65
import cPickle as pickle
70
import cPickle as pickle
66
73
import multiprocessing
74
82
import dbus.service
83
from gi.repository import GLib
77
84
from dbus.mainloop.glib import DBusGMainLoop
80
87
import xml.dom.minidom
90
# Try to find the value of SO_BINDTODEVICE:
92
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
93
# newer, and it is also the most natural place for it:
84
94
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
95
except AttributeError:
97
# This is where SO_BINDTODEVICE was up to and including Python
87
99
from IN import SO_BINDTODEVICE
88
100
except ImportError:
89
SO_BINDTODEVICE = None
101
# In Python 2.7 it seems to have been removed entirely.
102
# Try running the C preprocessor:
104
cc = subprocess.Popen(["cc", "--language=c", "-E",
106
stdin=subprocess.PIPE,
107
stdout=subprocess.PIPE)
108
stdout = cc.communicate(
109
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
110
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
111
except (OSError, ValueError, IndexError):
113
SO_BINDTODEVICE = None
115
if sys.version_info.major == 2:
92
119
stored_state_file = "clients.pickle"
94
121
logger = logging.getLogger()
95
syslogger = (logging.handlers.SysLogHandler
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
125
if_nametoindex = ctypes.cdll.LoadLibrary(
126
ctypes.util.find_library("c")).if_nametoindex
103
127
except (OSError, AttributeError):
104
129
def if_nametoindex(interface):
105
130
"Get an interface index the hard way, i.e. using fcntl()"
106
131
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
132
with contextlib.closing(socket.socket()) as s:
108
133
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
111
interface_index = struct.unpack(str("I"),
134
struct.pack(b"16s16x", interface))
135
interface_index = struct.unpack("I", ifreq[16:20])[0]
113
136
return interface_index
139
def copy_function(func):
140
"""Make a copy of a function"""
141
if sys.version_info.major == 2:
142
return types.FunctionType(func.func_code,
148
return types.FunctionType(func.__code__,
116
155
def initlogger(debug, level=logging.WARNING):
117
156
"""init logger and add loglevel"""
159
syslogger = (logging.handlers.SysLogHandler(
160
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
119
162
syslogger.setFormatter(logging.Formatter
120
163
('Mandos [%(process)d]: %(levelname)s:'
122
165
logger.addHandler(syslogger)
125
168
console = logging.StreamHandler()
126
169
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
179
236
.replace(b"\n", b"\\n")
180
237
.replace(b"\0", b"\\x00"))
183
240
def encrypt(self, data, password):
184
241
passphrase = self.password_encode(password)
185
with tempfile.NamedTemporaryFile(dir=self.tempdir
242
with tempfile.NamedTemporaryFile(
243
dir=self.tempdir) as passfile:
187
244
passfile.write(passphrase)
189
proc = subprocess.Popen(['gpg', '--symmetric',
246
proc = subprocess.Popen([self.gpg, '--symmetric',
190
247
'--passphrase-file',
192
249
+ self.gnupgargs,
193
stdin = subprocess.PIPE,
194
stdout = subprocess.PIPE,
195
stderr = subprocess.PIPE)
196
ciphertext, err = proc.communicate(input = data)
250
stdin=subprocess.PIPE,
251
stdout=subprocess.PIPE,
252
stderr=subprocess.PIPE)
253
ciphertext, err = proc.communicate(input=data)
197
254
if proc.returncode != 0:
198
255
raise PGPError(err)
199
256
return ciphertext
201
258
def decrypt(self, data, password):
202
259
passphrase = self.password_encode(password)
203
with tempfile.NamedTemporaryFile(dir = self.tempdir
260
with tempfile.NamedTemporaryFile(
261
dir=self.tempdir) as passfile:
205
262
passfile.write(passphrase)
207
proc = subprocess.Popen(['gpg', '--decrypt',
264
proc = subprocess.Popen([self.gpg, '--decrypt',
208
265
'--passphrase-file',
210
267
+ self.gnupgargs,
211
stdin = subprocess.PIPE,
212
stdout = subprocess.PIPE,
213
stderr = subprocess.PIPE)
214
decrypted_plaintext, err = proc.communicate(input
268
stdin=subprocess.PIPE,
269
stdout=subprocess.PIPE,
270
stderr=subprocess.PIPE)
271
decrypted_plaintext, err = proc.communicate(input=data)
216
272
if proc.returncode != 0:
217
273
raise PGPError(err)
218
274
return decrypted_plaintext
277
# Pretend that we have an Avahi module
279
"""This isn't so much a class as it is a module-like namespace."""
280
IF_UNSPEC = -1 # avahi-common/address.h
281
PROTO_UNSPEC = -1 # avahi-common/address.h
282
PROTO_INET = 0 # avahi-common/address.h
283
PROTO_INET6 = 1 # avahi-common/address.h
284
DBUS_NAME = "org.freedesktop.Avahi"
285
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
286
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
287
DBUS_PATH_SERVER = "/"
290
def string_array_to_txt_array(t):
291
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
292
for s in t), signature="ay")
293
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
294
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
295
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
296
SERVER_INVALID = 0 # avahi-common/defs.h
297
SERVER_REGISTERING = 1 # avahi-common/defs.h
298
SERVER_RUNNING = 2 # avahi-common/defs.h
299
SERVER_COLLISION = 3 # avahi-common/defs.h
300
SERVER_FAILURE = 4 # avahi-common/defs.h
221
303
class AvahiError(Exception):
222
304
def __init__(self, value, *args, **kwargs):
223
305
self.value = value
224
super(AvahiError, self).__init__(value, *args, **kwargs)
225
def __unicode__(self):
226
return unicode(repr(self.value))
306
return super(AvahiError, self).__init__(value, *args,
228
310
class AvahiServiceError(AvahiError):
231
314
class AvahiGroupError(AvahiError):
235
318
class AvahiService(object):
236
319
"""An Avahi (Zeroconf) service.
239
322
interface: integer; avahi.IF_UNSPEC or an interface index.
240
323
Used to optionally bind to the specified interface.
383
488
follow_name_owner_changes=True),
384
489
avahi.DBUS_INTERFACE_SERVER)
385
490
self.server.connect_to_signal("StateChanged",
386
self.server_state_changed)
491
self.server_state_changed)
387
492
self.server_state_changed(self.server.GetState())
390
495
class AvahiServiceToSyslog(AvahiService):
496
def rename(self, *args, **kwargs):
392
497
"""Add the new name to the syslog messages"""
393
ret = AvahiService.rename(self)
394
syslogger.setFormatter(logging.Formatter
395
('Mandos ({0}) [%(process)d]:'
396
' %(levelname)s: %(message)s'
498
ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)
499
syslogger.setFormatter(logging.Formatter(
500
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
401
def timedelta_to_milliseconds(td):
402
"Convert a datetime.timedelta() to milliseconds"
403
return ((td.days * 24 * 60 * 60 * 1000)
404
+ (td.seconds * 1000)
405
+ (td.microseconds // 1000))
505
# Pretend that we have a GnuTLS module
506
class gnutls(object):
507
"""This isn't so much a class as it is a module-like namespace."""
509
library = ctypes.util.find_library("gnutls")
511
library = ctypes.util.find_library("gnutls-deb0")
512
_library = ctypes.cdll.LoadLibrary(library)
515
# Unless otherwise indicated, the constants and types below are
516
# all from the gnutls/gnutls.h C header file.
527
E_NO_CERTIFICATE_FOUND = -49
532
KEYID_USE_SHA256 = 1 # gnutls/x509.h
533
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
536
class session_int(ctypes.Structure):
538
session_t = ctypes.POINTER(session_int)
540
class certificate_credentials_st(ctypes.Structure):
542
certificate_credentials_t = ctypes.POINTER(
543
certificate_credentials_st)
544
certificate_type_t = ctypes.c_int
546
class datum_t(ctypes.Structure):
547
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
548
('size', ctypes.c_uint)]
550
class openpgp_crt_int(ctypes.Structure):
552
openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)
553
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
554
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
555
credentials_type_t = ctypes.c_int
556
transport_ptr_t = ctypes.c_void_p
557
close_request_t = ctypes.c_int
560
class Error(Exception):
561
def __init__(self, message=None, code=None, args=()):
562
# Default usage is by a message string, but if a return
563
# code is passed, convert it to a string with
566
if message is None and code is not None:
567
message = gnutls.strerror(code)
568
return super(gnutls.Error, self).__init__(
571
class CertificateSecurityError(Error):
575
class Credentials(object):
577
self._c_object = gnutls.certificate_credentials_t()
578
gnutls.certificate_allocate_credentials(
579
ctypes.byref(self._c_object))
580
self.type = gnutls.CRD_CERTIFICATE
583
gnutls.certificate_free_credentials(self._c_object)
585
class ClientSession(object):
586
def __init__(self, socket, credentials=None):
587
self._c_object = gnutls.session_t()
588
gnutls_flags = gnutls.CLIENT
589
if gnutls.check_version(b"3.5.6"):
590
gnutls_flags |= gnutls.NO_TICKETS
592
gnutls_flags |= gnutls.ENABLE_RAWPK
593
gnutls.init(ctypes.byref(self._c_object), gnutls_flags)
595
gnutls.set_default_priority(self._c_object)
596
gnutls.transport_set_ptr(self._c_object, socket.fileno())
597
gnutls.handshake_set_private_extensions(self._c_object,
600
if credentials is None:
601
credentials = gnutls.Credentials()
602
gnutls.credentials_set(self._c_object, credentials.type,
603
ctypes.cast(credentials._c_object,
605
self.credentials = credentials
608
gnutls.deinit(self._c_object)
611
return gnutls.handshake(self._c_object)
613
def send(self, data):
617
data_len -= gnutls.record_send(self._c_object,
622
return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)
624
# Error handling functions
625
def _error_code(result):
626
"""A function to raise exceptions on errors, suitable
627
for the 'restype' attribute on ctypes functions"""
630
if result == gnutls.E_NO_CERTIFICATE_FOUND:
631
raise gnutls.CertificateSecurityError(code=result)
632
raise gnutls.Error(code=result)
634
def _retry_on_error(result, func, arguments):
635
"""A function to retry on some errors, suitable
636
for the 'errcheck' attribute on ctypes functions"""
638
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
639
return _error_code(result)
640
result = func(*arguments)
643
# Unless otherwise indicated, the function declarations below are
644
# all from the gnutls/gnutls.h C header file.
647
priority_set_direct = _library.gnutls_priority_set_direct
648
priority_set_direct.argtypes = [session_t, ctypes.c_char_p,
649
ctypes.POINTER(ctypes.c_char_p)]
650
priority_set_direct.restype = _error_code
652
init = _library.gnutls_init
653
init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]
654
init.restype = _error_code
656
set_default_priority = _library.gnutls_set_default_priority
657
set_default_priority.argtypes = [session_t]
658
set_default_priority.restype = _error_code
660
record_send = _library.gnutls_record_send
661
record_send.argtypes = [session_t, ctypes.c_void_p,
663
record_send.restype = ctypes.c_ssize_t
664
record_send.errcheck = _retry_on_error
666
certificate_allocate_credentials = (
667
_library.gnutls_certificate_allocate_credentials)
668
certificate_allocate_credentials.argtypes = [
669
ctypes.POINTER(certificate_credentials_t)]
670
certificate_allocate_credentials.restype = _error_code
672
certificate_free_credentials = (
673
_library.gnutls_certificate_free_credentials)
674
certificate_free_credentials.argtypes = [
675
certificate_credentials_t]
676
certificate_free_credentials.restype = None
678
handshake_set_private_extensions = (
679
_library.gnutls_handshake_set_private_extensions)
680
handshake_set_private_extensions.argtypes = [session_t,
682
handshake_set_private_extensions.restype = None
684
credentials_set = _library.gnutls_credentials_set
685
credentials_set.argtypes = [session_t, credentials_type_t,
687
credentials_set.restype = _error_code
689
strerror = _library.gnutls_strerror
690
strerror.argtypes = [ctypes.c_int]
691
strerror.restype = ctypes.c_char_p
693
certificate_type_get = _library.gnutls_certificate_type_get
694
certificate_type_get.argtypes = [session_t]
695
certificate_type_get.restype = _error_code
697
certificate_get_peers = _library.gnutls_certificate_get_peers
698
certificate_get_peers.argtypes = [session_t,
699
ctypes.POINTER(ctypes.c_uint)]
700
certificate_get_peers.restype = ctypes.POINTER(datum_t)
702
global_set_log_level = _library.gnutls_global_set_log_level
703
global_set_log_level.argtypes = [ctypes.c_int]
704
global_set_log_level.restype = None
706
global_set_log_function = _library.gnutls_global_set_log_function
707
global_set_log_function.argtypes = [log_func]
708
global_set_log_function.restype = None
710
deinit = _library.gnutls_deinit
711
deinit.argtypes = [session_t]
712
deinit.restype = None
714
handshake = _library.gnutls_handshake
715
handshake.argtypes = [session_t]
716
handshake.restype = _error_code
717
handshake.errcheck = _retry_on_error
719
transport_set_ptr = _library.gnutls_transport_set_ptr
720
transport_set_ptr.argtypes = [session_t, transport_ptr_t]
721
transport_set_ptr.restype = None
723
bye = _library.gnutls_bye
724
bye.argtypes = [session_t, close_request_t]
725
bye.restype = _error_code
726
bye.errcheck = _retry_on_error
728
check_version = _library.gnutls_check_version
729
check_version.argtypes = [ctypes.c_char_p]
730
check_version.restype = ctypes.c_char_p
732
_need_version = b"3.3.0"
733
if check_version(_need_version) is None:
734
raise self.Error("Needs GnuTLS {} or later"
735
.format(_need_version))
737
_tls_rawpk_version = b"3.6.6"
738
has_rawpk = bool(check_version(_tls_rawpk_version))
742
class pubkey_st(ctypes.Structure):
744
pubkey_t = ctypes.POINTER(pubkey_st)
746
x509_crt_fmt_t = ctypes.c_int
748
# All the function declarations below are from gnutls/abstract.h
749
pubkey_init = _library.gnutls_pubkey_init
750
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
751
pubkey_init.restype = _error_code
753
pubkey_import = _library.gnutls_pubkey_import
754
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
756
pubkey_import.restype = _error_code
758
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
759
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
760
ctypes.POINTER(ctypes.c_ubyte),
761
ctypes.POINTER(ctypes.c_size_t)]
762
pubkey_get_key_id.restype = _error_code
764
pubkey_deinit = _library.gnutls_pubkey_deinit
765
pubkey_deinit.argtypes = [pubkey_t]
766
pubkey_deinit.restype = None
768
# All the function declarations below are from gnutls/openpgp.h
770
openpgp_crt_init = _library.gnutls_openpgp_crt_init
771
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
772
openpgp_crt_init.restype = _error_code
774
openpgp_crt_import = _library.gnutls_openpgp_crt_import
775
openpgp_crt_import.argtypes = [openpgp_crt_t,
776
ctypes.POINTER(datum_t),
778
openpgp_crt_import.restype = _error_code
780
openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self
781
openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,
782
ctypes.POINTER(ctypes.c_uint)]
783
openpgp_crt_verify_self.restype = _error_code
785
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
786
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
787
openpgp_crt_deinit.restype = None
789
openpgp_crt_get_fingerprint = (
790
_library.gnutls_openpgp_crt_get_fingerprint)
791
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
795
openpgp_crt_get_fingerprint.restype = _error_code
797
if check_version(b"3.6.4"):
798
certificate_type_get2 = _library.gnutls_certificate_type_get2
799
certificate_type_get2.argtypes = [session_t, ctypes.c_int]
800
certificate_type_get2.restype = _error_code
802
# Remove non-public functions
803
del _error_code, _retry_on_error
806
def call_pipe(connection, # : multiprocessing.Connection
807
func, *args, **kwargs):
808
"""This function is meant to be called by multiprocessing.Process
810
This function runs func(*args, **kwargs), and writes the resulting
811
return value on the provided multiprocessing.Connection.
813
connection.send(func(*args, **kwargs))
408
817
class Client(object):
409
818
"""A representation of a client host served by this server.
412
821
approved: bool(); 'None' if not yet approved/disapproved
413
822
approval_delay: datetime.timedelta(); Time to wait for approval
414
823
approval_duration: datetime.timedelta(); Duration of one approval
415
checker: subprocess.Popen(); a running checker process used
416
to see if the client lives.
417
'None' if no process is running.
418
checker_callback_tag: a gobject event source tag, or None
824
checker: multiprocessing.Process(); a running checker process used
825
to see if the client lives. 'None' if no process is
827
checker_callback_tag: a GLib event source tag, or None
419
828
checker_command: string; External command which is run to check
420
829
if client lives. %() expansions are done at
421
830
runtime with vars(self) as dict, so that for
422
831
instance %(name)s can be used in the command.
423
checker_initiator_tag: a gobject event source tag, or None
832
checker_initiator_tag: a GLib event source tag, or None
424
833
created: datetime.datetime(); (UTC) object creation
425
834
client_structure: Object describing what attributes a client has
426
835
and is used for storing the client at exit
427
836
current_checker_command: string; current running checker_command
428
disable_initiator_tag: a gobject event source tag, or None
837
disable_initiator_tag: a GLib event source tag, or None
430
839
fingerprint: string (40 or 32 hexadecimal digits); used to
431
uniquely identify the client
840
uniquely identify an OpenPGP client
841
key_id: string (64 hexadecimal digits); used to uniquely identify
842
a client using raw public keys
432
843
host: string; available for use by the checker command
433
844
interval: datetime.timedelta(); How often to start a new checker
434
845
last_approval_request: datetime.datetime(); (UTC) or None
601
1002
logger.info("Disabling client %s", self.name)
602
1003
if getattr(self, "disable_initiator_tag", None) is not None:
603
gobject.source_remove(self.disable_initiator_tag)
1004
GLib.source_remove(self.disable_initiator_tag)
604
1005
self.disable_initiator_tag = None
605
1006
self.expires = None
606
1007
if getattr(self, "checker_initiator_tag", None) is not None:
607
gobject.source_remove(self.checker_initiator_tag)
1008
GLib.source_remove(self.checker_initiator_tag)
608
1009
self.checker_initiator_tag = None
609
1010
self.stop_checker()
610
1011
self.enabled = False
612
1013
self.send_changedstate()
613
# Do not run this again if called by a gobject.timeout_add
1014
# Do not run this again if called by a GLib.timeout_add
616
1017
def __del__(self):
619
1020
def init_checker(self):
620
1021
# Schedule a new checker to be started an 'interval' from now,
621
1022
# and every interval from then on.
622
1023
if self.checker_initiator_tag is not None:
623
gobject.source_remove(self.checker_initiator_tag)
624
self.checker_initiator_tag = (gobject.timeout_add
625
(self.interval_milliseconds(),
1024
GLib.source_remove(self.checker_initiator_tag)
1025
self.checker_initiator_tag = GLib.timeout_add(
1026
int(self.interval.total_seconds() * 1000),
627
1028
# Schedule a disable() when 'timeout' has passed
628
1029
if self.disable_initiator_tag is not None:
629
gobject.source_remove(self.disable_initiator_tag)
630
self.disable_initiator_tag = (gobject.timeout_add
631
(self.timeout_milliseconds(),
1030
GLib.source_remove(self.disable_initiator_tag)
1031
self.disable_initiator_tag = GLib.timeout_add(
1032
int(self.timeout.total_seconds() * 1000), self.disable)
633
1033
# Also start a new checker *right now*.
634
1034
self.start_checker()
636
def checker_callback(self, pid, condition, command):
1036
def checker_callback(self, source, condition, connection,
637
1038
"""The checker has completed, so take appropriate actions."""
1039
# Read return code from connection (see call_pipe)
1040
returncode = connection.recv()
638
1043
self.checker_callback_tag = None
639
1044
self.checker = None
640
if os.WIFEXITED(condition):
641
self.last_checker_status = os.WEXITSTATUS(condition)
1047
self.last_checker_status = returncode
1048
self.last_checker_signal = None
642
1049
if self.last_checker_status == 0:
643
1050
logger.info("Checker for %(name)s succeeded",
645
1052
self.checked_ok()
647
logger.info("Checker for %(name)s failed",
1054
logger.info("Checker for %(name)s failed", vars(self))
650
1056
self.last_checker_status = -1
1057
self.last_checker_signal = -returncode
651
1058
logger.warning("Checker for %(name)s crashed?",
654
1062
def checked_ok(self):
655
1063
"""Assert that the client has been seen, alive and well."""
656
1064
self.last_checked_ok = datetime.datetime.utcnow()
657
1065
self.last_checker_status = 0
1066
self.last_checker_signal = None
658
1067
self.bump_timeout()
660
1069
def bump_timeout(self, timeout=None):
661
1070
"""Bump up the timeout for this client."""
662
1071
if timeout is None:
663
1072
timeout = self.timeout
664
1073
if self.disable_initiator_tag is not None:
665
gobject.source_remove(self.disable_initiator_tag)
1074
GLib.source_remove(self.disable_initiator_tag)
666
1075
self.disable_initiator_tag = None
667
1076
if getattr(self, "enabled", False):
668
self.disable_initiator_tag = (gobject.timeout_add
669
(timedelta_to_milliseconds
670
(timeout), self.disable))
1077
self.disable_initiator_tag = GLib.timeout_add(
1078
int(timeout.total_seconds() * 1000), self.disable)
671
1079
self.expires = datetime.datetime.utcnow() + timeout
673
1081
def need_approval(self):
674
1082
self.last_approval_request = datetime.datetime.utcnow()
676
1084
def start_checker(self):
677
1085
"""Start a new checker subprocess if one is not running.
679
1087
If a checker already exists, leave it running and do
681
1089
# The reason for not killing a running checker is that if we
686
1094
# checkers alone, the checker would have to take more time
687
1095
# than 'timeout' for the client to be disabled, which is as it
690
# If a checker exists, make sure it is not a zombie
692
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
693
except (AttributeError, OSError) as error:
694
if (isinstance(error, OSError)
695
and error.errno != errno.ECHILD):
699
logger.warning("Checker was a zombie")
700
gobject.source_remove(self.checker_callback_tag)
701
self.checker_callback(pid, status,
702
self.current_checker_command)
1098
if self.checker is not None and not self.checker.is_alive():
1099
logger.warning("Checker was not alive; joining")
703
1102
# Start a new checker if needed
704
1103
if self.checker is None:
705
1104
# Escape attributes for the shell
706
escaped_attrs = dict(
707
(attr, re.escape(unicode(getattr(self, attr))))
709
self.runtime_expansions)
1106
attr: re.escape(str(getattr(self, attr)))
1107
for attr in self.runtime_expansions}
711
1109
command = self.checker_command % escaped_attrs
712
1110
except TypeError as error:
713
1111
logger.error('Could not format string "%s"',
714
self.checker_command, exc_info=error)
715
return True # Try again later
1112
self.checker_command,
1114
return True # Try again later
716
1115
self.current_checker_command = command
718
logger.info("Starting checker %r for %s",
720
# We don't need to redirect stdout and stderr, since
721
# in normal mode, that is already done by daemon(),
722
# and in debug mode we don't want to. (Stdin is
723
# always replaced by /dev/null.)
724
# The exception is when not debugging but nevertheless
725
# running in the foreground; use the previously
728
if (not self.server_settings["debug"]
729
and self.server_settings["foreground"]):
730
popen_args.update({"stdout": wnull,
732
self.checker = subprocess.Popen(command,
736
except OSError as error:
737
logger.error("Failed to start subprocess",
740
self.checker_callback_tag = (gobject.child_watch_add
742
self.checker_callback,
744
# The checker may have completed before the gobject
745
# watch was added. Check for this.
747
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
748
except OSError as error:
749
if error.errno == errno.ECHILD:
750
# This should never happen
751
logger.error("Child process vanished",
756
gobject.source_remove(self.checker_callback_tag)
757
self.checker_callback(pid, status, command)
758
# Re-run this periodically if run by gobject.timeout_add
1116
logger.info("Starting checker %r for %s", command,
1118
# We don't need to redirect stdout and stderr, since
1119
# in normal mode, that is already done by daemon(),
1120
# and in debug mode we don't want to. (Stdin is
1121
# always replaced by /dev/null.)
1122
# The exception is when not debugging but nevertheless
1123
# running in the foreground; use the previously
1125
popen_args = {"close_fds": True,
1128
if (not self.server_settings["debug"]
1129
and self.server_settings["foreground"]):
1130
popen_args.update({"stdout": wnull,
1132
pipe = multiprocessing.Pipe(duplex=False)
1133
self.checker = multiprocessing.Process(
1135
args=(pipe[1], subprocess.call, command),
1137
self.checker.start()
1138
self.checker_callback_tag = GLib.io_add_watch(
1139
pipe[0].fileno(), GLib.IO_IN,
1140
self.checker_callback, pipe[0], command)
1141
# Re-run this periodically if run by GLib.timeout_add
761
1144
def stop_checker(self):
762
1145
"""Force the checker process, if any, to stop."""
763
1146
if self.checker_callback_tag:
764
gobject.source_remove(self.checker_callback_tag)
1147
GLib.source_remove(self.checker_callback_tag)
765
1148
self.checker_callback_tag = None
766
1149
if getattr(self, "checker", None) is None:
768
1151
logger.debug("Stopping checker for %(name)s", vars(self))
770
self.checker.terminate()
772
#if self.checker.poll() is None:
773
# self.checker.kill()
774
except OSError as error:
775
if error.errno != errno.ESRCH: # No such process
1152
self.checker.terminate()
777
1153
self.checker = None
780
def dbus_service_property(dbus_interface, signature="v",
781
access="readwrite", byte_arrays=False):
1156
def dbus_service_property(dbus_interface,
782
1160
"""Decorators for marking methods of a DBusObjectWithProperties to
783
1161
become properties on the D-Bus.
785
1163
The decorated method will be called with no arguments by "Get"
786
1164
and with one argument by "Set".
788
1166
The parameters, where they are supported, are the same as
789
1167
dbus.service.method, except there is only "signature", since the
790
1168
type from Get() and the type sent to Set() is the same.
866
class DBusObjectWithProperties(dbus.service.Object):
867
"""A D-Bus object with properties.
869
Classes inheriting from this can use the dbus_service_property
870
decorator to expose methods as D-Bus properties. It exposes the
871
standard Get(), Set(), and GetAll() methods on the D-Bus.
1251
class DBusObjectWithAnnotations(dbus.service.Object):
1252
"""A D-Bus object with annotations.
1254
Classes inheriting from this can use the dbus_annotations
1255
decorator to add annotations to methods or signals.
875
1259
def _is_dbus_thing(thing):
876
1260
"""Returns a function testing if an attribute is a D-Bus thing
878
1262
If called like _is_dbus_thing("method") it returns a function
879
1263
suitable for use as predicate to inspect.getmembers().
881
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1265
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
884
1268
def _get_all_dbus_things(self, thing):
885
1269
"""Returns a generator of (name, attribute) pairs
887
return ((getattr(athing.__get__(self), "_dbus_name",
1271
return ((getattr(athing.__get__(self), "_dbus_name", name),
889
1272
athing.__get__(self))
890
1273
for cls in self.__class__.__mro__
891
1274
for name, athing in
892
inspect.getmembers(cls,
893
self._is_dbus_thing(thing)))
1275
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1277
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1279
path_keyword='object_path',
1280
connection_keyword='connection')
1281
def Introspect(self, object_path, connection):
1282
"""Overloading of standard D-Bus method.
1284
Inserts annotation tags on methods and signals.
1286
xmlstring = dbus.service.Object.Introspect(self, object_path,
1289
document = xml.dom.minidom.parseString(xmlstring)
1291
for if_tag in document.getElementsByTagName("interface"):
1292
# Add annotation tags
1293
for typ in ("method", "signal"):
1294
for tag in if_tag.getElementsByTagName(typ):
1296
for name, prop in (self.
1297
_get_all_dbus_things(typ)):
1298
if (name == tag.getAttribute("name")
1299
and prop._dbus_interface
1300
== if_tag.getAttribute("name")):
1301
annots.update(getattr(
1302
prop, "_dbus_annotations", {}))
1303
for name, value in annots.items():
1304
ann_tag = document.createElement(
1306
ann_tag.setAttribute("name", name)
1307
ann_tag.setAttribute("value", value)
1308
tag.appendChild(ann_tag)
1309
# Add interface annotation tags
1310
for annotation, value in dict(
1311
itertools.chain.from_iterable(
1312
annotations().items()
1313
for name, annotations
1314
in self._get_all_dbus_things("interface")
1315
if name == if_tag.getAttribute("name")
1317
ann_tag = document.createElement("annotation")
1318
ann_tag.setAttribute("name", annotation)
1319
ann_tag.setAttribute("value", value)
1320
if_tag.appendChild(ann_tag)
1321
# Fix argument name for the Introspect method itself
1322
if (if_tag.getAttribute("name")
1323
== dbus.INTROSPECTABLE_IFACE):
1324
for cn in if_tag.getElementsByTagName("method"):
1325
if cn.getAttribute("name") == "Introspect":
1326
for arg in cn.getElementsByTagName("arg"):
1327
if (arg.getAttribute("direction")
1329
arg.setAttribute("name",
1331
xmlstring = document.toxml("utf-8")
1333
except (AttributeError, xml.dom.DOMException,
1334
xml.parsers.expat.ExpatError) as error:
1335
logger.error("Failed to override Introspection method",
1340
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1341
"""A D-Bus object with properties.
1343
Classes inheriting from this can use the dbus_service_property
1344
decorator to expose methods as D-Bus properties. It exposes the
1345
standard Get(), Set(), and GetAll() methods on the D-Bus.
895
1348
def _get_dbus_property(self, interface_name, property_name):
896
1349
"""Returns a bound method if one exists which is a D-Bus
897
1350
property with the specified name and interface.
899
for cls in self.__class__.__mro__:
900
for name, value in (inspect.getmembers
902
self._is_dbus_thing("property"))):
1352
for cls in self.__class__.__mro__:
1353
for name, value in inspect.getmembers(
1354
cls, self._is_dbus_thing("property")):
903
1355
if (value._dbus_name == property_name
904
1356
and value._dbus_interface == interface_name):
905
1357
return value.__get__(self)
907
1359
# No such property
908
raise DBusPropertyNotFound(self.dbus_object_path + ":"
909
+ interface_name + "."
912
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1360
raise DBusPropertyNotFound("{}:{}.{}".format(
1361
self.dbus_object_path, interface_name, property_name))
1364
def _get_all_interface_names(cls):
1365
"""Get a sequence of all interfaces supported by an object"""
1366
return (name for name in set(getattr(getattr(x, attr),
1367
"_dbus_interface", None)
1368
for x in (inspect.getmro(cls))
1370
if name is not None)
1372
@dbus.service.method(dbus.PROPERTIES_IFACE,
913
1374
out_signature="v")
914
1375
def Get(self, interface_name, property_name):
915
1376
"""Standard D-Bus property Get() method, see D-Bus standard.
1045
1505
return xmlstring
1509
dbus.OBJECT_MANAGER_IFACE
1510
except AttributeError:
1511
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1514
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1515
"""A D-Bus object with an ObjectManager.
1517
Classes inheriting from this exposes the standard
1518
GetManagedObjects call and the InterfacesAdded and
1519
InterfacesRemoved signals on the standard
1520
"org.freedesktop.DBus.ObjectManager" interface.
1522
Note: No signals are sent automatically; they must be sent
1525
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1526
out_signature="a{oa{sa{sv}}}")
1527
def GetManagedObjects(self):
1528
"""This function must be overridden"""
1529
raise NotImplementedError()
1531
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1532
signature="oa{sa{sv}}")
1533
def InterfacesAdded(self, object_path, interfaces_and_properties):
1536
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1537
def InterfacesRemoved(self, object_path, interfaces):
1540
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1542
path_keyword='object_path',
1543
connection_keyword='connection')
1544
def Introspect(self, object_path, connection):
1545
"""Overloading of standard D-Bus method.
1547
Override return argument name of GetManagedObjects to be
1548
"objpath_interfaces_and_properties"
1550
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1554
document = xml.dom.minidom.parseString(xmlstring)
1556
for if_tag in document.getElementsByTagName("interface"):
1557
# Fix argument name for the GetManagedObjects method
1558
if (if_tag.getAttribute("name")
1559
== dbus.OBJECT_MANAGER_IFACE):
1560
for cn in if_tag.getElementsByTagName("method"):
1561
if (cn.getAttribute("name")
1562
== "GetManagedObjects"):
1563
for arg in cn.getElementsByTagName("arg"):
1564
if (arg.getAttribute("direction")
1568
"objpath_interfaces"
1570
xmlstring = document.toxml("utf-8")
1572
except (AttributeError, xml.dom.DOMException,
1573
xml.parsers.expat.ExpatError) as error:
1574
logger.error("Failed to override Introspection method",
1048
1579
def datetime_to_dbus(dt, variant_level=0):
1049
1580
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1051
return dbus.String("", variant_level = variant_level)
1052
return dbus.String(dt.isoformat(),
1053
variant_level=variant_level)
1582
return dbus.String("", variant_level=variant_level)
1583
return dbus.String(dt.isoformat(), variant_level=variant_level)
1056
1586
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1409
1947
server to mandos-client
1413
1951
# Rejected - signal
1414
1952
@dbus.service.signal(_interface, signature="s")
1415
1953
def Rejected(self, reason):
1419
1957
# NeedApproval - signal
1420
1958
@dbus.service.signal(_interface, signature="tb")
1421
1959
def NeedApproval(self, timeout, default):
1423
1961
return self.need_approval()
1427
1965
# Approve - method
1428
1966
@dbus.service.method(_interface, in_signature="b")
1429
1967
def Approve(self, value):
1430
1968
self.approve(value)
1432
1970
# CheckedOK - method
1433
1971
@dbus.service.method(_interface)
1434
1972
def CheckedOK(self):
1435
1973
self.checked_ok()
1437
1975
# Enable - method
1976
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1438
1977
@dbus.service.method(_interface)
1439
1978
def Enable(self):
1443
1982
# StartChecker - method
1983
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1444
1984
@dbus.service.method(_interface)
1445
1985
def StartChecker(self):
1447
1987
self.start_checker()
1449
1989
# Disable - method
1990
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1450
1991
@dbus.service.method(_interface)
1451
1992
def Disable(self):
1455
1996
# StopChecker - method
1997
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
1456
1998
@dbus.service.method(_interface)
1457
1999
def StopChecker(self):
1458
2000
self.stop_checker()
1462
2004
# ApprovalPending - property
1463
2005
@dbus_service_property(_interface, signature="b", access="read")
1464
2006
def ApprovalPending_dbus_property(self):
1465
2007
return dbus.Boolean(bool(self.approvals_pending))
1467
2009
# ApprovedByDefault - property
1468
@dbus_service_property(_interface, signature="b",
2010
@dbus_service_property(_interface,
1469
2012
access="readwrite")
1470
2013
def ApprovedByDefault_dbus_property(self, value=None):
1471
2014
if value is None: # get
1472
2015
return dbus.Boolean(self.approved_by_default)
1473
2016
self.approved_by_default = bool(value)
1475
2018
# ApprovalDelay - property
1476
@dbus_service_property(_interface, signature="t",
2019
@dbus_service_property(_interface,
1477
2021
access="readwrite")
1478
2022
def ApprovalDelay_dbus_property(self, value=None):
1479
2023
if value is None: # get
1480
return dbus.UInt64(self.approval_delay_milliseconds())
2024
return dbus.UInt64(self.approval_delay.total_seconds()
1481
2026
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1483
2028
# ApprovalDuration - property
1484
@dbus_service_property(_interface, signature="t",
2029
@dbus_service_property(_interface,
1485
2031
access="readwrite")
1486
2032
def ApprovalDuration_dbus_property(self, value=None):
1487
2033
if value is None: # get
1488
return dbus.UInt64(timedelta_to_milliseconds(
1489
self.approval_duration))
2034
return dbus.UInt64(self.approval_duration.total_seconds()
1490
2036
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1492
2038
# Name - property
2040
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1493
2041
@dbus_service_property(_interface, signature="s", access="read")
1494
2042
def Name_dbus_property(self):
1495
2043
return dbus.String(self.name)
2047
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2048
@dbus_service_property(_interface, signature="s", access="read")
2049
def KeyID_dbus_property(self):
2050
return dbus.String(self.key_id)
1497
2052
# Fingerprint - property
2054
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1498
2055
@dbus_service_property(_interface, signature="s", access="read")
1499
2056
def Fingerprint_dbus_property(self):
1500
2057
return dbus.String(self.fingerprint)
1502
2059
# Host - property
1503
@dbus_service_property(_interface, signature="s",
2060
@dbus_service_property(_interface,
1504
2062
access="readwrite")
1505
2063
def Host_dbus_property(self, value=None):
1506
2064
if value is None: # get
1507
2065
return dbus.String(self.host)
1508
self.host = unicode(value)
2066
self.host = str(value)
1510
2068
# Created - property
2070
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
1511
2071
@dbus_service_property(_interface, signature="s", access="read")
1512
2072
def Created_dbus_property(self):
1513
2073
return datetime_to_dbus(self.created)
1515
2075
# LastEnabled - property
1516
2076
@dbus_service_property(_interface, signature="s", access="read")
1517
2077
def LastEnabled_dbus_property(self):
1518
2078
return datetime_to_dbus(self.last_enabled)
1520
2080
# Enabled - property
1521
@dbus_service_property(_interface, signature="b",
2081
@dbus_service_property(_interface,
1522
2083
access="readwrite")
1523
2084
def Enabled_dbus_property(self, value=None):
1524
2085
if value is None: # get
1572
2134
if (getattr(self, "disable_initiator_tag", None)
1575
gobject.source_remove(self.disable_initiator_tag)
1576
self.disable_initiator_tag = (
1577
gobject.timeout_add(
1578
timedelta_to_milliseconds(self.expires - now),
2137
GLib.source_remove(self.disable_initiator_tag)
2138
self.disable_initiator_tag = GLib.timeout_add(
2139
int((self.expires - now).total_seconds() * 1000),
1581
2142
# ExtendedTimeout - property
1582
@dbus_service_property(_interface, signature="t",
2143
@dbus_service_property(_interface,
1583
2145
access="readwrite")
1584
2146
def ExtendedTimeout_dbus_property(self, value=None):
1585
2147
if value is None: # get
1586
return dbus.UInt64(self.extended_timeout_milliseconds())
2148
return dbus.UInt64(self.extended_timeout.total_seconds()
1587
2150
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1589
2152
# Interval - property
1590
@dbus_service_property(_interface, signature="t",
2153
@dbus_service_property(_interface,
1591
2155
access="readwrite")
1592
2156
def Interval_dbus_property(self, value=None):
1593
2157
if value is None: # get
1594
return dbus.UInt64(self.interval_milliseconds())
2158
return dbus.UInt64(self.interval.total_seconds() * 1000)
1595
2159
self.interval = datetime.timedelta(0, 0, 0, value)
1596
2160
if getattr(self, "checker_initiator_tag", None) is None:
1598
2162
if self.enabled:
1599
2163
# Reschedule checker run
1600
gobject.source_remove(self.checker_initiator_tag)
1601
self.checker_initiator_tag = (gobject.timeout_add
1602
(value, self.start_checker))
1603
self.start_checker() # Start one now, too
2164
GLib.source_remove(self.checker_initiator_tag)
2165
self.checker_initiator_tag = GLib.timeout_add(
2166
value, self.start_checker)
2167
self.start_checker() # Start one now, too
1605
2169
# Checker - property
1606
@dbus_service_property(_interface, signature="s",
2170
@dbus_service_property(_interface,
1607
2172
access="readwrite")
1608
2173
def Checker_dbus_property(self, value=None):
1609
2174
if value is None: # get
1610
2175
return dbus.String(self.checker_command)
1611
self.checker_command = unicode(value)
2176
self.checker_command = str(value)
1613
2178
# CheckerRunning - property
1614
@dbus_service_property(_interface, signature="b",
2179
@dbus_service_property(_interface,
1615
2181
access="readwrite")
1616
2182
def CheckerRunning_dbus_property(self, value=None):
1617
2183
if value is None: # get
1664
2240
class ClientHandler(socketserver.BaseRequestHandler, object):
1665
2241
"""A class to handle client connections.
1667
2243
Instantiated once for each connection to handle it.
1668
2244
Note: This will run in its own forked process."""
1670
2246
def handle(self):
1671
2247
with contextlib.closing(self.server.child_pipe) as child_pipe:
1672
2248
logger.info("TCP connection from: %s",
1673
unicode(self.client_address))
2249
str(self.client_address))
1674
2250
logger.debug("Pipe FD: %d",
1675
2251
self.server.child_pipe.fileno())
1677
session = (gnutls.connection
1678
.ClientSession(self.request,
1680
.X509Credentials()))
1682
# Note: gnutls.connection.X509Credentials is really a
1683
# generic GnuTLS certificate credentials object so long as
1684
# no X.509 keys are added to it. Therefore, we can use it
1685
# here despite using OpenPGP certificates.
1687
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1688
# "+AES-256-CBC", "+SHA1",
1689
# "+COMP-NULL", "+CTYPE-OPENPGP",
2253
session = gnutls.ClientSession(self.request)
2255
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2256
# "+AES-256-CBC", "+SHA1",
2257
# "+COMP-NULL", "+CTYPE-OPENPGP",
1691
2259
# Use a fallback default, since this MUST be set.
1692
2260
priority = self.server.gnutls_priority
1693
2261
if priority is None:
1694
2262
priority = "NORMAL"
1695
(gnutls.library.functions
1696
.gnutls_priority_set_direct(session._c_object,
2263
gnutls.priority_set_direct(session._c_object,
2264
priority.encode("utf-8"),
1699
2267
# Start communication using the Mandos protocol
1700
2268
# Get protocol number
1701
2269
line = self.request.makefile().readline()
1702
2270
logger.debug("Protocol version: %r", line)
1704
2272
if int(line.strip().split()[0]) > 1:
2273
raise RuntimeError(line)
1706
2274
except (ValueError, IndexError, RuntimeError) as error:
1707
2275
logger.error("Unknown protocol version: %s", error)
1710
2278
# Start GnuTLS connection
1712
2280
session.handshake()
1713
except gnutls.errors.GNUTLSError as error:
2281
except gnutls.Error as error:
1714
2282
logger.warning("Handshake failed: %s", error)
1715
2283
# Do not run session.bye() here: the session is not
1716
2284
# established. Just abandon the request.
1718
2286
logger.debug("Handshake succeeded")
1720
2288
approval_required = False
1723
fpr = self.fingerprint(self.peer_certificate
1726
gnutls.errors.GNUTLSError) as error:
1727
logger.warning("Bad certificate: %s", error)
1729
logger.debug("Fingerprint: %s", fpr)
1732
client = ProxyClient(child_pipe, fpr,
2290
if gnutls.has_rawpk:
2293
key_id = self.key_id(
2294
self.peer_certificate(session))
2295
except (TypeError, gnutls.Error) as error:
2296
logger.warning("Bad certificate: %s", error)
2298
logger.debug("Key ID: %s", key_id)
2303
fpr = self.fingerprint(
2304
self.peer_certificate(session))
2305
except (TypeError, gnutls.Error) as error:
2306
logger.warning("Bad certificate: %s", error)
2308
logger.debug("Fingerprint: %s", fpr)
2311
client = ProxyClient(child_pipe, key_id, fpr,
1733
2312
self.client_address)
1734
2313
except KeyError:
1737
2316
if client.approval_delay:
1738
2317
delay = client.approval_delay
1739
2318
client.approvals_pending += 1
1740
2319
approval_required = True
1743
2322
if not client.enabled:
1744
2323
logger.info("Client %s is disabled",
1746
2325
if self.server.use_dbus:
1747
2326
# Emit D-Bus signal
1748
2327
client.Rejected("Disabled")
1751
2330
if client.approved or not client.approval_delay:
1752
#We are approved or approval is disabled
2331
# We are approved or approval is disabled
1754
2333
elif client.approved is None:
1755
2334
logger.info("Client %s needs approval",
1790
2367
delay -= time2 - time
1793
while sent_size < len(client.secret):
1795
sent = session.send(client.secret[sent_size:])
1796
except gnutls.errors.GNUTLSError as error:
1797
logger.warning("gnutls send failed",
1800
logger.debug("Sent: %d, remaining: %d",
1801
sent, len(client.secret)
1802
- (sent_size + sent))
2370
session.send(client.secret)
2371
except gnutls.Error as error:
2372
logger.warning("gnutls send failed",
1805
2376
logger.info("Sending secret to %s", client.name)
1806
2377
# bump the timeout using extended_timeout
1807
2378
client.bump_timeout(client.extended_timeout)
1808
2379
if self.server.use_dbus:
1809
2380
# Emit D-Bus signal
1810
2381
client.GotSecret()
1813
2384
if approval_required:
1814
2385
client.approvals_pending -= 1
1817
except gnutls.errors.GNUTLSError as error:
2388
except gnutls.Error as error:
1818
2389
logger.warning("GnuTLS bye failed",
1819
2390
exc_info=error)
1822
2393
def peer_certificate(session):
1823
"Return the peer's OpenPGP certificate as a bytestring"
1824
# If not an OpenPGP certificate...
1825
if (gnutls.library.functions
1826
.gnutls_certificate_type_get(session._c_object)
1827
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1828
# ...do the normal thing
1829
return session.peer_certificate
2394
"Return the peer's certificate as a bytestring"
2396
cert_type = gnutls.certificate_type_get2(session._c_object,
2398
except AttributeError:
2399
cert_type = gnutls.certificate_type_get(session._c_object)
2400
if gnutls.has_rawpk:
2401
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2403
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2404
# If not a valid certificate type...
2405
if cert_type not in valid_cert_types:
2406
logger.info("Cert type %r not in %r", cert_type,
2408
# ...return invalid data
1830
2410
list_size = ctypes.c_uint(1)
1831
cert_list = (gnutls.library.functions
1832
.gnutls_certificate_get_peers
2411
cert_list = (gnutls.certificate_get_peers
1833
2412
(session._c_object, ctypes.byref(list_size)))
1834
2413
if not bool(cert_list) and list_size.value != 0:
1835
raise gnutls.errors.GNUTLSError("error getting peer"
2414
raise gnutls.Error("error getting peer certificate")
1837
2415
if list_size.value == 0:
1839
2417
cert = cert_list[0]
1840
2418
return ctypes.string_at(cert.data, cert.size)
2421
def key_id(certificate):
2422
"Convert a certificate bytestring to a hexdigit key ID"
2423
# New GnuTLS "datum" with the public key
2424
datum = gnutls.datum_t(
2425
ctypes.cast(ctypes.c_char_p(certificate),
2426
ctypes.POINTER(ctypes.c_ubyte)),
2427
ctypes.c_uint(len(certificate)))
2428
# XXX all these need to be created in the gnutls "module"
2429
# New empty GnuTLS certificate
2430
pubkey = gnutls.pubkey_t()
2431
gnutls.pubkey_init(ctypes.byref(pubkey))
2432
# Import the raw public key into the certificate
2433
gnutls.pubkey_import(pubkey,
2434
ctypes.byref(datum),
2435
gnutls.X509_FMT_DER)
2436
# New buffer for the key ID
2437
buf = ctypes.create_string_buffer(32)
2438
buf_len = ctypes.c_size_t(len(buf))
2439
# Get the key ID from the raw public key into the buffer
2440
gnutls.pubkey_get_key_id(pubkey,
2441
gnutls.KEYID_USE_SHA256,
2442
ctypes.cast(ctypes.byref(buf),
2443
ctypes.POINTER(ctypes.c_ubyte)),
2444
ctypes.byref(buf_len))
2445
# Deinit the certificate
2446
gnutls.pubkey_deinit(pubkey)
2448
# Convert the buffer to a Python bytestring
2449
key_id = ctypes.string_at(buf, buf_len.value)
2450
# Convert the bytestring to hexadecimal notation
2451
hex_key_id = binascii.hexlify(key_id).upper()
1843
2455
def fingerprint(openpgp):
1844
2456
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1845
2457
# New GnuTLS "datum" with the OpenPGP public key
1846
datum = (gnutls.library.types
1847
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1850
ctypes.c_uint(len(openpgp))))
2458
datum = gnutls.datum_t(
2459
ctypes.cast(ctypes.c_char_p(openpgp),
2460
ctypes.POINTER(ctypes.c_ubyte)),
2461
ctypes.c_uint(len(openpgp)))
1851
2462
# New empty GnuTLS certificate
1852
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1853
(gnutls.library.functions
1854
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2463
crt = gnutls.openpgp_crt_t()
2464
gnutls.openpgp_crt_init(ctypes.byref(crt))
1855
2465
# Import the OpenPGP public key into the certificate
1856
(gnutls.library.functions
1857
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1858
gnutls.library.constants
1859
.GNUTLS_OPENPGP_FMT_RAW))
2466
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2467
gnutls.OPENPGP_FMT_RAW)
1860
2468
# Verify the self signature in the key
1861
2469
crtverify = ctypes.c_uint()
1862
(gnutls.library.functions
1863
.gnutls_openpgp_crt_verify_self(crt, 0,
1864
ctypes.byref(crtverify)))
2470
gnutls.openpgp_crt_verify_self(crt, 0,
2471
ctypes.byref(crtverify))
1865
2472
if crtverify.value != 0:
1866
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1867
raise (gnutls.errors.CertificateSecurityError
2473
gnutls.openpgp_crt_deinit(crt)
2474
raise gnutls.CertificateSecurityError(code
1869
2476
# New buffer for the fingerprint
1870
2477
buf = ctypes.create_string_buffer(20)
1871
2478
buf_len = ctypes.c_size_t()
1872
2479
# Get the fingerprint from the certificate into the buffer
1873
(gnutls.library.functions
1874
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1875
ctypes.byref(buf_len)))
2480
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2481
ctypes.byref(buf_len))
1876
2482
# Deinit the certificate
1877
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2483
gnutls.openpgp_crt_deinit(crt)
1878
2484
# Convert the buffer to a Python bytestring
1879
2485
fpr = ctypes.string_at(buf, buf_len.value)
1880
2486
# Convert the bytestring to hexadecimal notation
1963
2575
# socket_wrapper(), if socketfd was set.
1964
2576
socketserver.TCPServer.__init__(self, server_address,
1965
2577
RequestHandlerClass)
1967
2579
def server_bind(self):
1968
2580
"""This overrides the normal server_bind() function
1969
2581
to bind to an interface if one was specified, and also NOT to
1970
2582
bind to an address or port if they were not specified."""
2583
global SO_BINDTODEVICE
1971
2584
if self.interface is not None:
1972
2585
if SO_BINDTODEVICE is None:
1973
logger.error("SO_BINDTODEVICE does not exist;"
1974
" cannot bind to interface %s",
1978
self.socket.setsockopt(socket.SOL_SOCKET,
1980
str(self.interface + '\0'))
1981
except socket.error as error:
1982
if error.errno == errno.EPERM:
1983
logger.error("No permission to bind to"
1984
" interface %s", self.interface)
1985
elif error.errno == errno.ENOPROTOOPT:
1986
logger.error("SO_BINDTODEVICE not available;"
1987
" cannot bind to interface %s",
1989
elif error.errno == errno.ENODEV:
1990
logger.error("Interface %s does not exist,"
1991
" cannot bind", self.interface)
2586
# Fall back to a hard-coded value which seems to be
2588
logger.warning("SO_BINDTODEVICE not found, trying 25")
2589
SO_BINDTODEVICE = 25
2591
self.socket.setsockopt(
2592
socket.SOL_SOCKET, SO_BINDTODEVICE,
2593
(self.interface + "\0").encode("utf-8"))
2594
except socket.error as error:
2595
if error.errno == errno.EPERM:
2596
logger.error("No permission to bind to"
2597
" interface %s", self.interface)
2598
elif error.errno == errno.ENOPROTOOPT:
2599
logger.error("SO_BINDTODEVICE not available;"
2600
" cannot bind to interface %s",
2602
elif error.errno == errno.ENODEV:
2603
logger.error("Interface %s does not exist,"
2604
" cannot bind", self.interface)
1994
2607
# Only bind(2) the socket if we really need to.
1995
2608
if self.server_address[0] or self.server_address[1]:
2609
if self.server_address[1]:
2610
self.allow_reuse_address = True
1996
2611
if not self.server_address[0]:
1997
2612
if self.address_family == socket.AF_INET6:
1998
any_address = "::" # in6addr_any
2613
any_address = "::" # in6addr_any
2000
any_address = "0.0.0.0" # INADDR_ANY
2615
any_address = "0.0.0.0" # INADDR_ANY
2001
2616
self.server_address = (any_address,
2002
2617
self.server_address[1])
2003
2618
elif not self.server_address[1]:
2004
self.server_address = (self.server_address[0],
2619
self.server_address = (self.server_address[0], 0)
2006
2620
# if self.interface:
2007
2621
# self.server_address = (self.server_address[0],
2033
2652
self.gnutls_priority = gnutls_priority
2034
2653
IPv6_TCPServer.__init__(self, server_address,
2035
2654
RequestHandlerClass,
2036
interface = interface,
2037
use_ipv6 = use_ipv6,
2038
socketfd = socketfd)
2655
interface=interface,
2039
2659
def server_activate(self):
2040
2660
if self.enabled:
2041
2661
return socketserver.TCPServer.server_activate(self)
2043
2663
def enable(self):
2044
2664
self.enabled = True
2046
2666
def add_pipe(self, parent_pipe, proc):
2047
2667
# Call "handle_ipc" for both data and EOF events
2048
gobject.io_add_watch(parent_pipe.fileno(),
2049
gobject.IO_IN | gobject.IO_HUP,
2050
functools.partial(self.handle_ipc,
2055
def handle_ipc(self, source, condition, parent_pipe=None,
2056
proc = None, client_object=None):
2669
parent_pipe.fileno(),
2670
GLib.IO_IN | GLib.IO_HUP,
2671
functools.partial(self.handle_ipc,
2672
parent_pipe=parent_pipe,
2675
def handle_ipc(self, source, condition,
2678
client_object=None):
2057
2679
# error, or the other end of multiprocessing.Pipe has closed
2058
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2680
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2059
2681
# Wait for other process to exit
2063
2685
# Read a request from the child
2064
2686
request = parent_pipe.recv()
2065
2687
command = request[0]
2067
2689
if command == 'init':
2069
address = request[2]
2071
for c in self.clients.itervalues():
2072
if c.fingerprint == fpr:
2690
key_id = request[1].decode("ascii")
2691
fpr = request[2].decode("ascii")
2692
address = request[3]
2694
for c in self.clients.values():
2695
if key_id == "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855":
2697
if key_id and c.key_id == key_id:
2700
if fpr and c.fingerprint == fpr:
2076
logger.info("Client not found for fingerprint: %s, ad"
2077
"dress: %s", fpr, address)
2704
logger.info("Client not found for key ID: %s, address"
2705
": %s", key_id or fpr, address)
2078
2706
if self.use_dbus:
2079
2707
# Emit D-Bus signal
2080
mandos_dbus_service.ClientNotFound(fpr,
2708
mandos_dbus_service.ClientNotFound(key_id or fpr,
2082
2710
parent_pipe.send(False)
2085
gobject.io_add_watch(parent_pipe.fileno(),
2086
gobject.IO_IN | gobject.IO_HUP,
2087
functools.partial(self.handle_ipc,
2714
parent_pipe.fileno(),
2715
GLib.IO_IN | GLib.IO_HUP,
2716
functools.partial(self.handle_ipc,
2717
parent_pipe=parent_pipe,
2719
client_object=client))
2093
2720
parent_pipe.send(True)
2094
2721
# remove the old hook in favor of the new above hook on
3128
logger.debug("Did setuid/setgid to {}:{}".format(uid,
2480
3130
except OSError as error:
3131
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3132
.format(uid, gid, os.strerror(error.errno)))
2481
3133
if error.errno != errno.EPERM:
2485
3137
# Enable all possible GnuTLS debugging
2487
3139
# "Use a log level over 10 to enable all debugging options."
2488
3140
# - GnuTLS manual
2489
gnutls.library.functions.gnutls_global_set_log_level(11)
2491
@gnutls.library.types.gnutls_log_func
3141
gnutls.global_set_log_level(11)
2492
3144
def debug_gnutls(level, string):
2493
3145
logger.debug("GnuTLS: %s", string[:-1])
2495
(gnutls.library.functions
2496
.gnutls_global_set_log_function(debug_gnutls))
3147
gnutls.global_set_log_function(debug_gnutls)
2498
3149
# Redirect stdin so all checkers get /dev/null
2499
3150
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2500
3151
os.dup2(null, sys.stdin.fileno())
2504
3155
# Need to fork before connecting to D-Bus
2505
3156
if not foreground:
2506
3157
# Close all input and output, do double fork, etc.
2509
# multiprocessing will use threads, so before we use gobject we
2510
# need to inform gobject that threads will be used.
2511
gobject.threads_init()
3160
# multiprocessing will use threads, so before we use GLib we need
3161
# to inform GLib that threads will be used.
2513
3164
global main_loop
2514
3165
# From the Avahi example code
2515
3166
DBusGMainLoop(set_as_default=True)
2516
main_loop = gobject.MainLoop()
3167
main_loop = GLib.MainLoop()
2517
3168
bus = dbus.SystemBus()
2518
3169
# End of Avahi example code
2521
3172
bus_name = dbus.service.BusName("se.recompile.Mandos",
2522
bus, do_not_queue=True)
2523
old_bus_name = (dbus.service.BusName
2524
("se.bsnet.fukt.Mandos", bus,
2526
except dbus.exceptions.NameExistsException as e:
3175
old_bus_name = dbus.service.BusName(
3176
"se.bsnet.fukt.Mandos", bus,
3178
except dbus.exceptions.DBusException as e:
2527
3179
logger.error("Disabling D-Bus:", exc_info=e)
2528
3180
use_dbus = False
2529
3181
server_settings["use_dbus"] = False
2530
3182
tcp_server.use_dbus = False
2531
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2532
service = AvahiServiceToSyslog(name =
2533
server_settings["servicename"],
2534
servicetype = "_mandos._tcp",
2535
protocol = protocol, bus = bus)
2536
if server_settings["interface"]:
2537
service.interface = (if_nametoindex
2538
(str(server_settings["interface"])))
3184
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3185
service = AvahiServiceToSyslog(
3186
name=server_settings["servicename"],
3187
servicetype="_mandos._tcp",
3190
if server_settings["interface"]:
3191
service.interface = if_nametoindex(
3192
server_settings["interface"].encode("utf-8"))
2540
3194
global multiprocessing_manager
2541
3195
multiprocessing_manager = multiprocessing.Manager()
2543
3197
client_class = Client
2545
client_class = functools.partial(ClientDBus, bus = bus)
3199
client_class = functools.partial(ClientDBus, bus=bus)
2547
3201
client_settings = Client.config_parser(client_config)
2548
3202
old_client_settings = {}
2549
3203
clients_data = {}
2551
3205
# This is used to redirect stdout and stderr for checker processes
2553
wnull = open(os.devnull, "w") # A writable /dev/null
3207
wnull = open(os.devnull, "w") # A writable /dev/null
2554
3208
# Only used if server is running in foreground but not in debug
2556
3210
if debug or not foreground:
2559
3213
# Get client data and settings from last running state.
2560
3214
if server_settings["restore"]:
2562
3216
with open(stored_state_path, "rb") as stored_state:
2563
clients_data, old_client_settings = (pickle.load
3217
if sys.version_info.major == 2:
3218
clients_data, old_client_settings = pickle.load(
3221
bytes_clients_data, bytes_old_client_settings = (
3222
pickle.load(stored_state, encoding="bytes"))
3223
# Fix bytes to strings
3226
clients_data = {(key.decode("utf-8")
3227
if isinstance(key, bytes)
3230
bytes_clients_data.items()}
3231
del bytes_clients_data
3232
for key in clients_data:
3233
value = {(k.decode("utf-8")
3234
if isinstance(k, bytes) else k): v
3236
clients_data[key].items()}
3237
clients_data[key] = value
3239
value["client_structure"] = [
3241
if isinstance(s, bytes)
3243
value["client_structure"]]
3245
for k in ("name", "host"):
3246
if isinstance(value[k], bytes):
3247
value[k] = value[k].decode("utf-8")
3248
if "key_id" not in value:
3249
value["key_id"] = ""
3250
elif "fingerprint" not in value:
3251
value["fingerprint"] = ""
3252
# old_client_settings
3254
old_client_settings = {
3255
(key.decode("utf-8")
3256
if isinstance(key, bytes)
3259
bytes_old_client_settings.items()}
3260
del bytes_old_client_settings
3262
for value in old_client_settings.values():
3263
if isinstance(value["host"], bytes):
3264
value["host"] = (value["host"]
2565
3266
os.remove(stored_state_path)
2566
3267
except IOError as e:
2567
3268
if e.errno == errno.ENOENT:
2568
logger.warning("Could not load persistent state: {0}"
2569
.format(os.strerror(e.errno)))
3269
logger.warning("Could not load persistent state:"
3270
" {}".format(os.strerror(e.errno)))
2571
3272
logger.critical("Could not load persistent state:",
2574
3275
except EOFError as e:
2575
3276
logger.warning("Could not load persistent state: "
2576
"EOFError:", exc_info=e)
2578
3280
with PGPEngine() as pgp:
2579
for client_name, client in clients_data.iteritems():
3281
for client_name, client in clients_data.items():
2580
3282
# Skip removed clients
2581
3283
if client_name not in client_settings:
2584
3286
# Decide which value to use after restoring saved state.
2585
3287
# We have three different values: Old config file,
2586
3288
# new config file, and saved state.
2644
3346
for client_name in (set(client_settings)
2645
3347
- set(old_client_settings)):
2646
3348
clients_data[client_name] = client_settings[client_name]
2648
3350
# Create all client objects
2649
for client_name, client in clients_data.iteritems():
3351
for client_name, client in clients_data.items():
2650
3352
tcp_server.clients[client_name] = client_class(
2651
name = client_name, settings = client,
2652
server_settings = server_settings)
3355
server_settings=server_settings)
2654
3357
if not tcp_server.clients:
2655
3358
logger.warning("No clients defined")
2657
3360
if not foreground:
2658
3361
if pidfile is not None:
2662
pidfile.write(str(pid) + "\n".encode("utf-8"))
3365
print(pid, file=pidfile)
2663
3366
except IOError:
2664
3367
logger.error("Could not write to file %r with PID %d",
2665
3368
pidfilename, pid)
2667
3370
del pidfilename
2669
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2670
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3372
for termsig in (signal.SIGHUP, signal.SIGTERM):
3373
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3374
lambda: main_loop.quit() and False)
2673
@alternate_dbus_interfaces({"se.recompile.Mandos":
2674
"se.bsnet.fukt.Mandos"})
2675
class MandosDBusService(DBusObjectWithProperties):
3378
@alternate_dbus_interfaces(
3379
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3380
class MandosDBusService(DBusObjectWithObjectManager):
2676
3381
"""A D-Bus proxy object"""
2677
3383
def __init__(self):
2678
3384
dbus.service.Object.__init__(self, bus, "/")
2679
3386
_interface = "se.recompile.Mandos"
2681
@dbus_interface_annotations(_interface)
2683
return { "org.freedesktop.DBus.Property"
2684
".EmitsChangedSignal":
2687
3388
@dbus.service.signal(_interface, signature="o")
2688
3389
def ClientAdded(self, objpath):
2692
3393
@dbus.service.signal(_interface, signature="ss")
2693
def ClientNotFound(self, fingerprint, address):
3394
def ClientNotFound(self, key_id, address):
3398
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2697
3400
@dbus.service.signal(_interface, signature="os")
2698
3401
def ClientRemoved(self, objpath, name):
3405
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2702
3407
@dbus.service.method(_interface, out_signature="ao")
2703
3408
def GetAllClients(self):
2705
return dbus.Array(c.dbus_object_path
2707
tcp_server.clients.itervalues())
3410
return dbus.Array(c.dbus_object_path for c in
3411
tcp_server.clients.values())
3413
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2709
3415
@dbus.service.method(_interface,
2710
3416
out_signature="a{oa{sv}}")
2711
3417
def GetAllClientsWithProperties(self):
2713
3419
return dbus.Dictionary(
2714
((c.dbus_object_path, c.GetAll(""))
2715
for c in tcp_server.clients.itervalues()),
3420
{c.dbus_object_path: c.GetAll(
3421
"se.recompile.Mandos.Client")
3422
for c in tcp_server.clients.values()},
2716
3423
signature="oa{sv}")
2718
3425
@dbus.service.method(_interface, in_signature="o")
2719
3426
def RemoveClient(self, object_path):
2721
for c in tcp_server.clients.itervalues():
3428
for c in tcp_server.clients.values():
2722
3429
if c.dbus_object_path == object_path:
2723
3430
del tcp_server.clients[c.name]
2724
3431
c.remove_from_connection()
2725
# Don't signal anything except ClientRemoved
3432
# Don't signal the disabling
2726
3433
c.disable(quiet=True)
2728
self.ClientRemoved(object_path, c.name)
3434
# Emit D-Bus signal for removal
3435
self.client_removed_signal(c)
2730
3437
raise KeyError(object_path)
3441
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3442
out_signature="a{oa{sa{sv}}}")
3443
def GetManagedObjects(self):
3445
return dbus.Dictionary(
3446
{client.dbus_object_path:
3448
{interface: client.GetAll(interface)
3450
client._get_all_interface_names()})
3451
for client in tcp_server.clients.values()})
3453
def client_added_signal(self, client):
3454
"""Send the new standard signal and the old signal"""
3456
# New standard signal
3457
self.InterfacesAdded(
3458
client.dbus_object_path,
3460
{interface: client.GetAll(interface)
3462
client._get_all_interface_names()}))
3464
self.ClientAdded(client.dbus_object_path)
3466
def client_removed_signal(self, client):
3467
"""Send the new standard signal and the old signal"""
3469
# New standard signal
3470
self.InterfacesRemoved(
3471
client.dbus_object_path,
3472
client._get_all_interface_names())
3474
self.ClientRemoved(client.dbus_object_path,
2734
3477
mandos_dbus_service = MandosDBusService()
3479
# Save modules to variables to exempt the modules from being
3480
# unloaded before the function registered with atexit() is run.
3481
mp = multiprocessing
2737
3485
"Cleanup function; run on exit"
2740
multiprocessing.active_children()
3489
mp.active_children()
2742
3491
if not (tcp_server.clients or client_settings):
2745
3494
# Store client before exiting. Secrets are encrypted with key
2746
3495
# based on what config file has. If config file is
2747
3496
# removed/edited, old secret will thus be unrecovable.
2749
3498
with PGPEngine() as pgp:
2750
for client in tcp_server.clients.itervalues():
3499
for client in tcp_server.clients.values():
2751
3500
key = client_settings[client.name]["secret"]
2752
3501
client.encrypted_secret = pgp.encrypt(client.secret,
2754
3503
client_dict = {}
2756
3505
# A list of attributes that can not be pickled
2758
exclude = set(("bus", "changedstate", "secret",
2759
"checker", "server_settings"))
2760
for name, typ in (inspect.getmembers
2761
(dbus.service.Object)):
3507
exclude = {"bus", "changedstate", "secret",
3508
"checker", "server_settings"}
3509
for name, typ in inspect.getmembers(dbus.service
2762
3511
exclude.add(name)
2764
3513
client_dict["encrypted_secret"] = (client
2765
3514
.encrypted_secret)
2766
3515
for attr in client.client_structure:
2767
3516
if attr not in exclude:
2768
3517
client_dict[attr] = getattr(client, attr)
2770
3519
clients[client.name] = client_dict
2771
3520
del client_settings[client.name]["secret"]
2774
with (tempfile.NamedTemporaryFile
2775
(mode='wb', suffix=".pickle", prefix='clients-',
2776
dir=os.path.dirname(stored_state_path),
2777
delete=False)) as stored_state:
2778
pickle.dump((clients, client_settings), stored_state)
2779
tempname=stored_state.name
3523
with tempfile.NamedTemporaryFile(
3527
dir=os.path.dirname(stored_state_path),
3528
delete=False) as stored_state:
3529
pickle.dump((clients, client_settings), stored_state,
3531
tempname = stored_state.name
2780
3532
os.rename(tempname, stored_state_path)
2781
3533
except (IOError, OSError) as e: