/mandos/release : revision 325

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

import SocketServer as socketserver

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

40

43

import socket

41

44

import argparse

42

45

import datetime

47

50

import gnutls.library.functions

48

51

import gnutls.library.constants

49

52

import gnutls.library.types

50

import ConfigParser as configparser

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

51

57

import sys

52

58

import re

53

59

import os

62

68

import struct

63

69

import fcntl

64

70

import functools

65

import cPickle as pickle

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

66

75

import multiprocessing

67

76

import types

68

77

import binascii

69

78

import tempfile

70

79

import itertools

71

80

import collections

81

import codecs

72

82

73

83

import dbus

74

84

import dbus.service

75

import gobject

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

76

89

import avahi

77

90

from dbus.mainloop.glib import DBusGMainLoop

78

91

import ctypes

98

111

syslogger = None

99

112

100

113

try:

101

if_nametoindex = (ctypes.cdll.LoadLibrary

102

(ctypes.util.find_library("c"))

103

.if_nametoindex)

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

104

116

except (OSError, AttributeError):

117

105

118

def if_nametoindex(interface):

106

119

"Get an interface index the hard way, i.e. using fcntl()"

107

120

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

116

129

"""init logger and add loglevel"""

117

130

118

131

global syslogger

119

syslogger = (logging.handlers.SysLogHandler

120

(facility =

121

logging.handlers.SysLogHandler.LOG_DAEMON,

122

address = "/dev/log"))

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

123

135

syslogger.setFormatter(logging.Formatter

124

136

('Mandos [%(process)d]: %(levelname)s:'

125

137

' %(message)s'))

142

154

143

155

class PGPEngine(object):

144

156

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

145

158

def __init__(self):

146

159

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

147

160

self.gnupgargs = ['--batch',

186

199

187

200

def encrypt(self, data, password):

188

201

passphrase = self.password_encode(password)

189

with tempfile.NamedTemporaryFile(dir=self.tempdir

190

) as passfile:

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

191

204

passfile.write(passphrase)

192

205

passfile.flush()

193

206

proc = subprocess.Popen(['gpg', '--symmetric',

204

217

205

218

def decrypt(self, data, password):

206

219

passphrase = self.password_encode(password)

207

with tempfile.NamedTemporaryFile(dir = self.tempdir

208

) as passfile:

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

209

222

passfile.write(passphrase)

210

223

passfile.flush()

211

224

proc = subprocess.Popen(['gpg', '--decrypt',

215

228

stdin = subprocess.PIPE,

216

229

stdout = subprocess.PIPE,

217

230

stderr = subprocess.PIPE)

218

decrypted_plaintext, err = proc.communicate(input

219

= data)

231

decrypted_plaintext, err = proc.communicate(input = data)

220

232

if proc.returncode != 0:

221

233

raise PGPError(err)

222

234

return decrypted_plaintext

228

240

return super(AvahiError, self).__init__(value, *args,

229

241

**kwargs)

230

242

243

231

244

class AvahiServiceError(AvahiError):

232

245

pass

233

246

247

234

248

class AvahiGroupError(AvahiError):

235

249

pass

236

250

256

270

bus: dbus.SystemBus()

257

271

"""

258

272

259

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

260

servicetype = None, port = None, TXT = None,

261

domain = "", host = "", max_renames = 32768,

262

protocol = avahi.PROTO_UNSPEC, bus = None):

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

263

284

self.interface = interface

264

285

self.name = name

265

286

self.type = servicetype

275

296

self.bus = bus

276

297

self.entry_group_state_changed_match = None

277

298

278

def rename(self):

299

def rename(self, remove=True):

279

300

"""Derived from the Avahi example code"""

280

301

if self.rename_count >= self.max_renames:

281

302

logger.critical("No suitable Zeroconf service name found"

282

303

" after %i retries, exiting.",

283

304

self.rename_count)

284

305

raise AvahiServiceError("Too many renames")

285

self.name = str(self.server

286

.GetAlternativeServiceName(self.name))

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

287

309

logger.info("Changing Zeroconf service name to %r ...",

288

310

self.name)

289

self.remove()

311

if remove:

312

self.remove()

290

313

try:

291

314

self.add()

292

315

except dbus.exceptions.DBusException as error:

293

logger.critical("D-Bus Exception", exc_info=error)

294

self.cleanup()

295

os._exit(1)

296

self.rename_count += 1

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

297

324

298

325

def remove(self):

299

326

"""Derived from the Avahi example code"""

338

365

elif state == avahi.ENTRY_GROUP_FAILURE:

339

366

logger.critical("Avahi: Error in group state changed %s",

340

367

str(error))

341

raise AvahiGroupError("State changed: {!s}"

342

.format(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

343

369

344

370

def cleanup(self):

345

371

"""Derived from the Avahi example code"""

355

381

def server_state_changed(self, state, error=None):

356

382

"""Derived from the Avahi example code"""

357

383

logger.debug("Avahi server state change: %i", state)

358

bad_states = { avahi.SERVER_INVALID:

359

"Zeroconf server invalid",

360

avahi.SERVER_REGISTERING: None,

361

avahi.SERVER_COLLISION:

362

"Zeroconf server name collision",

363

avahi.SERVER_FAILURE:

364

"Zeroconf server failure" }

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

365

390

if state in bad_states:

366

391

if bad_states[state] is not None:

367

392

if error is None:

370

395

logger.error(bad_states[state] + ": %r", error)

371

396

self.cleanup()

372

397

elif state == avahi.SERVER_RUNNING:

373

self.add()

398

try:

399

self.add()

400

except dbus.exceptions.DBusException as error:

401

if (error.get_dbus_name()

402

== "org.freedesktop.Avahi.CollisionError"):

403

logger.info("Local Zeroconf service name"

404

" collision.")

405

return self.rename(remove=False)

406

else:

407

logger.critical("D-Bus Exception", exc_info=error)

408

self.cleanup()

409

os._exit(1)

374

410

else:

375

411

if error is None:

376

412

logger.debug("Unknown state: %r", state)

386

422

follow_name_owner_changes=True),

387

423

avahi.DBUS_INTERFACE_SERVER)

388

424

self.server.connect_to_signal("StateChanged",

389

self.server_state_changed)

425

self.server_state_changed)

390

426

self.server_state_changed(self.server.GetState())

391

427

392

428

393

429

class AvahiServiceToSyslog(AvahiService):

394

def rename(self):

430

def rename(self, *args, **kwargs):

395

431

"""Add the new name to the syslog messages"""

396

ret = AvahiService.rename(self)

397

syslogger.setFormatter(logging.Formatter

398

('Mandos ({}) [%(process)d]:'

399

' %(levelname)s: %(message)s'

400

.format(self.name)))

432

ret = AvahiService.rename(self, *args, **kwargs)

433

syslogger.setFormatter(logging.Formatter(

434

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

435

.format(self.name)))

401

436

return ret

402

437

438

def call_pipe(connection, # : multiprocessing.Connection

439

func, *args, **kwargs):

440

"""This function is meant to be called by multiprocessing.Process

441

442

This function runs func(*args, **kwargs), and writes the resulting

443

return value on the provided multiprocessing.Connection.

444

"""

445

connection.send(func(*args, **kwargs))

446

connection.close()

403

447

404

448

class Client(object):

405

449

"""A representation of a client host served by this server.

432

476

last_checker_status: integer between 0 and 255 reflecting exit

433

477

status of last checker. -1 reflects crashed

434

478

checker, -2 means no checker completed yet.

479

last_checker_signal: The signal which killed the last checker, if

480

last_checker_status is -1

435

481

last_enabled: datetime.datetime(); (UTC) or None

436

482

name: string; from the config file, used in log messages and

437

483

D-Bus identifiers

450

496

"fingerprint", "host", "interval",

451

497

"last_approval_request", "last_checked_ok",

452

498

"last_enabled", "name", "timeout")

453

client_defaults = { "timeout": "PT5M",

454

"extended_timeout": "PT15M",

455

"interval": "PT2M",

456

"checker": "fping -q -- %%(host)s",

457

"host": "",

458

"approval_delay": "PT0S",

459

"approval_duration": "PT1S",

460

"approved_by_default": "True",

461

"enabled": "True",

462

}

499

client_defaults = {

500

"timeout": "PT5M",

501

"extended_timeout": "PT15M",

502

"interval": "PT2M",

503

"checker": "fping -q -- %%(host)s",

504

"host": "",

505

"approval_delay": "PT0S",

506

"approval_duration": "PT1S",

507

"approved_by_default": "True",

508

"enabled": "True",

509

}

463

510

464

511

@staticmethod

465

512

def config_parser(config):

481

528

client["enabled"] = config.getboolean(client_name,

482

529

"enabled")

483

530

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the

533

# fingerprint() function

484

534

client["fingerprint"] = (section["fingerprint"].upper()

485

535

.replace(" ", ""))

486

536

if "secret" in section:

528

578

self.expires = None

529

579

530

580

logger.debug("Creating client %r", self.name)

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the fingerprint()

533

# function

534

581

logger.debug(" Fingerprint: %s", self.fingerprint)

535

582

self.created = settings.get("created",

536

583

datetime.datetime.utcnow())

543

590

self.current_checker_command = None

544

591

self.approved = None

545

592

self.approvals_pending = 0

546

self.changedstate = (multiprocessing_manager

547

.Condition(multiprocessing_manager

548

.Lock()))

549

self.client_structure = [attr for attr in

550

self.__dict__.iterkeys()

593

self.changedstate = multiprocessing_manager.Condition(

594

multiprocessing_manager.Lock())

595

self.client_structure = [attr

596

for attr in self.__dict__.iterkeys()

551

597

if not attr.startswith("_")]

552

598

self.client_structure.append("client_structure")

553

599

554

for name, t in inspect.getmembers(type(self),

555

lambda obj:

556

isinstance(obj,

557

property)):

600

for name, t in inspect.getmembers(

601

type(self), lambda obj: isinstance(obj, property)):

558

602

if not name.startswith("_"):

559

603

self.client_structure.append(name)

560

604

602

646

# and every interval from then on.

603

647

if self.checker_initiator_tag is not None:

604

648

gobject.source_remove(self.checker_initiator_tag)

605

self.checker_initiator_tag = (gobject.timeout_add

606

(int(self.interval

607

.total_seconds() * 1000),

608

self.start_checker))

649

self.checker_initiator_tag = gobject.timeout_add(

650

int(self.interval.total_seconds() * 1000),

651

self.start_checker)

609

652

# Schedule a disable() when 'timeout' has passed

610

653

if self.disable_initiator_tag is not None:

611

654

gobject.source_remove(self.disable_initiator_tag)

612

self.disable_initiator_tag = (gobject.timeout_add

613

(int(self.timeout

614

.total_seconds() * 1000),

615

self.disable))

655

self.disable_initiator_tag = gobject.timeout_add(

656

int(self.timeout.total_seconds() * 1000), self.disable)

616

657

# Also start a new checker *right now*.

617

658

self.start_checker()

618

659

619

def checker_callback(self, pid, condition, command):

660

def checker_callback(self, source, condition, connection,

661

command):

620

662

"""The checker has completed, so take appropriate actions."""

621

663

self.checker_callback_tag = None

622

664

self.checker = None

623

if os.WIFEXITED(condition):

624

self.last_checker_status = os.WEXITSTATUS(condition)

665

# Read return code from connection (see call_pipe)

666

returncode = connection.recv()

667

connection.close()

668

669

if returncode >= 0:

670

self.last_checker_status = returncode

671

self.last_checker_signal = None

625

672

if self.last_checker_status == 0:

626

673

logger.info("Checker for %(name)s succeeded",

627

674

vars(self))

628

675

self.checked_ok()

629

676

else:

630

logger.info("Checker for %(name)s failed",

631

vars(self))

677

logger.info("Checker for %(name)s failed", vars(self))

632

678

else:

633

679

self.last_checker_status = -1

680

self.last_checker_signal = -returncode

634

681

logger.warning("Checker for %(name)s crashed?",

635

682

vars(self))

683

return False

636

684

637

685

def checked_ok(self):

638

686

"""Assert that the client has been seen, alive and well."""

639

687

self.last_checked_ok = datetime.datetime.utcnow()

640

688

self.last_checker_status = 0

689

self.last_checker_signal = None

641

690

self.bump_timeout()

642

691

643

692

def bump_timeout(self, timeout=None):

648

697

gobject.source_remove(self.disable_initiator_tag)

649

698

self.disable_initiator_tag = None

650

699

if getattr(self, "enabled", False):

651

self.disable_initiator_tag = (gobject.timeout_add

652

(int(timeout.total_seconds()

653

* 1000), self.disable))

700

self.disable_initiator_tag = gobject.timeout_add(

701

int(timeout.total_seconds() * 1000), self.disable)

654

702

self.expires = datetime.datetime.utcnow() + timeout

655

703

656

704

def need_approval(self):

670

718

# than 'timeout' for the client to be disabled, which is as it

671

719

# should be.

672

720

673

# If a checker exists, make sure it is not a zombie

674

try:

675

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

676

except AttributeError:

677

pass

678

except OSError as error:

679

if error.errno != errno.ECHILD:

680

raise

681

else:

682

if pid:

683

logger.warning("Checker was a zombie")

684

gobject.source_remove(self.checker_callback_tag)

685

self.checker_callback(pid, status,

686

self.current_checker_command)

721

if self.checker is not None and not self.checker.is_alive():

722

logger.warning("Checker was not alive; joining")

723

self.checker.join()

724

self.checker = None

687

725

# Start a new checker if needed

688

726

if self.checker is None:

689

727

# Escape attributes for the shell

690

escaped_attrs = { attr:

691

re.escape(str(getattr(self, attr)))

692

for attr in self.runtime_expansions }

728

escaped_attrs = {

729

attr: re.escape(str(getattr(self, attr)))

730

for attr in self.runtime_expansions }

693

731

try:

694

732

command = self.checker_command % escaped_attrs

695

733

except TypeError as error:

696

734

logger.error('Could not format string "%s"',

697

self.checker_command, exc_info=error)

698

return True # Try again later

735

self.checker_command,

736

exc_info=error)

737

return True # Try again later

699

738

self.current_checker_command = command

700

try:

701

logger.info("Starting checker %r for %s",

702

command, self.name)

703

# We don't need to redirect stdout and stderr, since

704

# in normal mode, that is already done by daemon(),

705

# and in debug mode we don't want to. (Stdin is

706

# always replaced by /dev/null.)

707

# The exception is when not debugging but nevertheless

708

# running in the foreground; use the previously

709

# created wnull.

710

popen_args = {}

711

if (not self.server_settings["debug"]

712

and self.server_settings["foreground"]):

713

popen_args.update({"stdout": wnull,

714

"stderr": wnull })

715

self.checker = subprocess.Popen(command,

716

close_fds=True,

717

shell=True, cwd="/",

718

**popen_args)

719

except OSError as error:

720

logger.error("Failed to start subprocess",

721

exc_info=error)

722

return True

723

self.checker_callback_tag = (gobject.child_watch_add

724

(self.checker.pid,

725

self.checker_callback,

726

data=command))

727

# The checker may have completed before the gobject

728

# watch was added. Check for this.

729

try:

730

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

731

except OSError as error:

732

if error.errno == errno.ECHILD:

733

# This should never happen

734

logger.error("Child process vanished",

735

exc_info=error)

736

return True

737

raise

738

if pid:

739

gobject.source_remove(self.checker_callback_tag)

740

self.checker_callback(pid, status, command)

739

logger.info("Starting checker %r for %s", command,

740

self.name)

741

# We don't need to redirect stdout and stderr, since

742

# in normal mode, that is already done by daemon(),

743

# and in debug mode we don't want to. (Stdin is

744

# always replaced by /dev/null.)

745

# The exception is when not debugging but nevertheless

746

# running in the foreground; use the previously

747

# created wnull.

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

751

if (not self.server_settings["debug"]

752

and self.server_settings["foreground"]):

753

popen_args.update({"stdout": wnull,

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

756

self.checker = multiprocessing.Process(

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

760

self.checker.start()

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

763

self.checker_callback, pipe[0], command)

741

764

# Re-run this periodically if run by gobject.timeout_add

742

765

return True

743

766

749

772

if getattr(self, "checker", None) is None:

750

773

return

751

774

logger.debug("Stopping checker for %(name)s", vars(self))

752

try:

753

self.checker.terminate()

754

#time.sleep(0.5)

755

#if self.checker.poll() is None:

756

# self.checker.kill()

757

except OSError as error:

758

if error.errno != errno.ESRCH: # No such process

759

raise

775

self.checker.terminate()

760

776

self.checker = None

761

777

762

778

763

def dbus_service_property(dbus_interface, signature="v",

764

access="readwrite", byte_arrays=False):

779

def dbus_service_property(dbus_interface,

780

signature="v",

781

access="readwrite",

782

byte_arrays=False):

765

783

"""Decorators for marking methods of a DBusObjectWithProperties to

766

784

become properties on the D-Bus.

767

785

777

795

if byte_arrays and signature != "ay":

778

796

raise ValueError("Byte arrays not supported for non-'ay'"

779

797

" signature {!r}".format(signature))

798

780

799

def decorator(func):

781

800

func._dbus_is_property = True

782

801

func._dbus_interface = dbus_interface

787

806

func._dbus_name = func._dbus_name[:-14]

788

807

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

789

808

return func

809

790

810

return decorator

791

811

792

812

801

821

"org.freedesktop.DBus.Property.EmitsChangedSignal":

802

822

"false"}

803

823

"""

824

804

825

def decorator(func):

805

826

func._dbus_is_interface = True

806

827

func._dbus_interface = dbus_interface

807

828

func._dbus_name = dbus_interface

808

829

return func

830

809

831

return decorator

810

832

811

833

820

842

access="r")

821

843

def Property_dbus_property(self):

822

844

return dbus.Boolean(False)

845

846

See also the DBusObjectWithAnnotations class.

823

847

"""

848

824

849

def decorator(func):

825

850

func._dbus_annotations = annotations

826

851

return func

852

827

853

return decorator

828

854

829

855

832

858

"""

833

859

pass

834

860

861

835

862

class DBusPropertyAccessException(DBusPropertyException):

836

863

"""A property's access permissions disallows an operation.

837

864

"""

844

871

pass

845

872

846

873

847

class DBusObjectWithProperties(dbus.service.Object):

848

"""A D-Bus object with properties.

874

class DBusObjectWithAnnotations(dbus.service.Object):

875

"""A D-Bus object with annotations.

849

876

850

Classes inheriting from this can use the dbus_service_property

851

decorator to expose methods as D-Bus properties. It exposes the

852

standard Get(), Set(), and GetAll() methods on the D-Bus.

877

Classes inheriting from this can use the dbus_annotations

878

decorator to add annotations to methods or signals.

853

879

"""

854

880

855

881

@staticmethod

865

891

def _get_all_dbus_things(self, thing):

866

892

"""Returns a generator of (name, attribute) pairs

867

893

"""

868

return ((getattr(athing.__get__(self), "_dbus_name",

869

name),

894

return ((getattr(athing.__get__(self), "_dbus_name", name),

870

895

athing.__get__(self))

871

896

for cls in self.__class__.__mro__

872

897

for name, athing in

873

inspect.getmembers(cls,

874

self._is_dbus_thing(thing)))

898

inspect.getmembers(cls, self._is_dbus_thing(thing)))

899

900

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

901

out_signature = "s",

902

path_keyword = 'object_path',

903

connection_keyword = 'connection')

904

def Introspect(self, object_path, connection):

905

"""Overloading of standard D-Bus method.

906

907

Inserts annotation tags on methods and signals.

908

"""

909

xmlstring = dbus.service.Object.Introspect(self, object_path,

910

connection)

911

try:

912

document = xml.dom.minidom.parseString(xmlstring)

913

914

for if_tag in document.getElementsByTagName("interface"):

915

# Add annotation tags

916

for typ in ("method", "signal"):

917

for tag in if_tag.getElementsByTagName(typ):

918

annots = dict()

919

for name, prop in (self.

920

_get_all_dbus_things(typ)):

921

if (name == tag.getAttribute("name")

922

and prop._dbus_interface

923

== if_tag.getAttribute("name")):

924

annots.update(getattr(

925

prop, "_dbus_annotations", {}))

926

for name, value in annots.items():

927

ann_tag = document.createElement(

928

"annotation")

929

ann_tag.setAttribute("name", name)

930

ann_tag.setAttribute("value", value)

931

tag.appendChild(ann_tag)

932

# Add interface annotation tags

933

for annotation, value in dict(

934

itertools.chain.from_iterable(

935

annotations().items()

936

for name, annotations

937

in self._get_all_dbus_things("interface")

938

if name == if_tag.getAttribute("name")

939

)).items():

940

ann_tag = document.createElement("annotation")

941

ann_tag.setAttribute("name", annotation)

942

ann_tag.setAttribute("value", value)

943

if_tag.appendChild(ann_tag)

944

# Fix argument name for the Introspect method itself

945

if (if_tag.getAttribute("name")

946

== dbus.INTROSPECTABLE_IFACE):

947

for cn in if_tag.getElementsByTagName("method"):

948

if cn.getAttribute("name") == "Introspect":

949

for arg in cn.getElementsByTagName("arg"):

950

if (arg.getAttribute("direction")

951

== "out"):

952

arg.setAttribute("name",

953

"xml_data")

954

xmlstring = document.toxml("utf-8")

955

document.unlink()

956

except (AttributeError, xml.dom.DOMException,

957

xml.parsers.expat.ExpatError) as error:

958

logger.error("Failed to override Introspection method",

959

exc_info=error)

960

return xmlstring

961

962

963

class DBusObjectWithProperties(DBusObjectWithAnnotations):

964

"""A D-Bus object with properties.

965

966

Classes inheriting from this can use the dbus_service_property

967

decorator to expose methods as D-Bus properties. It exposes the

968

standard Get(), Set(), and GetAll() methods on the D-Bus.

969

"""

875

970

876

971

def _get_dbus_property(self, interface_name, property_name):

877

972

"""Returns a bound method if one exists which is a D-Bus

878

973

property with the specified name and interface.

879

974

"""

880

for cls in self.__class__.__mro__:

881

for name, value in (inspect.getmembers

882

(cls,

883

self._is_dbus_thing("property"))):

975

for cls in self.__class__.__mro__:

976

for name, value in inspect.getmembers(

977

cls, self._is_dbus_thing("property")):

884

978

if (value._dbus_name == property_name

885

979

and value._dbus_interface == interface_name):

886

980

return value.__get__(self)

887

981

888

982

# No such property

889

raise DBusPropertyNotFound(self.dbus_object_path + ":"

890

+ interface_name + "."

891

+ property_name)

892

893

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

983

raise DBusPropertyNotFound("{}:{}.{}".format(

984

self.dbus_object_path, interface_name, property_name))

985

986

@classmethod

987

def _get_all_interface_names(cls):

988

"""Get a sequence of all interfaces supported by an object"""

989

return (name for name in set(getattr(getattr(x, attr),

990

"_dbus_interface", None)

991

for x in (inspect.getmro(cls))

992

for attr in dir(x))

993

if name is not None)

994

995

@dbus.service.method(dbus.PROPERTIES_IFACE,

996

in_signature="ss",

894

997

out_signature="v")

895

998

def Get(self, interface_name, property_name):

896

999

"""Standard D-Bus property Get() method, see D-Bus standard.

921

1024

for byte in value))

922

1025

prop(value)

923

1026

924

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1027

@dbus.service.method(dbus.PROPERTIES_IFACE,

1028

in_signature="s",

925

1029

out_signature="a{sv}")

926

1030

def GetAll(self, interface_name):

927

1031

"""Standard D-Bus property GetAll() method, see D-Bus

942

1046

if not hasattr(value, "variant_level"):

943

1047

properties[name] = value

944

1048

continue

945

properties[name] = type(value)(value, variant_level=

946

value.variant_level+1)

1049

properties[name] = type(value)(

1050

value, variant_level = value.variant_level + 1)

947

1051

return dbus.Dictionary(properties, signature="sv")

948

1052

949

1053

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

963

1067

964

1068

Inserts property tags and interface annotation tags.

965

1069

"""

966

xmlstring = dbus.service.Object.Introspect(self, object_path,

967

connection)

1070

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1071

object_path,

1072

connection)

968

1073

try:

969

1074

document = xml.dom.minidom.parseString(xmlstring)

1075

970

1076

def make_tag(document, name, prop):

971

1077

e = document.createElement("property")

972

1078

e.setAttribute("name", name)

973

1079

e.setAttribute("type", prop._dbus_signature)

974

1080

e.setAttribute("access", prop._dbus_access)

975

1081

return e

1082

976

1083

for if_tag in document.getElementsByTagName("interface"):

977

1084

# Add property tags

978

1085

for tag in (make_tag(document, name, prop)

981

1088

if prop._dbus_interface

982

1089

== if_tag.getAttribute("name")):

983

1090

if_tag.appendChild(tag)

984

# Add annotation tags

985

for typ in ("method", "signal", "property"):

986

for tag in if_tag.getElementsByTagName(typ):

987

annots = dict()

988

for name, prop in (self.

989

_get_all_dbus_things(typ)):

990

if (name == tag.getAttribute("name")

991

and prop._dbus_interface

992

== if_tag.getAttribute("name")):

993

annots.update(getattr

994

(prop,

995

"_dbus_annotations",

996

{}))

997

for name, value in annots.items():

998

ann_tag = document.createElement(

999

"annotation")

1000

ann_tag.setAttribute("name", name)

1001

ann_tag.setAttribute("value", value)

1002

tag.appendChild(ann_tag)

1003

# Add interface annotation tags

1004

for annotation, value in dict(

1005

itertools.chain.from_iterable(

1006

annotations().items()

1007

for name, annotations in

1008

self._get_all_dbus_things("interface")

1009

if name == if_tag.getAttribute("name")

1010

)).items():

1011

ann_tag = document.createElement("annotation")

1012

ann_tag.setAttribute("name", annotation)

1013

ann_tag.setAttribute("value", value)

1014

if_tag.appendChild(ann_tag)

1091

# Add annotation tags for properties

1092

for tag in if_tag.getElementsByTagName("property"):

1093

annots = dict()

1094

for name, prop in self._get_all_dbus_things(

1095

"property"):

1096

if (name == tag.getAttribute("name")

1097

and prop._dbus_interface

1098

== if_tag.getAttribute("name")):

1099

annots.update(getattr(

1100

prop, "_dbus_annotations", {}))

1101

for name, value in annots.items():

1102

ann_tag = document.createElement(

1103

"annotation")

1104

ann_tag.setAttribute("name", name)

1105

ann_tag.setAttribute("value", value)

1106

tag.appendChild(ann_tag)

1015

1107

# Add the names to the return values for the

1016

1108

# "org.freedesktop.DBus.Properties" methods

1017

1109

if (if_tag.getAttribute("name")

1035

1127

exc_info=error)

1036

1128

return xmlstring

1037

1129

1130

try:

1131

dbus.OBJECT_MANAGER_IFACE

1132

except AttributeError:

1133

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1134

1135

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1136

"""A D-Bus object with an ObjectManager.

1137

1138

Classes inheriting from this exposes the standard

1139

GetManagedObjects call and the InterfacesAdded and

1140

InterfacesRemoved signals on the standard

1141

"org.freedesktop.DBus.ObjectManager" interface.

1142

1143

Note: No signals are sent automatically; they must be sent

1144

manually.

1145

"""

1146

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1147

out_signature = "a{oa{sa{sv}}}")

1148

def GetManagedObjects(self):

1149

"""This function must be overridden"""

1150

raise NotImplementedError()

1151

1152

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1153

signature = "oa{sa{sv}}")

1154

def InterfacesAdded(self, object_path, interfaces_and_properties):

1155

pass

1156

1157

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1158

def InterfacesRemoved(self, object_path, interfaces):

1159

pass

1160

1161

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1162

out_signature = "s",

1163

path_keyword = 'object_path',

1164

connection_keyword = 'connection')

1165

def Introspect(self, object_path, connection):

1166

"""Overloading of standard D-Bus method.

1167

1168

Override return argument name of GetManagedObjects to be

1169

"objpath_interfaces_and_properties"

1170

"""

1171

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1172

object_path,

1173

connection)

1174

try:

1175

document = xml.dom.minidom.parseString(xmlstring)

1176

1177

for if_tag in document.getElementsByTagName("interface"):

1178

# Fix argument name for the GetManagedObjects method

1179

if (if_tag.getAttribute("name")

1180

== dbus.OBJECT_MANAGER_IFACE):

1181

for cn in if_tag.getElementsByTagName("method"):

1182

if (cn.getAttribute("name")

1183

== "GetManagedObjects"):

1184

for arg in cn.getElementsByTagName("arg"):

1185

if (arg.getAttribute("direction")

1186

== "out"):

1187

arg.setAttribute(

1188

"name",

1189

"objpath_interfaces"

1190

"_and_properties")

1191

xmlstring = document.toxml("utf-8")

1192

document.unlink()

1193

except (AttributeError, xml.dom.DOMException,

1194

xml.parsers.expat.ExpatError) as error:

1195

logger.error("Failed to override Introspection method",

1196

exc_info = error)

1197

return xmlstring

1038

1198

1039

1199

def datetime_to_dbus(dt, variant_level=0):

1040

1200

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1041

1201

if dt is None:

1042

1202

return dbus.String("", variant_level = variant_level)

1043

return dbus.String(dt.isoformat(),

1044

variant_level=variant_level)

1203

return dbus.String(dt.isoformat(), variant_level=variant_level)

1045

1204

1046

1205

1047

1206

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1067

1226

(from DBusObjectWithProperties) and interfaces (from the

1068

1227

dbus_interface_annotations decorator).

1069

1228

"""

1229

1070

1230

def wrapper(cls):

1071

1231

for orig_interface_name, alt_interface_name in (

1072

alt_interface_names.items()):

1232

alt_interface_names.items()):

1073

1233

attr = {}

1074

1234

interface_names = set()

1075

1235

# Go though all attributes of the class

1077

1237

# Ignore non-D-Bus attributes, and D-Bus attributes

1078

1238

# with the wrong interface name

1079

1239

if (not hasattr(attribute, "_dbus_interface")

1080

or not attribute._dbus_interface

1081

.startswith(orig_interface_name)):

1240

or not attribute._dbus_interface.startswith(

1241

orig_interface_name)):

1082

1242

continue

1083

1243

# Create an alternate D-Bus interface name based on

1084

1244

# the current name

1085

alt_interface = (attribute._dbus_interface

1086

.replace(orig_interface_name,

1087

alt_interface_name))

1245

alt_interface = attribute._dbus_interface.replace(

1246

orig_interface_name, alt_interface_name)

1088

1247

interface_names.add(alt_interface)

1089

1248

# Is this a D-Bus signal?

1090

1249

if getattr(attribute, "_dbus_is_signal", False):

1091

# Extract the original non-method undecorated

1092

# function by black magic

1093

nonmethod_func = (dict(

1250

if sys.version_info.major == 2:

1251

# Extract the original non-method undecorated

1252

# function by black magic

1253

nonmethod_func = (dict(

1094

1254

zip(attribute.func_code.co_freevars,

1095

attribute.__closure__))["func"]

1096

.cell_contents)

1255

attribute.__closure__))

1256

["func"].cell_contents)

1257

else:

1258

nonmethod_func = attribute

1097

1259

# Create a new, but exactly alike, function

1098

1260

# object, and decorate it to be a new D-Bus signal

1099

1261

# with the alternate D-Bus interface name

1100

new_function = (dbus.service.signal

1101

(alt_interface,

1102

attribute._dbus_signature)

1103

(types.FunctionType(

1104

nonmethod_func.func_code,

1105

nonmethod_func.func_globals,

1106

nonmethod_func.func_name,

1107

nonmethod_func.func_defaults,

1108

nonmethod_func.func_closure)))

1262

if sys.version_info.major == 2:

1263

new_function = types.FunctionType(

1264

nonmethod_func.func_code,

1265

nonmethod_func.func_globals,

1266

nonmethod_func.func_name,

1267

nonmethod_func.func_defaults,

1268

nonmethod_func.func_closure)

1269

else:

1270

new_function = types.FunctionType(

1271

nonmethod_func.__code__,

1272

nonmethod_func.__globals__,

1273

nonmethod_func.__name__,

1274

nonmethod_func.__defaults__,

1275

nonmethod_func.__closure__)

1276

new_function = (dbus.service.signal(

1277

alt_interface,

1278

attribute._dbus_signature)(new_function))

1109

1279

# Copy annotations, if any

1110

1280

try:

1111

new_function._dbus_annotations = (

1112

dict(attribute._dbus_annotations))

1281

new_function._dbus_annotations = dict(

1282

attribute._dbus_annotations)

1113

1283

except AttributeError:

1114

1284

pass

1115

1285

# Define a creator of a function to call both the

1120

1290

"""This function is a scope container to pass

1121

1291

func1 and func2 to the "call_both" function

1122

1292

outside of its arguments"""

1293

1294

@functools.wraps(func2)

1123

1295

def call_both(*args, **kwargs):

1124

1296

"""This function will emit two D-Bus

1125

1297

signals by calling func1 and func2"""

1126

1298

func1(*args, **kwargs)

1127

1299

func2(*args, **kwargs)

1300

# Make wrapper function look like a D-Bus signal

1301

for name, attr in inspect.getmembers(func2):

1302

if name.startswith("_dbus_"):

1303

setattr(call_both, name, attr)

1304

1128

1305

return call_both

1129

1306

# Create the "call_both" function and add it to

1130

1307

# the class

1135

1312

# object. Decorate it to be a new D-Bus method

1136

1313

# with the alternate D-Bus interface name. Add it

1137

1314

# to the class.

1138

attr[attrname] = (dbus.service.method

1139

(alt_interface,

1140

attribute._dbus_in_signature,

1141

attribute._dbus_out_signature)

1142

(types.FunctionType

1143

(attribute.func_code,

1144

attribute.func_globals,

1145

attribute.func_name,

1146

attribute.func_defaults,

1147

attribute.func_closure)))

1315

attr[attrname] = (

1316

dbus.service.method(

1317

alt_interface,

1318

attribute._dbus_in_signature,

1319

attribute._dbus_out_signature)

1320

(types.FunctionType(attribute.func_code,

1321

attribute.func_globals,

1322

attribute.func_name,

1323

attribute.func_defaults,

1324

attribute.func_closure)))

1148

1325

# Copy annotations, if any

1149

1326

try:

1150

attr[attrname]._dbus_annotations = (

1151

dict(attribute._dbus_annotations))

1327

attr[attrname]._dbus_annotations = dict(

1328

attribute._dbus_annotations)

1152

1329

except AttributeError:

1153

1330

pass

1154

1331

# Is this a D-Bus property?

1157

1334

# object, and decorate it to be a new D-Bus

1158

1335

# property with the alternate D-Bus interface

1159

1336

# name. Add it to the class.

1160

attr[attrname] = (dbus_service_property

1161

(alt_interface,

1162

attribute._dbus_signature,

1163

attribute._dbus_access,

1164

attribute

1165

._dbus_get_args_options

1166

["byte_arrays"])

1167

(types.FunctionType

1168

(attribute.func_code,

1169

attribute.func_globals,

1170

attribute.func_name,

1171

attribute.func_defaults,

1172

attribute.func_closure)))

1337

attr[attrname] = (dbus_service_property(

1338

alt_interface, attribute._dbus_signature,

1339

attribute._dbus_access,

1340

attribute._dbus_get_args_options

1341

["byte_arrays"])

1342

(types.FunctionType(

1343

attribute.func_code,

1344

attribute.func_globals,

1345

attribute.func_name,

1346

attribute.func_defaults,

1347

attribute.func_closure)))

1173

1348

# Copy annotations, if any

1174

1349

try:

1175

attr[attrname]._dbus_annotations = (

1176

dict(attribute._dbus_annotations))

1350

attr[attrname]._dbus_annotations = dict(

1351

attribute._dbus_annotations)

1177

1352

except AttributeError:

1178

1353

pass

1179

1354

# Is this a D-Bus interface?

1182

1357

# object. Decorate it to be a new D-Bus interface

1183

1358

# with the alternate D-Bus interface name. Add it

1184

1359

# to the class.

1185

attr[attrname] = (dbus_interface_annotations

1186

(alt_interface)

1187

(types.FunctionType

1188

(attribute.func_code,

1189

attribute.func_globals,

1190

attribute.func_name,

1191

attribute.func_defaults,

1192

attribute.func_closure)))

1360

attr[attrname] = (

1361

dbus_interface_annotations(alt_interface)

1362

(types.FunctionType(attribute.func_code,

1363

attribute.func_globals,

1364

attribute.func_name,

1365

attribute.func_defaults,

1366

attribute.func_closure)))

1193

1367

if deprecate:

1194

1368

# Deprecate all alternate interfaces

1195

1369

iname="_AlternateDBusNames_interface_annotation{}"

1196

1370

for interface_name in interface_names:

1371

1197

1372

@dbus_interface_annotations(interface_name)

1198

1373

def func(self):

1199

1374

return { "org.freedesktop.DBus.Deprecated":

1200

"true" }

1375

"true" }

1201

1376

# Find an unused name

1202

1377

for aname in (iname.format(i)

1203

1378

for i in itertools.count()):

1208

1383

# Replace the class with a new subclass of it with

1209

1384

# methods, signals, etc. as created above.

1210

1385

cls = type(b"{}Alternate".format(cls.__name__),

1211

(cls,), attr)

1386

(cls, ), attr)

1212

1387

return cls

1388

1213

1389

return wrapper

1214

1390

1215

1391

1216

1392

@alternate_dbus_interfaces({"se.recompile.Mandos":

1217

"se.bsnet.fukt.Mandos"})

1393

"se.bsnet.fukt.Mandos"})

1218

1394

class ClientDBus(Client, DBusObjectWithProperties):

1219

1395

"""A Client class using D-Bus

1220

1396

1224

1400

"""

1225

1401

1226

1402

runtime_expansions = (Client.runtime_expansions

1227

+ ("dbus_object_path",))

1403

+ ("dbus_object_path", ))

1228

1404

1229

1405

_interface = "se.recompile.Mandos.Client"

1230

1406

1238

1414

client_object_name = str(self.name).translate(

1239

1415

{ord("."): ord("_"),

1240

1416

ord("-"): ord("_")})

1241

self.dbus_object_path = (dbus.ObjectPath

1242

("/clients/" + client_object_name))

1417

self.dbus_object_path = dbus.ObjectPath(

1418

"/clients/" + client_object_name)

1243

1419

DBusObjectWithProperties.__init__(self, self.bus,

1244

1420

self.dbus_object_path)

1245

1421

1246

def notifychangeproperty(transform_func,

1247

dbus_name, type_func=lambda x: x,

1248

variant_level=1, invalidate_only=False,

1422

def notifychangeproperty(transform_func, dbus_name,

1423

type_func=lambda x: x,

1424

variant_level=1,

1425

invalidate_only=False,

1249

1426

_interface=_interface):

1250

1427

""" Modify a variable so that it's a property which announces

1251

1428

its changes to DBus.

1258

1435

variant_level: D-Bus variant level. Default: 1

1259

1436

"""

1260

1437

attrname = "_{}".format(dbus_name)

1438

1261

1439

def setter(self, value):

1262

1440

if hasattr(self, "dbus_object_path"):

1263

1441

if (not hasattr(self, attrname) or

1264

1442

type_func(getattr(self, attrname, None))

1265

1443

!= type_func(value)):

1266

1444

if invalidate_only:

1267

self.PropertiesChanged(_interface,

1268

dbus.Dictionary(),

1269

dbus.Array

1270

((dbus_name,)))

1445

self.PropertiesChanged(

1446

_interface, dbus.Dictionary(),

1447

dbus.Array((dbus_name, )))

1271

1448

else:

1272

dbus_value = transform_func(type_func(value),

1273

variant_level

1274

=variant_level)

1449

dbus_value = transform_func(

1450

type_func(value),

1451

variant_level = variant_level)

1275

1452

self.PropertyChanged(dbus.String(dbus_name),

1276

1453

dbus_value)

1277

self.PropertiesChanged(_interface,

1278

dbus.Dictionary({

1279

dbus.String(dbus_name):

1280

dbus_value }), dbus.Array())

1454

self.PropertiesChanged(

1455

_interface,

1456

dbus.Dictionary({ dbus.String(dbus_name):

1457

dbus_value }),

1458

dbus.Array())

1281

1459

setattr(self, attrname, value)

1282

1460

1283

1461

return property(lambda self: getattr(self, attrname), setter)

1289

1467

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1290

1468

last_enabled = notifychangeproperty(datetime_to_dbus,

1291

1469

"LastEnabled")

1292

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1293

type_func = lambda checker:

1294

checker is not None)

1470

checker = notifychangeproperty(

1471

dbus.Boolean, "CheckerRunning",

1472

type_func = lambda checker: checker is not None)

1295

1473

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1296

1474

"LastCheckedOK")

1297

1475

last_checker_status = notifychangeproperty(dbus.Int16,

1300

1478

datetime_to_dbus, "LastApprovalRequest")

1301

1479

approved_by_default = notifychangeproperty(dbus.Boolean,

1302

1480

"ApprovedByDefault")

1303

approval_delay = notifychangeproperty(dbus.UInt64,

1304

"ApprovalDelay",

1305

type_func =

1306

lambda td: td.total_seconds()

1307

* 1000)

1481

approval_delay = notifychangeproperty(

1482

dbus.UInt64, "ApprovalDelay",

1483

type_func = lambda td: td.total_seconds() * 1000)

1308

1484

approval_duration = notifychangeproperty(

1309

1485

dbus.UInt64, "ApprovalDuration",

1310

1486

type_func = lambda td: td.total_seconds() * 1000)

1311

1487

host = notifychangeproperty(dbus.String, "Host")

1312

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1313

type_func = lambda td:

1314

td.total_seconds() * 1000)

1488

timeout = notifychangeproperty(

1489

dbus.UInt64, "Timeout",

1490

type_func = lambda td: td.total_seconds() * 1000)

1315

1491

extended_timeout = notifychangeproperty(

1316

1492

dbus.UInt64, "ExtendedTimeout",

1317

1493

type_func = lambda td: td.total_seconds() * 1000)

1318

interval = notifychangeproperty(dbus.UInt64,

1319

"Interval",

1320

type_func =

1321

lambda td: td.total_seconds()

1322

* 1000)

1494

interval = notifychangeproperty(

1495

dbus.UInt64, "Interval",

1496

type_func = lambda td: td.total_seconds() * 1000)

1323

1497

checker_command = notifychangeproperty(dbus.String, "Checker")

1324

1498

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1325

1499

invalidate_only=True)

1335

1509

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1336

1510

Client.__del__(self, *args, **kwargs)

1337

1511

1338

def checker_callback(self, pid, condition, command,

1339

*args, **kwargs):

1340

self.checker_callback_tag = None

1341

self.checker = None

1342

if os.WIFEXITED(condition):

1343

exitstatus = os.WEXITSTATUS(condition)

1512

def checker_callback(self, source, condition,

1513

connection, command, *args, **kwargs):

1514

ret = Client.checker_callback(self, source, condition,

1515

connection, command, *args,

1516

**kwargs)

1517

exitstatus = self.last_checker_status

1518

if exitstatus >= 0:

1344

1519

# Emit D-Bus signal

1345

1520

self.CheckerCompleted(dbus.Int16(exitstatus),

1346

dbus.Int64(condition),

1521

# This is specific to GNU libC

1522

dbus.Int64(exitstatus << 8),

1347

1523

dbus.String(command))

1348

1524

else:

1349

1525

# Emit D-Bus signal

1350

1526

self.CheckerCompleted(dbus.Int16(-1),

1351

dbus.Int64(condition),

1527

dbus.Int64(

1528

# This is specific to GNU libC

1529

(exitstatus << 8)

1530

| self.last_checker_signal),

1352

1531

dbus.String(command))

1353

1354

return Client.checker_callback(self, pid, condition, command,

1355

*args, **kwargs)

1532

return ret

1356

1533

1357

1534

def start_checker(self, *args, **kwargs):

1358

1535

old_checker_pid = getattr(self.checker, "pid", None)

1433

1610

self.checked_ok()

1434

1611

1435

1612

# Enable - method

1613

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1436

1614

@dbus.service.method(_interface)

1437

1615

def Enable(self):

1438

1616

"D-Bus method"

1439

1617

self.enable()

1440

1618

1441

1619

# StartChecker - method

1620

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1442

1621

@dbus.service.method(_interface)

1443

1622

def StartChecker(self):

1444

1623

"D-Bus method"

1445

1624

self.start_checker()

1446

1625

1447

1626

# Disable - method

1627

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1448

1628

@dbus.service.method(_interface)

1449

1629

def Disable(self):

1450

1630

"D-Bus method"

1451

1631

self.disable()

1452

1632

1453

1633

# StopChecker - method

1634

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1454

1635

@dbus.service.method(_interface)

1455

1636

def StopChecker(self):

1456

1637

self.stop_checker()

1463

1644

return dbus.Boolean(bool(self.approvals_pending))

1464

1645

1465

1646

# ApprovedByDefault - property

1466

@dbus_service_property(_interface, signature="b",

1647

@dbus_service_property(_interface,

1648

signature="b",

1467

1649

access="readwrite")

1468

1650

def ApprovedByDefault_dbus_property(self, value=None):

1469

1651

if value is None: # get

1471

1653

self.approved_by_default = bool(value)

1472

1654

1473

1655

# ApprovalDelay - property

1474

@dbus_service_property(_interface, signature="t",

1656

@dbus_service_property(_interface,

1657

signature="t",

1475

1658

access="readwrite")

1476

1659

def ApprovalDelay_dbus_property(self, value=None):

1477

1660

if value is None: # get

1480

1663

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1481

1664

1482

1665

# ApprovalDuration - property

1483

@dbus_service_property(_interface, signature="t",

1666

@dbus_service_property(_interface,

1667

signature="t",

1484

1668

access="readwrite")

1485

1669

def ApprovalDuration_dbus_property(self, value=None):

1486

1670

if value is None: # get

1489

1673

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1490

1674

1491

1675

# Name - property

1676

@dbus_annotations(

1677

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1492

1678

@dbus_service_property(_interface, signature="s", access="read")

1493

1679

def Name_dbus_property(self):

1494

1680

return dbus.String(self.name)

1495

1681

1496

1682

# Fingerprint - property

1683

@dbus_annotations(

1684

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1497

1685

@dbus_service_property(_interface, signature="s", access="read")

1498

1686

def Fingerprint_dbus_property(self):

1499

1687

return dbus.String(self.fingerprint)

1500

1688

1501

1689

# Host - property

1502

@dbus_service_property(_interface, signature="s",

1690

@dbus_service_property(_interface,

1691

signature="s",

1503

1692

access="readwrite")

1504

1693

def Host_dbus_property(self, value=None):

1505

1694

if value is None: # get

1507

1696

self.host = str(value)

1508

1697

1509

1698

# Created - property

1699

@dbus_annotations(

1700

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1510

1701

@dbus_service_property(_interface, signature="s", access="read")

1511

1702

def Created_dbus_property(self):

1512

1703

return datetime_to_dbus(self.created)

1517

1708

return datetime_to_dbus(self.last_enabled)

1518

1709

1519

1710

# Enabled - property

1520

@dbus_service_property(_interface, signature="b",

1711

@dbus_service_property(_interface,

1712

signature="b",

1521

1713

access="readwrite")

1522

1714

def Enabled_dbus_property(self, value=None):

1523

1715

if value is None: # get

1528

1720

self.disable()

1529

1721

1530

1722

# LastCheckedOK - property

1531

@dbus_service_property(_interface, signature="s",

1723

@dbus_service_property(_interface,

1724

signature="s",

1532

1725

access="readwrite")

1533

1726

def LastCheckedOK_dbus_property(self, value=None):

1534

1727

if value is not None:

1537

1730

return datetime_to_dbus(self.last_checked_ok)

1538

1731

1539

1732

# LastCheckerStatus - property

1540

@dbus_service_property(_interface, signature="n",

1541

access="read")

1733

@dbus_service_property(_interface, signature="n", access="read")

1542

1734

def LastCheckerStatus_dbus_property(self):

1543

1735

return dbus.Int16(self.last_checker_status)

1544

1736

1553

1745

return datetime_to_dbus(self.last_approval_request)

1554

1746

1555

1747

# Timeout - property

1556

@dbus_service_property(_interface, signature="t",

1748

@dbus_service_property(_interface,

1749

signature="t",

1557

1750

access="readwrite")

1558

1751

def Timeout_dbus_property(self, value=None):

1559

1752

if value is None: # get

1572

1765

is None):

1573

1766

return

1574

1767

gobject.source_remove(self.disable_initiator_tag)

1575

self.disable_initiator_tag = (

1576

gobject.timeout_add(

1577

int((self.expires - now).total_seconds()

1578

* 1000), self.disable))

1768

self.disable_initiator_tag = gobject.timeout_add(

1769

int((self.expires - now).total_seconds() * 1000),

1770

self.disable)

1579

1771

1580

1772

# ExtendedTimeout - property

1581

@dbus_service_property(_interface, signature="t",

1773

@dbus_service_property(_interface,

1774

signature="t",

1582

1775

access="readwrite")

1583

1776

def ExtendedTimeout_dbus_property(self, value=None):

1584

1777

if value is None: # get

1587

1780

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1588

1781

1589

1782

# Interval - property

1590

@dbus_service_property(_interface, signature="t",

1783

@dbus_service_property(_interface,

1784

signature="t",

1591

1785

access="readwrite")

1592

1786

def Interval_dbus_property(self, value=None):

1593

1787

if value is None: # get

1598

1792

if self.enabled:

1599

1793

# Reschedule checker run

1600

1794

gobject.source_remove(self.checker_initiator_tag)

1601

self.checker_initiator_tag = (gobject.timeout_add

1602

(value, self.start_checker))

1603

self.start_checker() # Start one now, too

1795

self.checker_initiator_tag = gobject.timeout_add(

1796

value, self.start_checker)

1797

self.start_checker() # Start one now, too

1604

1798

1605

1799

# Checker - property

1606

@dbus_service_property(_interface, signature="s",

1800

@dbus_service_property(_interface,

1801

signature="s",

1607

1802

access="readwrite")

1608

1803

def Checker_dbus_property(self, value=None):

1609

1804

if value is None: # get

1611

1806

self.checker_command = str(value)

1612

1807

1613

1808

# CheckerRunning - property

1614

@dbus_service_property(_interface, signature="b",

1809

@dbus_service_property(_interface,

1810

signature="b",

1615

1811

access="readwrite")

1616

1812

def CheckerRunning_dbus_property(self, value=None):

1617

1813

if value is None: # get

1622

1818

self.stop_checker()

1623

1819

1624

1820

# ObjectPath - property

1821

@dbus_annotations(

1822

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

1823

"org.freedesktop.DBus.Deprecated": "true"})

1625

1824

@dbus_service_property(_interface, signature="o", access="read")

1626

1825

def ObjectPath_dbus_property(self):

1627

1826

return self.dbus_object_path # is already a dbus.ObjectPath

1628

1827

1629

1828

# Secret = property

1630

@dbus_service_property(_interface, signature="ay",

1631

access="write", byte_arrays=True)

1829

@dbus_annotations(

1830

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

1831

"invalidates"})

1832

@dbus_service_property(_interface,

1833

signature="ay",

1834

access="write",

1835

byte_arrays=True)

1632

1836

def Secret_dbus_property(self, value):

1633

1837

self.secret = bytes(value)

1634

1838

1640

1844

self._pipe = child_pipe

1641

1845

self._pipe.send(('init', fpr, address))

1642

1846

if not self._pipe.recv():

1643

raise KeyError()

1847

raise KeyError(fpr)

1644

1848

1645

1849

def __getattribute__(self, name):

1646

1850

if name == '_pipe':

1650

1854

if data[0] == 'data':

1651

1855

return data[1]

1652

1856

if data[0] == 'function':

1857

1653

1858

def func(*args, **kwargs):

1654

1859

self._pipe.send(('funcall', name, args, kwargs))

1655

1860

return self._pipe.recv()[1]

1861

1656

1862

return func

1657

1863

1658

1864

def __setattr__(self, name, value):

1674

1880

logger.debug("Pipe FD: %d",

1675

1881

self.server.child_pipe.fileno())

1676

1882

1677

session = (gnutls.connection

1678

.ClientSession(self.request,

1679

gnutls.connection

1680

.X509Credentials()))

1883

session = gnutls.connection.ClientSession(

1884

self.request, gnutls.connection .X509Credentials())

1681

1885

1682

1886

# Note: gnutls.connection.X509Credentials is really a

1683

1887

# generic GnuTLS certificate credentials object so long as

1692

1896

priority = self.server.gnutls_priority

1693

1897

if priority is None:

1694

1898

priority = "NORMAL"

1695

(gnutls.library.functions

1696

.gnutls_priority_set_direct(session._c_object,

1697

priority, None))

1899

gnutls.library.functions.gnutls_priority_set_direct(

1900

session._c_object, priority, None)

1698

1901

1699

1902

# Start communication using the Mandos protocol

1700

1903

# Get protocol number

1720

1923

approval_required = False

1721

1924

try:

1722

1925

try:

1723

fpr = self.fingerprint(self.peer_certificate

1724

(session))

1926

fpr = self.fingerprint(

1927

self.peer_certificate(session))

1725

1928

except (TypeError,

1726

1929

gnutls.errors.GNUTLSError) as error:

1727

1930

logger.warning("Bad certificate: %s", error)

1742

1945

while True:

1743

1946

if not client.enabled:

1744

1947

logger.info("Client %s is disabled",

1745

client.name)

1948

client.name)

1746

1949

if self.server.use_dbus:

1747

1950

# Emit D-Bus signal

1748

1951

client.Rejected("Disabled")

1795

1998

logger.warning("gnutls send failed",

1796

1999

exc_info=error)

1797

2000

return

1798

logger.debug("Sent: %d, remaining: %d",

1799

sent, len(client.secret)

1800

- (sent_size + sent))

2001

logger.debug("Sent: %d, remaining: %d", sent,

2002

len(client.secret) - (sent_size

2003

+ sent))

1801

2004

sent_size += sent

1802

2005

1803

2006

logger.info("Sending secret to %s", client.name)

1820

2023

def peer_certificate(session):

1821

2024

"Return the peer's OpenPGP certificate as a bytestring"

1822

2025

# If not an OpenPGP certificate...

1823

if (gnutls.library.functions

1824

.gnutls_certificate_type_get(session._c_object)

2026

if (gnutls.library.functions.gnutls_certificate_type_get(

2027

session._c_object)

1825

2028

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1826

2029

# ...do the normal thing

1827

2030

return session.peer_certificate

1841

2044

def fingerprint(openpgp):

1842

2045

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1843

2046

# New GnuTLS "datum" with the OpenPGP public key

1844

datum = (gnutls.library.types

1845

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1846

ctypes.POINTER

1847

(ctypes.c_ubyte)),

1848

ctypes.c_uint(len(openpgp))))

2047

datum = gnutls.library.types.gnutls_datum_t(

2048

ctypes.cast(ctypes.c_char_p(openpgp),

2049

ctypes.POINTER(ctypes.c_ubyte)),

2050

ctypes.c_uint(len(openpgp)))

1849

2051

# New empty GnuTLS certificate

1850

2052

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1851

(gnutls.library.functions

1852

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2053

gnutls.library.functions.gnutls_openpgp_crt_init(

2054

ctypes.byref(crt))

1853

2055

# Import the OpenPGP public key into the certificate

1854

(gnutls.library.functions

1855

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1856

gnutls.library.constants

1857

.GNUTLS_OPENPGP_FMT_RAW))

2056

gnutls.library.functions.gnutls_openpgp_crt_import(

2057

crt, ctypes.byref(datum),

2058

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1858

2059

# Verify the self signature in the key

1859

2060

crtverify = ctypes.c_uint()

1860

(gnutls.library.functions

1861

.gnutls_openpgp_crt_verify_self(crt, 0,

1862

ctypes.byref(crtverify)))

2061

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

2062

crt, 0, ctypes.byref(crtverify))

1863

2063

if crtverify.value != 0:

1864

2064

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1865

raise (gnutls.errors.CertificateSecurityError

1866

("Verify failed"))

2065

raise gnutls.errors.CertificateSecurityError(

2066

"Verify failed")

1867

2067

# New buffer for the fingerprint

1868

2068

buf = ctypes.create_string_buffer(20)

1869

2069

buf_len = ctypes.c_size_t()

1870

2070

# Get the fingerprint from the certificate into the buffer

1871

(gnutls.library.functions

1872

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1873

ctypes.byref(buf_len)))

2071

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

2072

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1874

2073

# Deinit the certificate

1875

2074

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1876

2075

# Convert the buffer to a Python bytestring

1882

2081

1883

2082

class MultiprocessingMixIn(object):

1884

2083

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2084

1885

2085

def sub_process_main(self, request, address):

1886

2086

try:

1887

2087

self.finish_request(request, address)

1899

2099

1900

2100

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1901

2101

""" adds a pipe to the MixIn """

2102

1902

2103

def process_request(self, request, client_address):

1903

2104

"""Overrides and wraps the original process_request().

1904

2105

1925

2126

interface: None or a network interface name (string)

1926

2127

use_ipv6: Boolean; to use IPv6 or not

1927

2128

"""

2129

1928

2130

def __init__(self, server_address, RequestHandlerClass,

1929

interface=None, use_ipv6=True, socketfd=None):

2131

interface=None,

2132

use_ipv6=True,

2133

socketfd=None):

1930

2134

"""If socketfd is set, use that file descriptor instead of

1931

2135

creating a new one with socket.socket().

1932

2136

"""

1973

2177

self.interface)

1974

2178

else:

1975

2179

try:

1976

self.socket.setsockopt(socket.SOL_SOCKET,

1977

SO_BINDTODEVICE,

1978

(self.interface + "\0")

1979

.encode("utf-8"))

2180

self.socket.setsockopt(

2181

socket.SOL_SOCKET, SO_BINDTODEVICE,

2182

(self.interface + "\0").encode("utf-8"))

1980

2183

except socket.error as error:

1981

2184

if error.errno == errno.EPERM:

1982

2185

logger.error("No permission to bind to"

2000

2203

self.server_address = (any_address,

2001

2204

self.server_address[1])

2002

2205

elif not self.server_address[1]:

2003

self.server_address = (self.server_address[0],

2004

0)

2206

self.server_address = (self.server_address[0], 0)

2005

2207

# if self.interface:

2006

2208

# self.server_address = (self.server_address[0],

2007

2209

# 0, # port

2021

2223

2022

2224

Assumes a gobject.MainLoop event loop.

2023

2225

"""

2226

2024

2227

def __init__(self, server_address, RequestHandlerClass,

2025

interface=None, use_ipv6=True, clients=None,

2026

gnutls_priority=None, use_dbus=True, socketfd=None):

2228

interface=None,

2229

use_ipv6=True,

2230

clients=None,

2231

gnutls_priority=None,

2232

use_dbus=True,

2233

socketfd=None):

2027

2234

self.enabled = False

2028

2235

self.clients = clients

2029

2236

if self.clients is None:

2035

2242

interface = interface,

2036

2243

use_ipv6 = use_ipv6,

2037

2244

socketfd = socketfd)

2245

2038

2246

def server_activate(self):

2039

2247

if self.enabled:

2040

2248

return socketserver.TCPServer.server_activate(self)

2044

2252

2045

2253

def add_pipe(self, parent_pipe, proc):

2046

2254

# Call "handle_ipc" for both data and EOF events

2047

gobject.io_add_watch(parent_pipe.fileno(),

2048

gobject.IO_IN | gobject.IO_HUP,

2049

functools.partial(self.handle_ipc,

2050

parent_pipe =

2051

parent_pipe,

2052

proc = proc))

2255

gobject.io_add_watch(

2256

parent_pipe.fileno(),

2257

gobject.IO_IN | gobject.IO_HUP,

2258

functools.partial(self.handle_ipc,

2259

parent_pipe = parent_pipe,

2260

proc = proc))

2053

2261

2054

def handle_ipc(self, source, condition, parent_pipe=None,

2055

proc = None, client_object=None):

2262

def handle_ipc(self, source, condition,

2263

parent_pipe=None,

2264

proc = None,

2265

client_object=None):

2056

2266

# error, or the other end of multiprocessing.Pipe has closed

2057

2267

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2058

2268

# Wait for other process to exit

2081

2291

parent_pipe.send(False)

2082

2292

return False

2083

2293

2084

gobject.io_add_watch(parent_pipe.fileno(),

2085

gobject.IO_IN | gobject.IO_HUP,

2086

functools.partial(self.handle_ipc,

2087

parent_pipe =

2088

parent_pipe,

2089

proc = proc,

2090

client_object =

2091

client))

2294

gobject.io_add_watch(

2295

parent_pipe.fileno(),

2296

gobject.IO_IN | gobject.IO_HUP,

2297

functools.partial(self.handle_ipc,

2298

parent_pipe = parent_pipe,

2299

proc = proc,

2300

client_object = client))

2092

2301

parent_pipe.send(True)

2093

2302

# remove the old hook in favor of the new above hook on

2094

2303

# same fileno

2100

2309

2101

2310

parent_pipe.send(('data', getattr(client_object,

2102

2311

funcname)(*args,

2103

**kwargs)))

2312

**kwargs)))

2104

2313

2105

2314

if command == 'getattr':

2106

2315

attrname = request[1]

2107

if callable(client_object.__getattribute__(attrname)):

2108

parent_pipe.send(('function',))

2316

if isinstance(client_object.__getattribute__(attrname),

2317

collections.Callable):

2318

parent_pipe.send(('function', ))

2109

2319

else:

2110

parent_pipe.send(('data', client_object

2111

.__getattribute__(attrname)))

2320

parent_pipe.send((

2321

'data', client_object.__getattribute__(attrname)))

2112

2322

2113

2323

if command == 'setattr':

2114

2324

attrname = request[1]

2145

2355

# avoid excessive use of external libraries.

2146

2356

2147

2357

# New type for defining tokens, syntax, and semantics all-in-one

2148

Token = collections.namedtuple("Token",

2149

("regexp", # To match token; if

2150

# "value" is not None,

2151

# must have a "group"

2152

# containing digits

2153

"value", # datetime.timedelta or

2154

# None

2155

"followers")) # Tokens valid after

2156

# this token

2358

Token = collections.namedtuple("Token", (

2359

"regexp", # To match token; if "value" is not None, must have

2360

# a "group" containing digits

2361

"value", # datetime.timedelta or None

2362

"followers")) # Tokens valid after this token

2157

2363

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2158

2364

# the "duration" ABNF definition in RFC 3339, Appendix A.

2159

2365

token_end = Token(re.compile(r"$"), None, frozenset())

2160

2366

token_second = Token(re.compile(r"(\d+)S"),

2161

2367

datetime.timedelta(seconds=1),

2162

frozenset((token_end,)))

2368

frozenset((token_end, )))

2163

2369

token_minute = Token(re.compile(r"(\d+)M"),

2164

2370

datetime.timedelta(minutes=1),

2165

2371

frozenset((token_second, token_end)))

2181

2387

frozenset((token_month, token_end)))

2182

2388

token_week = Token(re.compile(r"(\d+)W"),

2183

2389

datetime.timedelta(weeks=1),

2184

frozenset((token_end,)))

2390

frozenset((token_end, )))

2185

2391

token_duration = Token(re.compile(r"P"), None,

2186

2392

frozenset((token_year, token_month,

2187

2393

token_day, token_time,

2189

2395

# Define starting values

2190

2396

value = datetime.timedelta() # Value so far

2191

2397

found_token = None

2192

followers = frozenset((token_duration,)) # Following valid tokens

2398

followers = frozenset((token_duration, )) # Following valid tokens

2193

2399

s = duration # String left to parse

2194

2400

# Loop until end token is found

2195

2401

while found_token is not token_end:

2212

2418

break

2213

2419

else:

2214

2420

# No currently valid tokens were found

2215

raise ValueError("Invalid RFC 3339 duration")

2421

raise ValueError("Invalid RFC 3339 duration: {!r}"

2422

.format(duration))

2216

2423

# End token found

2217

2424

return value

2218

2425

2255

2462

elif suffix == "w":

2256

2463

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2257

2464

else:

2258

raise ValueError("Unknown suffix {!r}"

2259

.format(suffix))

2465

raise ValueError("Unknown suffix {!r}".format(suffix))

2260

2466

except IndexError as e:

2261

2467

raise ValueError(*(e.args))

2262

2468

timevalue += delta

2278

2484

# Close all standard open file descriptors

2279

2485

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2280

2486

if not stat.S_ISCHR(os.fstat(null).st_mode):

2281

raise OSError(errno.ENODEV, "{} not a character device"

2487

raise OSError(errno.ENODEV,

2488

"{} not a character device"

2282

2489

.format(os.devnull))

2283

2490

os.dup2(null, sys.stdin.fileno())

2284

2491

os.dup2(null, sys.stdout.fileno())

2350

2557

"port": "",

2351

2558

"debug": "False",

2352

2559

"priority":

2353

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2560

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2561

":+SIGN-DSA-SHA256",

2354

2562

"servicename": "Mandos",

2355

2563

"use_dbus": "True",

2356

2564

"use_ipv6": "True",

2360

2568

"statedir": "/var/lib/mandos",

2361

2569

"foreground": "False",

2362

2570

"zeroconf": "True",

2363

}

2571

}

2364

2572

2365

2573

# Parse config file for server-global settings

2366

2574

server_config = configparser.SafeConfigParser(server_defaults)

2367

2575

del server_defaults

2368

server_config.read(os.path.join(options.configdir,

2369

"mandos.conf"))

2576

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2370

2577

# Convert the SafeConfigParser object to a dict

2371

2578

server_settings = server_config.defaults()

2372

2579

# Use the appropriate methods on the non-string config options

2390

2597

# Override the settings from the config file with command line

2391

2598

# options, if set.

2392

2599

for option in ("interface", "address", "port", "debug",

2393

"priority", "servicename", "configdir",

2394

"use_dbus", "use_ipv6", "debuglevel", "restore",

2395

"statedir", "socket", "foreground", "zeroconf"):

2600

"priority", "servicename", "configdir", "use_dbus",

2601

"use_ipv6", "debuglevel", "restore", "statedir",

2602

"socket", "foreground", "zeroconf"):

2396

2603

value = getattr(options, option)

2397

2604

if value is not None:

2398

2605

server_settings[option] = value

2413

2620

2414

2621

##################################################################

2415

2622

2416

if (not server_settings["zeroconf"] and

2417

not (server_settings["port"]

2418

or server_settings["socket"] != "")):

2419

parser.error("Needs port or socket to work without"

2420

" Zeroconf")

2623

if (not server_settings["zeroconf"]

2624

and not (server_settings["port"]

2625

or server_settings["socket"] != "")):

2626

parser.error("Needs port or socket to work without Zeroconf")

2421

2627

2422

2628

# For convenience

2423

2629

debug = server_settings["debug"]

2439

2645

initlogger(debug, level)

2440

2646

2441

2647

if server_settings["servicename"] != "Mandos":

2442

syslogger.setFormatter(logging.Formatter

2443

('Mandos ({}) [%(process)d]:'

2444

' %(levelname)s: %(message)s'

2445

.format(server_settings

2446

["servicename"])))

2648

syslogger.setFormatter(

2649

logging.Formatter('Mandos ({}) [%(process)d]:'

2650

' %(levelname)s: %(message)s'.format(

2651

server_settings["servicename"])))

2447

2652

2448

2653

# Parse config file with clients

2449

2654

client_config = configparser.SafeConfigParser(Client

2457

2662

socketfd = None

2458

2663

if server_settings["socket"] != "":

2459

2664

socketfd = server_settings["socket"]

2460

tcp_server = MandosServer((server_settings["address"],

2461

server_settings["port"]),

2462

ClientHandler,

2463

interface=(server_settings["interface"]

2464

or None),

2465

use_ipv6=use_ipv6,

2466

gnutls_priority=

2467

server_settings["priority"],

2468

use_dbus=use_dbus,

2469

socketfd=socketfd)

2665

tcp_server = MandosServer(

2666

(server_settings["address"], server_settings["port"]),

2667

ClientHandler,

2668

interface=(server_settings["interface"] or None),

2669

use_ipv6=use_ipv6,

2670

gnutls_priority=server_settings["priority"],

2671

use_dbus=use_dbus,

2672

socketfd=socketfd)

2470

2673

if not foreground:

2471

2674

pidfilename = "/run/mandos.pid"

2472

2675

if not os.path.isdir("/run/."):

2473

2676

pidfilename = "/var/run/mandos.pid"

2474

2677

pidfile = None

2475

2678

try:

2476

pidfile = open(pidfilename, "w")

2679

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2477

2680

except IOError as e:

2478

2681

logger.error("Could not open file %r", pidfilename,

2479

2682

exc_info=e)

2506

2709

def debug_gnutls(level, string):

2507

2710

logger.debug("GnuTLS: %s", string[:-1])

2508

2711

2509

(gnutls.library.functions

2510

.gnutls_global_set_log_function(debug_gnutls))

2712

gnutls.library.functions.gnutls_global_set_log_function(

2713

debug_gnutls)

2511

2714

2512

2715

# Redirect stdin so all checkers get /dev/null

2513

2716

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2533

2736

if use_dbus:

2534

2737

try:

2535

2738

bus_name = dbus.service.BusName("se.recompile.Mandos",

2536

bus, do_not_queue=True)

2537

old_bus_name = (dbus.service.BusName

2538

("se.bsnet.fukt.Mandos", bus,

2539

do_not_queue=True))

2540

except dbus.exceptions.NameExistsException as e:

2739

bus,

2740

do_not_queue=True)

2741

old_bus_name = dbus.service.BusName(

2742

"se.bsnet.fukt.Mandos", bus,

2743

do_not_queue=True)

2744

except dbus.exceptions.DBusException as e:

2541

2745

logger.error("Disabling D-Bus:", exc_info=e)

2542

2746

use_dbus = False

2543

2747

server_settings["use_dbus"] = False

2544

2748

tcp_server.use_dbus = False

2545

2749

if zeroconf:

2546

2750

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2547

service = AvahiServiceToSyslog(name =

2548

server_settings["servicename"],

2549

servicetype = "_mandos._tcp",

2550

protocol = protocol, bus = bus)

2751

service = AvahiServiceToSyslog(

2752

name = server_settings["servicename"],

2753

servicetype = "_mandos._tcp",

2754

protocol = protocol,

2755

bus = bus)

2551

2756

if server_settings["interface"]:

2552

service.interface = (if_nametoindex

2553

(server_settings["interface"]

2554

.encode("utf-8")))

2757

service.interface = if_nametoindex(

2758

server_settings["interface"].encode("utf-8"))

2555

2759

2556

2760

global multiprocessing_manager

2557

2761

multiprocessing_manager = multiprocessing.Manager()

2576

2780

if server_settings["restore"]:

2577

2781

try:

2578

2782

with open(stored_state_path, "rb") as stored_state:

2579

clients_data, old_client_settings = (pickle.load

2580

(stored_state))

2783

clients_data, old_client_settings = pickle.load(

2784

stored_state)

2581

2785

os.remove(stored_state_path)

2582

2786

except IOError as e:

2583

2787

if e.errno == errno.ENOENT:

2584

logger.warning("Could not load persistent state: {}"

2585

.format(os.strerror(e.errno)))

2788

logger.warning("Could not load persistent state:"

2789

" {}".format(os.strerror(e.errno)))

2586

2790

else:

2587

2791

logger.critical("Could not load persistent state:",

2588

2792

exc_info=e)

2589

2793

raise

2590

2794

except EOFError as e:

2591

2795

logger.warning("Could not load persistent state: "

2592

"EOFError:", exc_info=e)

2796

"EOFError:",

2797

exc_info=e)

2593

2798

2594

2799

with PGPEngine() as pgp:

2595

2800

for client_name, client in clients_data.items():

2607

2812

# For each value in new config, check if it

2608

2813

# differs from the old config value (Except for

2609

2814

# the "secret" attribute)

2610

if (name != "secret" and

2611

value != old_client_settings[client_name]

2612

[name]):

2815

if (name != "secret"

2816

and (value !=

2817

old_client_settings[client_name][name])):

2613

2818

client[name] = value

2614

2819

except KeyError:

2615

2820

pass

2616

2821

2617

2822

# Clients who has passed its expire date can still be

2618

# enabled if its last checker was successful. Clients

2823

# enabled if its last checker was successful. A Client

2619

2824

# whose checker succeeded before we stored its state is

2620

2825

# assumed to have successfully run all checkers during

2621

2826

# downtime.

2624

2829

if not client["last_checked_ok"]:

2625

2830

logger.warning(

2626

2831

"disabling client {} - Client never "

2627

"performed a successful checker"

2628

.format(client_name))

2832

"performed a successful checker".format(

2833

client_name))

2629

2834

client["enabled"] = False

2630

2835

elif client["last_checker_status"] != 0:

2631

2836

logger.warning(

2632

2837

"disabling client {} - Client last"

2633

" checker failed with error code {}"

2634

.format(client_name,

2635

client["last_checker_status"]))

2838

" checker failed with error code"

2839

" {}".format(

2840

client_name,

2841

client["last_checker_status"]))

2636

2842

client["enabled"] = False

2637

2843

else:

2638

client["expires"] = (datetime.datetime

2639

.utcnow()

2640

+ client["timeout"])

2844

client["expires"] = (

2845

datetime.datetime.utcnow()

2846

+ client["timeout"])

2641

2847

logger.debug("Last checker succeeded,"

2642

" keeping {} enabled"

2643

.format(client_name))

2848

" keeping {} enabled".format(

2849

client_name))

2644

2850

try:

2645

client["secret"] = (

2646

pgp.decrypt(client["encrypted_secret"],

2647

client_settings[client_name]

2648

["secret"]))

2851

client["secret"] = pgp.decrypt(

2852

client["encrypted_secret"],

2853

client_settings[client_name]["secret"])

2649

2854

except PGPError:

2650

2855

# If decryption fails, we use secret from new settings

2651

logger.debug("Failed to decrypt {} old secret"

2652

.format(client_name))

2653

client["secret"] = (

2654

client_settings[client_name]["secret"])

2856

logger.debug("Failed to decrypt {} old secret".format(

2857

client_name))

2858

client["secret"] = (client_settings[client_name]

2859

["secret"])

2655

2860

2656

2861

# Add/remove clients based on new changes made to config

2657

2862

for client_name in (set(old_client_settings)

2664

2869

# Create all client objects

2665

2870

for client_name, client in clients_data.items():

2666

2871

tcp_server.clients[client_name] = client_class(

2667

name = client_name, settings = client,

2872

name = client_name,

2873

settings = client,

2668

2874

server_settings = server_settings)

2669

2875

2670

2876

if not tcp_server.clients:

2672

2878

2673

2879

if not foreground:

2674

2880

if pidfile is not None:

2881

pid = os.getpid()

2675

2882

try:

2676

2883

with pidfile:

2677

pid = os.getpid()

2678

pidfile.write("{}\n".format(pid).encode("utf-8"))

2884

print(pid, file=pidfile)

2679

2885

except IOError:

2680

2886

logger.error("Could not write to file %r with PID %d",

2681

2887

pidfilename, pid)

2686

2892

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2687

2893

2688

2894

if use_dbus:

2689

@alternate_dbus_interfaces({"se.recompile.Mandos":

2690

"se.bsnet.fukt.Mandos"})

2691

class MandosDBusService(DBusObjectWithProperties):

2895

2896

@alternate_dbus_interfaces(

2897

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2898

class MandosDBusService(DBusObjectWithObjectManager):

2692

2899

"""A D-Bus proxy object"""

2900

2693

2901

def __init__(self):

2694

2902

dbus.service.Object.__init__(self, bus, "/")

2903

2695

2904

_interface = "se.recompile.Mandos"

2696

2905

2697

@dbus_interface_annotations(_interface)

2698

def _foo(self):

2699

return { "org.freedesktop.DBus.Property"

2700

".EmitsChangedSignal":

2701

"false"}

2702

2703

2906

@dbus.service.signal(_interface, signature="o")

2704

2907

def ClientAdded(self, objpath):

2705

2908

"D-Bus signal"

2710

2913

"D-Bus signal"

2711

2914

pass

2712

2915

2916

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2917

"true"})

2713

2918

@dbus.service.signal(_interface, signature="os")

2714

2919

def ClientRemoved(self, objpath, name):

2715

2920

"D-Bus signal"

2716

2921

pass

2717

2922

2923

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2924

"true"})

2718

2925

@dbus.service.method(_interface, out_signature="ao")

2719

2926

def GetAllClients(self):

2720

2927

"D-Bus method"

2721

return dbus.Array(c.dbus_object_path

2722

for c in

2928

return dbus.Array(c.dbus_object_path for c in

2723

2929

tcp_server.clients.itervalues())

2724

2930

2931

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2932

"true"})

2725

2933

@dbus.service.method(_interface,

2726

2934

out_signature="a{oa{sv}}")

2727

2935

def GetAllClientsWithProperties(self):

2728

2936

"D-Bus method"

2729

2937

return dbus.Dictionary(

2730

{ c.dbus_object_path: c.GetAll("")

2938

{ c.dbus_object_path: c.GetAll(

2939

"se.recompile.Mandos.Client")

2731

2940

for c in tcp_server.clients.itervalues() },

2732

2941

signature="oa{sv}")

2733

2942

2738

2947

if c.dbus_object_path == object_path:

2739

2948

del tcp_server.clients[c.name]

2740

2949

c.remove_from_connection()

2741

# Don't signal anything except ClientRemoved

2950

# Don't signal the disabling

2742

2951

c.disable(quiet=True)

2743

# Emit D-Bus signal

2744

self.ClientRemoved(object_path, c.name)

2952

# Emit D-Bus signal for removal

2953

self.client_removed_signal(c)

2745

2954

return

2746

2955

raise KeyError(object_path)

2747

2956

2748

2957

del _interface

2958

2959

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

2960

out_signature = "a{oa{sa{sv}}}")

2961

def GetManagedObjects(self):

2962

"""D-Bus method"""

2963

return dbus.Dictionary(

2964

{ client.dbus_object_path:

2965

dbus.Dictionary(

2966

{ interface: client.GetAll(interface)

2967

for interface in

2968

client._get_all_interface_names()})

2969

for client in tcp_server.clients.values()})

2970

2971

def client_added_signal(self, client):

2972

"""Send the new standard signal and the old signal"""

2973

if use_dbus:

2974

# New standard signal

2975

self.InterfacesAdded(

2976

client.dbus_object_path,

2977

dbus.Dictionary(

2978

{ interface: client.GetAll(interface)

2979

for interface in

2980

client._get_all_interface_names()}))

2981

# Old signal

2982

self.ClientAdded(client.dbus_object_path)

2983

2984

def client_removed_signal(self, client):

2985

"""Send the new standard signal and the old signal"""

2986

if use_dbus:

2987

# New standard signal

2988

self.InterfacesRemoved(

2989

client.dbus_object_path,

2990

client._get_all_interface_names())

2991

# Old signal

2992

self.ClientRemoved(client.dbus_object_path,

2993

client.name)

2749

2994

2750

2995

mandos_dbus_service = MandosDBusService()

2751

2996

2774

3019

# + secret.

2775

3020

exclude = { "bus", "changedstate", "secret",

2776

3021

"checker", "server_settings" }

2777

for name, typ in (inspect.getmembers

2778

(dbus.service.Object)):

3022

for name, typ in inspect.getmembers(dbus.service

3023

.Object):

2779

3024

exclude.add(name)

2780

3025

2781

3026

client_dict["encrypted_secret"] = (client

2788

3033

del client_settings[client.name]["secret"]

2789

3034

2790

3035

try:

2791

with (tempfile.NamedTemporaryFile

2792

(mode='wb', suffix=".pickle", prefix='clients-',

2793

dir=os.path.dirname(stored_state_path),

2794

delete=False)) as stored_state:

3036

with tempfile.NamedTemporaryFile(

3037

mode='wb',

3038

suffix=".pickle",

3039

prefix='clients-',

3040

dir=os.path.dirname(stored_state_path),

3041

delete=False) as stored_state:

2795

3042

pickle.dump((clients, client_settings), stored_state)

2796

tempname=stored_state.name

3043

tempname = stored_state.name

2797

3044

os.rename(tempname, stored_state_path)

2798

3045

except (IOError, OSError) as e:

2799

3046

if not debug:

2814

3061

name, client = tcp_server.clients.popitem()

2815

3062

if use_dbus:

2816

3063

client.remove_from_connection()

2817

# Don't signal anything except ClientRemoved

3064

# Don't signal the disabling

2818

3065

client.disable(quiet=True)

2819

if use_dbus:

2820

# Emit D-Bus signal

2821

mandos_dbus_service.ClientRemoved(client

2822

.dbus_object_path,

2823

client.name)

3066

# Emit D-Bus signal for removal

3067

mandos_dbus_service.client_removed_signal(client)

2824

3068

client_settings.clear()

2825

3069

2826

3070

atexit.register(cleanup)

2827

3071

2828

3072

for client in tcp_server.clients.itervalues():

2829

3073

if use_dbus:

2830

# Emit D-Bus signal

2831

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3074

# Emit D-Bus signal for adding

3075

mandos_dbus_service.client_added_signal(client)

2832

3076

# Need to initiate checking of clients

2833

3077

if client.enabled:

2834

3078

client.init_checker()

2879

3123

# Must run before the D-Bus bus name gets deregistered

2880

3124

cleanup()

2881

3125

3126

2882

3127

if __name__ == '__main__':

2883

3128

main()