/mandos/release : revision 296

65

import types

66

import binascii

67

import tempfile

68

import itertools

69

68

70

69

import dbus

71

70

import dbus.service

86

85

except ImportError:

87

86

SO_BINDTODEVICE = None

88

87

89

version = "1.5.3"

88

version = "1.5.2"

90

89

stored_state_file = "clients.pickle"

91

90

92

91

logger = logging.getLogger()

176

175

177

176

def encrypt(self, data, password):

178

177

self.gnupg.passphrase = self.password_encode(password)

179

with open(os.devnull, "w") as devnull:

178

with open(os.devnull) as devnull:

180

179

try:

181

180

proc = self.gnupg.run(['--symmetric'],

182

181

create_fhs=['stdin', 'stdout'],

193

192

194

193

def decrypt(self, data, password):

195

194

self.gnupg.passphrase = self.password_encode(password)

196

with open(os.devnull, "w") as devnull:

195

with open(os.devnull) as devnull:

197

196

try:

198

197

proc = self.gnupg.run(['--decrypt'],

199

198

create_fhs=['stdin', 'stdout'],

200

199

attach_fhs={'stderr': devnull})

201

with contextlib.closing(proc.handles['stdin']) as f:

200

with contextlib.closing(proc.handles['stdin'] ) as f:

202

201

f.write(data)

203

202

with contextlib.closing(proc.handles['stdout']) as f:

204

203

decrypted_plaintext = f.read()

277

276

try:

278

277

self.add()

279

278

except dbus.exceptions.DBusException as error:

280

logger.critical("D-Bus Exception", exc_info=error)

279

logger.critical("DBusException: %s", error)

281

280

self.cleanup()

282

281

os._exit(1)

283

282

self.rename_count += 1

322

321

elif state == avahi.ENTRY_GROUP_FAILURE:

323

322

logger.critical("Avahi: Error in group state changed %s",

324

323

unicode(error))

325

raise AvahiGroupError("State changed: {0!s}"

326

.format(error))

324

raise AvahiGroupError("State changed: %s"

325

% unicode(error))

327

326

def cleanup(self):

328

327

"""Derived from the Avahi example code"""

329

328

if self.group is not None:

375

374

"""Add the new name to the syslog messages"""

376

375

ret = AvahiService.rename(self)

377

376

syslogger.setFormatter(logging.Formatter

378

('Mandos ({0}) [%(process)d]:'

379

' %(levelname)s: %(message)s'

380

.format(self.name)))

377

('Mandos (%s) [%%(process)d]:'

378

' %%(levelname)s: %%(message)s'

379

% self.name))

381

380

return ret

382

381

383

382

def timedelta_to_milliseconds(td):

489

488

"rb") as secfile:

490

489

client["secret"] = secfile.read()

491

490

else:

492

raise TypeError("No secret or secfile for section {0}"

493

.format(section))

491

raise TypeError("No secret or secfile for section %s"

492

% section)

494

493

client["timeout"] = string_to_delta(section["timeout"])

495

494

client["extended_timeout"] = string_to_delta(

496

495

section["extended_timeout"])

693

692

try:

694

693

command = self.checker_command % escaped_attrs

695

694

except TypeError as error:

696

logger.error('Could not format string "%s"',

697

self.checker_command, exc_info=error)

695

logger.error('Could not format string "%s":'

696

' %s', self.checker_command, error)

698

697

return True # Try again later

699

698

self.current_checker_command = command

700

699

try:

718

717

gobject.source_remove(self.checker_callback_tag)

719

718

self.checker_callback(pid, status, command)

720

719

except OSError as error:

721

logger.error("Failed to start subprocess",

722

exc_info=error)

720

logger.error("Failed to start subprocess: %s",

721

error)

723

722

# Re-run this periodically if run by gobject.timeout_add

724

723

return True

725

724

732

731

return

733

732

logger.debug("Stopping checker for %(name)s", vars(self))

734

733

try:

735

self.checker.terminate()

734

os.kill(self.checker.pid, signal.SIGTERM)

736

735

#time.sleep(0.5)

737

736

#if self.checker.poll() is None:

738

# self.checker.kill()

737

# os.kill(self.checker.pid, signal.SIGKILL)

739

738

except OSError as error:

740

739

if error.errno != errno.ESRCH: # No such process

741

740

raise

758

757

# "Set" method, so we fail early here:

759

758

if byte_arrays and signature != "ay":

760

759

raise ValueError("Byte arrays not supported for non-'ay'"

761

" signature {0!r}".format(signature))

760

" signature %r" % signature)

762

761

def decorator(func):

763

762

func._dbus_is_property = True

764

763

func._dbus_interface = dbus_interface

772

771

return decorator

773

772

774

773

775

def dbus_interface_annotations(dbus_interface):

776

"""Decorator for marking functions returning interface annotations.

777

778

Usage:

779

780

@dbus_interface_annotations("org.example.Interface")

781

def _foo(self): # Function name does not matter

782

return {"org.freedesktop.DBus.Deprecated": "true",

783

"org.freedesktop.DBus.Property.EmitsChangedSignal":

784

"false"}

785

"""

786

def decorator(func):

787

func._dbus_is_interface = True

788

func._dbus_interface = dbus_interface

789

func._dbus_name = dbus_interface

790

return func

791

return decorator

792

793

794

def dbus_annotations(annotations):

795

"""Decorator to annotate D-Bus methods, signals or properties

796

Usage:

797

798

@dbus_service_property("org.example.Interface", signature="b",

799

access="r")

800

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

801

"org.freedesktop.DBus.Property."

802

"EmitsChangedSignal": "false"})

803

def Property_dbus_property(self):

804

return dbus.Boolean(False)

805

"""

806

def decorator(func):

807

func._dbus_annotations = annotations

808

return func

809

return decorator

810

811

812

774

class DBusPropertyException(dbus.exceptions.DBusException):

813

775

"""A base class for D-Bus property-related exceptions

814

776

"""

837

799

"""

838

800

839

801

@staticmethod

840

def _is_dbus_thing(thing):

841

"""Returns a function testing if an attribute is a D-Bus thing

842

843

If called like _is_dbus_thing("method") it returns a function

844

suitable for use as predicate to inspect.getmembers().

845

"""

846

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

847

False)

802

def _is_dbus_property(obj):

803

return getattr(obj, "_dbus_is_property", False)

848

804

849

def _get_all_dbus_things(self, thing):

805

def _get_all_dbus_properties(self):

850

806

"""Returns a generator of (name, attribute) pairs

851

807

"""

852

return ((getattr(athing.__get__(self), "_dbus_name",

853

name),

854

athing.__get__(self))

808

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

855

809

for cls in self.__class__.__mro__

856

for name, athing in

857

inspect.getmembers(cls,

858

self._is_dbus_thing(thing)))

810

for name, prop in

811

inspect.getmembers(cls, self._is_dbus_property))

859

812

860

813

def _get_dbus_property(self, interface_name, property_name):

861

814

"""Returns a bound method if one exists which is a D-Bus

863

816

"""

864

817

for cls in self.__class__.__mro__:

865

818

for name, value in (inspect.getmembers

866

(cls,

867

self._is_dbus_thing("property"))):

819

(cls, self._is_dbus_property)):

868

820

if (value._dbus_name == property_name

869

821

and value._dbus_interface == interface_name):

870

822

return value.__get__(self)

912

864

Note: Will not include properties with access="write".

913

865

"""

914

866

properties = {}

915

for name, prop in self._get_all_dbus_things("property"):

867

for name, prop in self._get_all_dbus_properties():

916

868

if (interface_name

917

869

and interface_name != prop._dbus_interface):

918

870

# Interface non-empty but did not match

933

885

path_keyword='object_path',

934

886

connection_keyword='connection')

935

887

def Introspect(self, object_path, connection):

936

"""Overloading of standard D-Bus method.

937

938

Inserts property tags and interface annotation tags.

888

"""Standard D-Bus method, overloaded to insert property tags.

939

889

"""

940

890

xmlstring = dbus.service.Object.Introspect(self, object_path,

941

891

connection)

948

898

e.setAttribute("access", prop._dbus_access)

949

899

return e

950

900

for if_tag in document.getElementsByTagName("interface"):

951

# Add property tags

952

901

for tag in (make_tag(document, name, prop)

953

902

for name, prop

954

in self._get_all_dbus_things("property")

903

in self._get_all_dbus_properties()

955

904

if prop._dbus_interface

956

905

== if_tag.getAttribute("name")):

957

906

if_tag.appendChild(tag)

958

# Add annotation tags

959

for typ in ("method", "signal", "property"):

960

for tag in if_tag.getElementsByTagName(typ):

961

annots = dict()

962

for name, prop in (self.

963

_get_all_dbus_things(typ)):

964

if (name == tag.getAttribute("name")

965

and prop._dbus_interface

966

== if_tag.getAttribute("name")):

967

annots.update(getattr

968

(prop,

969

"_dbus_annotations",

970

{}))

971

for name, value in annots.iteritems():

972

ann_tag = document.createElement(

973

"annotation")

974

ann_tag.setAttribute("name", name)

975

ann_tag.setAttribute("value", value)

976

tag.appendChild(ann_tag)

977

# Add interface annotation tags

978

for annotation, value in dict(

979

itertools.chain(

980

*(annotations().iteritems()

981

for name, annotations in

982

self._get_all_dbus_things("interface")

983

if name == if_tag.getAttribute("name")

984

))).iteritems():

985

ann_tag = document.createElement("annotation")

986

ann_tag.setAttribute("name", annotation)

987

ann_tag.setAttribute("value", value)

988

if_tag.appendChild(ann_tag)

989

907

# Add the names to the return values for the

990

908

# "org.freedesktop.DBus.Properties" methods

991

909

if (if_tag.getAttribute("name")

1006

924

except (AttributeError, xml.dom.DOMException,

1007

925

xml.parsers.expat.ExpatError) as error:

1008

926

logger.error("Failed to override Introspection method",

1009

exc_info=error)

927

error)

1010

928

return xmlstring

1011

929

1012

930

1026

944

def __new__(mcs, name, bases, attr):

1027

945

# Go through all the base classes which could have D-Bus

1028

946

# methods, signals, or properties in them

1029

old_interface_names = []

1030

947

for base in (b for b in bases

1031

948

if issubclass(b, dbus.service.Object)):

1032

949

# Go though all attributes of the base class

1042

959

alt_interface = (attribute._dbus_interface

1043

960

.replace("se.recompile.Mandos",

1044

961

"se.bsnet.fukt.Mandos"))

1045

if alt_interface != attribute._dbus_interface:

1046

old_interface_names.append(alt_interface)

1047

962

# Is this a D-Bus signal?

1048

963

if getattr(attribute, "_dbus_is_signal", False):

1049

964

# Extract the original non-method function by

1064

979

nonmethod_func.func_name,

1065

980

nonmethod_func.func_defaults,

1066

981

nonmethod_func.func_closure)))

1067

# Copy annotations, if any

1068

try:

1069

new_function._dbus_annotations = (

1070

dict(attribute._dbus_annotations))

1071

except AttributeError:

1072

pass

1073

982

# Define a creator of a function to call both the

1074

983

# old and new functions, so both the old and new

1075

984

# signals gets sent when the function is called

1103

1012

attribute.func_name,

1104

1013

attribute.func_defaults,

1105

1014

attribute.func_closure)))

1106

# Copy annotations, if any

1107

try:

1108

attr[attrname]._dbus_annotations = (

1109

dict(attribute._dbus_annotations))

1110

except AttributeError:

1111

pass

1112

1015

# Is this a D-Bus property?

1113

1016

elif getattr(attribute, "_dbus_is_property", False):

1114

1017

# Create a new, but exactly alike, function

1128

1031

attribute.func_name,

1129

1032

attribute.func_defaults,

1130

1033

attribute.func_closure)))

1131

# Copy annotations, if any

1132

try:

1133

attr[attrname]._dbus_annotations = (

1134

dict(attribute._dbus_annotations))

1135

except AttributeError:

1136

pass

1137

# Is this a D-Bus interface?

1138

elif getattr(attribute, "_dbus_is_interface", False):

1139

# Create a new, but exactly alike, function

1140

# object. Decorate it to be a new D-Bus interface

1141

# with the alternate D-Bus interface name. Add it

1142

# to the class.

1143

attr[attrname] = (dbus_interface_annotations

1144

(alt_interface)

1145

(types.FunctionType

1146

(attribute.func_code,

1147

attribute.func_globals,

1148

attribute.func_name,

1149

attribute.func_defaults,

1150

attribute.func_closure)))

1151

# Deprecate all old interfaces

1152

basename="_AlternateDBusNamesMetaclass_interface_annotation{0}"

1153

for old_interface_name in old_interface_names:

1154

@dbus_interface_annotations(old_interface_name)

1155

def func(self):

1156

return { "org.freedesktop.DBus.Deprecated": "true" }

1157

# Find an unused name

1158

for aname in (basename.format(i) for i in

1159

itertools.count()):

1160

if aname not in attr:

1161

attr[aname] = func

1162

break

1163

1034

return type.__new__(mcs, name, bases, attr)

1164

1035

1165

1036

1315

1186

## D-Bus methods, signals & properties

1316

1187

_interface = "se.recompile.Mandos.Client"

1317

1188

1318

## Interfaces

1319

1320

@dbus_interface_annotations(_interface)

1321

def _foo(self):

1322

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1323

"false"}

1324

1325

1189

## Signals

1326

1190

1327

1191

# CheckerCompleted - signal

2079

1943

elif suffix == "w":

2080

1944

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2081

1945

else:

2082

raise ValueError("Unknown suffix {0!r}"

2083

.format(suffix))

1946

raise ValueError("Unknown suffix %r" % suffix)

2084

1947

except (ValueError, IndexError) as e:

2085

1948

raise ValueError(*(e.args))

2086

1949

timevalue += delta

2100

1963

sys.exit()

2101

1964

if not noclose:

2102

1965

# Close all standard open file descriptors

2103

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1966

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2104

1967

if not stat.S_ISCHR(os.fstat(null).st_mode):

2105

1968

raise OSError(errno.ENODEV,

2106

"{0} not a character device"

2107

.format(os.devnull))

1969

"%s not a character device"

1970

% os.path.devnull)

2108

1971

os.dup2(null, sys.stdin.fileno())

2109

1972

os.dup2(null, sys.stdout.fileno())

2110

1973

os.dup2(null, sys.stderr.fileno())

2119

1982

2120

1983

parser = argparse.ArgumentParser()

2121

1984

parser.add_argument("-v", "--version", action="version",

2122

version = "%(prog)s {0}".format(version),

1985

version = "%%(prog)s %s" % version,

2123

1986

help="show version number and exit")

2124

1987

parser.add_argument("-i", "--interface", metavar="IF",

2125

1988

help="Bind to interface IF")

2228

2091

2229

2092

if server_settings["servicename"] != "Mandos":

2230

2093

syslogger.setFormatter(logging.Formatter

2231

('Mandos ({0}) [%(process)d]:'

2232

' %(levelname)s: %(message)s'

2233

.format(server_settings

2234

["servicename"])))

2094

('Mandos (%s) [%%(process)d]:'

2095

' %%(levelname)s: %%(message)s'

2096

% server_settings["servicename"]))

2235

2097

2236

2098

# Parse config file with clients

2237

2099

client_config = configparser.SafeConfigParser(Client

2258

2120

except IOError:

2259

2121

logger.error("Could not open file %r", pidfilename)

2260

2122

2261

for name in ("_mandos", "mandos", "nobody"):

2123

try:

2124

uid = pwd.getpwnam("_mandos").pw_uid

2125

gid = pwd.getpwnam("_mandos").pw_gid

2126

except KeyError:

2262

2127

try:

2263

uid = pwd.getpwnam(name).pw_uid

2264

gid = pwd.getpwnam(name).pw_gid

2265

break

2128

uid = pwd.getpwnam("mandos").pw_uid

2129

gid = pwd.getpwnam("mandos").pw_gid

2266

2130

except KeyError:

2267

continue

2268

else:

2269

uid = 65534

2270

gid = 65534

2131

try:

2132

uid = pwd.getpwnam("nobody").pw_uid

2133

gid = pwd.getpwnam("nobody").pw_gid

2134

except KeyError:

2135

uid = 65534

2136

gid = 65534

2271

2137

try:

2272

2138

os.setgid(gid)

2273

2139

os.setuid(uid)

2290

2156

.gnutls_global_set_log_function(debug_gnutls))

2291

2157

2292

2158

# Redirect stdin so all checkers get /dev/null

2293

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2159

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2294

2160

os.dup2(null, sys.stdin.fileno())

2295

2161

if null > 2:

2296

2162

os.close(null)

2304

2170

2305

2171

global main_loop

2306

2172

# From the Avahi example code

2307

DBusGMainLoop(set_as_default=True)

2173

DBusGMainLoop(set_as_default=True )

2308

2174

main_loop = gobject.MainLoop()

2309

2175

bus = dbus.SystemBus()

2310

2176

# End of Avahi example code

2451

2317

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2452

2318

2453

2319

if use_dbus:

2454

class MandosDBusService(DBusObjectWithProperties):

2320

class MandosDBusService(dbus.service.Object):

2455

2321

"""A D-Bus proxy object"""

2456

2322

def __init__(self):

2457

2323

dbus.service.Object.__init__(self, bus, "/")

2458

2324

_interface = "se.recompile.Mandos"

2459

2325

2460

@dbus_interface_annotations(_interface)

2461

def _foo(self):

2462

return { "org.freedesktop.DBus.Property"

2463

".EmitsChangedSignal":

2464

"false"}

2465

2466

2326

@dbus.service.signal(_interface, signature="o")

2467

2327

def ClientAdded(self, objpath):

2468

2328

"D-Bus signal"

2601

2461

service.port = tcp_server.socket.getsockname()[1]

2602

2462

if use_ipv6:

2603

2463

logger.info("Now listening on address %r, port %d,"

2604

" flowinfo %d, scope_id %d",

2605

*tcp_server.socket.getsockname())

2464

" flowinfo %d, scope_id %d"

2465

% tcp_server.socket.getsockname())

2606

2466

else: # IPv4

2607

logger.info("Now listening on address %r, port %d",

2608

*tcp_server.socket.getsockname())

2467

logger.info("Now listening on address %r, port %d"

2468

% tcp_server.socket.getsockname())

2609

2469

2610

2470

#service.interface = tcp_server.socket.getsockname()[3]

2611

2471

2614

2474

try:

2615

2475

service.activate()

2616

2476

except dbus.exceptions.DBusException as error:

2617

logger.critical("D-Bus Exception", exc_info=error)

2477

logger.critical("DBusException: %s", error)

2618

2478

cleanup()

2619

2479

sys.exit(1)

2620

2480

# End of Avahi example code

2627

2487

logger.debug("Starting main loop")

2628

2488

main_loop.run()

2629

2489

except AvahiError as error:

2630

logger.critical("Avahi Error", exc_info=error)

2490

logger.critical("AvahiError: %s", error)

2631

2491

cleanup()

2632

2492

sys.exit(1)

2633

2493

except KeyboardInterrupt: