d+)M"),

2624

datetime.timedelta(weeks=4),

2625

frozenset((token_day, token_end)))

2626

token_year = Token(re.compile(r"(\d+)Y"),

2627

datetime.timedelta(weeks=52),

2628

frozenset((token_month, token_end)))

2629

token_week = Token(re.compile(r"(\d+)W"),

2630

datetime.timedelta(weeks=1),

2631

frozenset((token_end, )))

2632

token_duration = Token(re.compile(r"P"), None,

2633

frozenset((token_year, token_month,

2634

token_day, token_time,

2635

token_week)))

2636

# Define starting values

2637

value = datetime.timedelta() # Value so far

2638

found_token = None

2639

followers = frozenset((token_duration, )) # Following valid tokens

2640

s = duration # String left to parse

2641

# Loop until end token is found

2642

while found_token is not token_end:

2643

# Search for any currently valid tokens

2644

for token in followers:

2645

match = token.regexp.match(s)

2646

if match is not None:

2647

# Token found

2648

if token.value is not None:

2649

# Value found, parse digits

2650

factor = int(match.group(1), 10)

2651

# Add to value so far

2652

value += factor * token.value

2653

# Strip token from string

2654

s = token.regexp.sub("", s, 1)

2655

# Go to found token

2656

found_token = token

2657

# Set valid next tokens

2658

followers = found_token.followers

2659

break

2660

else:

2661

# No currently valid tokens were found

2662

raise ValueError("Invalid RFC 3339 duration: {!r}"

2663

.format(duration))

2664

# End token found

2665

return value

2666

2667

2668

1920

def string_to_delta(interval):

2669

1921

"""Parse a string and return a datetime.timedelta

2670

1922

2681

1933

>>> string_to_delta('5m 30s')

2682

1934

datetime.timedelta(0, 330)

2683

1935

"""

2684

2685

try:

2686

return rfc3339_duration_to_delta(interval)

2687

except ValueError:

2688

pass

2689

2690

1936

timevalue = datetime.timedelta(0)

2691

1937

for s in interval.split():

2692

1938

try:

2693

suffix = s[-1]

1939

suffix = unicode(s[-1])

2694

1940

value = int(s[:-1])

2695

1941

if suffix == "d":

2696

1942

delta = datetime.timedelta(value)

2703

1949

elif suffix == "w":

2704

1950

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2705

1951

else:

2706

raise ValueError("Unknown suffix {!r}".format(suffix))

2707

except IndexError as e:

1952

raise ValueError("Unknown suffix %r" % suffix)

1953

except (ValueError, IndexError) as e:

2708

1954

raise ValueError(*(e.args))

2709

1955

timevalue += delta

2710

1956

return timevalue

2723

1969

sys.exit()

2724

1970

if not noclose:

2725

1971

# Close all standard open file descriptors

2726

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1972

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2727

1973

if not stat.S_ISCHR(os.fstat(null).st_mode):

2728

1974

raise OSError(errno.ENODEV,

2729

"{} not a character device"

2730

.format(os.devnull))

1975

"%s not a character device"

1976

% os.path.devnull)

2731

1977

os.dup2(null, sys.stdin.fileno())

2732

1978

os.dup2(null, sys.stdout.fileno())

2733

1979

os.dup2(null, sys.stderr.fileno())

2742

1988

2743

1989

parser = argparse.ArgumentParser()

2744

1990

parser.add_argument("-v", "--version", action="version",

2745

version = "%(prog)s {}".format(version),

1991

version = "%%(prog)s %s" % version,

2746

1992

help="show version number and exit")

2747

1993

parser.add_argument("-i", "--interface", metavar="IF",

2748

1994

help="Bind to interface IF")

2754

2000

help="Run self-test")

2755

2001

parser.add_argument("--debug", action="store_true",

2756

2002

help="Debug mode; run in foreground and log"

2757

" to terminal", default=None)

2003

" to terminal")

2758

2004

parser.add_argument("--debuglevel", metavar="LEVEL",

2759

2005

help="Debug level for stdout output")

2760

2006

parser.add_argument("--priority", help="GnuTLS"

2767

2013

" files")

2768

2014

parser.add_argument("--no-dbus", action="store_false",

2769

2015

dest="use_dbus", help="Do not provide D-Bus"

2770

" system bus interface", default=None)

2016

" system bus interface")

2771

2017

parser.add_argument("--no-ipv6", action="store_false",

2772

dest="use_ipv6", help="Do not use IPv6",

2773

default=None)

2018

dest="use_ipv6", help="Do not use IPv6")

2774

2019

parser.add_argument("--no-restore", action="store_false",

2775

2020

dest="restore", help="Do not restore stored"

2776

" state", default=None)

2777

parser.add_argument("--socket", type=int,

2778

help="Specify a file descriptor to a network"

2779

" socket to use instead of creating one")

2021

" state")

2780

2022

parser.add_argument("--statedir", metavar="DIR",

2781

2023

help="Directory to save/restore state in")

2782

parser.add_argument("--foreground", action="store_true",

2783

help="Run in foreground", default=None)

2784

parser.add_argument("--no-zeroconf", action="store_false",

2785

dest="zeroconf", help="Do not use Zeroconf",

2786

default=None)

2787

2024

2788

2025

options = parser.parse_args()

2789

2026

2790

2027

if options.check:

2791

2028

import doctest

2792

fail_count, test_count = doctest.testmod()

2793

sys.exit(os.EX_OK if fail_count == 0 else 1)

2029

doctest.testmod()

2030

sys.exit()

2794

2031

2795

2032

# Default values for config file for server-global settings

2796

2033

server_defaults = { "interface": "",

2798

2035

"port": "",

2799

2036

"debug": "False",

2800

2037

"priority":

2801

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2802

":+SIGN-DSA-SHA256",

2038

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2803

2039

"servicename": "Mandos",

2804

2040

"use_dbus": "True",

2805

2041

"use_ipv6": "True",

2806

2042

"debuglevel": "",

2807

2043

"restore": "True",

2808

"socket": "",

2809

"statedir": "/var/lib/mandos",

2810

"foreground": "False",

2811

"zeroconf": "True",

2812

}

2044

"statedir": "/var/lib/mandos"

2045

}

2813

2046

2814

2047

# Parse config file for server-global settings

2815

2048

server_config = configparser.SafeConfigParser(server_defaults)

2816

2049

del server_defaults

2817

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2050

server_config.read(os.path.join(options.configdir,

2051

"mandos.conf"))

2818

2052

# Convert the SafeConfigParser object to a dict

2819

2053

server_settings = server_config.defaults()

2820

2054

# Use the appropriate methods on the non-string config options

2821

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

2055

for option in ("debug", "use_dbus", "use_ipv6"):

2822

2056

server_settings[option] = server_config.getboolean("DEFAULT",

2823

2057

option)

2824

2058

if server_settings["port"]:

2825

2059

server_settings["port"] = server_config.getint("DEFAULT",

2826

2060

"port")

2827

if server_settings["socket"]:

2828

server_settings["socket"] = server_config.getint("DEFAULT",

2829

"socket")

2830

# Later, stdin will, and stdout and stderr might, be dup'ed

2831

# over with an opened os.devnull. But we don't want this to

2832

# happen with a supplied network socket.

2833

if 0 <= server_settings["socket"] <= 2:

2834

server_settings["socket"] = os.dup(server_settings

2835

["socket"])

2836

2061

del server_config

2837

2062

2838

2063

# Override the settings from the config file with command line

2839

2064

# options, if set.

2840

2065

for option in ("interface", "address", "port", "debug",

2841

"priority", "servicename", "configdir", "use_dbus",

2842

"use_ipv6", "debuglevel", "restore", "statedir",

2843

"socket", "foreground", "zeroconf"):

2066

"priority", "servicename", "configdir",

2067

"use_dbus", "use_ipv6", "debuglevel", "restore",

2068

"statedir"):

2844

2069

value = getattr(options, option)

2845

2070

if value is not None:

2846

2071

server_settings[option] = value

2847

2072

del options

2848

2073

# Force all strings to be unicode

2849

2074

for option in server_settings.keys():

2850

if isinstance(server_settings[option], bytes):

2851

server_settings[option] = (server_settings[option]

2852

.decode("utf-8"))

2853

# Force all boolean options to be boolean

2854

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2855

"foreground", "zeroconf"):

2856

server_settings[option] = bool(server_settings[option])

2857

# Debug implies foreground

2858

if server_settings["debug"]:

2859

server_settings["foreground"] = True

2075

if type(server_settings[option]) is str:

2076

server_settings[option] = unicode(server_settings[option])

2860

2077

# Now we have our good server settings in "server_settings"

2861

2078

2862

2079

##################################################################

2863

2080

2864

if (not server_settings["zeroconf"]

2865

and not (server_settings["port"]

2866

or server_settings["socket"] != "")):

2867

parser.error("Needs port or socket to work without Zeroconf")

2868

2869

2081

# For convenience

2870

2082

debug = server_settings["debug"]

2871

2083

debuglevel = server_settings["debuglevel"]

2873

2085

use_ipv6 = server_settings["use_ipv6"]

2874

2086

stored_state_path = os.path.join(server_settings["statedir"],

2875

2087

stored_state_file)

2876

foreground = server_settings["foreground"]

2877

zeroconf = server_settings["zeroconf"]

2878

2088

2879

2089

if debug:

2880

2090

initlogger(debug, logging.DEBUG)

2886

2096

initlogger(debug, level)

2887

2097

2888

2098

if server_settings["servicename"] != "Mandos":

2889

syslogger.setFormatter(

2890

logging.Formatter('Mandos ({}) [%(process)d]:'

2891

' %(levelname)s: %(message)s'.format(

2892

server_settings["servicename"])))

2099

syslogger.setFormatter(logging.Formatter

2100

('Mandos (%s) [%%(process)d]:'

2101

' %%(levelname)s: %%(message)s'

2102

% server_settings["servicename"]))

2893

2103

2894

2104

# Parse config file with clients

2895

2105

client_config = configparser.SafeConfigParser(Client

2900

2110

global mandos_dbus_service

2901

2111

mandos_dbus_service = None

2902

2112

2903

socketfd = None

2904

if server_settings["socket"] != "":

2905

socketfd = server_settings["socket"]

2906

tcp_server = MandosServer(

2907

(server_settings["address"], server_settings["port"]),

2908

ClientHandler,

2909

interface=(server_settings["interface"] or None),

2910

use_ipv6=use_ipv6,

2911

gnutls_priority=server_settings["priority"],

2912

use_dbus=use_dbus,

2913

socketfd=socketfd)

2914

if not foreground:

2915

pidfilename = "/run/mandos.pid"

2916

if not os.path.isdir("/run/."):

2917

pidfilename = "/var/run/mandos.pid"

2918

pidfile = None

2113

tcp_server = MandosServer((server_settings["address"],

2114

server_settings["port"]),

2115

ClientHandler,

2116

interface=(server_settings["interface"]

2117

or None),

2118

use_ipv6=use_ipv6,

2119

gnutls_priority=

2120

server_settings["priority"],

2121

use_dbus=use_dbus)

2122

if not debug:

2123

pidfilename = "/var/run/mandos.pid"

2919

2124

try:

2920

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2921

except IOError as e:

2922

logger.error("Could not open file %r", pidfilename,

2923

exc_info=e)

2125

pidfile = open(pidfilename, "w")

2126

except IOError:

2127

logger.error("Could not open file %r", pidfilename)

2924

2128

2925

for name in ("_mandos", "mandos", "nobody"):

2129

try:

2130

uid = pwd.getpwnam("_mandos").pw_uid

2131

gid = pwd.getpwnam("_mandos").pw_gid

2132

except KeyError:

2926

2133

try:

2927

uid = pwd.getpwnam(name).pw_uid

2928

gid = pwd.getpwnam(name).pw_gid

2929

break

2134

uid = pwd.getpwnam("mandos").pw_uid

2135

gid = pwd.getpwnam("mandos").pw_gid

2930

2136

except KeyError:

2931

continue

2932

else:

2933

uid = 65534

2934

gid = 65534

2137

try:

2138

uid = pwd.getpwnam("nobody").pw_uid

2139

gid = pwd.getpwnam("nobody").pw_gid

2140

except KeyError:

2141

uid = 65534

2142

gid = 65534

2935

2143

try:

2936

2144

os.setgid(gid)

2937

2145

os.setuid(uid)

2938

2146

except OSError as error:

2939

if error.errno != errno.EPERM:

2940

raise

2147

if error[0] != errno.EPERM:

2148

raise error

2941

2149

2942

2150

if debug:

2943

2151

# Enable all possible GnuTLS debugging

2944

2152

2945

2153

# "Use a log level over 10 to enable all debugging options."

2946

2154

# - GnuTLS manual

2947

gnutls.global_set_log_level(11)

2155

gnutls.library.functions.gnutls_global_set_log_level(11)

2948

2156

2949

@gnutls.log_func

2157

@gnutls.library.types.gnutls_log_func

2950

2158

def debug_gnutls(level, string):

2951

2159

logger.debug("GnuTLS: %s", string[:-1])

2952

2160

2953

gnutls.global_set_log_function(debug_gnutls)

2161

(gnutls.library.functions

2162

.gnutls_global_set_log_function(debug_gnutls))

2954

2163

2955

2164

# Redirect stdin so all checkers get /dev/null

2956

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2165

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2957

2166

os.dup2(null, sys.stdin.fileno())

2958

2167

if null > 2:

2959

2168

os.close(null)

2960

2169

2961

2170

# Need to fork before connecting to D-Bus

2962

if not foreground:

2171

if not debug:

2963

2172

# Close all input and output, do double fork, etc.

2964

2173

daemon()

2965

2174

2966

# multiprocessing will use threads, so before we use gobject we

2967

# need to inform gobject that threads will be used.

2968

2175

gobject.threads_init()

2969

2176

2970

2177

global main_loop

2971

2178

# From the Avahi example code

2972

DBusGMainLoop(set_as_default=True)

2179

DBusGMainLoop(set_as_default=True )

2973

2180

main_loop = gobject.MainLoop()

2974

2181

bus = dbus.SystemBus()

2975

2182

# End of Avahi example code

2976

2183

if use_dbus:

2977

2184

try:

2978

2185

bus_name = dbus.service.BusName("se.recompile.Mandos",

2979

bus,

2980

do_not_queue=True)

2981

old_bus_name = dbus.service.BusName(

2982

"se.bsnet.fukt.Mandos", bus,

2983

do_not_queue=True)

2984

except dbus.exceptions.DBusException as e:

2985

logger.error("Disabling D-Bus:", exc_info=e)

2186

bus, do_not_queue=True)

2187

old_bus_name = (dbus.service.BusName

2188

("se.bsnet.fukt.Mandos", bus,

2189

do_not_queue=True))

2190

except dbus.exceptions.NameExistsException as e:

2191

logger.error(unicode(e) + ", disabling D-Bus")

2986

2192

use_dbus = False

2987

2193

server_settings["use_dbus"] = False

2988

2194

tcp_server.use_dbus = False

2989

if zeroconf:

2990

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2991

service = AvahiServiceToSyslog(

2992

name = server_settings["servicename"],

2993

servicetype = "_mandos._tcp",

2994

protocol = protocol,

2995

bus = bus)

2996

if server_settings["interface"]:

2997

service.interface = if_nametoindex(

2998

server_settings["interface"].encode("utf-8"))

2195

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2196

service = AvahiServiceToSyslog(name =

2197

server_settings["servicename"],

2198

servicetype = "_mandos._tcp",

2199

protocol = protocol, bus = bus)

2200

if server_settings["interface"]:

2201

service.interface = (if_nametoindex

2202

(str(server_settings["interface"])))

2999

2203

3000

2204

global multiprocessing_manager

3001

2205

multiprocessing_manager = multiprocessing.Manager()

3002

2206

3003

2207

client_class = Client

3004

2208

if use_dbus:

3005

client_class = functools.partial(ClientDBus, bus = bus)

2209

client_class = functools.partial(ClientDBusTransitional,

2210

bus = bus)

3006

2211

3007

2212

client_settings = Client.config_parser(client_config)

3008

2213

old_client_settings = {}

3009

2214

clients_data = {}

3010

2215

3011

# This is used to redirect stdout and stderr for checker processes

3012

global wnull

3013

wnull = open(os.devnull, "w") # A writable /dev/null

3014

# Only used if server is running in foreground but not in debug

3015

# mode

3016

if debug or not foreground:

3017

wnull.close()

3018

3019

2216

# Get client data and settings from last running state.

3020

2217

if server_settings["restore"]:

3021

2218

try:

3022

2219

with open(stored_state_path, "rb") as stored_state:

3023

clients_data, old_client_settings = pickle.load(

3024

stored_state)

2220

clients_data, old_client_settings = (pickle.load

2221

(stored_state))

3025

2222

os.remove(stored_state_path)

3026

2223

except IOError as e:

3027

if e.errno == errno.ENOENT:

3028

logger.warning("Could not load persistent state:"

3029

" {}".format(os.strerror(e.errno)))

3030

else:

3031

logger.critical("Could not load persistent state:",

3032

exc_info=e)

2224

logger.warning("Could not load persistent state: {0}"

2225

.format(e))

2226

if e.errno != errno.ENOENT:

3033

2227

raise

3034

2228

except EOFError as e:

3035

2229

logger.warning("Could not load persistent state: "

3036

"EOFError:",

3037

exc_info=e)

2230

"EOFError: {0}".format(e))

3038

2231

3039

2232

with PGPEngine() as pgp:

3040

for client_name, client in clients_data.items():

3041

# Skip removed clients

3042

if client_name not in client_settings:

3043

continue

3044

2233

for client_name, client in clients_data.iteritems():

3045

2234

# Decide which value to use after restoring saved state.

3046

2235

# We have three different values: Old config file,

3047

2236

# new config file, and saved state.

3052

2241

# For each value in new config, check if it

3053

2242

# differs from the old config value (Except for

3054

2243

# the "secret" attribute)

3055

if (name != "secret"

3056

and (value !=

3057

old_client_settings[client_name][name])):

2244

if (name != "secret" and

2245

value != old_client_settings[client_name]

2246

[name]):

3058

2247

client[name] = value

3059

2248

except KeyError:

3060

2249

pass

3061

2250

3062

2251

# Clients who has passed its expire date can still be

3063

# enabled if its last checker was successful. A Client

3064

# whose checker succeeded before we stored its state is

3065

# assumed to have successfully run all checkers during

3066

# downtime.

2252

# enabled if its last checker was successful. Clients

2253

# whose checker failed before we stored its state is

2254

# assumed to have failed all checkers during downtime.

3067

2255

if client["enabled"]:

3068

2256

if datetime.datetime.utcnow() >= client["expires"]:

3069

2257

if not client["last_checked_ok"]:

3070

2258

logger.warning(

3071

"disabling client {} - Client never "

3072

"performed a successful checker".format(

3073

client_name))

2259

"disabling client {0} - Client never "

2260

"performed a successfull checker"

2261

.format(client["name"]))

3074

2262

client["enabled"] = False

3075

2263

elif client["last_checker_status"] != 0:

3076

2264

logger.warning(

3077

"disabling client {} - Client last"

3078

" checker failed with error code"

3079

" {}".format(

3080

client_name,

3081

client["last_checker_status"]))

2265

"disabling client {0} - Client "

2266

"last checker failed with error code {1}"

2267

.format(client["name"],

2268

client["last_checker_status"]))

3082

2269

client["enabled"] = False

3083

2270

else:

3084

client["expires"] = (

3085

datetime.datetime.utcnow()

3086

+ client["timeout"])

2271

client["expires"] = (datetime.datetime

2272

.utcnow()

2273

+ client["timeout"])

3087

2274

logger.debug("Last checker succeeded,"

3088

" keeping {} enabled".format(

3089

client_name))

2275

" keeping {0} enabled"

2276

.format(client["name"]))

3090

2277

try:

3091

client["secret"] = pgp.decrypt(

3092

client["encrypted_secret"],

3093

client_settings[client_name]["secret"])

2278

client["secret"] = (

2279

pgp.decrypt(client["encrypted_secret"],

2280

client_settings[client_name]

2281

["secret"]))

3094

2282

except PGPError:

3095

2283

# If decryption fails, we use secret from new settings

3096

logger.debug("Failed to decrypt {} old secret".format(

3097

client_name))

3098

client["secret"] = (client_settings[client_name]

3099

["secret"])

2284

logger.debug("Failed to decrypt {0} old secret"

2285

.format(client_name))

2286

client["secret"] = (

2287

client_settings[client_name]["secret"])

2288

3100

2289

3101

2290

# Add/remove clients based on new changes made to config

3102

2291

for client_name in (set(old_client_settings)

3105

2294

for client_name in (set(client_settings)

3106

2295

- set(old_client_settings)):

3107

2296

clients_data[client_name] = client_settings[client_name]

3108

3109

# Create all client objects

3110

for client_name, client in clients_data.items():

2297

2298

# Create clients all clients

2299

for client_name, client in clients_data.iteritems():

3111

2300

tcp_server.clients[client_name] = client_class(

3112

name = client_name,

3113

settings = client,

3114

server_settings = server_settings)

2301

name = client_name, settings = client)

3115

2302

3116

2303

if not tcp_server.clients:

3117

2304

logger.warning("No clients defined")

3118

3119

if not foreground:

3120

if pidfile is not None:

3121

pid = os.getpid()

3122

try:

3123

with pidfile:

3124

print(pid, file=pidfile)

3125

except IOError:

3126

logger.error("Could not write to file %r with PID %d",

3127

pidfilename, pid)

3128

del pidfile

2305

2306

if not debug:

2307

try:

2308

with pidfile:

2309

pid = os.getpid()

2310

pidfile.write(str(pid) + "\n".encode("utf-8"))

2311

del pidfile

2312

except IOError:

2313

logger.error("Could not write to file %r with PID %d",

2314

pidfilename, pid)

2315

except NameError:

2316

# "pidfile" was never created

2317

pass

3129

2318

del pidfilename

2319

signal.signal(signal.SIGINT, signal.SIG_IGN)

3130

2320

3131

2321

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

3132

2322

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

3133

2323

3134

2324

if use_dbus:

3135

3136

@alternate_dbus_interfaces(

3137

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3138

class MandosDBusService(DBusObjectWithObjectManager):

2325

class MandosDBusService(dbus.service.Object):

3139

2326

"""A D-Bus proxy object"""

3140

3141

2327

def __init__(self):

3142

2328

dbus.service.Object.__init__(self, bus, "/")

3143

3144

2329

_interface = "se.recompile.Mandos"

3145

2330

3146

2331

@dbus.service.signal(_interface, signature="o")

3153

2338

"D-Bus signal"

3154

2339

pass

3155

2340

3156

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3157

"true"})

3158

2341

@dbus.service.signal(_interface, signature="os")

3159

2342

def ClientRemoved(self, objpath, name):

3160

2343

"D-Bus signal"

3161

2344

pass

3162

2345

3163

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3164

"true"})

3165

2346

@dbus.service.method(_interface, out_signature="ao")

3166

2347

def GetAllClients(self):

3167

2348

"D-Bus method"

3168

return dbus.Array(c.dbus_object_path for c in

2349

return dbus.Array(c.dbus_object_path

2350

for c in

3169

2351

tcp_server.clients.itervalues())

3170

2352

3171

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3172

"true"})

3173

2353

@dbus.service.method(_interface,

3174

2354

out_signature="a{oa{sv}}")

3175

2355

def GetAllClientsWithProperties(self):

3176

2356

"D-Bus method"

3177

2357

return dbus.Dictionary(

3178

{ c.dbus_object_path: c.GetAll(

3179

"se.recompile.Mandos.Client")

3180

for c in tcp_server.clients.itervalues() },

2358

((c.dbus_object_path, c.GetAll(""))

2359

for c in tcp_server.clients.itervalues()),

3181

2360

signature="oa{sv}")

3182

2361

3183

2362

@dbus.service.method(_interface, in_signature="o")

3187

2366

if c.dbus_object_path == object_path:

3188

2367

del tcp_server.clients[c.name]

3189

2368

c.remove_from_connection()

3190

# Don't signal the disabling

2369

# Don't signal anything except ClientRemoved

3191

2370

c.disable(quiet=True)

3192

# Emit D-Bus signal for removal

3193

self.client_removed_signal(c)

2371

# Emit D-Bus signal

2372

self.ClientRemoved(object_path, c.name)

3194

2373

return

3195

2374

raise KeyError(object_path)

3196

2375

3197

2376

del _interface

3198

3199

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3200

out_signature = "a{oa{sa{sv}}}")

3201

def GetManagedObjects(self):

3202

"""D-Bus method"""

3203

return dbus.Dictionary(

3204

{ client.dbus_object_path:

3205

dbus.Dictionary(

3206

{ interface: client.GetAll(interface)

3207

for interface in

3208

client._get_all_interface_names()})

3209

for client in tcp_server.clients.values()})

3210

3211

def client_added_signal(self, client):

3212

"""Send the new standard signal and the old signal"""

3213

if use_dbus:

3214

# New standard signal

3215

self.InterfacesAdded(

3216

client.dbus_object_path,

3217

dbus.Dictionary(

3218

{ interface: client.GetAll(interface)

3219

for interface in

3220

client._get_all_interface_names()}))

3221

# Old signal

3222

self.ClientAdded(client.dbus_object_path)

3223

3224

def client_removed_signal(self, client):

3225

"""Send the new standard signal and the old signal"""

3226

if use_dbus:

3227

# New standard signal

3228

self.InterfacesRemoved(

3229

client.dbus_object_path,

3230

client._get_all_interface_names())

3231

# Old signal

3232

self.ClientRemoved(client.dbus_object_path,

3233

client.name)

3234

2377

3235

mandos_dbus_service = MandosDBusService()

2378

class MandosDBusServiceTransitional(MandosDBusService):

2379

__metaclass__ = AlternateDBusNamesMetaclass

2380

mandos_dbus_service = MandosDBusServiceTransitional()

3236

2381

3237

2382

def cleanup():

3238

2383

"Cleanup function; run on exit"

3239

if zeroconf:

3240

service.cleanup()

2384

service.cleanup()

3241

2385

3242

2386

multiprocessing.active_children()

3243

wnull.close()

3244

2387

if not (tcp_server.clients or client_settings):

3245

2388

return

3246

2389

3257

2400

3258

2401

# A list of attributes that can not be pickled

3259

2402

# + secret.

3260

exclude = { "bus", "changedstate", "secret",

3261

"checker", "server_settings" }

3262

for name, typ in inspect.getmembers(dbus.service

3263

.Object):

2403

exclude = set(("bus", "changedstate", "secret",

2404

"checker"))

2405

for name, typ in (inspect.getmembers

2406

(dbus.service.Object)):

3264

2407

exclude.add(name)

3265

2408

3266

2409

client_dict["encrypted_secret"] = (client

3273

2416

del client_settings[client.name]["secret"]

3274

2417

3275

2418

try:

3276

with tempfile.NamedTemporaryFile(

3277

mode='wb',

3278

suffix=".pickle",

3279

prefix='clients-',

3280

dir=os.path.dirname(stored_state_path),

3281

delete=False) as stored_state:

2419

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2420

prefix="clients-",

2421

dir=os.path.dirname

2422

(stored_state_path))

2423

with os.fdopen(tempfd, "wb") as stored_state:

3282

2424

pickle.dump((clients, client_settings), stored_state)

3283

tempname = stored_state.name

3284

2425

os.rename(tempname, stored_state_path)

3285

2426

except (IOError, OSError) as e:

2427

logger.warning("Could not save persistent state: {0}"

2428

.format(e))

3286

2429

if not debug:

3287

2430

try:

3288

2431

os.remove(tempname)

3289

2432

except NameError:

3290

2433

pass

3291

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3292

logger.warning("Could not save persistent state: {}"

3293

.format(os.strerror(e.errno)))

3294

else:

3295

logger.warning("Could not save persistent state:",

3296

exc_info=e)

3297

raise

2434

if e.errno not in set((errno.ENOENT, errno.EACCES,

2435

errno.EEXIST)):

2436

raise e

3298

2437

3299

2438

# Delete all clients, and settings from config

3300

2439

while tcp_server.clients:

3301

2440

name, client = tcp_server.clients.popitem()

3302

2441

if use_dbus:

3303

2442

client.remove_from_connection()

3304

# Don't signal the disabling

2443

# Don't signal anything except ClientRemoved

3305

2444

client.disable(quiet=True)

3306

# Emit D-Bus signal for removal

3307

2445

if use_dbus:

3308

mandos_dbus_service.client_removed_signal(client)

2446

# Emit D-Bus signal

2447

mandos_dbus_service.ClientRemoved(client

2448

.dbus_object_path,

2449

client.name)

3309

2450

client_settings.clear()

3310

2451

3311

2452

atexit.register(cleanup)

3312

2453

3313

2454

for client in tcp_server.clients.itervalues():

3314

2455

if use_dbus:

3315

# Emit D-Bus signal for adding

3316

mandos_dbus_service.client_added_signal(client)

2456

# Emit D-Bus signal

2457

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3317

2458

# Need to initiate checking of clients

3318

2459

if client.enabled:

3319

2460

client.init_checker()

3322

2463

tcp_server.server_activate()

3323

2464

3324

2465

# Find out what port we got

3325

if zeroconf:

3326

service.port = tcp_server.socket.getsockname()[1]

2466

service.port = tcp_server.socket.getsockname()[1]

3327

2467

if use_ipv6:

3328

2468

logger.info("Now listening on address %r, port %d,"

3329

" flowinfo %d, scope_id %d",

3330

*tcp_server.socket.getsockname())

2469

" flowinfo %d, scope_id %d"

2470

% tcp_server.socket.getsockname())

3331

2471

else: # IPv4

3332

logger.info("Now listening on address %r, port %d",

3333

*tcp_server.socket.getsockname())

2472

logger.info("Now listening on address %r, port %d"

2473

% tcp_server.socket.getsockname())

3334

2474

3335

2475

#service.interface = tcp_server.socket.getsockname()[3]

3336

2476

3337

2477

try:

3338

if zeroconf:

3339

# From the Avahi example code

3340

try:

3341

service.activate()

3342

except dbus.exceptions.DBusException as error:

3343

logger.critical("D-Bus Exception", exc_info=error)

3344

cleanup()

3345

sys.exit(1)

3346

# End of Avahi example code

2478

# From the Avahi example code

2479

try:

2480

service.activate()

2481

except dbus.exceptions.DBusException as error:

2482

logger.critical("DBusException: %s", error)

2483

cleanup()

2484

sys.exit(1)

2485

# End of Avahi example code

3347

2486

3348

2487

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

3349

2488

lambda *args, **kwargs:

3353

2492

logger.debug("Starting main loop")

3354

2493

main_loop.run()

3355

2494

except AvahiError as error:

3356

logger.critical("Avahi Error", exc_info=error)

2495

logger.critical("AvahiError: %s", error)

3357

2496

cleanup()

3358

2497

sys.exit(1)

3359

2498

except KeyboardInterrupt:

3364

2503

# Must run before the D-Bus bus name gets deregistered

3365

2504

cleanup()

3366

2505

3367

3368

2506

if __name__ == '__main__':

3369

2507

main()