/mandos/trunk : revision 237.4.54

1

#!/usr/bin/python

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

37

from future_builtins import *

41

38

42

try:

43

import SocketServer as socketserver

44

except ImportError:

45

import socketserver

39

import SocketServer as socketserver

46

40

import socket

47

41

import argparse

48

42

import datetime

49

43

import errno

50

try:

51

import ConfigParser as configparser

52

except ImportError:

53

import configparser

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

54

51

import sys

55

52

import re

56

53

import os

65

62

import struct

66

63

import fcntl

67

64

import functools

68

try:

69

import cPickle as pickle

70

except ImportError:

71

import pickle

65

import cPickle as pickle

72

66

import multiprocessing

73

67

import types

74

68

import binascii

75

69

import tempfile

76

70

import itertools

77

71

import collections

78

import codecs

79

72

80

73

import dbus

81

74

import dbus.service

82

from gi.repository import GLib

75

import gobject

76

import avahi

83

77

from dbus.mainloop.glib import DBusGMainLoop

84

78

import ctypes

85

79

import ctypes.util

86

80

import xml.dom.minidom

87

81

import inspect

88

82

89

# Try to find the value of SO_BINDTODEVICE:

90

83

try:

91

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

92

# newer, and it is also the most natural place for it:

93

84

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

94

85

except AttributeError:

95

86

try:

96

# This is where SO_BINDTODEVICE was up to and including Python

97

# 2.6, and also 3.2:

98

87

from IN import SO_BINDTODEVICE

99

88

except ImportError:

100

# In Python 2.7 it seems to have been removed entirely.

101

# Try running the C preprocessor:

102

try:

103

cc = subprocess.Popen(["cc", "--language=c", "-E",

104

"/dev/stdin"],

105

stdin=subprocess.PIPE,

106

stdout=subprocess.PIPE)

107

stdout = cc.communicate(

108

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

109

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

110

except (OSError, ValueError, IndexError):

111

# No value found

112

SO_BINDTODEVICE = None

89

SO_BINDTODEVICE = None

113

90

114

91

if sys.version_info.major == 2:

115

92

str = unicode

116

93

117

version = "1.7.9"

94

version = "1.6.8"

118

95

stored_state_file = "clients.pickle"

119

96

120

97

logger = logging.getLogger()

121

98

syslogger = None

122

99

123

100

try:

124

if_nametoindex = ctypes.cdll.LoadLibrary(

125

ctypes.util.find_library("c")).if_nametoindex

101

if_nametoindex = (ctypes.cdll.LoadLibrary

102

(ctypes.util.find_library("c"))

103

.if_nametoindex)

126

104

except (OSError, AttributeError):

127

128

105

def if_nametoindex(interface):

129

106

"Get an interface index the hard way, i.e. using fcntl()"

130

107

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

135

112

return interface_index

136

113

137

114

138

def copy_function(func):

139

"""Make a copy of a function"""

140

if sys.version_info.major == 2:

141

return types.FunctionType(func.func_code,

142

func.func_globals,

143

func.func_name,

144

func.func_defaults,

145

func.func_closure)

146

else:

147

return types.FunctionType(func.__code__,

148

func.__globals__,

149

func.__name__,

150

func.__defaults__,

151

func.__closure__)

152

153

154

115

def initlogger(debug, level=logging.WARNING):

155

116

"""init logger and add loglevel"""

156

117

157

118

global syslogger

158

syslogger = (logging.handlers.SysLogHandler(

159

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

160

address = "/dev/log"))

119

syslogger = (logging.handlers.SysLogHandler

120

(facility =

121

logging.handlers.SysLogHandler.LOG_DAEMON,

122

address = "/dev/log"))

161

123

syslogger.setFormatter(logging.Formatter

162

124

('Mandos [%(process)d]: %(levelname)s:'

163

125

' %(message)s'))

180

142

181

143

class PGPEngine(object):

182

144

"""A simple class for OpenPGP symmetric encryption & decryption"""

183

184

145

def __init__(self):

185

146

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

186

self.gpg = "gpg"

187

try:

188

output = subprocess.check_output(["gpgconf"])

189

for line in output.splitlines():

190

name, text, path = line.split(b":")

191

if name == "gpg":

192

self.gpg = path

193

break

194

except OSError as e:

195

if e.errno != errno.ENOENT:

196

raise

197

147

self.gnupgargs = ['--batch',

198

'--homedir', self.tempdir,

148

'--home', self.tempdir,

199

149

'--force-mdc',

200

'--quiet']

201

# Only GPG version 1 has the --no-use-agent option.

202

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

203

self.gnupgargs.append("--no-use-agent")

150

'--quiet',

151

'--no-use-agent']

204

152

205

153

def __enter__(self):

206

154

return self

238

186

239

187

def encrypt(self, data, password):

240

188

passphrase = self.password_encode(password)

241

with tempfile.NamedTemporaryFile(

242

dir=self.tempdir) as passfile:

189

with tempfile.NamedTemporaryFile(dir=self.tempdir

190

) as passfile:

243

191

passfile.write(passphrase)

244

192

passfile.flush()

245

proc = subprocess.Popen([self.gpg, '--symmetric',

193

proc = subprocess.Popen(['gpg', '--symmetric',

246

194

'--passphrase-file',

247

195

passfile.name]

248

196

+ self.gnupgargs,

256

204

257

205

def decrypt(self, data, password):

258

206

passphrase = self.password_encode(password)

259

with tempfile.NamedTemporaryFile(

260

dir = self.tempdir) as passfile:

207

with tempfile.NamedTemporaryFile(dir = self.tempdir

208

) as passfile:

261

209

passfile.write(passphrase)

262

210

passfile.flush()

263

proc = subprocess.Popen([self.gpg, '--decrypt',

211

proc = subprocess.Popen(['gpg', '--decrypt',

264

212

'--passphrase-file',

265

213

passfile.name]

266

214

+ self.gnupgargs,

267

215

stdin = subprocess.PIPE,

268

216

stdout = subprocess.PIPE,

269

217

stderr = subprocess.PIPE)

270

decrypted_plaintext, err = proc.communicate(input = data)

218

decrypted_plaintext, err = proc.communicate(input

219

= data)

271

220

if proc.returncode != 0:

272

221

raise PGPError(err)

273

222

return decrypted_plaintext

274

223

275

# Pretend that we have an Avahi module

276

class Avahi(object):

277

"""This isn't so much a class as it is a module-like namespace.

278

It is instantiated once, and simulates having an Avahi module."""

279

IF_UNSPEC = -1 # avahi-common/address.h

280

PROTO_UNSPEC = -1 # avahi-common/address.h

281

PROTO_INET = 0 # avahi-common/address.h

282

PROTO_INET6 = 1 # avahi-common/address.h

283

DBUS_NAME = "org.freedesktop.Avahi"

284

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

285

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

286

DBUS_PATH_SERVER = "/"

287

def string_array_to_txt_array(self, t):

288

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

289

for s in t), signature="ay")

290

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

291

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

292

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

293

SERVER_INVALID = 0 # avahi-common/defs.h

294

SERVER_REGISTERING = 1 # avahi-common/defs.h

295

SERVER_RUNNING = 2 # avahi-common/defs.h

296

SERVER_COLLISION = 3 # avahi-common/defs.h

297

SERVER_FAILURE = 4 # avahi-common/defs.h

298

avahi = Avahi()

299

224

300

225

class AvahiError(Exception):

301

226

def __init__(self, value, *args, **kwargs):

303

228

return super(AvahiError, self).__init__(value, *args,

304

229

**kwargs)

305

230

306

307

231

class AvahiServiceError(AvahiError):

308

232

pass

309

233

310

311

234

class AvahiGroupError(AvahiError):

312

235

pass

313

236

333

256

bus: dbus.SystemBus()

334

257

"""

335

258

336

def __init__(self,

337

interface = avahi.IF_UNSPEC,

338

name = None,

339

servicetype = None,

340

port = None,

341

TXT = None,

342

domain = "",

343

host = "",

344

max_renames = 32768,

345

protocol = avahi.PROTO_UNSPEC,

346

bus = None):

259

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

260

servicetype = None, port = None, TXT = None,

261

domain = "", host = "", max_renames = 32768,

262

protocol = avahi.PROTO_UNSPEC, bus = None):

347

263

self.interface = interface

348

264

self.name = name

349

265

self.type = servicetype

359

275

self.bus = bus

360

276

self.entry_group_state_changed_match = None

361

277

362

def rename(self, remove=True):

278

def rename(self):

363

279

"""Derived from the Avahi example code"""

364

280

if self.rename_count >= self.max_renames:

365

281

logger.critical("No suitable Zeroconf service name found"

366

282

" after %i retries, exiting.",

367

283

self.rename_count)

368

284

raise AvahiServiceError("Too many renames")

369

self.name = str(

370

self.server.GetAlternativeServiceName(self.name))

371

self.rename_count += 1

285

self.name = str(self.server

286

.GetAlternativeServiceName(self.name))

372

287

logger.info("Changing Zeroconf service name to %r ...",

373

288

self.name)

374

if remove:

375

self.remove()

289

self.remove()

376

290

try:

377

291

self.add()

378

292

except dbus.exceptions.DBusException as error:

379

if (error.get_dbus_name()

380

== "org.freedesktop.Avahi.CollisionError"):

381

logger.info("Local Zeroconf service name collision.")

382

return self.rename(remove=False)

383

else:

384

logger.critical("D-Bus Exception", exc_info=error)

385

self.cleanup()

386

os._exit(1)

293

logger.critical("D-Bus Exception", exc_info=error)

294

self.cleanup()

295

os._exit(1)

296

self.rename_count += 1

387

297

388

298

def remove(self):

389

299

"""Derived from the Avahi example code"""

428

338

elif state == avahi.ENTRY_GROUP_FAILURE:

429

339

logger.critical("Avahi: Error in group state changed %s",

430

340

str(error))

431

raise AvahiGroupError("State changed: {!s}".format(error))

341

raise AvahiGroupError("State changed: {!s}"

342

.format(error))

432

343

433

344

def cleanup(self):

434

345

"""Derived from the Avahi example code"""

444

355

def server_state_changed(self, state, error=None):

445

356

"""Derived from the Avahi example code"""

446

357

logger.debug("Avahi server state change: %i", state)

447

bad_states = {

448

avahi.SERVER_INVALID: "Zeroconf server invalid",

449

avahi.SERVER_REGISTERING: None,

450

avahi.SERVER_COLLISION: "Zeroconf server name collision",

451

avahi.SERVER_FAILURE: "Zeroconf server failure",

452

}

358

bad_states = { avahi.SERVER_INVALID:

359

"Zeroconf server invalid",

360

avahi.SERVER_REGISTERING: None,

361

avahi.SERVER_COLLISION:

362

"Zeroconf server name collision",

363

avahi.SERVER_FAILURE:

364

"Zeroconf server failure" }

453

365

if state in bad_states:

454

366

if bad_states[state] is not None:

455

367

if error is None:

458

370

logger.error(bad_states[state] + ": %r", error)

459

371

self.cleanup()

460

372

elif state == avahi.SERVER_RUNNING:

461

try:

462

self.add()

463

except dbus.exceptions.DBusException as error:

464

if (error.get_dbus_name()

465

== "org.freedesktop.Avahi.CollisionError"):

466

logger.info("Local Zeroconf service name"

467

" collision.")

468

return self.rename(remove=False)

469

else:

470

logger.critical("D-Bus Exception", exc_info=error)

471

self.cleanup()

472

os._exit(1)

373

self.add()

473

374

else:

474

375

if error is None:

475

376

logger.debug("Unknown state: %r", state)

485

386

follow_name_owner_changes=True),

486

387

avahi.DBUS_INTERFACE_SERVER)

487

388

self.server.connect_to_signal("StateChanged",

488

self.server_state_changed)

389

self.server_state_changed)

489

390

self.server_state_changed(self.server.GetState())

490

391

491

392

492

393

class AvahiServiceToSyslog(AvahiService):

493

def rename(self, *args, **kwargs):

394

def rename(self):

494

395

"""Add the new name to the syslog messages"""

495

ret = AvahiService.rename(self, *args, **kwargs)

496

syslogger.setFormatter(logging.Formatter(

497

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

498

.format(self.name)))

396

ret = AvahiService.rename(self)

397

syslogger.setFormatter(logging.Formatter

398

('Mandos ({}) [%(process)d]:'

399

' %(levelname)s: %(message)s'

400

.format(self.name)))

499

401

return ret

500

402

501

# Pretend that we have a GnuTLS module

502

class GnuTLS(object):

503

"""This isn't so much a class as it is a module-like namespace.

504

It is instantiated once, and simulates having a GnuTLS module."""

505

506

_library = ctypes.cdll.LoadLibrary(

507

ctypes.util.find_library("gnutls"))

508

_need_version = b"3.3.0"

509

def __init__(self):

510

# Need to use class name "GnuTLS" here, since this method is

511

# called before the assignment to the "gnutls" global variable

512

# happens.

513

if GnuTLS.check_version(self._need_version) is None:

514

raise GnuTLS.Error("Needs GnuTLS {} or later"

515

.format(self._need_version))

516

517

# Unless otherwise indicated, the constants and types below are

518

# all from the gnutls/gnutls.h C header file.

519

520

# Constants

521

E_SUCCESS = 0

522

E_INTERRUPTED = -52

523

E_AGAIN = -28

524

CRT_OPENPGP = 2

525

CLIENT = 2

526

SHUT_RDWR = 0

527

CRD_CERTIFICATE = 1

528

E_NO_CERTIFICATE_FOUND = -49

529

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

530

531

# Types

532

class session_int(ctypes.Structure):

533

_fields_ = []

534

session_t = ctypes.POINTER(session_int)

535

class certificate_credentials_st(ctypes.Structure):

536

_fields_ = []

537

certificate_credentials_t = ctypes.POINTER(

538

certificate_credentials_st)

539

certificate_type_t = ctypes.c_int

540

class datum_t(ctypes.Structure):

541

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

542

('size', ctypes.c_uint)]

543

class openpgp_crt_int(ctypes.Structure):

544

_fields_ = []

545

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

546

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

547

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

548

credentials_type_t = ctypes.c_int

549

transport_ptr_t = ctypes.c_void_p

550

close_request_t = ctypes.c_int

551

552

# Exceptions

553

class Error(Exception):

554

# We need to use the class name "GnuTLS" here, since this

555

# exception might be raised from within GnuTLS.__init__,

556

# which is called before the assignment to the "gnutls"

557

# global variable has happened.

558

def __init__(self, message = None, code = None, args=()):

559

# Default usage is by a message string, but if a return

560

# code is passed, convert it to a string with

561

# gnutls.strerror()

562

self.code = code

563

if message is None and code is not None:

564

message = GnuTLS.strerror(code)

565

return super(GnuTLS.Error, self).__init__(

566

message, *args)

567

568

class CertificateSecurityError(Error):

569

pass

570

571

# Classes

572

class Credentials(object):

573

def __init__(self):

574

self._c_object = gnutls.certificate_credentials_t()

575

gnutls.certificate_allocate_credentials(

576

ctypes.byref(self._c_object))

577

self.type = gnutls.CRD_CERTIFICATE

578

579

def __del__(self):

580

gnutls.certificate_free_credentials(self._c_object)

581

582

class ClientSession(object):

583

def __init__(self, socket, credentials = None):

584

self._c_object = gnutls.session_t()

585

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

586

gnutls.set_default_priority(self._c_object)

587

gnutls.transport_set_ptr(self._c_object, socket.fileno())

588

gnutls.handshake_set_private_extensions(self._c_object,

589

True)

590

self.socket = socket

591

if credentials is None:

592

credentials = gnutls.Credentials()

593

gnutls.credentials_set(self._c_object, credentials.type,

594

ctypes.cast(credentials._c_object,

595

ctypes.c_void_p))

596

self.credentials = credentials

597

598

def __del__(self):

599

gnutls.deinit(self._c_object)

600

601

def handshake(self):

602

return gnutls.handshake(self._c_object)

603

604

def send(self, data):

605

data = bytes(data)

606

data_len = len(data)

607

while data_len > 0:

608

data_len -= gnutls.record_send(self._c_object,

609

data[-data_len:],

610

data_len)

611

612

def bye(self):

613

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

614

615

# Error handling functions

616

def _error_code(result):

617

"""A function to raise exceptions on errors, suitable

618

for the 'restype' attribute on ctypes functions"""

619

if result >= 0:

620

return result

621

if result == gnutls.E_NO_CERTIFICATE_FOUND:

622

raise gnutls.CertificateSecurityError(code = result)

623

raise gnutls.Error(code = result)

624

625

def _retry_on_error(result, func, arguments):

626

"""A function to retry on some errors, suitable

627

for the 'errcheck' attribute on ctypes functions"""

628

while result < 0:

629

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

630

return _error_code(result)

631

result = func(*arguments)

632

return result

633

634

# Unless otherwise indicated, the function declarations below are

635

# all from the gnutls/gnutls.h C header file.

636

637

# Functions

638

priority_set_direct = _library.gnutls_priority_set_direct

639

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

640

ctypes.POINTER(ctypes.c_char_p)]

641

priority_set_direct.restype = _error_code

642

643

init = _library.gnutls_init

644

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

645

init.restype = _error_code

646

647

set_default_priority = _library.gnutls_set_default_priority

648

set_default_priority.argtypes = [session_t]

649

set_default_priority.restype = _error_code

650

651

record_send = _library.gnutls_record_send

652

record_send.argtypes = [session_t, ctypes.c_void_p,

653

ctypes.c_size_t]

654

record_send.restype = ctypes.c_ssize_t

655

record_send.errcheck = _retry_on_error

656

657

certificate_allocate_credentials = (

658

_library.gnutls_certificate_allocate_credentials)

659

certificate_allocate_credentials.argtypes = [

660

ctypes.POINTER(certificate_credentials_t)]

661

certificate_allocate_credentials.restype = _error_code

662

663

certificate_free_credentials = (

664

_library.gnutls_certificate_free_credentials)

665

certificate_free_credentials.argtypes = [certificate_credentials_t]

666

certificate_free_credentials.restype = None

667

668

handshake_set_private_extensions = (

669

_library.gnutls_handshake_set_private_extensions)

670

handshake_set_private_extensions.argtypes = [session_t,

671

ctypes.c_int]

672

handshake_set_private_extensions.restype = None

673

674

credentials_set = _library.gnutls_credentials_set

675

credentials_set.argtypes = [session_t, credentials_type_t,

676

ctypes.c_void_p]

677

credentials_set.restype = _error_code

678

679

strerror = _library.gnutls_strerror

680

strerror.argtypes = [ctypes.c_int]

681

strerror.restype = ctypes.c_char_p

682

683

certificate_type_get = _library.gnutls_certificate_type_get

684

certificate_type_get.argtypes = [session_t]

685

certificate_type_get.restype = _error_code

686

687

certificate_get_peers = _library.gnutls_certificate_get_peers

688

certificate_get_peers.argtypes = [session_t,

689

ctypes.POINTER(ctypes.c_uint)]

690

certificate_get_peers.restype = ctypes.POINTER(datum_t)

691

692

global_set_log_level = _library.gnutls_global_set_log_level

693

global_set_log_level.argtypes = [ctypes.c_int]

694

global_set_log_level.restype = None

695

696

global_set_log_function = _library.gnutls_global_set_log_function

697

global_set_log_function.argtypes = [log_func]

698

global_set_log_function.restype = None

699

700

deinit = _library.gnutls_deinit

701

deinit.argtypes = [session_t]

702

deinit.restype = None

703

704

handshake = _library.gnutls_handshake

705

handshake.argtypes = [session_t]

706

handshake.restype = _error_code

707

handshake.errcheck = _retry_on_error

708

709

transport_set_ptr = _library.gnutls_transport_set_ptr

710

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

711

transport_set_ptr.restype = None

712

713

bye = _library.gnutls_bye

714

bye.argtypes = [session_t, close_request_t]

715

bye.restype = _error_code

716

bye.errcheck = _retry_on_error

717

718

check_version = _library.gnutls_check_version

719

check_version.argtypes = [ctypes.c_char_p]

720

check_version.restype = ctypes.c_char_p

721

722

# All the function declarations below are from gnutls/openpgp.h

723

724

openpgp_crt_init = _library.gnutls_openpgp_crt_init

725

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

726

openpgp_crt_init.restype = _error_code

727

728

openpgp_crt_import = _library.gnutls_openpgp_crt_import

729

openpgp_crt_import.argtypes = [openpgp_crt_t,

730

ctypes.POINTER(datum_t),

731

openpgp_crt_fmt_t]

732

openpgp_crt_import.restype = _error_code

733

734

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

735

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

736

ctypes.POINTER(ctypes.c_uint)]

737

openpgp_crt_verify_self.restype = _error_code

738

739

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

740

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

741

openpgp_crt_deinit.restype = None

742

743

openpgp_crt_get_fingerprint = (

744

_library.gnutls_openpgp_crt_get_fingerprint)

745

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

746

ctypes.c_void_p,

747

ctypes.POINTER(

748

ctypes.c_size_t)]

749

openpgp_crt_get_fingerprint.restype = _error_code

750

751

# Remove non-public functions

752

del _error_code, _retry_on_error

753

# Create the global "gnutls" object, simulating a module

754

gnutls = GnuTLS()

755

756

def call_pipe(connection, # : multiprocessing.Connection

757

func, *args, **kwargs):

758

"""This function is meant to be called by multiprocessing.Process

759

760

This function runs func(*args, **kwargs), and writes the resulting

761

return value on the provided multiprocessing.Connection.

762

"""

763

connection.send(func(*args, **kwargs))

764

connection.close()

765

403

766

404

class Client(object):

767

405

"""A representation of a client host served by this server.

773

411

checker: subprocess.Popen(); a running checker process used

774

412

to see if the client lives.

775

413

'None' if no process is running.

776

checker_callback_tag: a GLib event source tag, or None

414

checker_callback_tag: a gobject event source tag, or None

777

415

checker_command: string; External command which is run to check

778

416

if client lives. %() expansions are done at

779

417

runtime with vars(self) as dict, so that for

780

418

instance %(name)s can be used in the command.

781

checker_initiator_tag: a GLib event source tag, or None

419

checker_initiator_tag: a gobject event source tag, or None

782

420

created: datetime.datetime(); (UTC) object creation

783

421

client_structure: Object describing what attributes a client has

784

422

and is used for storing the client at exit

785

423

current_checker_command: string; current running checker_command

786

disable_initiator_tag: a GLib event source tag, or None

424

disable_initiator_tag: a gobject event source tag, or None

787

425

enabled: bool()

788

426

fingerprint: string (40 or 32 hexadecimal digits); used to

789

427

uniquely identify the client

794

432

last_checker_status: integer between 0 and 255 reflecting exit

795

433

status of last checker. -1 reflects crashed

796

434

checker, -2 means no checker completed yet.

797

last_checker_signal: The signal which killed the last checker, if

798

last_checker_status is -1

799

435

last_enabled: datetime.datetime(); (UTC) or None

800

436

name: string; from the config file, used in log messages and

801

437

D-Bus identifiers

814

450

"fingerprint", "host", "interval",

815

451

"last_approval_request", "last_checked_ok",

816

452

"last_enabled", "name", "timeout")

817

client_defaults = {

818

"timeout": "PT5M",

819

"extended_timeout": "PT15M",

820

"interval": "PT2M",

821

"checker": "fping -q -- %%(host)s",

822

"host": "",

823

"approval_delay": "PT0S",

824

"approval_duration": "PT1S",

825

"approved_by_default": "True",

826

"enabled": "True",

827

}

453

client_defaults = { "timeout": "PT5M",

454

"extended_timeout": "PT15M",

455

"interval": "PT2M",

456

"checker": "fping -q -- %%(host)s",

457

"host": "",

458

"approval_delay": "PT0S",

459

"approval_duration": "PT1S",

460

"approved_by_default": "True",

461

"enabled": "True",

462

}

828

463

829

464

@staticmethod

830

465

def config_parser(config):

846

481

client["enabled"] = config.getboolean(client_name,

847

482

"enabled")

848

483

849

# Uppercase and remove spaces from fingerprint for later

850

# comparison purposes with return value from the

851

# fingerprint() function

852

484

client["fingerprint"] = (section["fingerprint"].upper()

853

485

.replace(" ", ""))

854

486

if "secret" in section:

855

client["secret"] = codecs.decode(section["secret"]

856

.encode("utf-8"),

857

"base64")

487

client["secret"] = section["secret"].decode("base64")

858

488

elif "secfile" in section:

859

489

with open(os.path.expanduser(os.path.expandvars

860

490

(section["secfile"])),

898

528

self.expires = None

899

529

900

530

logger.debug("Creating client %r", self.name)

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the fingerprint()

533

# function

901

534

logger.debug(" Fingerprint: %s", self.fingerprint)

902

535

self.created = settings.get("created",

903

536

datetime.datetime.utcnow())

910

543

self.current_checker_command = None

911

544

self.approved = None

912

545

self.approvals_pending = 0

913

self.changedstate = multiprocessing_manager.Condition(

914

multiprocessing_manager.Lock())

915

self.client_structure = [attr

916

for attr in self.__dict__.keys()

546

self.changedstate = (multiprocessing_manager

547

.Condition(multiprocessing_manager

548

.Lock()))

549

self.client_structure = [attr for attr in

550

self.__dict__.iterkeys()

917

551

if not attr.startswith("_")]

918

552

self.client_structure.append("client_structure")

919

553

920

for name, t in inspect.getmembers(

921

type(self), lambda obj: isinstance(obj, property)):

554

for name, t in inspect.getmembers(type(self),

555

lambda obj:

556

isinstance(obj,

557

property)):

922

558

if not name.startswith("_"):

923

559

self.client_structure.append(name)

924

560

945

581

if not quiet:

946

582

logger.info("Disabling client %s", self.name)

947

583

if getattr(self, "disable_initiator_tag", None) is not None:

948

GLib.source_remove(self.disable_initiator_tag)

584

gobject.source_remove(self.disable_initiator_tag)

949

585

self.disable_initiator_tag = None

950

586

self.expires = None

951

587

if getattr(self, "checker_initiator_tag", None) is not None:

952

GLib.source_remove(self.checker_initiator_tag)

588

gobject.source_remove(self.checker_initiator_tag)

953

589

self.checker_initiator_tag = None

954

590

self.stop_checker()

955

591

self.enabled = False

956

592

if not quiet:

957

593

self.send_changedstate()

958

# Do not run this again if called by a GLib.timeout_add

594

# Do not run this again if called by a gobject.timeout_add

959

595

return False

960

596

961

597

def __del__(self):

965

601

# Schedule a new checker to be started an 'interval' from now,

966

602

# and every interval from then on.

967

603

if self.checker_initiator_tag is not None:

968

GLib.source_remove(self.checker_initiator_tag)

969

self.checker_initiator_tag = GLib.timeout_add(

970

int(self.interval.total_seconds() * 1000),

971

self.start_checker)

604

gobject.source_remove(self.checker_initiator_tag)

605

self.checker_initiator_tag = (gobject.timeout_add

606

(int(self.interval

607

.total_seconds() * 1000),

608

self.start_checker))

972

609

# Schedule a disable() when 'timeout' has passed

973

610

if self.disable_initiator_tag is not None:

974

GLib.source_remove(self.disable_initiator_tag)

975

self.disable_initiator_tag = GLib.timeout_add(

976

int(self.timeout.total_seconds() * 1000), self.disable)

611

gobject.source_remove(self.disable_initiator_tag)

612

self.disable_initiator_tag = (gobject.timeout_add

613

(int(self.timeout

614

.total_seconds() * 1000),

615

self.disable))

977

616

# Also start a new checker *right now*.

978

617

self.start_checker()

979

618

980

def checker_callback(self, source, condition, connection,

981

command):

619

def checker_callback(self, pid, condition, command):

982

620

"""The checker has completed, so take appropriate actions."""

983

621

self.checker_callback_tag = None

984

622

self.checker = None

985

# Read return code from connection (see call_pipe)

986

returncode = connection.recv()

987

connection.close()

988

989

if returncode >= 0:

990

self.last_checker_status = returncode

991

self.last_checker_signal = None

623

if os.WIFEXITED(condition):

624

self.last_checker_status = os.WEXITSTATUS(condition)

992

625

if self.last_checker_status == 0:

993

626

logger.info("Checker for %(name)s succeeded",

994

627

vars(self))

995

628

self.checked_ok()

996

629

else:

997

logger.info("Checker for %(name)s failed", vars(self))

630

logger.info("Checker for %(name)s failed",

631

vars(self))

998

632

else:

999

633

self.last_checker_status = -1

1000

self.last_checker_signal = -returncode

1001

634

logger.warning("Checker for %(name)s crashed?",

1002

635

vars(self))

1003

return False

1004

636

1005

637

def checked_ok(self):

1006

638

"""Assert that the client has been seen, alive and well."""

1007

639

self.last_checked_ok = datetime.datetime.utcnow()

1008

640

self.last_checker_status = 0

1009

self.last_checker_signal = None

1010

641

self.bump_timeout()

1011

642

1012

643

def bump_timeout(self, timeout=None):

1014

645

if timeout is None:

1015

646

timeout = self.timeout

1016

647

if self.disable_initiator_tag is not None:

1017

GLib.source_remove(self.disable_initiator_tag)

648

gobject.source_remove(self.disable_initiator_tag)

1018

649

self.disable_initiator_tag = None

1019

650

if getattr(self, "enabled", False):

1020

self.disable_initiator_tag = GLib.timeout_add(

1021

int(timeout.total_seconds() * 1000), self.disable)

651

self.disable_initiator_tag = (gobject.timeout_add

652

(int(timeout.total_seconds()

653

* 1000), self.disable))

1022

654

self.expires = datetime.datetime.utcnow() + timeout

1023

655

1024

656

def need_approval(self):

1038

670

# than 'timeout' for the client to be disabled, which is as it

1039

671

# should be.

1040

672

1041

if self.checker is not None and not self.checker.is_alive():

1042

logger.warning("Checker was not alive; joining")

1043

self.checker.join()

1044

self.checker = None

673

# If a checker exists, make sure it is not a zombie

674

try:

675

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

676

except AttributeError:

677

pass

678

except OSError as error:

679

if error.errno != errno.ECHILD:

680

raise

681

else:

682

if pid:

683

logger.warning("Checker was a zombie")

684

gobject.source_remove(self.checker_callback_tag)

685

self.checker_callback(pid, status,

686

self.current_checker_command)

1045

687

# Start a new checker if needed

1046

688

if self.checker is None:

1047

689

# Escape attributes for the shell

1048

escaped_attrs = {

1049

attr: re.escape(str(getattr(self, attr)))

1050

for attr in self.runtime_expansions }

690

escaped_attrs = { attr:

691

re.escape(str(getattr(self, attr)))

692

for attr in self.runtime_expansions }

1051

693

try:

1052

694

command = self.checker_command % escaped_attrs

1053

695

except TypeError as error:

1054

696

logger.error('Could not format string "%s"',

1055

self.checker_command,

697

self.checker_command, exc_info=error)

698

return True # Try again later

699

self.current_checker_command = command

700

try:

701

logger.info("Starting checker %r for %s",

702

command, self.name)

703

# We don't need to redirect stdout and stderr, since

704

# in normal mode, that is already done by daemon(),

705

# and in debug mode we don't want to. (Stdin is

706

# always replaced by /dev/null.)

707

# The exception is when not debugging but nevertheless

708

# running in the foreground; use the previously

709

# created wnull.

710

popen_args = {}

711

if (not self.server_settings["debug"]

712

and self.server_settings["foreground"]):

713

popen_args.update({"stdout": wnull,

714

"stderr": wnull })

715

self.checker = subprocess.Popen(command,

716

close_fds=True,

717

shell=True, cwd="/",

718

**popen_args)

719

except OSError as error:

720

logger.error("Failed to start subprocess",

1056

721

exc_info=error)

1057

return True # Try again later

1058

self.current_checker_command = command

1059

logger.info("Starting checker %r for %s", command,

1060

self.name)

1061

# We don't need to redirect stdout and stderr, since

1062

# in normal mode, that is already done by daemon(),

1063

# and in debug mode we don't want to. (Stdin is

1064

# always replaced by /dev/null.)

1065

# The exception is when not debugging but nevertheless

1066

# running in the foreground; use the previously

1067

# created wnull.

1068

popen_args = { "close_fds": True,

1069

"shell": True,

1070

"cwd": "/" }

1071

if (not self.server_settings["debug"]

1072

and self.server_settings["foreground"]):

1073

popen_args.update({"stdout": wnull,

1074

"stderr": wnull })

1075

pipe = multiprocessing.Pipe(duplex = False)

1076

self.checker = multiprocessing.Process(

1077

target = call_pipe,

1078

args = (pipe[1], subprocess.call, command),

1079

kwargs = popen_args)

1080

self.checker.start()

1081

self.checker_callback_tag = GLib.io_add_watch(

1082

pipe[0].fileno(), GLib.IO_IN,

1083

self.checker_callback, pipe[0], command)

1084

# Re-run this periodically if run by GLib.timeout_add

722

return True

723

self.checker_callback_tag = (gobject.child_watch_add

724

(self.checker.pid,

725

self.checker_callback,

726

data=command))

727

# The checker may have completed before the gobject

728

# watch was added. Check for this.

729

try:

730

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

731

except OSError as error:

732

if error.errno == errno.ECHILD:

733

# This should never happen

734

logger.error("Child process vanished",

735

exc_info=error)

736

return True

737

raise

738

if pid:

739

gobject.source_remove(self.checker_callback_tag)

740

self.checker_callback(pid, status, command)

741

# Re-run this periodically if run by gobject.timeout_add

1085

742

return True

1086

743

1087

744

def stop_checker(self):

1088

745

"""Force the checker process, if any, to stop."""

1089

746

if self.checker_callback_tag:

1090

GLib.source_remove(self.checker_callback_tag)

747

gobject.source_remove(self.checker_callback_tag)

1091

748

self.checker_callback_tag = None

1092

749

if getattr(self, "checker", None) is None:

1093

750

return

1094

751

logger.debug("Stopping checker for %(name)s", vars(self))

1095

self.checker.terminate()

752

try:

753

self.checker.terminate()

754

#time.sleep(0.5)

755

#if self.checker.poll() is None:

756

# self.checker.kill()

757

except OSError as error:

758

if error.errno != errno.ESRCH: # No such process

759

raise

1096

760

self.checker = None

1097

761

1098

762

1099

def dbus_service_property(dbus_interface,

1100

signature="v",

1101

access="readwrite",

1102

byte_arrays=False):

763

def dbus_service_property(dbus_interface, signature="v",

764

access="readwrite", byte_arrays=False):

1103

765

"""Decorators for marking methods of a DBusObjectWithProperties to

1104

766

become properties on the D-Bus.

1105

767

1115

777

if byte_arrays and signature != "ay":

1116

778

raise ValueError("Byte arrays not supported for non-'ay'"

1117

779

" signature {!r}".format(signature))

1118

1119

780

def decorator(func):

1120

781

func._dbus_is_property = True

1121

782

func._dbus_interface = dbus_interface

1126

787

func._dbus_name = func._dbus_name[:-14]

1127

788

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1128

789

return func

1129

1130

790

return decorator

1131

791

1132

792

1141

801

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1142

802

"false"}

1143

803

"""

1144

1145

804

def decorator(func):

1146

805

func._dbus_is_interface = True

1147

806

func._dbus_interface = dbus_interface

1148

807

func._dbus_name = dbus_interface

1149

808

return func

1150

1151

809

return decorator

1152

810

1153

811

1162

820

access="r")

1163

821

def Property_dbus_property(self):

1164

822

return dbus.Boolean(False)

1165

1166

See also the DBusObjectWithAnnotations class.

1167

823

"""

1168

1169

824

def decorator(func):

1170

825

func._dbus_annotations = annotations

1171

826

return func

1172

1173

827

return decorator

1174

828

1175

829

1178

832

"""

1179

833

pass

1180

834

1181

1182

835

class DBusPropertyAccessException(DBusPropertyException):

1183

836

"""A property's access permissions disallows an operation.

1184

837

"""

1191

844

pass

1192

845

1193

846

1194

class DBusObjectWithAnnotations(dbus.service.Object):

1195

"""A D-Bus object with annotations.

847

class DBusObjectWithProperties(dbus.service.Object):

848

"""A D-Bus object with properties.

1196

849

1197

Classes inheriting from this can use the dbus_annotations

1198

decorator to add annotations to methods or signals.

850

Classes inheriting from this can use the dbus_service_property

851

decorator to expose methods as D-Bus properties. It exposes the

852

standard Get(), Set(), and GetAll() methods on the D-Bus.

1199

853

"""

1200

854

1201

855

@staticmethod

1211

865

def _get_all_dbus_things(self, thing):

1212

866

"""Returns a generator of (name, attribute) pairs

1213

867

"""

1214

return ((getattr(athing.__get__(self), "_dbus_name", name),

868

return ((getattr(athing.__get__(self), "_dbus_name",

869

name),

1215

870

athing.__get__(self))

1216

871

for cls in self.__class__.__mro__

1217

872

for name, athing in

1218

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1219

1220

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1221

out_signature = "s",

1222

path_keyword = 'object_path',

1223

connection_keyword = 'connection')

1224

def Introspect(self, object_path, connection):

1225

"""Overloading of standard D-Bus method.

1226

1227

Inserts annotation tags on methods and signals.

1228

"""

1229

xmlstring = dbus.service.Object.Introspect(self, object_path,

1230

connection)

1231

try:

1232

document = xml.dom.minidom.parseString(xmlstring)

1233

1234

for if_tag in document.getElementsByTagName("interface"):

1235

# Add annotation tags

1236

for typ in ("method", "signal"):

1237

for tag in if_tag.getElementsByTagName(typ):

1238

annots = dict()

1239

for name, prop in (self.

1240

_get_all_dbus_things(typ)):

1241

if (name == tag.getAttribute("name")

1242

and prop._dbus_interface

1243

== if_tag.getAttribute("name")):

1244

annots.update(getattr(

1245

prop, "_dbus_annotations", {}))

1246

for name, value in annots.items():

1247

ann_tag = document.createElement(

1248

"annotation")

1249

ann_tag.setAttribute("name", name)

1250

ann_tag.setAttribute("value", value)

1251

tag.appendChild(ann_tag)

1252

# Add interface annotation tags

1253

for annotation, value in dict(

1254

itertools.chain.from_iterable(

1255

annotations().items()

1256

for name, annotations

1257

in self._get_all_dbus_things("interface")

1258

if name == if_tag.getAttribute("name")

1259

)).items():

1260

ann_tag = document.createElement("annotation")

1261

ann_tag.setAttribute("name", annotation)

1262

ann_tag.setAttribute("value", value)

1263

if_tag.appendChild(ann_tag)

1264

# Fix argument name for the Introspect method itself

1265

if (if_tag.getAttribute("name")

1266

== dbus.INTROSPECTABLE_IFACE):

1267

for cn in if_tag.getElementsByTagName("method"):

1268

if cn.getAttribute("name") == "Introspect":

1269

for arg in cn.getElementsByTagName("arg"):

1270

if (arg.getAttribute("direction")

1271

== "out"):

1272

arg.setAttribute("name",

1273

"xml_data")

1274

xmlstring = document.toxml("utf-8")

1275

document.unlink()

1276

except (AttributeError, xml.dom.DOMException,

1277

xml.parsers.expat.ExpatError) as error:

1278

logger.error("Failed to override Introspection method",

1279

exc_info=error)

1280

return xmlstring

1281

1282

1283

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1284

"""A D-Bus object with properties.

1285

1286

Classes inheriting from this can use the dbus_service_property

1287

decorator to expose methods as D-Bus properties. It exposes the

1288

standard Get(), Set(), and GetAll() methods on the D-Bus.

1289

"""

873

inspect.getmembers(cls,

874

self._is_dbus_thing(thing)))

1290

875

1291

876

def _get_dbus_property(self, interface_name, property_name):

1292

877

"""Returns a bound method if one exists which is a D-Bus

1293

878

property with the specified name and interface.

1294

879

"""

1295

for cls in self.__class__.__mro__:

1296

for name, value in inspect.getmembers(

1297

cls, self._is_dbus_thing("property")):

880

for cls in self.__class__.__mro__:

881

for name, value in (inspect.getmembers

882

(cls,

883

self._is_dbus_thing("property"))):

1298

884

if (value._dbus_name == property_name

1299

885

and value._dbus_interface == interface_name):

1300

886

return value.__get__(self)

1301

887

1302

888

# No such property

1303

raise DBusPropertyNotFound("{}:{}.{}".format(

1304

self.dbus_object_path, interface_name, property_name))

1305

1306

@classmethod

1307

def _get_all_interface_names(cls):

1308

"""Get a sequence of all interfaces supported by an object"""

1309

return (name for name in set(getattr(getattr(x, attr),

1310

"_dbus_interface", None)

1311

for x in (inspect.getmro(cls))

1312

for attr in dir(x))

1313

if name is not None)

1314

1315

@dbus.service.method(dbus.PROPERTIES_IFACE,

1316

in_signature="ss",

889

raise DBusPropertyNotFound(self.dbus_object_path + ":"

890

+ interface_name + "."

891

+ property_name)

892

893

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1317

894

out_signature="v")

1318

895

def Get(self, interface_name, property_name):

1319

896

"""Standard D-Bus property Get() method, see D-Bus standard.

1344

921

for byte in value))

1345

922

prop(value)

1346

923

1347

@dbus.service.method(dbus.PROPERTIES_IFACE,

1348

in_signature="s",

924

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1349

925

out_signature="a{sv}")

1350

926

def GetAll(self, interface_name):

1351

927

"""Standard D-Bus property GetAll() method, see D-Bus

1366

942

if not hasattr(value, "variant_level"):

1367

943

properties[name] = value

1368

944

continue

1369

properties[name] = type(value)(

1370

value, variant_level = value.variant_level + 1)

945

properties[name] = type(value)(value, variant_level=

946

value.variant_level+1)

1371

947

return dbus.Dictionary(properties, signature="sv")

1372

948

1373

949

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1387

963

1388

964

Inserts property tags and interface annotation tags.

1389

965

"""

1390

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1391

object_path,

1392

connection)

966

xmlstring = dbus.service.Object.Introspect(self, object_path,

967

connection)

1393

968

try:

1394

969

document = xml.dom.minidom.parseString(xmlstring)

1395

1396

970

def make_tag(document, name, prop):

1397

971

e = document.createElement("property")

1398

972

e.setAttribute("name", name)

1399

973

e.setAttribute("type", prop._dbus_signature)

1400

974

e.setAttribute("access", prop._dbus_access)

1401

975

return e

1402

1403

976

for if_tag in document.getElementsByTagName("interface"):

1404

977

# Add property tags

1405

978

for tag in (make_tag(document, name, prop)

1408

981

if prop._dbus_interface

1409

982

== if_tag.getAttribute("name")):

1410

983

if_tag.appendChild(tag)

1411

# Add annotation tags for properties

1412

for tag in if_tag.getElementsByTagName("property"):

1413

annots = dict()

1414

for name, prop in self._get_all_dbus_things(

1415

"property"):

1416

if (name == tag.getAttribute("name")

1417

and prop._dbus_interface

1418

== if_tag.getAttribute("name")):

1419

annots.update(getattr(

1420

prop, "_dbus_annotations", {}))

1421

for name, value in annots.items():

1422

ann_tag = document.createElement(

1423

"annotation")

1424

ann_tag.setAttribute("name", name)

1425

ann_tag.setAttribute("value", value)

1426

tag.appendChild(ann_tag)

984

# Add annotation tags

985

for typ in ("method", "signal", "property"):

986

for tag in if_tag.getElementsByTagName(typ):

987

annots = dict()

988

for name, prop in (self.

989

_get_all_dbus_things(typ)):

990

if (name == tag.getAttribute("name")

991

and prop._dbus_interface

992

== if_tag.getAttribute("name")):

993

annots.update(getattr

994

(prop,

995

"_dbus_annotations",

996

{}))

997

for name, value in annots.items():

998

ann_tag = document.createElement(

999

"annotation")

1000

ann_tag.setAttribute("name", name)

1001

ann_tag.setAttribute("value", value)

1002

tag.appendChild(ann_tag)

1003

# Add interface annotation tags

1004

for annotation, value in dict(

1005

itertools.chain.from_iterable(

1006

annotations().items()

1007

for name, annotations in

1008

self._get_all_dbus_things("interface")

1009

if name == if_tag.getAttribute("name")

1010

)).items():

1011

ann_tag = document.createElement("annotation")

1012

ann_tag.setAttribute("name", annotation)

1013

ann_tag.setAttribute("value", value)

1014

if_tag.appendChild(ann_tag)

1427

1015

# Add the names to the return values for the

1428

1016

# "org.freedesktop.DBus.Properties" methods

1429

1017

if (if_tag.getAttribute("name")

1447

1035

exc_info=error)

1448

1036

return xmlstring

1449

1037

1450

try:

1451

dbus.OBJECT_MANAGER_IFACE

1452

except AttributeError:

1453

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1454

1455

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1456

"""A D-Bus object with an ObjectManager.

1457

1458

Classes inheriting from this exposes the standard

1459

GetManagedObjects call and the InterfacesAdded and

1460

InterfacesRemoved signals on the standard

1461

"org.freedesktop.DBus.ObjectManager" interface.

1462

1463

Note: No signals are sent automatically; they must be sent

1464

manually.

1465

"""

1466

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1467

out_signature = "a{oa{sa{sv}}}")

1468

def GetManagedObjects(self):

1469

"""This function must be overridden"""

1470

raise NotImplementedError()

1471

1472

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1473

signature = "oa{sa{sv}}")

1474

def InterfacesAdded(self, object_path, interfaces_and_properties):

1475

pass

1476

1477

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1478

def InterfacesRemoved(self, object_path, interfaces):

1479

pass

1480

1481

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1482

out_signature = "s",

1483

path_keyword = 'object_path',

1484

connection_keyword = 'connection')

1485

def Introspect(self, object_path, connection):

1486

"""Overloading of standard D-Bus method.

1487

1488

Override return argument name of GetManagedObjects to be

1489

"objpath_interfaces_and_properties"

1490

"""

1491

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1492

object_path,

1493

connection)

1494

try:

1495

document = xml.dom.minidom.parseString(xmlstring)

1496

1497

for if_tag in document.getElementsByTagName("interface"):

1498

# Fix argument name for the GetManagedObjects method

1499

if (if_tag.getAttribute("name")

1500

== dbus.OBJECT_MANAGER_IFACE):

1501

for cn in if_tag.getElementsByTagName("method"):

1502

if (cn.getAttribute("name")

1503

== "GetManagedObjects"):

1504

for arg in cn.getElementsByTagName("arg"):

1505

if (arg.getAttribute("direction")

1506

== "out"):

1507

arg.setAttribute(

1508

"name",

1509

"objpath_interfaces"

1510

"_and_properties")

1511

xmlstring = document.toxml("utf-8")

1512

document.unlink()

1513

except (AttributeError, xml.dom.DOMException,

1514

xml.parsers.expat.ExpatError) as error:

1515

logger.error("Failed to override Introspection method",

1516

exc_info = error)

1517

return xmlstring

1518

1038

1519

1039

def datetime_to_dbus(dt, variant_level=0):

1520

1040

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1521

1041

if dt is None:

1522

1042

return dbus.String("", variant_level = variant_level)

1523

return dbus.String(dt.isoformat(), variant_level=variant_level)

1043

return dbus.String(dt.isoformat(),

1044

variant_level=variant_level)

1524

1045

1525

1046

1526

1047

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1546

1067

(from DBusObjectWithProperties) and interfaces (from the

1547

1068

dbus_interface_annotations decorator).

1548

1069

"""

1549

1550

1070

def wrapper(cls):

1551

1071

for orig_interface_name, alt_interface_name in (

1552

alt_interface_names.items()):

1072

alt_interface_names.items()):

1553

1073

attr = {}

1554

1074

interface_names = set()

1555

1075

# Go though all attributes of the class

1557

1077

# Ignore non-D-Bus attributes, and D-Bus attributes

1558

1078

# with the wrong interface name

1559

1079

if (not hasattr(attribute, "_dbus_interface")

1560

or not attribute._dbus_interface.startswith(

1561

orig_interface_name)):

1080

or not attribute._dbus_interface

1081

.startswith(orig_interface_name)):

1562

1082

continue

1563

1083

# Create an alternate D-Bus interface name based on

1564

1084

# the current name

1565

alt_interface = attribute._dbus_interface.replace(

1566

orig_interface_name, alt_interface_name)

1085

alt_interface = (attribute._dbus_interface

1086

.replace(orig_interface_name,

1087

alt_interface_name))

1567

1088

interface_names.add(alt_interface)

1568

1089

# Is this a D-Bus signal?

1569

1090

if getattr(attribute, "_dbus_is_signal", False):

1570

1091

# Extract the original non-method undecorated

1571

1092

# function by black magic

1572

if sys.version_info.major == 2:

1573

nonmethod_func = (dict(

1093

nonmethod_func = (dict(

1574

1094

zip(attribute.func_code.co_freevars,

1575

attribute.__closure__))

1576

["func"].cell_contents)

1577

else:

1578

nonmethod_func = (dict(

1579

zip(attribute.__code__.co_freevars,

1580

attribute.__closure__))

1581

["func"].cell_contents)

1095

attribute.__closure__))["func"]

1096

.cell_contents)

1582

1097

# Create a new, but exactly alike, function

1583

1098

# object, and decorate it to be a new D-Bus signal

1584

1099

# with the alternate D-Bus interface name

1585

new_function = copy_function(nonmethod_func)

1586

new_function = (dbus.service.signal(

1587

alt_interface,

1588

attribute._dbus_signature)(new_function))

1100

new_function = (dbus.service.signal

1101

(alt_interface,

1102

attribute._dbus_signature)

1103

(types.FunctionType(

1104

nonmethod_func.func_code,

1105

nonmethod_func.func_globals,

1106

nonmethod_func.func_name,

1107

nonmethod_func.func_defaults,

1108

nonmethod_func.func_closure)))

1589

1109

# Copy annotations, if any

1590

1110

try:

1591

new_function._dbus_annotations = dict(

1592

attribute._dbus_annotations)

1111

new_function._dbus_annotations = (

1112

dict(attribute._dbus_annotations))

1593

1113

except AttributeError:

1594

1114

pass

1595

1115

# Define a creator of a function to call both the

1600

1120

"""This function is a scope container to pass

1601

1121

func1 and func2 to the "call_both" function

1602

1122

outside of its arguments"""

1603

1604

@functools.wraps(func2)

1605

1123

def call_both(*args, **kwargs):

1606

1124

"""This function will emit two D-Bus

1607

1125

signals by calling func1 and func2"""

1608

1126

func1(*args, **kwargs)

1609

1127

func2(*args, **kwargs)

1610

# Make wrapper function look like a D-Bus signal

1611

for name, attr in inspect.getmembers(func2):

1612

if name.startswith("_dbus_"):

1613

setattr(call_both, name, attr)

1614

1615

1128

return call_both

1616

1129

# Create the "call_both" function and add it to

1617

1130

# the class

1622

1135

# object. Decorate it to be a new D-Bus method

1623

1136

# with the alternate D-Bus interface name. Add it

1624

1137

# to the class.

1625

attr[attrname] = (

1626

dbus.service.method(

1627

alt_interface,

1628

attribute._dbus_in_signature,

1629

attribute._dbus_out_signature)

1630

(copy_function(attribute)))

1138

attr[attrname] = (dbus.service.method

1139

(alt_interface,

1140

attribute._dbus_in_signature,

1141

attribute._dbus_out_signature)

1142

(types.FunctionType

1143

(attribute.func_code,

1144

attribute.func_globals,

1145

attribute.func_name,

1146

attribute.func_defaults,

1147

attribute.func_closure)))

1631

1148

# Copy annotations, if any

1632

1149

try:

1633

attr[attrname]._dbus_annotations = dict(

1634

attribute._dbus_annotations)

1150

attr[attrname]._dbus_annotations = (

1151

dict(attribute._dbus_annotations))

1635

1152

except AttributeError:

1636

1153

pass

1637

1154

# Is this a D-Bus property?

1640

1157

# object, and decorate it to be a new D-Bus

1641

1158

# property with the alternate D-Bus interface

1642

1159

# name. Add it to the class.

1643

attr[attrname] = (dbus_service_property(

1644

alt_interface, attribute._dbus_signature,

1645

attribute._dbus_access,

1646

attribute._dbus_get_args_options

1647

["byte_arrays"])

1648

(copy_function(attribute)))

1160

attr[attrname] = (dbus_service_property

1161

(alt_interface,

1162

attribute._dbus_signature,

1163

attribute._dbus_access,

1164

attribute

1165

._dbus_get_args_options

1166

["byte_arrays"])

1167

(types.FunctionType

1168

(attribute.func_code,

1169

attribute.func_globals,

1170

attribute.func_name,

1171

attribute.func_defaults,

1172

attribute.func_closure)))

1649

1173

# Copy annotations, if any

1650

1174

try:

1651

attr[attrname]._dbus_annotations = dict(

1652

attribute._dbus_annotations)

1175

attr[attrname]._dbus_annotations = (

1176

dict(attribute._dbus_annotations))

1653

1177

except AttributeError:

1654

1178

pass

1655

1179

# Is this a D-Bus interface?

1658

1182

# object. Decorate it to be a new D-Bus interface

1659

1183

# with the alternate D-Bus interface name. Add it

1660

1184

# to the class.

1661

attr[attrname] = (

1662

dbus_interface_annotations(alt_interface)

1663

(copy_function(attribute)))

1185

attr[attrname] = (dbus_interface_annotations

1186

(alt_interface)

1187

(types.FunctionType

1188

(attribute.func_code,

1189

attribute.func_globals,

1190

attribute.func_name,

1191

attribute.func_defaults,

1192

attribute.func_closure)))

1664

1193

if deprecate:

1665

1194

# Deprecate all alternate interfaces

1666

1195

iname="_AlternateDBusNames_interface_annotation{}"

1667

1196

for interface_name in interface_names:

1668

1669

1197

@dbus_interface_annotations(interface_name)

1670

1198

def func(self):

1671

1199

return { "org.freedesktop.DBus.Deprecated":

1672

"true" }

1200

"true" }

1673

1201

# Find an unused name

1674

1202

for aname in (iname.format(i)

1675

1203

for i in itertools.count()):

1679

1207

if interface_names:

1680

1208

# Replace the class with a new subclass of it with

1681

1209

# methods, signals, etc. as created above.

1682

if sys.version_info.major == 2:

1683

cls = type(b"{}Alternate".format(cls.__name__),

1684

(cls, ), attr)

1685

else:

1686

cls = type("{}Alternate".format(cls.__name__),

1687

(cls, ), attr)

1210

cls = type(b"{}Alternate".format(cls.__name__),

1211

(cls,), attr)

1688

1212

return cls

1689

1690

1213

return wrapper

1691

1214

1692

1215

1693

1216

@alternate_dbus_interfaces({"se.recompile.Mandos":

1694

"se.bsnet.fukt.Mandos"})

1217

"se.bsnet.fukt.Mandos"})

1695

1218

class ClientDBus(Client, DBusObjectWithProperties):

1696

1219

"""A Client class using D-Bus

1697

1220

1701

1224

"""

1702

1225

1703

1226

runtime_expansions = (Client.runtime_expansions

1704

+ ("dbus_object_path", ))

1227

+ ("dbus_object_path",))

1705

1228

1706

1229

_interface = "se.recompile.Mandos.Client"

1707

1230

1715

1238

client_object_name = str(self.name).translate(

1716

1239

{ord("."): ord("_"),

1717

1240

ord("-"): ord("_")})

1718

self.dbus_object_path = dbus.ObjectPath(

1719

"/clients/" + client_object_name)

1241

self.dbus_object_path = (dbus.ObjectPath

1242

("/clients/" + client_object_name))

1720

1243

DBusObjectWithProperties.__init__(self, self.bus,

1721

1244

self.dbus_object_path)

1722

1245

1723

def notifychangeproperty(transform_func, dbus_name,

1724

type_func=lambda x: x,

1725

variant_level=1,

1726

invalidate_only=False,

1246

def notifychangeproperty(transform_func,

1247

dbus_name, type_func=lambda x: x,

1248

variant_level=1, invalidate_only=False,

1727

1249

_interface=_interface):

1728

1250

""" Modify a variable so that it's a property which announces

1729

1251

its changes to DBus.

1736

1258

variant_level: D-Bus variant level. Default: 1

1737

1259

"""

1738

1260

attrname = "_{}".format(dbus_name)

1739

1740

1261

def setter(self, value):

1741

1262

if hasattr(self, "dbus_object_path"):

1742

1263

if (not hasattr(self, attrname) or

1743

1264

type_func(getattr(self, attrname, None))

1744

1265

!= type_func(value)):

1745

1266

if invalidate_only:

1746

self.PropertiesChanged(

1747

_interface, dbus.Dictionary(),

1748

dbus.Array((dbus_name, )))

1267

self.PropertiesChanged(_interface,

1268

dbus.Dictionary(),

1269

dbus.Array

1270

((dbus_name,)))

1749

1271

else:

1750

dbus_value = transform_func(

1751

type_func(value),

1752

variant_level = variant_level)

1272

dbus_value = transform_func(type_func(value),

1273

variant_level

1274

=variant_level)

1753

1275

self.PropertyChanged(dbus.String(dbus_name),

1754

1276

dbus_value)

1755

self.PropertiesChanged(

1756

_interface,

1757

dbus.Dictionary({ dbus.String(dbus_name):

1758

dbus_value }),

1759

dbus.Array())

1277

self.PropertiesChanged(_interface,

1278

dbus.Dictionary({

1279

dbus.String(dbus_name):

1280

dbus_value }), dbus.Array())

1760

1281

setattr(self, attrname, value)

1761

1282

1762

1283

return property(lambda self: getattr(self, attrname), setter)

1768

1289

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1769

1290

last_enabled = notifychangeproperty(datetime_to_dbus,

1770

1291

"LastEnabled")

1771

checker = notifychangeproperty(

1772

dbus.Boolean, "CheckerRunning",

1773

type_func = lambda checker: checker is not None)

1292

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1293

type_func = lambda checker:

1294

checker is not None)

1774

1295

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1775

1296

"LastCheckedOK")

1776

1297

last_checker_status = notifychangeproperty(dbus.Int16,

1779

1300

datetime_to_dbus, "LastApprovalRequest")

1780

1301

approved_by_default = notifychangeproperty(dbus.Boolean,

1781

1302

"ApprovedByDefault")

1782

approval_delay = notifychangeproperty(

1783

dbus.UInt64, "ApprovalDelay",

1784

type_func = lambda td: td.total_seconds() * 1000)

1303

approval_delay = notifychangeproperty(dbus.UInt64,

1304

"ApprovalDelay",

1305

type_func =

1306

lambda td: td.total_seconds()

1307

* 1000)

1785

1308

approval_duration = notifychangeproperty(

1786

1309

dbus.UInt64, "ApprovalDuration",

1787

1310

type_func = lambda td: td.total_seconds() * 1000)

1788

1311

host = notifychangeproperty(dbus.String, "Host")

1789

timeout = notifychangeproperty(

1790

dbus.UInt64, "Timeout",

1791

type_func = lambda td: td.total_seconds() * 1000)

1312

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1313

type_func = lambda td:

1314

td.total_seconds() * 1000)

1792

1315

extended_timeout = notifychangeproperty(

1793

1316

dbus.UInt64, "ExtendedTimeout",

1794

1317

type_func = lambda td: td.total_seconds() * 1000)

1795

interval = notifychangeproperty(

1796

dbus.UInt64, "Interval",

1797

type_func = lambda td: td.total_seconds() * 1000)

1318

interval = notifychangeproperty(dbus.UInt64,

1319

"Interval",

1320

type_func =

1321

lambda td: td.total_seconds()

1322

* 1000)

1798

1323

checker_command = notifychangeproperty(dbus.String, "Checker")

1799

1324

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1800

1325

invalidate_only=True)

1810

1335

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1811

1336

Client.__del__(self, *args, **kwargs)

1812

1337

1813

def checker_callback(self, source, condition,

1814

connection, command, *args, **kwargs):

1815

ret = Client.checker_callback(self, source, condition,

1816

connection, command, *args,

1817

**kwargs)

1818

exitstatus = self.last_checker_status

1819

if exitstatus >= 0:

1338

def checker_callback(self, pid, condition, command,

1339

*args, **kwargs):

1340

self.checker_callback_tag = None

1341

self.checker = None

1342

if os.WIFEXITED(condition):

1343

exitstatus = os.WEXITSTATUS(condition)

1820

1344

# Emit D-Bus signal

1821

1345

self.CheckerCompleted(dbus.Int16(exitstatus),

1822

# This is specific to GNU libC

1823

dbus.Int64(exitstatus << 8),

1346

dbus.Int64(condition),

1824

1347

dbus.String(command))

1825

1348

else:

1826

1349

# Emit D-Bus signal

1827

1350

self.CheckerCompleted(dbus.Int16(-1),

1828

dbus.Int64(

1829

# This is specific to GNU libC

1830

(exitstatus << 8)

1831

| self.last_checker_signal),

1351

dbus.Int64(condition),

1832

1352

dbus.String(command))

1833

return ret

1353

1354

return Client.checker_callback(self, pid, condition, command,

1355

*args, **kwargs)

1834

1356

1835

1357

def start_checker(self, *args, **kwargs):

1836

1358

old_checker_pid = getattr(self.checker, "pid", None)

1848

1370

1849

1371

def approve(self, value=True):

1850

1372

self.approved = value

1851

GLib.timeout_add(int(self.approval_duration.total_seconds()

1852

* 1000), self._reset_approved)

1373

gobject.timeout_add(int(self.approval_duration.total_seconds()

1374

* 1000), self._reset_approved)

1853

1375

self.send_changedstate()

1854

1376

1855

1377

## D-Bus methods, signals & properties

1911

1433

self.checked_ok()

1912

1434

1913

1435

# Enable - method

1914

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1915

1436

@dbus.service.method(_interface)

1916

1437

def Enable(self):

1917

1438

"D-Bus method"

1918

1439

self.enable()

1919

1440

1920

1441

# StartChecker - method

1921

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1922

1442

@dbus.service.method(_interface)

1923

1443

def StartChecker(self):

1924

1444

"D-Bus method"

1925

1445

self.start_checker()

1926

1446

1927

1447

# Disable - method

1928

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1929

1448

@dbus.service.method(_interface)

1930

1449

def Disable(self):

1931

1450

"D-Bus method"

1932

1451

self.disable()

1933

1452

1934

1453

# StopChecker - method

1935

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1936

1454

@dbus.service.method(_interface)

1937

1455

def StopChecker(self):

1938

1456

self.stop_checker()

1945

1463

return dbus.Boolean(bool(self.approvals_pending))

1946

1464

1947

1465

# ApprovedByDefault - property

1948

@dbus_service_property(_interface,

1949

signature="b",

1466

@dbus_service_property(_interface, signature="b",

1950

1467

access="readwrite")

1951

1468

def ApprovedByDefault_dbus_property(self, value=None):

1952

1469

if value is None: # get

1954

1471

self.approved_by_default = bool(value)

1955

1472

1956

1473

# ApprovalDelay - property

1957

@dbus_service_property(_interface,

1958

signature="t",

1474

@dbus_service_property(_interface, signature="t",

1959

1475

access="readwrite")

1960

1476

def ApprovalDelay_dbus_property(self, value=None):

1961

1477

if value is None: # get

1964

1480

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1965

1481

1966

1482

# ApprovalDuration - property

1967

@dbus_service_property(_interface,

1968

signature="t",

1483

@dbus_service_property(_interface, signature="t",

1969

1484

access="readwrite")

1970

1485

def ApprovalDuration_dbus_property(self, value=None):

1971

1486

if value is None: # get

1974

1489

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1975

1490

1976

1491

# Name - property

1977

@dbus_annotations(

1978

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1979

1492

@dbus_service_property(_interface, signature="s", access="read")

1980

1493

def Name_dbus_property(self):

1981

1494

return dbus.String(self.name)

1982

1495

1983

1496

# Fingerprint - property

1984

@dbus_annotations(

1985

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1986

1497

@dbus_service_property(_interface, signature="s", access="read")

1987

1498

def Fingerprint_dbus_property(self):

1988

1499

return dbus.String(self.fingerprint)

1989

1500

1990

1501

# Host - property

1991

@dbus_service_property(_interface,

1992

signature="s",

1502

@dbus_service_property(_interface, signature="s",

1993

1503

access="readwrite")

1994

1504

def Host_dbus_property(self, value=None):

1995

1505

if value is None: # get

1997

1507

self.host = str(value)

1998

1508

1999

1509

# Created - property

2000

@dbus_annotations(

2001

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

2002

1510

@dbus_service_property(_interface, signature="s", access="read")

2003

1511

def Created_dbus_property(self):

2004

1512

return datetime_to_dbus(self.created)

2009

1517

return datetime_to_dbus(self.last_enabled)

2010

1518

2011

1519

# Enabled - property

2012

@dbus_service_property(_interface,

2013

signature="b",

1520

@dbus_service_property(_interface, signature="b",

2014

1521

access="readwrite")

2015

1522

def Enabled_dbus_property(self, value=None):

2016

1523

if value is None: # get

2021

1528

self.disable()

2022

1529

2023

1530

# LastCheckedOK - property

2024

@dbus_service_property(_interface,

2025

signature="s",

1531

@dbus_service_property(_interface, signature="s",

2026

1532

access="readwrite")

2027

1533

def LastCheckedOK_dbus_property(self, value=None):

2028

1534

if value is not None:

2031

1537

return datetime_to_dbus(self.last_checked_ok)

2032

1538

2033

1539

# LastCheckerStatus - property

2034

@dbus_service_property(_interface, signature="n", access="read")

1540

@dbus_service_property(_interface, signature="n",

1541

access="read")

2035

1542

def LastCheckerStatus_dbus_property(self):

2036

1543

return dbus.Int16(self.last_checker_status)

2037

1544

2046

1553

return datetime_to_dbus(self.last_approval_request)

2047

1554

2048

1555

# Timeout - property

2049

@dbus_service_property(_interface,

2050

signature="t",

1556

@dbus_service_property(_interface, signature="t",

2051

1557

access="readwrite")

2052

1558

def Timeout_dbus_property(self, value=None):

2053

1559

if value is None: # get

2065

1571

if (getattr(self, "disable_initiator_tag", None)

2066

1572

is None):

2067

1573

return

2068

GLib.source_remove(self.disable_initiator_tag)

2069

self.disable_initiator_tag = GLib.timeout_add(

2070

int((self.expires - now).total_seconds() * 1000),

2071

self.disable)

1574

gobject.source_remove(self.disable_initiator_tag)

1575

self.disable_initiator_tag = (

1576

gobject.timeout_add(

1577

int((self.expires - now).total_seconds()

1578

* 1000), self.disable))

2072

1579

2073

1580

# ExtendedTimeout - property

2074

@dbus_service_property(_interface,

2075

signature="t",

1581

@dbus_service_property(_interface, signature="t",

2076

1582

access="readwrite")

2077

1583

def ExtendedTimeout_dbus_property(self, value=None):

2078

1584

if value is None: # get

2081

1587

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2082

1588

2083

1589

# Interval - property

2084

@dbus_service_property(_interface,

2085

signature="t",

1590

@dbus_service_property(_interface, signature="t",

2086

1591

access="readwrite")

2087

1592

def Interval_dbus_property(self, value=None):

2088

1593

if value is None: # get

2092

1597

return

2093

1598

if self.enabled:

2094

1599

# Reschedule checker run

2095

GLib.source_remove(self.checker_initiator_tag)

2096

self.checker_initiator_tag = GLib.timeout_add(

2097

value, self.start_checker)

2098

self.start_checker() # Start one now, too

1600

gobject.source_remove(self.checker_initiator_tag)

1601

self.checker_initiator_tag = (gobject.timeout_add

1602

(value, self.start_checker))

1603

self.start_checker() # Start one now, too

2099

1604

2100

1605

# Checker - property

2101

@dbus_service_property(_interface,

2102

signature="s",

1606

@dbus_service_property(_interface, signature="s",

2103

1607

access="readwrite")

2104

1608

def Checker_dbus_property(self, value=None):

2105

1609

if value is None: # get

2107

1611

self.checker_command = str(value)

2108

1612

2109

1613

# CheckerRunning - property

2110

@dbus_service_property(_interface,

2111

signature="b",

1614

@dbus_service_property(_interface, signature="b",

2112

1615

access="readwrite")

2113

1616

def CheckerRunning_dbus_property(self, value=None):

2114

1617

if value is None: # get

2119

1622

self.stop_checker()

2120

1623

2121

1624

# ObjectPath - property

2122

@dbus_annotations(

2123

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2124

"org.freedesktop.DBus.Deprecated": "true"})

2125

1625

@dbus_service_property(_interface, signature="o", access="read")

2126

1626

def ObjectPath_dbus_property(self):

2127

1627

return self.dbus_object_path # is already a dbus.ObjectPath

2128

1628

2129

1629

# Secret = property

2130

@dbus_annotations(

2131

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2132

"invalidates"})

2133

@dbus_service_property(_interface,

2134

signature="ay",

2135

access="write",

2136

byte_arrays=True)

1630

@dbus_service_property(_interface, signature="ay",

1631

access="write", byte_arrays=True)

2137

1632

def Secret_dbus_property(self, value):

2138

1633

self.secret = bytes(value)

2139

1634

2145

1640

self._pipe = child_pipe

2146

1641

self._pipe.send(('init', fpr, address))

2147

1642

if not self._pipe.recv():

2148

raise KeyError(fpr)

1643

raise KeyError()

2149

1644

2150

1645

def __getattribute__(self, name):

2151

1646

if name == '_pipe':

2155

1650

if data[0] == 'data':

2156

1651

return data[1]

2157

1652

if data[0] == 'function':

2158

2159

1653

def func(*args, **kwargs):

2160

1654

self._pipe.send(('funcall', name, args, kwargs))

2161

1655

return self._pipe.recv()[1]

2162

2163

1656

return func

2164

1657

2165

1658

def __setattr__(self, name, value):

2181

1674

logger.debug("Pipe FD: %d",

2182

1675

self.server.child_pipe.fileno())

2183

1676

2184

session = gnutls.ClientSession(self.request)

1677

session = (gnutls.connection

1678

.ClientSession(self.request,

1679

gnutls.connection

1680

.X509Credentials()))

1681

1682

# Note: gnutls.connection.X509Credentials is really a

1683

# generic GnuTLS certificate credentials object so long as

1684

# no X.509 keys are added to it. Therefore, we can use it

1685

# here despite using OpenPGP certificates.

2185

1686

2186

1687

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

2187

1688

# "+AES-256-CBC", "+SHA1",

2191

1692

priority = self.server.gnutls_priority

2192

1693

if priority is None:

2193

1694

priority = "NORMAL"

2194

gnutls.priority_set_direct(session._c_object,

2195

priority.encode("utf-8"),

2196

None)

1695

(gnutls.library.functions

1696

.gnutls_priority_set_direct(session._c_object,

1697

priority, None))

2197

1698

2198

1699

# Start communication using the Mandos protocol

2199

1700

# Get protocol number

2209

1710

# Start GnuTLS connection

2210

1711

try:

2211

1712

session.handshake()

2212

except gnutls.Error as error:

1713

except gnutls.errors.GNUTLSError as error:

2213

1714

logger.warning("Handshake failed: %s", error)

2214

1715

# Do not run session.bye() here: the session is not

2215

1716

# established. Just abandon the request.

2219

1720

approval_required = False

2220

1721

try:

2221

1722

try:

2222

fpr = self.fingerprint(

2223

self.peer_certificate(session))

2224

except (TypeError, gnutls.Error) as error:

1723

fpr = self.fingerprint(self.peer_certificate

1724

(session))

1725

except (TypeError,

1726

gnutls.errors.GNUTLSError) as error:

2225

1727

logger.warning("Bad certificate: %s", error)

2226

1728

return

2227

1729

logger.debug("Fingerprint: %s", fpr)

2240

1742

while True:

2241

1743

if not client.enabled:

2242

1744

logger.info("Client %s is disabled",

2243

client.name)

1745

client.name)

2244

1746

if self.server.use_dbus:

2245

1747

# Emit D-Bus signal

2246

1748

client.Rejected("Disabled")

2285

1787

else:

2286

1788

delay -= time2 - time

2287

1789

2288

try:

2289

session.send(client.secret)

2290

except gnutls.Error as error:

2291

logger.warning("gnutls send failed",

2292

exc_info = error)

2293

return

1790

sent_size = 0

1791

while sent_size < len(client.secret):

1792

try:

1793

sent = session.send(client.secret[sent_size:])

1794

except gnutls.errors.GNUTLSError as error:

1795

logger.warning("gnutls send failed",

1796

exc_info=error)

1797

return

1798

logger.debug("Sent: %d, remaining: %d",

1799

sent, len(client.secret)

1800

- (sent_size + sent))

1801

sent_size += sent

2294

1802

2295

1803

logger.info("Sending secret to %s", client.name)

2296

1804

# bump the timeout using extended_timeout

2304

1812

client.approvals_pending -= 1

2305

1813

try:

2306

1814

session.bye()

2307

except gnutls.Error as error:

1815

except gnutls.errors.GNUTLSError as error:

2308

1816

logger.warning("GnuTLS bye failed",

2309

1817

exc_info=error)

2310

1818

2312

1820

def peer_certificate(session):

2313

1821

"Return the peer's OpenPGP certificate as a bytestring"

2314

1822

# If not an OpenPGP certificate...

2315

if (gnutls.certificate_type_get(session._c_object)

2316

!= gnutls.CRT_OPENPGP):

2317

# ...return invalid data

2318

return b""

1823

if (gnutls.library.functions

1824

.gnutls_certificate_type_get(session._c_object)

1825

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1826

# ...do the normal thing

1827

return session.peer_certificate

2319

1828

list_size = ctypes.c_uint(1)

2320

cert_list = (gnutls.certificate_get_peers

1829

cert_list = (gnutls.library.functions

1830

.gnutls_certificate_get_peers

2321

1831

(session._c_object, ctypes.byref(list_size)))

2322

1832

if not bool(cert_list) and list_size.value != 0:

2323

raise gnutls.Error("error getting peer certificate")

1833

raise gnutls.errors.GNUTLSError("error getting peer"

1834

" certificate")

2324

1835

if list_size.value == 0:

2325

1836

return None

2326

1837

cert = cert_list[0]

2330

1841

def fingerprint(openpgp):

2331

1842

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2332

1843

# New GnuTLS "datum" with the OpenPGP public key

2333

datum = gnutls.datum_t(

2334

ctypes.cast(ctypes.c_char_p(openpgp),

2335

ctypes.POINTER(ctypes.c_ubyte)),

2336

ctypes.c_uint(len(openpgp)))

1844

datum = (gnutls.library.types

1845

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1846

ctypes.POINTER

1847

(ctypes.c_ubyte)),

1848

ctypes.c_uint(len(openpgp))))

2337

1849

# New empty GnuTLS certificate

2338

crt = gnutls.openpgp_crt_t()

2339

gnutls.openpgp_crt_init(ctypes.byref(crt))

1850

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1851

(gnutls.library.functions

1852

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2340

1853

# Import the OpenPGP public key into the certificate

2341

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2342

gnutls.OPENPGP_FMT_RAW)

1854

(gnutls.library.functions

1855

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1856

gnutls.library.constants

1857

.GNUTLS_OPENPGP_FMT_RAW))

2343

1858

# Verify the self signature in the key

2344

1859

crtverify = ctypes.c_uint()

2345

gnutls.openpgp_crt_verify_self(crt, 0,

2346

ctypes.byref(crtverify))

1860

(gnutls.library.functions

1861

.gnutls_openpgp_crt_verify_self(crt, 0,

1862

ctypes.byref(crtverify)))

2347

1863

if crtverify.value != 0:

2348

gnutls.openpgp_crt_deinit(crt)

2349

raise gnutls.CertificateSecurityError("Verify failed")

1864

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1865

raise (gnutls.errors.CertificateSecurityError

1866

("Verify failed"))

2350

1867

# New buffer for the fingerprint

2351

1868

buf = ctypes.create_string_buffer(20)

2352

1869

buf_len = ctypes.c_size_t()

2353

1870

# Get the fingerprint from the certificate into the buffer

2354

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2355

ctypes.byref(buf_len))

1871

(gnutls.library.functions

1872

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1873

ctypes.byref(buf_len)))

2356

1874

# Deinit the certificate

2357

gnutls.openpgp_crt_deinit(crt)

1875

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2358

1876

# Convert the buffer to a Python bytestring

2359

1877

fpr = ctypes.string_at(buf, buf_len.value)

2360

1878

# Convert the bytestring to hexadecimal notation

2364

1882

2365

1883

class MultiprocessingMixIn(object):

2366

1884

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2367

2368

1885

def sub_process_main(self, request, address):

2369

1886

try:

2370

1887

self.finish_request(request, address)

2382

1899

2383

1900

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2384

1901

""" adds a pipe to the MixIn """

2385

2386

1902

def process_request(self, request, client_address):

2387

1903

"""Overrides and wraps the original process_request().

2388

1904

2409

1925

interface: None or a network interface name (string)

2410

1926

use_ipv6: Boolean; to use IPv6 or not

2411

1927

"""

2412

2413

1928

def __init__(self, server_address, RequestHandlerClass,

2414

interface=None,

2415

use_ipv6=True,

2416

socketfd=None):

1929

interface=None, use_ipv6=True, socketfd=None):

2417

1930

"""If socketfd is set, use that file descriptor instead of

2418

1931

creating a new one with socket.socket().

2419

1932

"""

2453

1966

"""This overrides the normal server_bind() function

2454

1967

to bind to an interface if one was specified, and also NOT to

2455

1968

bind to an address or port if they were not specified."""

2456

global SO_BINDTODEVICE

2457

1969

if self.interface is not None:

2458

1970

if SO_BINDTODEVICE is None:

2459

# Fall back to a hard-coded value which seems to be

2460

# common enough.

2461

logger.warning("SO_BINDTODEVICE not found, trying 25")

2462

SO_BINDTODEVICE = 25

2463

try:

2464

self.socket.setsockopt(

2465

socket.SOL_SOCKET, SO_BINDTODEVICE,

2466

(self.interface + "\0").encode("utf-8"))

2467

except socket.error as error:

2468

if error.errno == errno.EPERM:

2469

logger.error("No permission to bind to"

2470

" interface %s", self.interface)

2471

elif error.errno == errno.ENOPROTOOPT:

2472

logger.error("SO_BINDTODEVICE not available;"

2473

" cannot bind to interface %s",

2474

self.interface)

2475

elif error.errno == errno.ENODEV:

2476

logger.error("Interface %s does not exist,"

2477

" cannot bind", self.interface)

2478

else:

2479

raise

1971

logger.error("SO_BINDTODEVICE does not exist;"

1972

" cannot bind to interface %s",

1973

self.interface)

1974

else:

1975

try:

1976

self.socket.setsockopt(socket.SOL_SOCKET,

1977

SO_BINDTODEVICE,

1978

(self.interface + "\0")

1979

.encode("utf-8"))

1980

except socket.error as error:

1981

if error.errno == errno.EPERM:

1982

logger.error("No permission to bind to"

1983

" interface %s", self.interface)

1984

elif error.errno == errno.ENOPROTOOPT:

1985

logger.error("SO_BINDTODEVICE not available;"

1986

" cannot bind to interface %s",

1987

self.interface)

1988

elif error.errno == errno.ENODEV:

1989

logger.error("Interface %s does not exist,"

1990

" cannot bind", self.interface)

1991

else:

1992

raise

2480

1993

# Only bind(2) the socket if we really need to.

2481

1994

if self.server_address[0] or self.server_address[1]:

2482

1995

if not self.server_address[0]:

2487

2000

self.server_address = (any_address,

2488

2001

self.server_address[1])

2489

2002

elif not self.server_address[1]:

2490

self.server_address = (self.server_address[0], 0)

2003

self.server_address = (self.server_address[0],

2004

0)

2491

2005

# if self.interface:

2492

2006

# self.server_address = (self.server_address[0],

2493

2007

# 0, # port

2505

2019

gnutls_priority GnuTLS priority string

2506

2020

use_dbus: Boolean; to emit D-Bus signals or not

2507

2021

2508

Assumes a GLib.MainLoop event loop.

2022

Assumes a gobject.MainLoop event loop.

2509

2023

"""

2510

2511

2024

def __init__(self, server_address, RequestHandlerClass,

2512

interface=None,

2513

use_ipv6=True,

2514

clients=None,

2515

gnutls_priority=None,

2516

use_dbus=True,

2517

socketfd=None):

2025

interface=None, use_ipv6=True, clients=None,

2026

gnutls_priority=None, use_dbus=True, socketfd=None):

2518

2027

self.enabled = False

2519

2028

self.clients = clients

2520

2029

if self.clients is None:

2526

2035

interface = interface,

2527

2036

use_ipv6 = use_ipv6,

2528

2037

socketfd = socketfd)

2529

2530

2038

def server_activate(self):

2531

2039

if self.enabled:

2532

2040

return socketserver.TCPServer.server_activate(self)

2536

2044

2537

2045

def add_pipe(self, parent_pipe, proc):

2538

2046

# Call "handle_ipc" for both data and EOF events

2539

GLib.io_add_watch(

2540

parent_pipe.fileno(),

2541

GLib.IO_IN | GLib.IO_HUP,

2542

functools.partial(self.handle_ipc,

2543

parent_pipe = parent_pipe,

2544

proc = proc))

2047

gobject.io_add_watch(parent_pipe.fileno(),

2048

gobject.IO_IN | gobject.IO_HUP,

2049

functools.partial(self.handle_ipc,

2050

parent_pipe =

2051

parent_pipe,

2052

proc = proc))

2545

2053

2546

def handle_ipc(self, source, condition,

2547

parent_pipe=None,

2548

proc = None,

2549

client_object=None):

2054

def handle_ipc(self, source, condition, parent_pipe=None,

2055

proc = None, client_object=None):

2550

2056

# error, or the other end of multiprocessing.Pipe has closed

2551

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2057

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2552

2058

# Wait for other process to exit

2553

2059

proc.join()

2554

2060

return False

2561

2067

fpr = request[1]

2562

2068

address = request[2]

2563

2069

2564

for c in self.clients.values():

2070

for c in self.clients.itervalues():

2565

2071

if c.fingerprint == fpr:

2566

2072

client = c

2567

2073

break

2575

2081

parent_pipe.send(False)

2576

2082

return False

2577

2083

2578

GLib.io_add_watch(

2579

parent_pipe.fileno(),

2580

GLib.IO_IN | GLib.IO_HUP,

2581

functools.partial(self.handle_ipc,

2582

parent_pipe = parent_pipe,

2583

proc = proc,

2584

client_object = client))

2084

gobject.io_add_watch(parent_pipe.fileno(),

2085

gobject.IO_IN | gobject.IO_HUP,

2086

functools.partial(self.handle_ipc,

2087

parent_pipe =

2088

parent_pipe,

2089

proc = proc,

2090

client_object =

2091

client))

2585

2092

parent_pipe.send(True)

2586

2093

# remove the old hook in favor of the new above hook on

2587

2094

# same fileno

2593

2100

2594

2101

parent_pipe.send(('data', getattr(client_object,

2595

2102

funcname)(*args,

2596

**kwargs)))

2103

**kwargs)))

2597

2104

2598

2105

if command == 'getattr':

2599

2106

attrname = request[1]

2600

if isinstance(client_object.__getattribute__(attrname),

2601

collections.Callable):

2602

parent_pipe.send(('function', ))

2107

if callable(client_object.__getattribute__(attrname)):

2108

parent_pipe.send(('function',))

2603

2109

else:

2604

parent_pipe.send((

2605

'data', client_object.__getattribute__(attrname)))

2110

parent_pipe.send(('data', client_object

2111

.__getattribute__(attrname)))

2606

2112

2607

2113

if command == 'setattr':

2608

2114

attrname = request[1]

2639

2145

# avoid excessive use of external libraries.

2640

2146

2641

2147

# New type for defining tokens, syntax, and semantics all-in-one

2642

Token = collections.namedtuple("Token", (

2643

"regexp", # To match token; if "value" is not None, must have

2644

# a "group" containing digits

2645

"value", # datetime.timedelta or None

2646

"followers")) # Tokens valid after this token

2148

Token = collections.namedtuple("Token",

2149

("regexp", # To match token; if

2150

# "value" is not None,

2151

# must have a "group"

2152

# containing digits

2153

"value", # datetime.timedelta or

2154

# None

2155

"followers")) # Tokens valid after

2156

# this token

2647

2157

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2648

2158

# the "duration" ABNF definition in RFC 3339, Appendix A.

2649

2159

token_end = Token(re.compile(r"$"), None, frozenset())

2650

2160

token_second = Token(re.compile(r"(\d+)S"),

2651

2161

datetime.timedelta(seconds=1),

2652

frozenset((token_end, )))

2162

frozenset((token_end,)))

2653

2163

token_minute = Token(re.compile(r"(\d+)M"),

2654

2164

datetime.timedelta(minutes=1),

2655

2165

frozenset((token_second, token_end)))

2671

2181

frozenset((token_month, token_end)))

2672

2182

token_week = Token(re.compile(r"(\d+)W"),

2673

2183

datetime.timedelta(weeks=1),

2674

frozenset((token_end, )))

2184

frozenset((token_end,)))

2675

2185

token_duration = Token(re.compile(r"P"), None,

2676

2186

frozenset((token_year, token_month,

2677

2187

token_day, token_time,

2679

2189

# Define starting values

2680

2190

value = datetime.timedelta() # Value so far

2681

2191

found_token = None

2682

followers = frozenset((token_duration, )) # Following valid tokens

2192

followers = frozenset((token_duration,)) # Following valid tokens

2683

2193

s = duration # String left to parse

2684

2194

# Loop until end token is found

2685

2195

while found_token is not token_end:

2702

2212

break

2703

2213

else:

2704

2214

# No currently valid tokens were found

2705

raise ValueError("Invalid RFC 3339 duration: {!r}"

2706

.format(duration))

2215

raise ValueError("Invalid RFC 3339 duration")

2707

2216

# End token found

2708

2217

return value

2709

2218

2746

2255

elif suffix == "w":

2747

2256

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2748

2257

else:

2749

raise ValueError("Unknown suffix {!r}".format(suffix))

2258

raise ValueError("Unknown suffix {!r}"

2259

.format(suffix))

2750

2260

except IndexError as e:

2751

2261

raise ValueError(*(e.args))

2752

2262

timevalue += delta

2768

2278

# Close all standard open file descriptors

2769

2279

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2770

2280

if not stat.S_ISCHR(os.fstat(null).st_mode):

2771

raise OSError(errno.ENODEV,

2772

"{} not a character device"

2281

raise OSError(errno.ENODEV, "{} not a character device"

2773

2282

.format(os.devnull))

2774

2283

os.dup2(null, sys.stdin.fileno())

2775

2284

os.dup2(null, sys.stdout.fileno())

2841

2350

"port": "",

2842

2351

"debug": "False",

2843

2352

"priority":

2844

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2845

":+SIGN-DSA-SHA256",

2353

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2846

2354

"servicename": "Mandos",

2847

2355

"use_dbus": "True",

2848

2356

"use_ipv6": "True",

2852

2360

"statedir": "/var/lib/mandos",

2853

2361

"foreground": "False",

2854

2362

"zeroconf": "True",

2855

}

2363

}

2856

2364

2857

2365

# Parse config file for server-global settings

2858

2366

server_config = configparser.SafeConfigParser(server_defaults)

2859

2367

del server_defaults

2860

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2368

server_config.read(os.path.join(options.configdir,

2369

"mandos.conf"))

2861

2370

# Convert the SafeConfigParser object to a dict

2862

2371

server_settings = server_config.defaults()

2863

2372

# Use the appropriate methods on the non-string config options

2881

2390

# Override the settings from the config file with command line

2882

2391

# options, if set.

2883

2392

for option in ("interface", "address", "port", "debug",

2884

"priority", "servicename", "configdir", "use_dbus",

2885

"use_ipv6", "debuglevel", "restore", "statedir",

2886

"socket", "foreground", "zeroconf"):

2393

"priority", "servicename", "configdir",

2394

"use_dbus", "use_ipv6", "debuglevel", "restore",

2395

"statedir", "socket", "foreground", "zeroconf"):

2887

2396

value = getattr(options, option)

2888

2397

if value is not None:

2889

2398

server_settings[option] = value

2904

2413

2905

2414

##################################################################

2906

2415

2907

if (not server_settings["zeroconf"]

2908

and not (server_settings["port"]

2909

or server_settings["socket"] != "")):

2910

parser.error("Needs port or socket to work without Zeroconf")

2416

if (not server_settings["zeroconf"] and

2417

not (server_settings["port"]

2418

or server_settings["socket"] != "")):

2419

parser.error("Needs port or socket to work without"

2420

" Zeroconf")

2911

2421

2912

2422

# For convenience

2913

2423

debug = server_settings["debug"]

2929

2439

initlogger(debug, level)

2930

2440

2931

2441

if server_settings["servicename"] != "Mandos":

2932

syslogger.setFormatter(

2933

logging.Formatter('Mandos ({}) [%(process)d]:'

2934

' %(levelname)s: %(message)s'.format(

2935

server_settings["servicename"])))

2442

syslogger.setFormatter(logging.Formatter

2443

('Mandos ({}) [%(process)d]:'

2444

' %(levelname)s: %(message)s'

2445

.format(server_settings

2446

["servicename"])))

2936

2447

2937

2448

# Parse config file with clients

2938

2449

client_config = configparser.SafeConfigParser(Client

2946

2457

socketfd = None

2947

2458

if server_settings["socket"] != "":

2948

2459

socketfd = server_settings["socket"]

2949

tcp_server = MandosServer(

2950

(server_settings["address"], server_settings["port"]),

2951

ClientHandler,

2952

interface=(server_settings["interface"] or None),

2953

use_ipv6=use_ipv6,

2954

gnutls_priority=server_settings["priority"],

2955

use_dbus=use_dbus,

2956

socketfd=socketfd)

2460

tcp_server = MandosServer((server_settings["address"],

2461

server_settings["port"]),

2462

ClientHandler,

2463

interface=(server_settings["interface"]

2464

or None),

2465

use_ipv6=use_ipv6,

2466

gnutls_priority=

2467

server_settings["priority"],

2468

use_dbus=use_dbus,

2469

socketfd=socketfd)

2957

2470

if not foreground:

2958

2471

pidfilename = "/run/mandos.pid"

2959

2472

if not os.path.isdir("/run/."):

2960

2473

pidfilename = "/var/run/mandos.pid"

2961

2474

pidfile = None

2962

2475

try:

2963

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2476

pidfile = open(pidfilename, "w")

2964

2477

except IOError as e:

2965

2478

logger.error("Could not open file %r", pidfilename,

2966

2479

exc_info=e)

2967

2480

2968

for name, group in (("_mandos", "_mandos"),

2969

("mandos", "mandos"),

2970

("nobody", "nogroup")):

2481

for name in ("_mandos", "mandos", "nobody"):

2971

2482

try:

2972

2483

uid = pwd.getpwnam(name).pw_uid

2973

gid = pwd.getpwnam(group).pw_gid

2484

gid = pwd.getpwnam(name).pw_gid

2974

2485

break

2975

2486

except KeyError:

2976

2487

continue

2980

2491

try:

2981

2492

os.setgid(gid)

2982

2493

os.setuid(uid)

2983

if debug:

2984

logger.debug("Did setuid/setgid to {}:{}".format(uid,

2985

gid))

2986

2494

except OSError as error:

2987

logger.warning("Failed to setuid/setgid to {}:{}: {}"

2988

.format(uid, gid, os.strerror(error.errno)))

2989

2495

if error.errno != errno.EPERM:

2990

2496

raise

2991

2497

2994

2500

2995

2501

# "Use a log level over 10 to enable all debugging options."

2996

2502

# - GnuTLS manual

2997

gnutls.global_set_log_level(11)

2503

gnutls.library.functions.gnutls_global_set_log_level(11)

2998

2504

2999

@gnutls.log_func

2505

@gnutls.library.types.gnutls_log_func

3000

2506

def debug_gnutls(level, string):

3001

2507

logger.debug("GnuTLS: %s", string[:-1])

3002

2508

3003

gnutls.global_set_log_function(debug_gnutls)

2509

(gnutls.library.functions

2510

.gnutls_global_set_log_function(debug_gnutls))

3004

2511

3005

2512

# Redirect stdin so all checkers get /dev/null

3006

2513

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3013

2520

# Close all input and output, do double fork, etc.

3014

2521

daemon()

3015

2522

3016

# multiprocessing will use threads, so before we use GLib we need

3017

# to inform GLib that threads will be used.

3018

GLib.threads_init()

2523

# multiprocessing will use threads, so before we use gobject we

2524

# need to inform gobject that threads will be used.

2525

gobject.threads_init()

3019

2526

3020

2527

global main_loop

3021

2528

# From the Avahi example code

3022

2529

DBusGMainLoop(set_as_default=True)

3023

main_loop = GLib.MainLoop()

2530

main_loop = gobject.MainLoop()

3024

2531

bus = dbus.SystemBus()

3025

2532

# End of Avahi example code

3026

2533

if use_dbus:

3027

2534

try:

3028

2535

bus_name = dbus.service.BusName("se.recompile.Mandos",

3029

bus,

3030

do_not_queue=True)

3031

old_bus_name = dbus.service.BusName(

3032

"se.bsnet.fukt.Mandos", bus,

3033

do_not_queue=True)

3034

except dbus.exceptions.DBusException as e:

2536

bus, do_not_queue=True)

2537

old_bus_name = (dbus.service.BusName

2538

("se.bsnet.fukt.Mandos", bus,

2539

do_not_queue=True))

2540

except dbus.exceptions.NameExistsException as e:

3035

2541

logger.error("Disabling D-Bus:", exc_info=e)

3036

2542

use_dbus = False

3037

2543

server_settings["use_dbus"] = False

3038

2544

tcp_server.use_dbus = False

3039

2545

if zeroconf:

3040

2546

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3041

service = AvahiServiceToSyslog(

3042

name = server_settings["servicename"],

3043

servicetype = "_mandos._tcp",

3044

protocol = protocol,

3045

bus = bus)

2547

service = AvahiServiceToSyslog(name =

2548

server_settings["servicename"],

2549

servicetype = "_mandos._tcp",

2550

protocol = protocol, bus = bus)

3046

2551

if server_settings["interface"]:

3047

service.interface = if_nametoindex(

3048

server_settings["interface"].encode("utf-8"))

2552

service.interface = (if_nametoindex

2553

(server_settings["interface"]

2554

.encode("utf-8")))

3049

2555

3050

2556

global multiprocessing_manager

3051

2557

multiprocessing_manager = multiprocessing.Manager()

3070

2576

if server_settings["restore"]:

3071

2577

try:

3072

2578

with open(stored_state_path, "rb") as stored_state:

3073

if sys.version_info.major == 2:

3074

clients_data, old_client_settings = pickle.load(

3075

stored_state)

3076

else:

3077

bytes_clients_data, bytes_old_client_settings = (

3078

pickle.load(stored_state, encoding = "bytes"))

3079

### Fix bytes to strings

3080

## clients_data

3081

# .keys()

3082

clients_data = { (key.decode("utf-8")

3083

if isinstance(key, bytes)

3084

else key): value

3085

for key, value in

3086

bytes_clients_data.items() }

3087

del bytes_clients_data

3088

for key in clients_data:

3089

value = { (k.decode("utf-8")

3090

if isinstance(k, bytes) else k): v

3091

for k, v in

3092

clients_data[key].items() }

3093

clients_data[key] = value

3094

# .client_structure

3095

value["client_structure"] = [

3096

(s.decode("utf-8")

3097

if isinstance(s, bytes)

3098

else s) for s in

3099

value["client_structure"] ]

3100

# .name & .host

3101

for k in ("name", "host"):

3102

if isinstance(value[k], bytes):

3103

value[k] = value[k].decode("utf-8")

3104

## old_client_settings

3105

# .keys()

3106

old_client_settings = {

3107

(key.decode("utf-8")

3108

if isinstance(key, bytes)

3109

else key): value

3110

for key, value in

3111

bytes_old_client_settings.items() }

3112

del bytes_old_client_settings

3113

# .host

3114

for value in old_client_settings.values():

3115

if isinstance(value["host"], bytes):

3116

value["host"] = (value["host"]

3117

.decode("utf-8"))

2579

clients_data, old_client_settings = (pickle.load

2580

(stored_state))

3118

2581

os.remove(stored_state_path)

3119

2582

except IOError as e:

3120

2583

if e.errno == errno.ENOENT:

3121

logger.warning("Could not load persistent state:"

3122

" {}".format(os.strerror(e.errno)))

2584

logger.warning("Could not load persistent state: {}"

2585

.format(os.strerror(e.errno)))

3123

2586

else:

3124

2587

logger.critical("Could not load persistent state:",

3125

2588

exc_info=e)

3126

2589

raise

3127

2590

except EOFError as e:

3128

2591

logger.warning("Could not load persistent state: "

3129

"EOFError:",

3130

exc_info=e)

2592

"EOFError:", exc_info=e)

3131

2593

3132

2594

with PGPEngine() as pgp:

3133

2595

for client_name, client in clients_data.items():

3145

2607

# For each value in new config, check if it

3146

2608

# differs from the old config value (Except for

3147

2609

# the "secret" attribute)

3148

if (name != "secret"

3149

and (value !=

3150

old_client_settings[client_name][name])):

2610

if (name != "secret" and

2611

value != old_client_settings[client_name]

2612

[name]):

3151

2613

client[name] = value

3152

2614

except KeyError:

3153

2615

pass

3154

2616

3155

2617

# Clients who has passed its expire date can still be

3156

# enabled if its last checker was successful. A Client

2618

# enabled if its last checker was successful. Clients

3157

2619

# whose checker succeeded before we stored its state is

3158

2620

# assumed to have successfully run all checkers during

3159

2621

# downtime.

3162

2624

if not client["last_checked_ok"]:

3163

2625

logger.warning(

3164

2626

"disabling client {} - Client never "

3165

"performed a successful checker".format(

3166

client_name))

2627

"performed a successful checker"

2628

.format(client_name))

3167

2629

client["enabled"] = False

3168

2630

elif client["last_checker_status"] != 0:

3169

2631

logger.warning(

3170

2632

"disabling client {} - Client last"

3171

" checker failed with error code"

3172

" {}".format(

3173

client_name,

3174

client["last_checker_status"]))

2633

" checker failed with error code {}"

2634

.format(client_name,

2635

client["last_checker_status"]))

3175

2636

client["enabled"] = False

3176

2637

else:

3177

client["expires"] = (

3178

datetime.datetime.utcnow()

3179

+ client["timeout"])

2638

client["expires"] = (datetime.datetime

2639

.utcnow()

2640

+ client["timeout"])

3180

2641

logger.debug("Last checker succeeded,"

3181

" keeping {} enabled".format(

3182

client_name))

2642

" keeping {} enabled"

2643

.format(client_name))

3183

2644

try:

3184

client["secret"] = pgp.decrypt(

3185

client["encrypted_secret"],

3186

client_settings[client_name]["secret"])

2645

client["secret"] = (

2646

pgp.decrypt(client["encrypted_secret"],

2647

client_settings[client_name]

2648

["secret"]))

3187

2649

except PGPError:

3188

2650

# If decryption fails, we use secret from new settings

3189

logger.debug("Failed to decrypt {} old secret".format(

3190

client_name))

3191

client["secret"] = (client_settings[client_name]

3192

["secret"])

2651

logger.debug("Failed to decrypt {} old secret"

2652

.format(client_name))

2653

client["secret"] = (

2654

client_settings[client_name]["secret"])

3193

2655

3194

2656

# Add/remove clients based on new changes made to config

3195

2657

for client_name in (set(old_client_settings)

3202

2664

# Create all client objects

3203

2665

for client_name, client in clients_data.items():

3204

2666

tcp_server.clients[client_name] = client_class(

3205

name = client_name,

3206

settings = client,

2667

name = client_name, settings = client,

3207

2668

server_settings = server_settings)

3208

2669

3209

2670

if not tcp_server.clients:

3211

2672

3212

2673

if not foreground:

3213

2674

if pidfile is not None:

3214

pid = os.getpid()

3215

2675

try:

3216

2676

with pidfile:

3217

print(pid, file=pidfile)

2677

pid = os.getpid()

2678

pidfile.write("{}\n".format(pid).encode("utf-8"))

3218

2679

except IOError:

3219

2680

logger.error("Could not write to file %r with PID %d",

3220

2681

pidfilename, pid)

3221

2682

del pidfile

3222

2683

del pidfilename

3223

2684

3224

for termsig in (signal.SIGHUP, signal.SIGTERM):

3225

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3226

lambda: main_loop.quit() and False)

2685

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2686

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

3227

2687

3228

2688

if use_dbus:

3229

3230

@alternate_dbus_interfaces(

3231

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3232

class MandosDBusService(DBusObjectWithObjectManager):

2689

@alternate_dbus_interfaces({"se.recompile.Mandos":

2690

"se.bsnet.fukt.Mandos"})

2691

class MandosDBusService(DBusObjectWithProperties):

3233

2692

"""A D-Bus proxy object"""

3234

3235

2693

def __init__(self):

3236

2694

dbus.service.Object.__init__(self, bus, "/")

3237

3238

2695

_interface = "se.recompile.Mandos"

3239

2696

2697

@dbus_interface_annotations(_interface)

2698

def _foo(self):

2699

return { "org.freedesktop.DBus.Property"

2700

".EmitsChangedSignal":

2701

"false"}

2702

3240

2703

@dbus.service.signal(_interface, signature="o")

3241

2704

def ClientAdded(self, objpath):

3242

2705

"D-Bus signal"

3247

2710

"D-Bus signal"

3248

2711

pass

3249

2712

3250

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3251

"true"})

3252

2713

@dbus.service.signal(_interface, signature="os")

3253

2714

def ClientRemoved(self, objpath, name):

3254

2715

"D-Bus signal"

3255

2716

pass

3256

2717

3257

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3258

"true"})

3259

2718

@dbus.service.method(_interface, out_signature="ao")

3260

2719

def GetAllClients(self):

3261

2720

"D-Bus method"

3262

return dbus.Array(c.dbus_object_path for c in

3263

tcp_server.clients.values())

2721

return dbus.Array(c.dbus_object_path

2722

for c in

2723

tcp_server.clients.itervalues())

3264

2724

3265

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3266

"true"})

3267

2725

@dbus.service.method(_interface,

3268

2726

out_signature="a{oa{sv}}")

3269

2727

def GetAllClientsWithProperties(self):

3270

2728

"D-Bus method"

3271

2729

return dbus.Dictionary(

3272

{ c.dbus_object_path: c.GetAll(

3273

"se.recompile.Mandos.Client")

3274

for c in tcp_server.clients.values() },

2730

{ c.dbus_object_path: c.GetAll("")

2731

for c in tcp_server.clients.itervalues() },

3275

2732

signature="oa{sv}")

3276

2733

3277

2734

@dbus.service.method(_interface, in_signature="o")

3278

2735

def RemoveClient(self, object_path):

3279

2736

"D-Bus method"

3280

for c in tcp_server.clients.values():

2737

for c in tcp_server.clients.itervalues():

3281

2738

if c.dbus_object_path == object_path:

3282

2739

del tcp_server.clients[c.name]

3283

2740

c.remove_from_connection()

3284

# Don't signal the disabling

2741

# Don't signal anything except ClientRemoved

3285

2742

c.disable(quiet=True)

3286

# Emit D-Bus signal for removal

3287

self.client_removed_signal(c)

2743

# Emit D-Bus signal

2744

self.ClientRemoved(object_path, c.name)

3288

2745

return

3289

2746

raise KeyError(object_path)

3290

2747

3291

2748

del _interface

3292

3293

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3294

out_signature = "a{oa{sa{sv}}}")

3295

def GetManagedObjects(self):

3296

"""D-Bus method"""

3297

return dbus.Dictionary(

3298

{ client.dbus_object_path:

3299

dbus.Dictionary(

3300

{ interface: client.GetAll(interface)

3301

for interface in

3302

client._get_all_interface_names()})

3303

for client in tcp_server.clients.values()})

3304

3305

def client_added_signal(self, client):

3306

"""Send the new standard signal and the old signal"""

3307

if use_dbus:

3308

# New standard signal

3309

self.InterfacesAdded(

3310

client.dbus_object_path,

3311

dbus.Dictionary(

3312

{ interface: client.GetAll(interface)

3313

for interface in

3314

client._get_all_interface_names()}))

3315

# Old signal

3316

self.ClientAdded(client.dbus_object_path)

3317

3318

def client_removed_signal(self, client):

3319

"""Send the new standard signal and the old signal"""

3320

if use_dbus:

3321

# New standard signal

3322

self.InterfacesRemoved(

3323

client.dbus_object_path,

3324

client._get_all_interface_names())

3325

# Old signal

3326

self.ClientRemoved(client.dbus_object_path,

3327

client.name)

3328

2749

3329

2750

mandos_dbus_service = MandosDBusService()

3330

2751

3331

# Save modules to variables to exempt the modules from being

3332

# unloaded before the function registered with atexit() is run.

3333

mp = multiprocessing

3334

wn = wnull

3335

2752

def cleanup():

3336

2753

"Cleanup function; run on exit"

3337

2754

if zeroconf:

3338

2755

service.cleanup()

3339

2756

3340

mp.active_children()

3341

wn.close()

2757

multiprocessing.active_children()

2758

wnull.close()

3342

2759

if not (tcp_server.clients or client_settings):

3343

2760

return

3344

2761

3347

2764

# removed/edited, old secret will thus be unrecovable.

3348

2765

clients = {}

3349

2766

with PGPEngine() as pgp:

3350

for client in tcp_server.clients.values():

2767

for client in tcp_server.clients.itervalues():

3351

2768

key = client_settings[client.name]["secret"]

3352

2769

client.encrypted_secret = pgp.encrypt(client.secret,

3353

2770

key)

3357

2774

# + secret.

3358

2775

exclude = { "bus", "changedstate", "secret",

3359

2776

"checker", "server_settings" }

3360

for name, typ in inspect.getmembers(dbus.service

3361

.Object):

2777

for name, typ in (inspect.getmembers

2778

(dbus.service.Object)):

3362

2779

exclude.add(name)

3363

2780

3364

2781

client_dict["encrypted_secret"] = (client

3371

2788

del client_settings[client.name]["secret"]

3372

2789

3373

2790

try:

3374

with tempfile.NamedTemporaryFile(

3375

mode='wb',

3376

suffix=".pickle",

3377

prefix='clients-',

3378

dir=os.path.dirname(stored_state_path),

3379

delete=False) as stored_state:

3380

pickle.dump((clients, client_settings), stored_state,

3381

protocol = 2)

3382

tempname = stored_state.name

2791

with (tempfile.NamedTemporaryFile

2792

(mode='wb', suffix=".pickle", prefix='clients-',

2793

dir=os.path.dirname(stored_state_path),

2794

delete=False)) as stored_state:

2795

pickle.dump((clients, client_settings), stored_state)

2796

tempname=stored_state.name

3383

2797

os.rename(tempname, stored_state_path)

3384

2798

except (IOError, OSError) as e:

3385

2799

if not debug:

3400

2814

name, client = tcp_server.clients.popitem()

3401

2815

if use_dbus:

3402

2816

client.remove_from_connection()

3403

# Don't signal the disabling

2817

# Don't signal anything except ClientRemoved

3404

2818

client.disable(quiet=True)

3405

# Emit D-Bus signal for removal

3406

2819

if use_dbus:

3407

mandos_dbus_service.client_removed_signal(client)

2820

# Emit D-Bus signal

2821

mandos_dbus_service.ClientRemoved(client

2822

.dbus_object_path,

2823

client.name)

3408

2824

client_settings.clear()

3409

2825

3410

2826

atexit.register(cleanup)

3411

2827

3412

for client in tcp_server.clients.values():

2828

for client in tcp_server.clients.itervalues():

3413

2829

if use_dbus:

3414

# Emit D-Bus signal for adding

3415

mandos_dbus_service.client_added_signal(client)

2830

# Emit D-Bus signal

2831

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3416

2832

# Need to initiate checking of clients

3417

2833

if client.enabled:

3418

2834

client.init_checker()

3444

2860

sys.exit(1)

3445

2861

# End of Avahi example code

3446

2862

3447

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3448

lambda *args, **kwargs:

3449

(tcp_server.handle_request

3450

(*args[2:], **kwargs) or True))

2863

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2864

lambda *args, **kwargs:

2865

(tcp_server.handle_request

2866

(*args[2:], **kwargs) or True))

3451

2867

3452

2868

logger.debug("Starting main loop")

3453

2869

main_loop.run()

3463

2879

# Must run before the D-Bus bus name gets deregistered

3464

2880

cleanup()

3465

2881

3466

3467

2882

if __name__ == '__main__':

3468

2883

main()