/mandos/trunk : revision 237.4.77

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

import SocketServer as socketserver

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

41

42

try:

43

import SocketServer as socketserver

44

except ImportError:

45

import socketserver

38

46

import socket

39

47

import argparse

40

48

import datetime

41

49

import errno

42

import gnutls.crypto

43

import gnutls.connection

44

import gnutls.errors

45

import gnutls.library.functions

46

import gnutls.library.constants

47

import gnutls.library.types

48

import ConfigParser as configparser

50

try:

51

import ConfigParser as configparser

52

except ImportError:

53

import configparser

49

54

import sys

50

55

import re

51

56

import os

60

65

import struct

61

66

import fcntl

62

67

import functools

63

import cPickle as pickle

68

try:

69

import cPickle as pickle

70

except ImportError:

71

import pickle

64

72

import multiprocessing

65

73

import types

66

74

import binascii

67

75

import tempfile

68

76

import itertools

77

import collections

78

import codecs

69

79

70

80

import dbus

71

81

import dbus.service

72

import gobject

73

import avahi

82

from gi.repository import GLib

74

83

from dbus.mainloop.glib import DBusGMainLoop

75

84

import ctypes

76

85

import ctypes.util

77

86

import xml.dom.minidom

78

87

import inspect

79

import GnuPGInterface

80

88

89

# Try to find the value of SO_BINDTODEVICE:

81

90

try:

91

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

92

# newer, and it is also the most natural place for it:

82

93

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

83

94

except AttributeError:

84

95

try:

96

# This is where SO_BINDTODEVICE was up to and including Python

97

# 2.6, and also 3.2:

85

98

from IN import SO_BINDTODEVICE

86

99

except ImportError:

87

SO_BINDTODEVICE = None

88

89

version = "1.5.3"

100

# In Python 2.7 it seems to have been removed entirely.

101

# Try running the C preprocessor:

102

try:

103

cc = subprocess.Popen(["cc", "--language=c", "-E",

104

"/dev/stdin"],

105

stdin=subprocess.PIPE,

106

stdout=subprocess.PIPE)

107

stdout = cc.communicate(

108

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

109

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

110

except (OSError, ValueError, IndexError):

111

# No value found

112

SO_BINDTODEVICE = None

113

114

if sys.version_info.major == 2:

115

str = unicode

116

117

version = "1.7.8"

90

118

stored_state_file = "clients.pickle"

91

119

92

120

logger = logging.getLogger()

93

syslogger = (logging.handlers.SysLogHandler

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

address = str("/dev/log")))

121

syslogger = None

96

122

97

123

try:

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

124

if_nametoindex = ctypes.cdll.LoadLibrary(

125

ctypes.util.find_library("c")).if_nametoindex

101

126

except (OSError, AttributeError):

127

102

128

def if_nametoindex(interface):

103

129

"Get an interface index the hard way, i.e. using fcntl()"

104

130

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

105

131

with contextlib.closing(socket.socket()) as s:

106

132

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

133

struct.pack(b"16s16x", interface))

134

interface_index = struct.unpack("I", ifreq[16:20])[0]

111

135

return interface_index

112

136

113

137

138

def copy_function(func):

139

"""Make a copy of a function"""

140

if sys.version_info.major == 2:

141

return types.FunctionType(func.func_code,

142

func.func_globals,

143

func.func_name,

144

func.func_defaults,

145

func.func_closure)

146

else:

147

return types.FunctionType(func.__code__,

148

func.__globals__,

149

func.__name__,

150

func.__defaults__,

151

func.__closure__)

152

153

114

154

def initlogger(debug, level=logging.WARNING):

115

155

"""init logger and add loglevel"""

116

156

157

global syslogger

158

syslogger = (logging.handlers.SysLogHandler(

159

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

160

address = "/dev/log"))

117

161

syslogger.setFormatter(logging.Formatter

118

162

('Mandos [%(process)d]: %(levelname)s:'

119

163

' %(message)s'))

136

180

137

181

class PGPEngine(object):

138

182

"""A simple class for OpenPGP symmetric encryption & decryption"""

183

139

184

def __init__(self):

140

self.gnupg = GnuPGInterface.GnuPG()

141

185

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

142

self.gnupg = GnuPGInterface.GnuPG()

143

self.gnupg.options.meta_interactive = False

144

self.gnupg.options.homedir = self.tempdir

145

self.gnupg.options.extra_args.extend(['--force-mdc',

146

'--quiet',

147

'--no-use-agent'])

186

self.gpg = "gpg"

187

try:

188

output = subprocess.check_output(["gpgconf"])

189

for line in output.splitlines():

190

name, text, path = line.split(b":")

191

if name == "gpg":

192

self.gpg = path

193

break

194

except OSError as e:

195

if e.errno != errno.ENOENT:

196

raise

197

self.gnupgargs = ['--batch',

198

'--homedir', self.tempdir,

199

'--force-mdc',

200

'--quiet']

201

# Only GPG version 1 has the --no-use-agent option.

202

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

203

self.gnupgargs.append("--no-use-agent")

148

204

149

205

def __enter__(self):

150

206

return self

151

207

152

def __exit__ (self, exc_type, exc_value, traceback):

208

def __exit__(self, exc_type, exc_value, traceback):

153

209

self._cleanup()

154

210

return False

155

211

172

228

def password_encode(self, password):

173

229

# Passphrase can not be empty and can not contain newlines or

174

230

# NUL bytes. So we prefix it and hex encode it.

175

return b"mandos" + binascii.hexlify(password)

231

encoded = b"mandos" + binascii.hexlify(password)

232

if len(encoded) > 2048:

233

# GnuPG can't handle long passwords, so encode differently

234

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

235

.replace(b"\n", b"\\n")

236

.replace(b"\0", b"\\x00"))

237

return encoded

176

238

177

239

def encrypt(self, data, password):

178

self.gnupg.passphrase = self.password_encode(password)

179

with open(os.devnull, "w") as devnull:

180

try:

181

proc = self.gnupg.run(['--symmetric'],

182

create_fhs=['stdin', 'stdout'],

183

attach_fhs={'stderr': devnull})

184

with contextlib.closing(proc.handles['stdin']) as f:

185

f.write(data)

186

with contextlib.closing(proc.handles['stdout']) as f:

187

ciphertext = f.read()

188

proc.wait()

189

except IOError as e:

190

raise PGPError(e)

191

self.gnupg.passphrase = None

240

passphrase = self.password_encode(password)

241

with tempfile.NamedTemporaryFile(

242

dir=self.tempdir) as passfile:

243

passfile.write(passphrase)

244

passfile.flush()

245

proc = subprocess.Popen([self.gpg, '--symmetric',

246

'--passphrase-file',

247

passfile.name]

248

+ self.gnupgargs,

249

stdin = subprocess.PIPE,

250

stdout = subprocess.PIPE,

251

stderr = subprocess.PIPE)

252

ciphertext, err = proc.communicate(input = data)

253

if proc.returncode != 0:

254

raise PGPError(err)

192

255

return ciphertext

193

256

194

257

def decrypt(self, data, password):

195

self.gnupg.passphrase = self.password_encode(password)

196

with open(os.devnull, "w") as devnull:

197

try:

198

proc = self.gnupg.run(['--decrypt'],

199

create_fhs=['stdin', 'stdout'],

200

attach_fhs={'stderr': devnull})

201

with contextlib.closing(proc.handles['stdin']) as f:

202

f.write(data)

203

with contextlib.closing(proc.handles['stdout']) as f:

204

decrypted_plaintext = f.read()

205

proc.wait()

206

except IOError as e:

207

raise PGPError(e)

208

self.gnupg.passphrase = None

258

passphrase = self.password_encode(password)

259

with tempfile.NamedTemporaryFile(

260

dir = self.tempdir) as passfile:

261

passfile.write(passphrase)

262

passfile.flush()

263

proc = subprocess.Popen([self.gpg, '--decrypt',

264

'--passphrase-file',

265

passfile.name]

266

+ self.gnupgargs,

267

stdin = subprocess.PIPE,

268

stdout = subprocess.PIPE,

269

stderr = subprocess.PIPE)

270

decrypted_plaintext, err = proc.communicate(input = data)

271

if proc.returncode != 0:

272

raise PGPError(err)

209

273

return decrypted_plaintext

210

274

275

# Pretend that we have an Avahi module

276

class Avahi(object):

277

"""This isn't so much a class as it is a module-like namespace.

278

It is instantiated once, and simulates having an Avahi module."""

279

IF_UNSPEC = -1 # avahi-common/address.h

280

PROTO_UNSPEC = -1 # avahi-common/address.h

281

PROTO_INET = 0 # avahi-common/address.h

282

PROTO_INET6 = 1 # avahi-common/address.h

283

DBUS_NAME = "org.freedesktop.Avahi"

284

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

285

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

286

DBUS_PATH_SERVER = "/"

287

def string_array_to_txt_array(self, t):

288

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

289

for s in t), signature="ay")

290

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

291

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

292

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

293

SERVER_INVALID = 0 # avahi-common/defs.h

294

SERVER_REGISTERING = 1 # avahi-common/defs.h

295

SERVER_RUNNING = 2 # avahi-common/defs.h

296

SERVER_COLLISION = 3 # avahi-common/defs.h

297

SERVER_FAILURE = 4 # avahi-common/defs.h

298

avahi = Avahi()

211

299

212

300

class AvahiError(Exception):

213

301

def __init__(self, value, *args, **kwargs):

214

302

self.value = value

215

super(AvahiError, self).__init__(value, *args, **kwargs)

216

def __unicode__(self):

217

return unicode(repr(self.value))

303

return super(AvahiError, self).__init__(value, *args,

304

**kwargs)

305

218

306

219

307

class AvahiServiceError(AvahiError):

220

308

pass

221

309

310

222

311

class AvahiGroupError(AvahiError):

223

312

pass

224

313

231

320

Used to optionally bind to the specified interface.

232

321

name: string; Example: 'Mandos'

233

322

type: string; Example: '_mandos._tcp'.

234

See <http://www.dns-sd.org/ServiceTypes.html>

323

See <https://www.iana.org/assignments/service-names-port-numbers>

235

324

port: integer; what port to announce

236

325

TXT: list of strings; TXT record for the service

237

326

domain: string; Domain to publish on, default to .local if empty.

244

333

bus: dbus.SystemBus()

245

334

"""

246

335

247

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

248

servicetype = None, port = None, TXT = None,

249

domain = "", host = "", max_renames = 32768,

250

protocol = avahi.PROTO_UNSPEC, bus = None):

336

def __init__(self,

337

interface = avahi.IF_UNSPEC,

338

name = None,

339

servicetype = None,

340

port = None,

341

TXT = None,

342

domain = "",

343

host = "",

344

max_renames = 32768,

345

protocol = avahi.PROTO_UNSPEC,

346

bus = None):

251

347

self.interface = interface

252

348

self.name = name

253

349

self.type = servicetype

263

359

self.bus = bus

264

360

self.entry_group_state_changed_match = None

265

361

266

def rename(self):

362

def rename(self, remove=True):

267

363

"""Derived from the Avahi example code"""

268

364

if self.rename_count >= self.max_renames:

269

365

logger.critical("No suitable Zeroconf service name found"

270

366

" after %i retries, exiting.",

271

367

self.rename_count)

272

368

raise AvahiServiceError("Too many renames")

273

self.name = unicode(self.server

274

.GetAlternativeServiceName(self.name))

369

self.name = str(

370

self.server.GetAlternativeServiceName(self.name))

371

self.rename_count += 1

275

372

logger.info("Changing Zeroconf service name to %r ...",

276

373

self.name)

277

self.remove()

374

if remove:

375

self.remove()

278

376

try:

279

377

self.add()

280

378

except dbus.exceptions.DBusException as error:

281

logger.critical("D-Bus Exception", exc_info=error)

282

self.cleanup()

283

os._exit(1)

284

self.rename_count += 1

379

if (error.get_dbus_name()

380

== "org.freedesktop.Avahi.CollisionError"):

381

logger.info("Local Zeroconf service name collision.")

382

return self.rename(remove=False)

383

else:

384

logger.critical("D-Bus Exception", exc_info=error)

385

self.cleanup()

386

os._exit(1)

285

387

286

388

def remove(self):

287

389

"""Derived from the Avahi example code"""

325

427

self.rename()

326

428

elif state == avahi.ENTRY_GROUP_FAILURE:

327

429

logger.critical("Avahi: Error in group state changed %s",

328

unicode(error))

329

raise AvahiGroupError("State changed: {0!s}"

330

.format(error))

430

str(error))

431

raise AvahiGroupError("State changed: {!s}".format(error))

331

432

332

433

def cleanup(self):

333

434

"""Derived from the Avahi example code"""

343

444

def server_state_changed(self, state, error=None):

344

445

"""Derived from the Avahi example code"""

345

446

logger.debug("Avahi server state change: %i", state)

346

bad_states = { avahi.SERVER_INVALID:

347

"Zeroconf server invalid",

348

avahi.SERVER_REGISTERING: None,

349

avahi.SERVER_COLLISION:

350

"Zeroconf server name collision",

351

avahi.SERVER_FAILURE:

352

"Zeroconf server failure" }

447

bad_states = {

448

avahi.SERVER_INVALID: "Zeroconf server invalid",

449

avahi.SERVER_REGISTERING: None,

450

avahi.SERVER_COLLISION: "Zeroconf server name collision",

451

avahi.SERVER_FAILURE: "Zeroconf server failure",

452

}

353

453

if state in bad_states:

354

454

if bad_states[state] is not None:

355

455

if error is None:

358

458

logger.error(bad_states[state] + ": %r", error)

359

459

self.cleanup()

360

460

elif state == avahi.SERVER_RUNNING:

361

self.add()

461

try:

462

self.add()

463

except dbus.exceptions.DBusException as error:

464

if (error.get_dbus_name()

465

== "org.freedesktop.Avahi.CollisionError"):

466

logger.info("Local Zeroconf service name"

467

" collision.")

468

return self.rename(remove=False)

469

else:

470

logger.critical("D-Bus Exception", exc_info=error)

471

self.cleanup()

472

os._exit(1)

362

473

else:

363

474

if error is None:

364

475

logger.debug("Unknown state: %r", state)

374

485

follow_name_owner_changes=True),

375

486

avahi.DBUS_INTERFACE_SERVER)

376

487

self.server.connect_to_signal("StateChanged",

377

self.server_state_changed)

488

self.server_state_changed)

378

489

self.server_state_changed(self.server.GetState())

379

490

491

380

492

class AvahiServiceToSyslog(AvahiService):

381

def rename(self):

493

def rename(self, *args, **kwargs):

382

494

"""Add the new name to the syslog messages"""

383

ret = AvahiService.rename(self)

384

syslogger.setFormatter(logging.Formatter

385

('Mandos ({0}) [%(process)d]:'

386

' %(levelname)s: %(message)s'

387

.format(self.name)))

495

ret = AvahiService.rename(self, *args, **kwargs)

496

syslogger.setFormatter(logging.Formatter(

497

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

498

.format(self.name)))

388

499

return ret

389

500

390

def timedelta_to_milliseconds(td):

391

"Convert a datetime.timedelta() to milliseconds"

392

return ((td.days * 24 * 60 * 60 * 1000)

393

+ (td.seconds * 1000)

394

+ (td.microseconds // 1000))

501

# Pretend that we have a GnuTLS module

502

class GnuTLS(object):

503

"""This isn't so much a class as it is a module-like namespace.

504

It is instantiated once, and simulates having a GnuTLS module."""

505

506

_library = ctypes.cdll.LoadLibrary(

507

ctypes.util.find_library("gnutls"))

508

_need_version = b"3.3.0"

509

def __init__(self):

510

# Need to use class name "GnuTLS" here, since this method is

511

# called before the assignment to the "gnutls" global variable

512

# happens.

513

if GnuTLS.check_version(self._need_version) is None:

514

raise GnuTLS.Error("Needs GnuTLS {} or later"

515

.format(self._need_version))

516

517

# Unless otherwise indicated, the constants and types below are

518

# all from the gnutls/gnutls.h C header file.

519

520

# Constants

521

E_SUCCESS = 0

522

E_INTERRUPTED = -52

523

E_AGAIN = -28

524

CRT_OPENPGP = 2

525

CLIENT = 2

526

SHUT_RDWR = 0

527

CRD_CERTIFICATE = 1

528

E_NO_CERTIFICATE_FOUND = -49

529

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

530

531

# Types

532

class session_int(ctypes.Structure):

533

_fields_ = []

534

session_t = ctypes.POINTER(session_int)

535

class certificate_credentials_st(ctypes.Structure):

536

_fields_ = []

537

certificate_credentials_t = ctypes.POINTER(

538

certificate_credentials_st)

539

certificate_type_t = ctypes.c_int

540

class datum_t(ctypes.Structure):

541

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

542

('size', ctypes.c_uint)]

543

class openpgp_crt_int(ctypes.Structure):

544

_fields_ = []

545

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

546

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

547

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

548

credentials_type_t = ctypes.c_int

549

transport_ptr_t = ctypes.c_void_p

550

close_request_t = ctypes.c_int

551

552

# Exceptions

553

class Error(Exception):

554

# We need to use the class name "GnuTLS" here, since this

555

# exception might be raised from within GnuTLS.__init__,

556

# which is called before the assignment to the "gnutls"

557

# global variable has happened.

558

def __init__(self, message = None, code = None, args=()):

559

# Default usage is by a message string, but if a return

560

# code is passed, convert it to a string with

561

# gnutls.strerror()

562

self.code = code

563

if message is None and code is not None:

564

message = GnuTLS.strerror(code)

565

return super(GnuTLS.Error, self).__init__(

566

message, *args)

567

568

class CertificateSecurityError(Error):

569

pass

570

571

# Classes

572

class Credentials(object):

573

def __init__(self):

574

self._c_object = gnutls.certificate_credentials_t()

575

gnutls.certificate_allocate_credentials(

576

ctypes.byref(self._c_object))

577

self.type = gnutls.CRD_CERTIFICATE

578

579

def __del__(self):

580

gnutls.certificate_free_credentials(self._c_object)

581

582

class ClientSession(object):

583

def __init__(self, socket, credentials = None):

584

self._c_object = gnutls.session_t()

585

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

586

gnutls.set_default_priority(self._c_object)

587

gnutls.transport_set_ptr(self._c_object, socket.fileno())

588

gnutls.handshake_set_private_extensions(self._c_object,

589

True)

590

self.socket = socket

591

if credentials is None:

592

credentials = gnutls.Credentials()

593

gnutls.credentials_set(self._c_object, credentials.type,

594

ctypes.cast(credentials._c_object,

595

ctypes.c_void_p))

596

self.credentials = credentials

597

598

def __del__(self):

599

gnutls.deinit(self._c_object)

600

601

def handshake(self):

602

return gnutls.handshake(self._c_object)

603

604

def send(self, data):

605

data = bytes(data)

606

data_len = len(data)

607

while data_len > 0:

608

data_len -= gnutls.record_send(self._c_object,

609

data[-data_len:],

610

data_len)

611

612

def bye(self):

613

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

614

615

# Error handling functions

616

def _error_code(result):

617

"""A function to raise exceptions on errors, suitable

618

for the 'restype' attribute on ctypes functions"""

619

if result >= 0:

620

return result

621

if result == gnutls.E_NO_CERTIFICATE_FOUND:

622

raise gnutls.CertificateSecurityError(code = result)

623

raise gnutls.Error(code = result)

624

625

def _retry_on_error(result, func, arguments):

626

"""A function to retry on some errors, suitable

627

for the 'errcheck' attribute on ctypes functions"""

628

while result < 0:

629

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

630

return _error_code(result)

631

result = func(*arguments)

632

return result

633

634

# Unless otherwise indicated, the function declarations below are

635

# all from the gnutls/gnutls.h C header file.

636

637

# Functions

638

priority_set_direct = _library.gnutls_priority_set_direct

639

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

640

ctypes.POINTER(ctypes.c_char_p)]

641

priority_set_direct.restype = _error_code

642

643

init = _library.gnutls_init

644

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

645

init.restype = _error_code

646

647

set_default_priority = _library.gnutls_set_default_priority

648

set_default_priority.argtypes = [session_t]

649

set_default_priority.restype = _error_code

650

651

record_send = _library.gnutls_record_send

652

record_send.argtypes = [session_t, ctypes.c_void_p,

653

ctypes.c_size_t]

654

record_send.restype = ctypes.c_ssize_t

655

record_send.errcheck = _retry_on_error

656

657

certificate_allocate_credentials = (

658

_library.gnutls_certificate_allocate_credentials)

659

certificate_allocate_credentials.argtypes = [

660

ctypes.POINTER(certificate_credentials_t)]

661

certificate_allocate_credentials.restype = _error_code

662

663

certificate_free_credentials = (

664

_library.gnutls_certificate_free_credentials)

665

certificate_free_credentials.argtypes = [certificate_credentials_t]

666

certificate_free_credentials.restype = None

667

668

handshake_set_private_extensions = (

669

_library.gnutls_handshake_set_private_extensions)

670

handshake_set_private_extensions.argtypes = [session_t,

671

ctypes.c_int]

672

handshake_set_private_extensions.restype = None

673

674

credentials_set = _library.gnutls_credentials_set

675

credentials_set.argtypes = [session_t, credentials_type_t,

676

ctypes.c_void_p]

677

credentials_set.restype = _error_code

678

679

strerror = _library.gnutls_strerror

680

strerror.argtypes = [ctypes.c_int]

681

strerror.restype = ctypes.c_char_p

682

683

certificate_type_get = _library.gnutls_certificate_type_get

684

certificate_type_get.argtypes = [session_t]

685

certificate_type_get.restype = _error_code

686

687

certificate_get_peers = _library.gnutls_certificate_get_peers

688

certificate_get_peers.argtypes = [session_t,

689

ctypes.POINTER(ctypes.c_uint)]

690

certificate_get_peers.restype = ctypes.POINTER(datum_t)

691

692

global_set_log_level = _library.gnutls_global_set_log_level

693

global_set_log_level.argtypes = [ctypes.c_int]

694

global_set_log_level.restype = None

695

696

global_set_log_function = _library.gnutls_global_set_log_function

697

global_set_log_function.argtypes = [log_func]

698

global_set_log_function.restype = None

699

700

deinit = _library.gnutls_deinit

701

deinit.argtypes = [session_t]

702

deinit.restype = None

703

704

handshake = _library.gnutls_handshake

705

handshake.argtypes = [session_t]

706

handshake.restype = _error_code

707

handshake.errcheck = _retry_on_error

708

709

transport_set_ptr = _library.gnutls_transport_set_ptr

710

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

711

transport_set_ptr.restype = None

712

713

bye = _library.gnutls_bye

714

bye.argtypes = [session_t, close_request_t]

715

bye.restype = _error_code

716

bye.errcheck = _retry_on_error

717

718

check_version = _library.gnutls_check_version

719

check_version.argtypes = [ctypes.c_char_p]

720

check_version.restype = ctypes.c_char_p

721

722

# All the function declarations below are from gnutls/openpgp.h

723

724

openpgp_crt_init = _library.gnutls_openpgp_crt_init

725

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

726

openpgp_crt_init.restype = _error_code

727

728

openpgp_crt_import = _library.gnutls_openpgp_crt_import

729

openpgp_crt_import.argtypes = [openpgp_crt_t,

730

ctypes.POINTER(datum_t),

731

openpgp_crt_fmt_t]

732

openpgp_crt_import.restype = _error_code

733

734

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

735

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

736

ctypes.POINTER(ctypes.c_uint)]

737

openpgp_crt_verify_self.restype = _error_code

738

739

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

740

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

741

openpgp_crt_deinit.restype = None

742

743

openpgp_crt_get_fingerprint = (

744

_library.gnutls_openpgp_crt_get_fingerprint)

745

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

746

ctypes.c_void_p,

747

ctypes.POINTER(

748

ctypes.c_size_t)]

749

openpgp_crt_get_fingerprint.restype = _error_code

750

751

# Remove non-public functions

752

del _error_code, _retry_on_error

753

# Create the global "gnutls" object, simulating a module

754

gnutls = GnuTLS()

755

756

def call_pipe(connection, # : multiprocessing.Connection

757

func, *args, **kwargs):

758

"""This function is meant to be called by multiprocessing.Process

759

760

This function runs func(*args, **kwargs), and writes the resulting

761

return value on the provided multiprocessing.Connection.

762

"""

763

connection.send(func(*args, **kwargs))

764

connection.close()

395

765

396

766

class Client(object):

397

767

"""A representation of a client host served by this server.

403

773

checker: subprocess.Popen(); a running checker process used

404

774

to see if the client lives.

405

775

'None' if no process is running.

406

checker_callback_tag: a gobject event source tag, or None

776

checker_callback_tag: a GLib event source tag, or None

407

777

checker_command: string; External command which is run to check

408

778

if client lives. %() expansions are done at

409

779

runtime with vars(self) as dict, so that for

410

780

instance %(name)s can be used in the command.

411

checker_initiator_tag: a gobject event source tag, or None

781

checker_initiator_tag: a GLib event source tag, or None

412

782

created: datetime.datetime(); (UTC) object creation

413

783

client_structure: Object describing what attributes a client has

414

784

and is used for storing the client at exit

415

785

current_checker_command: string; current running checker_command

416

disable_initiator_tag: a gobject event source tag, or None

786

disable_initiator_tag: a GLib event source tag, or None

417

787

enabled: bool()

418

788

fingerprint: string (40 or 32 hexadecimal digits); used to

419

789

uniquely identify the client

424

794

last_checker_status: integer between 0 and 255 reflecting exit

425

795

status of last checker. -1 reflects crashed

426

796

checker, -2 means no checker completed yet.

797

last_checker_signal: The signal which killed the last checker, if

798

last_checker_status is -1

427

799

last_enabled: datetime.datetime(); (UTC) or None

428

800

name: string; from the config file, used in log messages and

429

801

D-Bus identifiers

434

806

runtime_expansions: Allowed attributes for runtime expansion.

435

807

expires: datetime.datetime(); time (UTC) when a client will be

436

808

disabled, or None

809

server_settings: The server_settings dict from main()

437

810

"""

438

811

439

812

runtime_expansions = ("approval_delay", "approval_duration",

440

"created", "enabled", "fingerprint",

441

"host", "interval", "last_checked_ok",

813

"created", "enabled", "expires",

814

"fingerprint", "host", "interval",

815

"last_approval_request", "last_checked_ok",

442

816

"last_enabled", "name", "timeout")

443

client_defaults = { "timeout": "5m",

444

"extended_timeout": "15m",

445

"interval": "2m",

446

"checker": "fping -q -- %%(host)s",

447

"host": "",

448

"approval_delay": "0s",

449

"approval_duration": "1s",

450

"approved_by_default": "True",

451

"enabled": "True",

452

}

453

454

def timeout_milliseconds(self):

455

"Return the 'timeout' attribute in milliseconds"

456

return timedelta_to_milliseconds(self.timeout)

457

458

def extended_timeout_milliseconds(self):

459

"Return the 'extended_timeout' attribute in milliseconds"

460

return timedelta_to_milliseconds(self.extended_timeout)

461

462

def interval_milliseconds(self):

463

"Return the 'interval' attribute in milliseconds"

464

return timedelta_to_milliseconds(self.interval)

465

466

def approval_delay_milliseconds(self):

467

return timedelta_to_milliseconds(self.approval_delay)

817

client_defaults = {

818

"timeout": "PT5M",

819

"extended_timeout": "PT15M",

820

"interval": "PT2M",

821

"checker": "fping -q -- %%(host)s",

822

"host": "",

823

"approval_delay": "PT0S",

824

"approval_duration": "PT1S",

825

"approved_by_default": "True",

826

"enabled": "True",

827

}

468

828

469

829

@staticmethod

470

830

def config_parser(config):

486

846

client["enabled"] = config.getboolean(client_name,

487

847

"enabled")

488

848

849

# Uppercase and remove spaces from fingerprint for later

850

# comparison purposes with return value from the

851

# fingerprint() function

489

852

client["fingerprint"] = (section["fingerprint"].upper()

490

853

.replace(" ", ""))

491

854

if "secret" in section:

492

client["secret"] = section["secret"].decode("base64")

855

client["secret"] = codecs.decode(section["secret"]

856

.encode("utf-8"),

857

"base64")

493

858

elif "secfile" in section:

494

859

with open(os.path.expanduser(os.path.expandvars

495

860

(section["secfile"])),

496

861

"rb") as secfile:

497

862

client["secret"] = secfile.read()

498

863

else:

499

raise TypeError("No secret or secfile for section {0}"

864

raise TypeError("No secret or secfile for section {}"

500

865

.format(section))

501

866

client["timeout"] = string_to_delta(section["timeout"])

502

867

client["extended_timeout"] = string_to_delta(

513

878

514

879

return settings

515

880

516

def __init__(self, settings, name = None):

881

def __init__(self, settings, name = None, server_settings=None):

517

882

self.name = name

883

if server_settings is None:

884

server_settings = {}

885

self.server_settings = server_settings

518

886

# adding all client settings

519

for setting, value in settings.iteritems():

887

for setting, value in settings.items():

520

888

setattr(self, setting, value)

521

889

522

890

if self.enabled:

530

898

self.expires = None

531

899

532

900

logger.debug("Creating client %r", self.name)

533

# Uppercase and remove spaces from fingerprint for later

534

# comparison purposes with return value from the fingerprint()

535

# function

536

901

logger.debug(" Fingerprint: %s", self.fingerprint)

537

902

self.created = settings.get("created",

538

903

datetime.datetime.utcnow())

545

910

self.current_checker_command = None

546

911

self.approved = None

547

912

self.approvals_pending = 0

548

self.changedstate = (multiprocessing_manager

549

.Condition(multiprocessing_manager

550

.Lock()))

551

self.client_structure = [attr for attr in

552

self.__dict__.iterkeys()

913

self.changedstate = multiprocessing_manager.Condition(

914

multiprocessing_manager.Lock())

915

self.client_structure = [attr

916

for attr in self.__dict__.keys()

553

917

if not attr.startswith("_")]

554

918

self.client_structure.append("client_structure")

555

919

556

for name, t in inspect.getmembers(type(self),

557

lambda obj:

558

isinstance(obj,

559

property)):

920

for name, t in inspect.getmembers(

921

type(self), lambda obj: isinstance(obj, property)):

560

922

if not name.startswith("_"):

561

923

self.client_structure.append(name)

562

924

570

932

if getattr(self, "enabled", False):

571

933

# Already enabled

572

934

return

573

self.send_changedstate()

574

935

self.expires = datetime.datetime.utcnow() + self.timeout

575

936

self.enabled = True

576

937

self.last_enabled = datetime.datetime.utcnow()

577

938

self.init_checker()

939

self.send_changedstate()

578

940

579

941

def disable(self, quiet=True):

580

942

"""Disable this client."""

581

943

if not getattr(self, "enabled", False):

582

944

return False

583

945

if not quiet:

584

self.send_changedstate()

585

if not quiet:

586

946

logger.info("Disabling client %s", self.name)

587

if getattr(self, "disable_initiator_tag", False):

588

gobject.source_remove(self.disable_initiator_tag)

947

if getattr(self, "disable_initiator_tag", None) is not None:

948

GLib.source_remove(self.disable_initiator_tag)

589

949

self.disable_initiator_tag = None

590

950

self.expires = None

591

if getattr(self, "checker_initiator_tag", False):

592

gobject.source_remove(self.checker_initiator_tag)

951

if getattr(self, "checker_initiator_tag", None) is not None:

952

GLib.source_remove(self.checker_initiator_tag)

593

953

self.checker_initiator_tag = None

594

954

self.stop_checker()

595

955

self.enabled = False

596

# Do not run this again if called by a gobject.timeout_add

956

if not quiet:

957

self.send_changedstate()

958

# Do not run this again if called by a GLib.timeout_add

597

959

return False

598

960

599

961

def __del__(self):

602

964

def init_checker(self):

603

965

# Schedule a new checker to be started an 'interval' from now,

604

966

# and every interval from then on.

605

self.checker_initiator_tag = (gobject.timeout_add

606

(self.interval_milliseconds(),

607

self.start_checker))

967

if self.checker_initiator_tag is not None:

968

GLib.source_remove(self.checker_initiator_tag)

969

self.checker_initiator_tag = GLib.timeout_add(

970

int(self.interval.total_seconds() * 1000),

971

self.start_checker)

608

972

# Schedule a disable() when 'timeout' has passed

609

self.disable_initiator_tag = (gobject.timeout_add

610

(self.timeout_milliseconds(),

611

self.disable))

973

if self.disable_initiator_tag is not None:

974

GLib.source_remove(self.disable_initiator_tag)

975

self.disable_initiator_tag = GLib.timeout_add(

976

int(self.timeout.total_seconds() * 1000), self.disable)

612

977

# Also start a new checker *right now*.

613

978

self.start_checker()

614

979

615

def checker_callback(self, pid, condition, command):

980

def checker_callback(self, source, condition, connection,

981

command):

616

982

"""The checker has completed, so take appropriate actions."""

617

983

self.checker_callback_tag = None

618

984

self.checker = None

619

if os.WIFEXITED(condition):

620

self.last_checker_status = os.WEXITSTATUS(condition)

985

# Read return code from connection (see call_pipe)

986

returncode = connection.recv()

987

connection.close()

988

989

if returncode >= 0:

990

self.last_checker_status = returncode

991

self.last_checker_signal = None

621

992

if self.last_checker_status == 0:

622

993

logger.info("Checker for %(name)s succeeded",

623

994

vars(self))

624

995

self.checked_ok()

625

996

else:

626

logger.info("Checker for %(name)s failed",

627

vars(self))

997

logger.info("Checker for %(name)s failed", vars(self))

628

998

else:

629

999

self.last_checker_status = -1

1000

self.last_checker_signal = -returncode

630

1001

logger.warning("Checker for %(name)s crashed?",

631

1002

vars(self))

1003

return False

632

1004

633

1005

def checked_ok(self):

634

1006

"""Assert that the client has been seen, alive and well."""

635

1007

self.last_checked_ok = datetime.datetime.utcnow()

636

1008

self.last_checker_status = 0

1009

self.last_checker_signal = None

637

1010

self.bump_timeout()

638

1011

639

1012

def bump_timeout(self, timeout=None):

641

1014

if timeout is None:

642

1015

timeout = self.timeout

643

1016

if self.disable_initiator_tag is not None:

644

gobject.source_remove(self.disable_initiator_tag)

1017

GLib.source_remove(self.disable_initiator_tag)

1018

self.disable_initiator_tag = None

645

1019

if getattr(self, "enabled", False):

646

self.disable_initiator_tag = (gobject.timeout_add

647

(timedelta_to_milliseconds

648

(timeout), self.disable))

1020

self.disable_initiator_tag = GLib.timeout_add(

1021

int(timeout.total_seconds() * 1000), self.disable)

649

1022

self.expires = datetime.datetime.utcnow() + timeout

650

1023

651

1024

def need_approval(self):

657

1030

If a checker already exists, leave it running and do

658

1031

nothing."""

659

1032

# The reason for not killing a running checker is that if we

660

# did that, then if a checker (for some reason) started

661

# running slowly and taking more than 'interval' time, the

662

# client would inevitably timeout, since no checker would get

663

# a chance to run to completion. If we instead leave running

1033

# did that, and if a checker (for some reason) started running

1034

# slowly and taking more than 'interval' time, then the client

1035

# would inevitably timeout, since no checker would get a

1036

# chance to run to completion. If we instead leave running

664

1037

# checkers alone, the checker would have to take more time

665

1038

# than 'timeout' for the client to be disabled, which is as it

666

1039

# should be.

667

1040

668

# If a checker exists, make sure it is not a zombie

669

try:

670

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

671

except (AttributeError, OSError) as error:

672

if (isinstance(error, OSError)

673

and error.errno != errno.ECHILD):

674

raise error

675

else:

676

if pid:

677

logger.warning("Checker was a zombie")

678

gobject.source_remove(self.checker_callback_tag)

679

self.checker_callback(pid, status,

680

self.current_checker_command)

1041

if self.checker is not None and not self.checker.is_alive():

1042

logger.warning("Checker was not alive; joining")

1043

self.checker.join()

1044

self.checker = None

681

1045

# Start a new checker if needed

682

1046

if self.checker is None:

1047

# Escape attributes for the shell

1048

escaped_attrs = {

1049

attr: re.escape(str(getattr(self, attr)))

1050

for attr in self.runtime_expansions }

683

1051

try:

684

# In case checker_command has exactly one % operator

685

command = self.checker_command % self.host

686

except TypeError:

687

# Escape attributes for the shell

688

escaped_attrs = dict(

689

(attr,

690

re.escape(unicode(str(getattr(self, attr, "")),

691

errors=

692

'replace')))

693

for attr in

694

self.runtime_expansions)

695

696

try:

697

command = self.checker_command % escaped_attrs

698

except TypeError as error:

699

logger.error('Could not format string "%s"',

700

self.checker_command, exc_info=error)

701

return True # Try again later

1052

command = self.checker_command % escaped_attrs

1053

except TypeError as error:

1054

logger.error('Could not format string "%s"',

1055

self.checker_command,

1056

exc_info=error)

1057

return True # Try again later

702

1058

self.current_checker_command = command

703

try:

704

logger.info("Starting checker %r for %s",

705

command, self.name)

706

# We don't need to redirect stdout and stderr, since

707

# in normal mode, that is already done by daemon(),

708

# and in debug mode we don't want to. (Stdin is

709

# always replaced by /dev/null.)

710

self.checker = subprocess.Popen(command,

711

close_fds=True,

712

shell=True, cwd="/")

713

self.checker_callback_tag = (gobject.child_watch_add

714

(self.checker.pid,

715

self.checker_callback,

716

data=command))

717

# The checker may have completed before the gobject

718

# watch was added. Check for this.

719

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

720

if pid:

721

gobject.source_remove(self.checker_callback_tag)

722

self.checker_callback(pid, status, command)

723

except OSError as error:

724

logger.error("Failed to start subprocess",

725

exc_info=error)

726

# Re-run this periodically if run by gobject.timeout_add

1059

logger.info("Starting checker %r for %s", command,

1060

self.name)

1061

# We don't need to redirect stdout and stderr, since

1062

# in normal mode, that is already done by daemon(),

1063

# and in debug mode we don't want to. (Stdin is

1064

# always replaced by /dev/null.)

1065

# The exception is when not debugging but nevertheless

1066

# running in the foreground; use the previously

1067

# created wnull.

1068

popen_args = { "close_fds": True,

1069

"shell": True,

1070

"cwd": "/" }

1071

if (not self.server_settings["debug"]

1072

and self.server_settings["foreground"]):

1073

popen_args.update({"stdout": wnull,

1074

"stderr": wnull })

1075

pipe = multiprocessing.Pipe(duplex = False)

1076

self.checker = multiprocessing.Process(

1077

target = call_pipe,

1078

args = (pipe[1], subprocess.call, command),

1079

kwargs = popen_args)

1080

self.checker.start()

1081

self.checker_callback_tag = GLib.io_add_watch(

1082

pipe[0].fileno(), GLib.IO_IN,

1083

self.checker_callback, pipe[0], command)

1084

# Re-run this periodically if run by GLib.timeout_add

727

1085

return True

728

1086

729

1087

def stop_checker(self):

730

1088

"""Force the checker process, if any, to stop."""

731

1089

if self.checker_callback_tag:

732

gobject.source_remove(self.checker_callback_tag)

1090

GLib.source_remove(self.checker_callback_tag)

733

1091

self.checker_callback_tag = None

734

1092

if getattr(self, "checker", None) is None:

735

1093

return

736

1094

logger.debug("Stopping checker for %(name)s", vars(self))

737

try:

738

self.checker.terminate()

739

#time.sleep(0.5)

740

#if self.checker.poll() is None:

741

# self.checker.kill()

742

except OSError as error:

743

if error.errno != errno.ESRCH: # No such process

744

raise

1095

self.checker.terminate()

745

1096

self.checker = None

746

1097

747

1098

748

def dbus_service_property(dbus_interface, signature="v",

749

access="readwrite", byte_arrays=False):

1099

def dbus_service_property(dbus_interface,

1100

signature="v",

1101

access="readwrite",

1102

byte_arrays=False):

750

1103

"""Decorators for marking methods of a DBusObjectWithProperties to

751

1104

become properties on the D-Bus.

752

1105

761

1114

# "Set" method, so we fail early here:

762

1115

if byte_arrays and signature != "ay":

763

1116

raise ValueError("Byte arrays not supported for non-'ay'"

764

" signature {0!r}".format(signature))

1117

" signature {!r}".format(signature))

1118

765

1119

def decorator(func):

766

1120

func._dbus_is_property = True

767

1121

func._dbus_interface = dbus_interface

772

1126

func._dbus_name = func._dbus_name[:-14]

773

1127

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

774

1128

return func

1129

775

1130

return decorator

776

1131

777

1132

786

1141

"org.freedesktop.DBus.Property.EmitsChangedSignal":

787

1142

"false"}

788

1143

"""

1144

789

1145

def decorator(func):

790

1146

func._dbus_is_interface = True

791

1147

func._dbus_interface = dbus_interface

792

1148

func._dbus_name = dbus_interface

793

1149

return func

1150

794

1151

return decorator

795

1152

796

1153

798

1155

"""Decorator to annotate D-Bus methods, signals or properties

799

1156

Usage:

800

1157

1158

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1159

"org.freedesktop.DBus.Property."

1160

"EmitsChangedSignal": "false"})

801

1161

@dbus_service_property("org.example.Interface", signature="b",

802

1162

access="r")

803

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

804

"org.freedesktop.DBus.Property."

805

"EmitsChangedSignal": "false"})

806

1163

def Property_dbus_property(self):

807

1164

return dbus.Boolean(False)

1165

1166

See also the DBusObjectWithAnnotations class.

808

1167

"""

1168

809

1169

def decorator(func):

810

1170

func._dbus_annotations = annotations

811

1171

return func

1172

812

1173

return decorator

813

1174

814

1175

815

1176

class DBusPropertyException(dbus.exceptions.DBusException):

816

1177

"""A base class for D-Bus property-related exceptions

817

1178

"""

818

def __unicode__(self):

819

return unicode(str(self))

1179

pass

820

1180

821

1181

822

1182

class DBusPropertyAccessException(DBusPropertyException):

831

1191

pass

832

1192

833

1193

834

class DBusObjectWithProperties(dbus.service.Object):

835

"""A D-Bus object with properties.

1194

class DBusObjectWithAnnotations(dbus.service.Object):

1195

"""A D-Bus object with annotations.

836

1196

837

Classes inheriting from this can use the dbus_service_property

838

decorator to expose methods as D-Bus properties. It exposes the

839

standard Get(), Set(), and GetAll() methods on the D-Bus.

1197

Classes inheriting from this can use the dbus_annotations

1198

decorator to add annotations to methods or signals.

840

1199

"""

841

1200

842

1201

@staticmethod

846

1205

If called like _is_dbus_thing("method") it returns a function

847

1206

suitable for use as predicate to inspect.getmembers().

848

1207

"""

849

return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),

1208

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

850

1209

False)

851

1210

852

1211

def _get_all_dbus_things(self, thing):

853

1212

"""Returns a generator of (name, attribute) pairs

854

1213

"""

855

return ((getattr(athing.__get__(self), "_dbus_name",

856

name),

1214

return ((getattr(athing.__get__(self), "_dbus_name", name),

857

1215

athing.__get__(self))

858

1216

for cls in self.__class__.__mro__

859

1217

for name, athing in

860

inspect.getmembers(cls,

861

self._is_dbus_thing(thing)))

1218

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1219

1220

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1221

out_signature = "s",

1222

path_keyword = 'object_path',

1223

connection_keyword = 'connection')

1224

def Introspect(self, object_path, connection):

1225

"""Overloading of standard D-Bus method.

1226

1227

Inserts annotation tags on methods and signals.

1228

"""

1229

xmlstring = dbus.service.Object.Introspect(self, object_path,

1230

connection)

1231

try:

1232

document = xml.dom.minidom.parseString(xmlstring)

1233

1234

for if_tag in document.getElementsByTagName("interface"):

1235

# Add annotation tags

1236

for typ in ("method", "signal"):

1237

for tag in if_tag.getElementsByTagName(typ):

1238

annots = dict()

1239

for name, prop in (self.

1240

_get_all_dbus_things(typ)):

1241

if (name == tag.getAttribute("name")

1242

and prop._dbus_interface

1243

== if_tag.getAttribute("name")):

1244

annots.update(getattr(

1245

prop, "_dbus_annotations", {}))

1246

for name, value in annots.items():

1247

ann_tag = document.createElement(

1248

"annotation")

1249

ann_tag.setAttribute("name", name)

1250

ann_tag.setAttribute("value", value)

1251

tag.appendChild(ann_tag)

1252

# Add interface annotation tags

1253

for annotation, value in dict(

1254

itertools.chain.from_iterable(

1255

annotations().items()

1256

for name, annotations

1257

in self._get_all_dbus_things("interface")

1258

if name == if_tag.getAttribute("name")

1259

)).items():

1260

ann_tag = document.createElement("annotation")

1261

ann_tag.setAttribute("name", annotation)

1262

ann_tag.setAttribute("value", value)

1263

if_tag.appendChild(ann_tag)

1264

# Fix argument name for the Introspect method itself

1265

if (if_tag.getAttribute("name")

1266

== dbus.INTROSPECTABLE_IFACE):

1267

for cn in if_tag.getElementsByTagName("method"):

1268

if cn.getAttribute("name") == "Introspect":

1269

for arg in cn.getElementsByTagName("arg"):

1270

if (arg.getAttribute("direction")

1271

== "out"):

1272

arg.setAttribute("name",

1273

"xml_data")

1274

xmlstring = document.toxml("utf-8")

1275

document.unlink()

1276

except (AttributeError, xml.dom.DOMException,

1277

xml.parsers.expat.ExpatError) as error:

1278

logger.error("Failed to override Introspection method",

1279

exc_info=error)

1280

return xmlstring

1281

1282

1283

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1284

"""A D-Bus object with properties.

1285

1286

Classes inheriting from this can use the dbus_service_property

1287

decorator to expose methods as D-Bus properties. It exposes the

1288

standard Get(), Set(), and GetAll() methods on the D-Bus.

1289

"""

862

1290

863

1291

def _get_dbus_property(self, interface_name, property_name):

864

1292

"""Returns a bound method if one exists which is a D-Bus

865

1293

property with the specified name and interface.

866

1294

"""

867

for cls in self.__class__.__mro__:

868

for name, value in (inspect.getmembers

869

(cls,

870

self._is_dbus_thing("property"))):

1295

for cls in self.__class__.__mro__:

1296

for name, value in inspect.getmembers(

1297

cls, self._is_dbus_thing("property")):

871

1298

if (value._dbus_name == property_name

872

1299

and value._dbus_interface == interface_name):

873

1300

return value.__get__(self)

874

1301

875

1302

# No such property

876

raise DBusPropertyNotFound(self.dbus_object_path + ":"

877

+ interface_name + "."

878

+ property_name)

879

880

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1303

raise DBusPropertyNotFound("{}:{}.{}".format(

1304

self.dbus_object_path, interface_name, property_name))

1305

1306

@classmethod

1307

def _get_all_interface_names(cls):

1308

"""Get a sequence of all interfaces supported by an object"""

1309

return (name for name in set(getattr(getattr(x, attr),

1310

"_dbus_interface", None)

1311

for x in (inspect.getmro(cls))

1312

for attr in dir(x))

1313

if name is not None)

1314

1315

@dbus.service.method(dbus.PROPERTIES_IFACE,

1316

in_signature="ss",

881

1317

out_signature="v")

882

1318

def Get(self, interface_name, property_name):

883

1319

"""Standard D-Bus property Get() method, see D-Bus standard.

901

1337

# The byte_arrays option is not supported yet on

902

1338

# signatures other than "ay".

903

1339

if prop._dbus_signature != "ay":

904

raise ValueError

1340

raise ValueError("Byte arrays not supported for non-"

1341

"'ay' signature {!r}"

1342

.format(prop._dbus_signature))

905

1343

value = dbus.ByteArray(b''.join(chr(byte)

906

1344

for byte in value))

907

1345

prop(value)

908

1346

909

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1347

@dbus.service.method(dbus.PROPERTIES_IFACE,

1348

in_signature="s",

910

1349

out_signature="a{sv}")

911

1350

def GetAll(self, interface_name):

912

1351

"""Standard D-Bus property GetAll() method, see D-Bus

927

1366

if not hasattr(value, "variant_level"):

928

1367

properties[name] = value

929

1368

continue

930

properties[name] = type(value)(value, variant_level=

931

value.variant_level+1)

1369

properties[name] = type(value)(

1370

value, variant_level = value.variant_level + 1)

932

1371

return dbus.Dictionary(properties, signature="sv")

933

1372

1373

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1374

def PropertiesChanged(self, interface_name, changed_properties,

1375

invalidated_properties):

1376

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1377

standard.

1378

"""

1379

pass

1380

934

1381

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

935

1382

out_signature="s",

936

1383

path_keyword='object_path',

940

1387

941

1388

Inserts property tags and interface annotation tags.

942

1389

"""

943

xmlstring = dbus.service.Object.Introspect(self, object_path,

944

connection)

1390

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1391

object_path,

1392

connection)

945

1393

try:

946

1394

document = xml.dom.minidom.parseString(xmlstring)

1395

947

1396

def make_tag(document, name, prop):

948

1397

e = document.createElement("property")

949

1398

e.setAttribute("name", name)

950

1399

e.setAttribute("type", prop._dbus_signature)

951

1400

e.setAttribute("access", prop._dbus_access)

952

1401

return e

1402

953

1403

for if_tag in document.getElementsByTagName("interface"):

954

1404

# Add property tags

955

1405

for tag in (make_tag(document, name, prop)

958

1408

if prop._dbus_interface

959

1409

== if_tag.getAttribute("name")):

960

1410

if_tag.appendChild(tag)

961

# Add annotation tags

962

for typ in ("method", "signal", "property"):

963

for tag in if_tag.getElementsByTagName(typ):

964

annots = dict()

965

for name, prop in (self.

966

_get_all_dbus_things(typ)):

967

if (name == tag.getAttribute("name")

968

and prop._dbus_interface

969

== if_tag.getAttribute("name")):

970

annots.update(getattr

971

(prop,

972

"_dbus_annotations",

973

{}))

974

for name, value in annots.iteritems():

975

ann_tag = document.createElement(

976

"annotation")

977

ann_tag.setAttribute("name", name)

978

ann_tag.setAttribute("value", value)

979

tag.appendChild(ann_tag)

980

# Add interface annotation tags

981

for annotation, value in dict(

982

itertools.chain.from_iterable(

983

annotations().iteritems()

984

for name, annotations in

985

self._get_all_dbus_things("interface")

986

if name == if_tag.getAttribute("name")

987

)).iteritems():

988

ann_tag = document.createElement("annotation")

989

ann_tag.setAttribute("name", annotation)

990

ann_tag.setAttribute("value", value)

991

if_tag.appendChild(ann_tag)

1411

# Add annotation tags for properties

1412

for tag in if_tag.getElementsByTagName("property"):

1413

annots = dict()

1414

for name, prop in self._get_all_dbus_things(

1415

"property"):

1416

if (name == tag.getAttribute("name")

1417

and prop._dbus_interface

1418

== if_tag.getAttribute("name")):

1419

annots.update(getattr(

1420

prop, "_dbus_annotations", {}))

1421

for name, value in annots.items():

1422

ann_tag = document.createElement(

1423

"annotation")

1424

ann_tag.setAttribute("name", name)

1425

ann_tag.setAttribute("value", value)

1426

tag.appendChild(ann_tag)

992

1427

# Add the names to the return values for the

993

1428

# "org.freedesktop.DBus.Properties" methods

994

1429

if (if_tag.getAttribute("name")

1012

1447

exc_info=error)

1013

1448

return xmlstring

1014

1449

1015

1016

def datetime_to_dbus (dt, variant_level=0):

1450

try:

1451

dbus.OBJECT_MANAGER_IFACE

1452

except AttributeError:

1453

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1454

1455

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1456

"""A D-Bus object with an ObjectManager.

1457

1458

Classes inheriting from this exposes the standard

1459

GetManagedObjects call and the InterfacesAdded and

1460

InterfacesRemoved signals on the standard

1461

"org.freedesktop.DBus.ObjectManager" interface.

1462

1463

Note: No signals are sent automatically; they must be sent

1464

manually.

1465

"""

1466

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1467

out_signature = "a{oa{sa{sv}}}")

1468

def GetManagedObjects(self):

1469

"""This function must be overridden"""

1470

raise NotImplementedError()

1471

1472

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1473

signature = "oa{sa{sv}}")

1474

def InterfacesAdded(self, object_path, interfaces_and_properties):

1475

pass

1476

1477

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1478

def InterfacesRemoved(self, object_path, interfaces):

1479

pass

1480

1481

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1482

out_signature = "s",

1483

path_keyword = 'object_path',

1484

connection_keyword = 'connection')

1485

def Introspect(self, object_path, connection):

1486

"""Overloading of standard D-Bus method.

1487

1488

Override return argument name of GetManagedObjects to be

1489

"objpath_interfaces_and_properties"

1490

"""

1491

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1492

object_path,

1493

connection)

1494

try:

1495

document = xml.dom.minidom.parseString(xmlstring)

1496

1497

for if_tag in document.getElementsByTagName("interface"):

1498

# Fix argument name for the GetManagedObjects method

1499

if (if_tag.getAttribute("name")

1500

== dbus.OBJECT_MANAGER_IFACE):

1501

for cn in if_tag.getElementsByTagName("method"):

1502

if (cn.getAttribute("name")

1503

== "GetManagedObjects"):

1504

for arg in cn.getElementsByTagName("arg"):

1505

if (arg.getAttribute("direction")

1506

== "out"):

1507

arg.setAttribute(

1508

"name",

1509

"objpath_interfaces"

1510

"_and_properties")

1511

xmlstring = document.toxml("utf-8")

1512

document.unlink()

1513

except (AttributeError, xml.dom.DOMException,

1514

xml.parsers.expat.ExpatError) as error:

1515

logger.error("Failed to override Introspection method",

1516

exc_info = error)

1517

return xmlstring

1518

1519

def datetime_to_dbus(dt, variant_level=0):

1017

1520

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1018

1521

if dt is None:

1019

1522

return dbus.String("", variant_level = variant_level)

1020

return dbus.String(dt.isoformat(),

1021

variant_level=variant_level)

1523

return dbus.String(dt.isoformat(), variant_level=variant_level)

1022

1524

1023

1525

1024

1526

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1027

1529

interface names according to the "alt_interface_names" mapping.

1028

1530

Usage:

1029

1531

1030

@alternate_dbus_names({"org.example.Interface":

1031

"net.example.AlternateInterface"})

1532

@alternate_dbus_interfaces({"org.example.Interface":

1533

"net.example.AlternateInterface"})

1032

1534

class SampleDBusObject(dbus.service.Object):

1033

1535

@dbus.service.method("org.example.Interface")

1034

1536

def SampleDBusMethod():

1044

1546

(from DBusObjectWithProperties) and interfaces (from the

1045

1547

dbus_interface_annotations decorator).

1046

1548

"""

1549

1047

1550

def wrapper(cls):

1048

1551

for orig_interface_name, alt_interface_name in (

1049

alt_interface_names.iteritems()):

1552

alt_interface_names.items()):

1050

1553

attr = {}

1051

1554

interface_names = set()

1052

1555

# Go though all attributes of the class

1054

1557

# Ignore non-D-Bus attributes, and D-Bus attributes

1055

1558

# with the wrong interface name

1056

1559

if (not hasattr(attribute, "_dbus_interface")

1057

or not attribute._dbus_interface

1058

.startswith(orig_interface_name)):

1560

or not attribute._dbus_interface.startswith(

1561

orig_interface_name)):

1059

1562

continue

1060

1563

# Create an alternate D-Bus interface name based on

1061

1564

# the current name

1062

alt_interface = (attribute._dbus_interface

1063

.replace(orig_interface_name,

1064

alt_interface_name))

1565

alt_interface = attribute._dbus_interface.replace(

1566

orig_interface_name, alt_interface_name)

1065

1567

interface_names.add(alt_interface)

1066

1568

# Is this a D-Bus signal?

1067

1569

if getattr(attribute, "_dbus_is_signal", False):

1068

# Extract the original non-method function by

1069

# black magic

1070

nonmethod_func = (dict(

1570

# Extract the original non-method undecorated

1571

# function by black magic

1572

if sys.version_info.major == 2:

1573

nonmethod_func = (dict(

1071

1574

zip(attribute.func_code.co_freevars,

1072

attribute.__closure__))["func"]

1073

.cell_contents)

1575

attribute.__closure__))

1576

["func"].cell_contents)

1577

else:

1578

nonmethod_func = (dict(

1579

zip(attribute.__code__.co_freevars,

1580

attribute.__closure__))

1581

["func"].cell_contents)

1074

1582

# Create a new, but exactly alike, function

1075

1583

# object, and decorate it to be a new D-Bus signal

1076

1584

# with the alternate D-Bus interface name

1077

new_function = (dbus.service.signal

1078

(alt_interface,

1079

attribute._dbus_signature)

1080

(types.FunctionType(

1081

nonmethod_func.func_code,

1082

nonmethod_func.func_globals,

1083

nonmethod_func.func_name,

1084

nonmethod_func.func_defaults,

1085

nonmethod_func.func_closure)))

1585

new_function = copy_function(nonmethod_func)

1586

new_function = (dbus.service.signal(

1587

alt_interface,

1588

attribute._dbus_signature)(new_function))

1086

1589

# Copy annotations, if any

1087

1590

try:

1088

new_function._dbus_annotations = (

1089

dict(attribute._dbus_annotations))

1591

new_function._dbus_annotations = dict(

1592

attribute._dbus_annotations)

1090

1593

except AttributeError:

1091

1594

pass

1092

1595

# Define a creator of a function to call both the

1097

1600

"""This function is a scope container to pass

1098

1601

func1 and func2 to the "call_both" function

1099

1602

outside of its arguments"""

1603

1604

@functools.wraps(func2)

1100

1605

def call_both(*args, **kwargs):

1101

1606

"""This function will emit two D-Bus

1102

1607

signals by calling func1 and func2"""

1103

1608

func1(*args, **kwargs)

1104

1609

func2(*args, **kwargs)

1610

# Make wrapper function look like a D-Bus signal

1611

for name, attr in inspect.getmembers(func2):

1612

if name.startswith("_dbus_"):

1613

setattr(call_both, name, attr)

1614

1105

1615

return call_both

1106

1616

# Create the "call_both" function and add it to

1107

1617

# the class

1112

1622

# object. Decorate it to be a new D-Bus method

1113

1623

# with the alternate D-Bus interface name. Add it

1114

1624

# to the class.

1115

attr[attrname] = (dbus.service.method

1116

(alt_interface,

1117

attribute._dbus_in_signature,

1118

attribute._dbus_out_signature)

1119

(types.FunctionType

1120

(attribute.func_code,

1121

attribute.func_globals,

1122

attribute.func_name,

1123

attribute.func_defaults,

1124

attribute.func_closure)))

1625

attr[attrname] = (

1626

dbus.service.method(

1627

alt_interface,

1628

attribute._dbus_in_signature,

1629

attribute._dbus_out_signature)

1630

(copy_function(attribute)))

1125

1631

# Copy annotations, if any

1126

1632

try:

1127

attr[attrname]._dbus_annotations = (

1128

dict(attribute._dbus_annotations))

1633

attr[attrname]._dbus_annotations = dict(

1634

attribute._dbus_annotations)

1129

1635

except AttributeError:

1130

1636

pass

1131

1637

# Is this a D-Bus property?

1134

1640

# object, and decorate it to be a new D-Bus

1135

1641

# property with the alternate D-Bus interface

1136

1642

# name. Add it to the class.

1137

attr[attrname] = (dbus_service_property

1138

(alt_interface,

1139

attribute._dbus_signature,

1140

attribute._dbus_access,

1141

attribute

1142

._dbus_get_args_options

1143

["byte_arrays"])

1144

(types.FunctionType

1145

(attribute.func_code,

1146

attribute.func_globals,

1147

attribute.func_name,

1148

attribute.func_defaults,

1149

attribute.func_closure)))

1643

attr[attrname] = (dbus_service_property(

1644

alt_interface, attribute._dbus_signature,

1645

attribute._dbus_access,

1646

attribute._dbus_get_args_options

1647

["byte_arrays"])

1648

(copy_function(attribute)))

1150

1649

# Copy annotations, if any

1151

1650

try:

1152

attr[attrname]._dbus_annotations = (

1153

dict(attribute._dbus_annotations))

1651

attr[attrname]._dbus_annotations = dict(

1652

attribute._dbus_annotations)

1154

1653

except AttributeError:

1155

1654

pass

1156

1655

# Is this a D-Bus interface?

1159

1658

# object. Decorate it to be a new D-Bus interface

1160

1659

# with the alternate D-Bus interface name. Add it

1161

1660

# to the class.

1162

attr[attrname] = (dbus_interface_annotations

1163

(alt_interface)

1164

(types.FunctionType

1165

(attribute.func_code,

1166

attribute.func_globals,

1167

attribute.func_name,

1168

attribute.func_defaults,

1169

attribute.func_closure)))

1661

attr[attrname] = (

1662

dbus_interface_annotations(alt_interface)

1663

(copy_function(attribute)))

1170

1664

if deprecate:

1171

1665

# Deprecate all alternate interfaces

1172

iname="_AlternateDBusNames_interface_annotation{0}"

1666

iname="_AlternateDBusNames_interface_annotation{}"

1173

1667

for interface_name in interface_names:

1668

1174

1669

@dbus_interface_annotations(interface_name)

1175

1670

def func(self):

1176

1671

return { "org.freedesktop.DBus.Deprecated":

1177

"true" }

1672

"true" }

1178

1673

# Find an unused name

1179

1674

for aname in (iname.format(i)

1180

1675

for i in itertools.count()):

1184

1679

if interface_names:

1185

1680

# Replace the class with a new subclass of it with

1186

1681

# methods, signals, etc. as created above.

1187

cls = type(b"{0}Alternate".format(cls.__name__),

1188

(cls,), attr)

1682

if sys.version_info.major == 2:

1683

cls = type(b"{}Alternate".format(cls.__name__),

1684

(cls, ), attr)

1685

else:

1686

cls = type("{}Alternate".format(cls.__name__),

1687

(cls, ), attr)

1189

1688

return cls

1689

1190

1690

return wrapper

1191

1691

1192

1692

1193

1693

@alternate_dbus_interfaces({"se.recompile.Mandos":

1194

"se.bsnet.fukt.Mandos"})

1694

"se.bsnet.fukt.Mandos"})

1195

1695

class ClientDBus(Client, DBusObjectWithProperties):

1196

1696

"""A Client class using D-Bus

1197

1697

1201

1701

"""

1202

1702

1203

1703

runtime_expansions = (Client.runtime_expansions

1204

+ ("dbus_object_path",))

1704

+ ("dbus_object_path", ))

1705

1706

_interface = "se.recompile.Mandos.Client"

1205

1707

1206

1708

# dbus.service.Object doesn't use super(), so we can't either.

1207

1709

1210

1712

Client.__init__(self, *args, **kwargs)

1211

1713

# Only now, when this client is initialized, can it show up on

1212

1714

# the D-Bus

1213

client_object_name = unicode(self.name).translate(

1715

client_object_name = str(self.name).translate(

1214

1716

{ord("."): ord("_"),

1215

1717

ord("-"): ord("_")})

1216

self.dbus_object_path = (dbus.ObjectPath

1217

("/clients/" + client_object_name))

1718

self.dbus_object_path = dbus.ObjectPath(

1719

"/clients/" + client_object_name)

1218

1720

DBusObjectWithProperties.__init__(self, self.bus,

1219

1721

self.dbus_object_path)

1220

1722

1221

def notifychangeproperty(transform_func,

1222

dbus_name, type_func=lambda x: x,

1223

variant_level=1):

1723

def notifychangeproperty(transform_func, dbus_name,

1724

type_func=lambda x: x,

1725

variant_level=1,

1726

invalidate_only=False,

1727

_interface=_interface):

1224

1728

""" Modify a variable so that it's a property which announces

1225

1729

its changes to DBus.

1226

1730

1231

1735

to the D-Bus. Default: no transform

1232

1736

variant_level: D-Bus variant level. Default: 1

1233

1737

"""

1234

attrname = "_{0}".format(dbus_name)

1738

attrname = "_{}".format(dbus_name)

1739

1235

1740

def setter(self, value):

1236

1741

if hasattr(self, "dbus_object_path"):

1237

1742

if (not hasattr(self, attrname) or

1238

1743

type_func(getattr(self, attrname, None))

1239

1744

!= type_func(value)):

1240

dbus_value = transform_func(type_func(value),

1241

variant_level

1242

=variant_level)

1243

self.PropertyChanged(dbus.String(dbus_name),

1244

dbus_value)

1745

if invalidate_only:

1746

self.PropertiesChanged(

1747

_interface, dbus.Dictionary(),

1748

dbus.Array((dbus_name, )))

1749

else:

1750

dbus_value = transform_func(

1751

type_func(value),

1752

variant_level = variant_level)

1753

self.PropertyChanged(dbus.String(dbus_name),

1754

dbus_value)

1755

self.PropertiesChanged(

1756

_interface,

1757

dbus.Dictionary({ dbus.String(dbus_name):

1758

dbus_value }),

1759

dbus.Array())

1245

1760

setattr(self, attrname, value)

1246

1761

1247

1762

return property(lambda self: getattr(self, attrname), setter)

1253

1768

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1254

1769

last_enabled = notifychangeproperty(datetime_to_dbus,

1255

1770

"LastEnabled")

1256

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1257

type_func = lambda checker:

1258

checker is not None)

1771

checker = notifychangeproperty(

1772

dbus.Boolean, "CheckerRunning",

1773

type_func = lambda checker: checker is not None)

1259

1774

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1260

1775

"LastCheckedOK")

1261

1776

last_checker_status = notifychangeproperty(dbus.Int16,

1264

1779

datetime_to_dbus, "LastApprovalRequest")

1265

1780

approved_by_default = notifychangeproperty(dbus.Boolean,

1266

1781

"ApprovedByDefault")

1267

approval_delay = notifychangeproperty(dbus.UInt64,

1268

"ApprovalDelay",

1269

type_func =

1270

timedelta_to_milliseconds)

1782

approval_delay = notifychangeproperty(

1783

dbus.UInt64, "ApprovalDelay",

1784

type_func = lambda td: td.total_seconds() * 1000)

1271

1785

approval_duration = notifychangeproperty(

1272

1786

dbus.UInt64, "ApprovalDuration",

1273

type_func = timedelta_to_milliseconds)

1787

type_func = lambda td: td.total_seconds() * 1000)

1274

1788

host = notifychangeproperty(dbus.String, "Host")

1275

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1276

type_func =

1277

timedelta_to_milliseconds)

1789

timeout = notifychangeproperty(

1790

dbus.UInt64, "Timeout",

1791

type_func = lambda td: td.total_seconds() * 1000)

1278

1792

extended_timeout = notifychangeproperty(

1279

1793

dbus.UInt64, "ExtendedTimeout",

1280

type_func = timedelta_to_milliseconds)

1281

interval = notifychangeproperty(dbus.UInt64,

1282

"Interval",

1283

type_func =

1284

timedelta_to_milliseconds)

1794

type_func = lambda td: td.total_seconds() * 1000)

1795

interval = notifychangeproperty(

1796

dbus.UInt64, "Interval",

1797

type_func = lambda td: td.total_seconds() * 1000)

1285

1798

checker_command = notifychangeproperty(dbus.String, "Checker")

1799

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1800

invalidate_only=True)

1286

1801

1287

1802

del notifychangeproperty

1288

1803

1295

1810

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1296

1811

Client.__del__(self, *args, **kwargs)

1297

1812

1298

def checker_callback(self, pid, condition, command,

1299

*args, **kwargs):

1300

self.checker_callback_tag = None

1301

self.checker = None

1302

if os.WIFEXITED(condition):

1303

exitstatus = os.WEXITSTATUS(condition)

1813

def checker_callback(self, source, condition,

1814

connection, command, *args, **kwargs):

1815

ret = Client.checker_callback(self, source, condition,

1816

connection, command, *args,

1817

**kwargs)

1818

exitstatus = self.last_checker_status

1819

if exitstatus >= 0:

1304

1820

# Emit D-Bus signal

1305

1821

self.CheckerCompleted(dbus.Int16(exitstatus),

1306

dbus.Int64(condition),

1822

# This is specific to GNU libC

1823

dbus.Int64(exitstatus << 8),

1307

1824

dbus.String(command))

1308

1825

else:

1309

1826

# Emit D-Bus signal

1310

1827

self.CheckerCompleted(dbus.Int16(-1),

1311

dbus.Int64(condition),

1828

dbus.Int64(

1829

# This is specific to GNU libC

1830

(exitstatus << 8)

1831

| self.last_checker_signal),

1312

1832

dbus.String(command))

1313

1314

return Client.checker_callback(self, pid, condition, command,

1315

*args, **kwargs)

1833

return ret

1316

1834

1317

1835

def start_checker(self, *args, **kwargs):

1318

old_checker = self.checker

1319

if self.checker is not None:

1320

old_checker_pid = self.checker.pid

1321

else:

1322

old_checker_pid = None

1836

old_checker_pid = getattr(self.checker, "pid", None)

1323

1837

r = Client.start_checker(self, *args, **kwargs)

1324

1838

# Only if new checker process was started

1325

1839

if (self.checker is not None

1333

1847

return False

1334

1848

1335

1849

def approve(self, value=True):

1336

self.send_changedstate()

1337

1850

self.approved = value

1338

gobject.timeout_add(timedelta_to_milliseconds

1339

(self.approval_duration),

1340

self._reset_approved)

1851

GLib.timeout_add(int(self.approval_duration.total_seconds()

1852

* 1000), self._reset_approved)

1853

self.send_changedstate()

1341

1854

1342

1855

## D-Bus methods, signals & properties

1343

_interface = "se.recompile.Mandos.Client"

1344

1856

1345

1857

## Interfaces

1346

1858

1347

@dbus_interface_annotations(_interface)

1348

def _foo(self):

1349

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1350

"false"}

1351

1352

1859

## Signals

1353

1860

1354

1861

# CheckerCompleted - signal

1364

1871

pass

1365

1872

1366

1873

# PropertyChanged - signal

1874

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1367

1875

@dbus.service.signal(_interface, signature="sv")

1368

1876

def PropertyChanged(self, property, value):

1369

1877

"D-Bus signal"

1403

1911

self.checked_ok()

1404

1912

1405

1913

# Enable - method

1914

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1406

1915

@dbus.service.method(_interface)

1407

1916

def Enable(self):

1408

1917

"D-Bus method"

1409

1918

self.enable()

1410

1919

1411

1920

# StartChecker - method

1921

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1412

1922

@dbus.service.method(_interface)

1413

1923

def StartChecker(self):

1414

1924

"D-Bus method"

1415

1925

self.start_checker()

1416

1926

1417

1927

# Disable - method

1928

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1418

1929

@dbus.service.method(_interface)

1419

1930

def Disable(self):

1420

1931

"D-Bus method"

1421

1932

self.disable()

1422

1933

1423

1934

# StopChecker - method

1935

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1424

1936

@dbus.service.method(_interface)

1425

1937

def StopChecker(self):

1426

1938

self.stop_checker()

1433

1945

return dbus.Boolean(bool(self.approvals_pending))

1434

1946

1435

1947

# ApprovedByDefault - property

1436

@dbus_service_property(_interface, signature="b",

1948

@dbus_service_property(_interface,

1949

signature="b",

1437

1950

access="readwrite")

1438

1951

def ApprovedByDefault_dbus_property(self, value=None):

1439

1952

if value is None: # get

1441

1954

self.approved_by_default = bool(value)

1442

1955

1443

1956

# ApprovalDelay - property

1444

@dbus_service_property(_interface, signature="t",

1957

@dbus_service_property(_interface,

1958

signature="t",

1445

1959

access="readwrite")

1446

1960

def ApprovalDelay_dbus_property(self, value=None):

1447

1961

if value is None: # get

1448

return dbus.UInt64(self.approval_delay_milliseconds())

1962

return dbus.UInt64(self.approval_delay.total_seconds()

1963

* 1000)

1449

1964

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1450

1965

1451

1966

# ApprovalDuration - property

1452

@dbus_service_property(_interface, signature="t",

1967

@dbus_service_property(_interface,

1968

signature="t",

1453

1969

access="readwrite")

1454

1970

def ApprovalDuration_dbus_property(self, value=None):

1455

1971

if value is None: # get

1456

return dbus.UInt64(timedelta_to_milliseconds(

1457

self.approval_duration))

1972

return dbus.UInt64(self.approval_duration.total_seconds()

1973

* 1000)

1458

1974

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1459

1975

1460

1976

# Name - property

1977

@dbus_annotations(

1978

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1461

1979

@dbus_service_property(_interface, signature="s", access="read")

1462

1980

def Name_dbus_property(self):

1463

1981

return dbus.String(self.name)

1464

1982

1465

1983

# Fingerprint - property

1984

@dbus_annotations(

1985

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1466

1986

@dbus_service_property(_interface, signature="s", access="read")

1467

1987

def Fingerprint_dbus_property(self):

1468

1988

return dbus.String(self.fingerprint)

1469

1989

1470

1990

# Host - property

1471

@dbus_service_property(_interface, signature="s",

1991

@dbus_service_property(_interface,

1992

signature="s",

1472

1993

access="readwrite")

1473

1994

def Host_dbus_property(self, value=None):

1474

1995

if value is None: # get

1475

1996

return dbus.String(self.host)

1476

self.host = unicode(value)

1997

self.host = str(value)

1477

1998

1478

1999

# Created - property

2000

@dbus_annotations(

2001

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1479

2002

@dbus_service_property(_interface, signature="s", access="read")

1480

2003

def Created_dbus_property(self):

1481

2004

return datetime_to_dbus(self.created)

1486

2009

return datetime_to_dbus(self.last_enabled)

1487

2010

1488

2011

# Enabled - property

1489

@dbus_service_property(_interface, signature="b",

2012

@dbus_service_property(_interface,

2013

signature="b",

1490

2014

access="readwrite")

1491

2015

def Enabled_dbus_property(self, value=None):

1492

2016

if value is None: # get

1497

2021

self.disable()

1498

2022

1499

2023

# LastCheckedOK - property

1500

@dbus_service_property(_interface, signature="s",

2024

@dbus_service_property(_interface,

2025

signature="s",

1501

2026

access="readwrite")

1502

2027

def LastCheckedOK_dbus_property(self, value=None):

1503

2028

if value is not None:

1506

2031

return datetime_to_dbus(self.last_checked_ok)

1507

2032

1508

2033

# LastCheckerStatus - property

1509

@dbus_service_property(_interface, signature="n",

1510

access="read")

2034

@dbus_service_property(_interface, signature="n", access="read")

1511

2035

def LastCheckerStatus_dbus_property(self):

1512

2036

return dbus.Int16(self.last_checker_status)

1513

2037

1522

2046

return datetime_to_dbus(self.last_approval_request)

1523

2047

1524

2048

# Timeout - property

1525

@dbus_service_property(_interface, signature="t",

2049

@dbus_service_property(_interface,

2050

signature="t",

1526

2051

access="readwrite")

1527

2052

def Timeout_dbus_property(self, value=None):

1528

2053

if value is None: # get

1529

return dbus.UInt64(self.timeout_milliseconds())

2054

return dbus.UInt64(self.timeout.total_seconds() * 1000)

2055

old_timeout = self.timeout

1530

2056

self.timeout = datetime.timedelta(0, 0, 0, value)

1531

# Reschedule timeout

2057

# Reschedule disabling

1532

2058

if self.enabled:

1533

2059

now = datetime.datetime.utcnow()

1534

time_to_die = timedelta_to_milliseconds(

1535

(self.last_checked_ok + self.timeout) - now)

1536

if time_to_die <= 0:

2060

self.expires += self.timeout - old_timeout

2061

if self.expires <= now:

1537

2062

# The timeout has passed

1538

2063

self.disable()

1539

2064

else:

1540

self.expires = (now +

1541

datetime.timedelta(milliseconds =

1542

time_to_die))

1543

2065

if (getattr(self, "disable_initiator_tag", None)

1544

2066

is None):

1545

2067

return

1546

gobject.source_remove(self.disable_initiator_tag)

1547

self.disable_initiator_tag = (gobject.timeout_add

1548

(time_to_die,

1549

self.disable))

2068

GLib.source_remove(self.disable_initiator_tag)

2069

self.disable_initiator_tag = GLib.timeout_add(

2070

int((self.expires - now).total_seconds() * 1000),

2071

self.disable)

1550

2072

1551

2073

# ExtendedTimeout - property

1552

@dbus_service_property(_interface, signature="t",

2074

@dbus_service_property(_interface,

2075

signature="t",

1553

2076

access="readwrite")

1554

2077

def ExtendedTimeout_dbus_property(self, value=None):

1555

2078

if value is None: # get

1556

return dbus.UInt64(self.extended_timeout_milliseconds())

2079

return dbus.UInt64(self.extended_timeout.total_seconds()

2080

* 1000)

1557

2081

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1558

2082

1559

2083

# Interval - property

1560

@dbus_service_property(_interface, signature="t",

2084

@dbus_service_property(_interface,

2085

signature="t",

1561

2086

access="readwrite")

1562

2087

def Interval_dbus_property(self, value=None):

1563

2088

if value is None: # get

1564

return dbus.UInt64(self.interval_milliseconds())

2089

return dbus.UInt64(self.interval.total_seconds() * 1000)

1565

2090

self.interval = datetime.timedelta(0, 0, 0, value)

1566

2091

if getattr(self, "checker_initiator_tag", None) is None:

1567

2092

return

1568

2093

if self.enabled:

1569

2094

# Reschedule checker run

1570

gobject.source_remove(self.checker_initiator_tag)

1571

self.checker_initiator_tag = (gobject.timeout_add

1572

(value, self.start_checker))

1573

self.start_checker() # Start one now, too

2095

GLib.source_remove(self.checker_initiator_tag)

2096

self.checker_initiator_tag = GLib.timeout_add(

2097

value, self.start_checker)

2098

self.start_checker() # Start one now, too

1574

2099

1575

2100

# Checker - property

1576

@dbus_service_property(_interface, signature="s",

2101

@dbus_service_property(_interface,

2102

signature="s",

1577

2103

access="readwrite")

1578

2104

def Checker_dbus_property(self, value=None):

1579

2105

if value is None: # get

1580

2106

return dbus.String(self.checker_command)

1581

self.checker_command = unicode(value)

2107

self.checker_command = str(value)

1582

2108

1583

2109

# CheckerRunning - property

1584

@dbus_service_property(_interface, signature="b",

2110

@dbus_service_property(_interface,

2111

signature="b",

1585

2112

access="readwrite")

1586

2113

def CheckerRunning_dbus_property(self, value=None):

1587

2114

if value is None: # get

1592

2119

self.stop_checker()

1593

2120

1594

2121

# ObjectPath - property

2122

@dbus_annotations(

2123

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2124

"org.freedesktop.DBus.Deprecated": "true"})

1595

2125

@dbus_service_property(_interface, signature="o", access="read")

1596

2126

def ObjectPath_dbus_property(self):

1597

2127

return self.dbus_object_path # is already a dbus.ObjectPath

1598

2128

1599

2129

# Secret = property

1600

@dbus_service_property(_interface, signature="ay",

1601

access="write", byte_arrays=True)

2130

@dbus_annotations(

2131

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2132

"invalidates"})

2133

@dbus_service_property(_interface,

2134

signature="ay",

2135

access="write",

2136

byte_arrays=True)

1602

2137

def Secret_dbus_property(self, value):

1603

self.secret = str(value)

2138

self.secret = bytes(value)

1604

2139

1605

2140

del _interface

1606

2141

1610

2145

self._pipe = child_pipe

1611

2146

self._pipe.send(('init', fpr, address))

1612

2147

if not self._pipe.recv():

1613

raise KeyError()

2148

raise KeyError(fpr)

1614

2149

1615

2150

def __getattribute__(self, name):

1616

2151

if name == '_pipe':

1620

2155

if data[0] == 'data':

1621

2156

return data[1]

1622

2157

if data[0] == 'function':

2158

1623

2159

def func(*args, **kwargs):

1624

2160

self._pipe.send(('funcall', name, args, kwargs))

1625

2161

return self._pipe.recv()[1]

2162

1626

2163

return func

1627

2164

1628

2165

def __setattr__(self, name, value):

1640

2177

def handle(self):

1641

2178

with contextlib.closing(self.server.child_pipe) as child_pipe:

1642

2179

logger.info("TCP connection from: %s",

1643

unicode(self.client_address))

2180

str(self.client_address))

1644

2181

logger.debug("Pipe FD: %d",

1645

2182

self.server.child_pipe.fileno())

1646

2183

1647

session = (gnutls.connection

1648

.ClientSession(self.request,

1649

gnutls.connection

1650

.X509Credentials()))

1651

1652

# Note: gnutls.connection.X509Credentials is really a

1653

# generic GnuTLS certificate credentials object so long as

1654

# no X.509 keys are added to it. Therefore, we can use it

1655

# here despite using OpenPGP certificates.

2184

session = gnutls.ClientSession(self.request)

1656

2185

1657

2186

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1658

2187

# "+AES-256-CBC", "+SHA1",

1662

2191

priority = self.server.gnutls_priority

1663

2192

if priority is None:

1664

2193

priority = "NORMAL"

1665

(gnutls.library.functions

1666

.gnutls_priority_set_direct(session._c_object,

1667

priority, None))

2194

gnutls.priority_set_direct(session._c_object,

2195

priority.encode("utf-8"),

2196

None)

1668

2197

1669

2198

# Start communication using the Mandos protocol

1670

2199

# Get protocol number

1672

2201

logger.debug("Protocol version: %r", line)

1673

2202

try:

1674

2203

if int(line.strip().split()[0]) > 1:

1675

raise RuntimeError

2204

raise RuntimeError(line)

1676

2205

except (ValueError, IndexError, RuntimeError) as error:

1677

2206

logger.error("Unknown protocol version: %s", error)

1678

2207

return

1680

2209

# Start GnuTLS connection

1681

2210

try:

1682

2211

session.handshake()

1683

except gnutls.errors.GNUTLSError as error:

2212

except gnutls.Error as error:

1684

2213

logger.warning("Handshake failed: %s", error)

1685

2214

# Do not run session.bye() here: the session is not

1686

2215

# established. Just abandon the request.

1690

2219

approval_required = False

1691

2220

try:

1692

2221

try:

1693

fpr = self.fingerprint(self.peer_certificate

1694

(session))

1695

except (TypeError,

1696

gnutls.errors.GNUTLSError) as error:

2222

fpr = self.fingerprint(

2223

self.peer_certificate(session))

2224

except (TypeError, gnutls.Error) as error:

1697

2225

logger.warning("Bad certificate: %s", error)

1698

2226

return

1699

2227

logger.debug("Fingerprint: %s", fpr)

1712

2240

while True:

1713

2241

if not client.enabled:

1714

2242

logger.info("Client %s is disabled",

1715

client.name)

2243

client.name)

1716

2244

if self.server.use_dbus:

1717

2245

# Emit D-Bus signal

1718

2246

client.Rejected("Disabled")

1727

2255

if self.server.use_dbus:

1728

2256

# Emit D-Bus signal

1729

2257

client.NeedApproval(

1730

client.approval_delay_milliseconds(),

1731

client.approved_by_default)

2258

client.approval_delay.total_seconds()

2259

* 1000, client.approved_by_default)

1732

2260

else:

1733

2261

logger.warning("Client %s was not approved",

1734

2262

client.name)

1740

2268

#wait until timeout or approved

1741

2269

time = datetime.datetime.now()

1742

2270

client.changedstate.acquire()

1743

(client.changedstate.wait

1744

(float(client.timedelta_to_milliseconds(delay)

1745

/ 1000)))

2271

client.changedstate.wait(delay.total_seconds())

1746

2272

client.changedstate.release()

1747

2273

time2 = datetime.datetime.now()

1748

2274

if (time2 - time) >= delay:

1759

2285

else:

1760

2286

delay -= time2 - time

1761

2287

1762

sent_size = 0

1763

while sent_size < len(client.secret):

1764

try:

1765

sent = session.send(client.secret[sent_size:])

1766

except gnutls.errors.GNUTLSError as error:

1767

logger.warning("gnutls send failed",

1768

exc_info=error)

1769

return

1770

logger.debug("Sent: %d, remaining: %d",

1771

sent, len(client.secret)

1772

- (sent_size + sent))

1773

sent_size += sent

2288

try:

2289

session.send(client.secret)

2290

except gnutls.Error as error:

2291

logger.warning("gnutls send failed",

2292

exc_info = error)

2293

return

1774

2294

1775

2295

logger.info("Sending secret to %s", client.name)

1776

2296

# bump the timeout using extended_timeout

1784

2304

client.approvals_pending -= 1

1785

2305

try:

1786

2306

session.bye()

1787

except gnutls.errors.GNUTLSError as error:

2307

except gnutls.Error as error:

1788

2308

logger.warning("GnuTLS bye failed",

1789

2309

exc_info=error)

1790

2310

1792

2312

def peer_certificate(session):

1793

2313

"Return the peer's OpenPGP certificate as a bytestring"

1794

2314

# If not an OpenPGP certificate...

1795

if (gnutls.library.functions

1796

.gnutls_certificate_type_get(session._c_object)

1797

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1798

# ...do the normal thing

1799

return session.peer_certificate

2315

if (gnutls.certificate_type_get(session._c_object)

2316

!= gnutls.CRT_OPENPGP):

2317

# ...return invalid data

2318

return b""

1800

2319

list_size = ctypes.c_uint(1)

1801

cert_list = (gnutls.library.functions

1802

.gnutls_certificate_get_peers

2320

cert_list = (gnutls.certificate_get_peers

1803

2321

(session._c_object, ctypes.byref(list_size)))

1804

2322

if not bool(cert_list) and list_size.value != 0:

1805

raise gnutls.errors.GNUTLSError("error getting peer"

1806

" certificate")

2323

raise gnutls.Error("error getting peer certificate")

1807

2324

if list_size.value == 0:

1808

2325

return None

1809

2326

cert = cert_list[0]

1813

2330

def fingerprint(openpgp):

1814

2331

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1815

2332

# New GnuTLS "datum" with the OpenPGP public key

1816

datum = (gnutls.library.types

1817

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1818

ctypes.POINTER

1819

(ctypes.c_ubyte)),

1820

ctypes.c_uint(len(openpgp))))

2333

datum = gnutls.datum_t(

2334

ctypes.cast(ctypes.c_char_p(openpgp),

2335

ctypes.POINTER(ctypes.c_ubyte)),

2336

ctypes.c_uint(len(openpgp)))

1821

2337

# New empty GnuTLS certificate

1822

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1823

(gnutls.library.functions

1824

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2338

crt = gnutls.openpgp_crt_t()

2339

gnutls.openpgp_crt_init(ctypes.byref(crt))

1825

2340

# Import the OpenPGP public key into the certificate

1826

(gnutls.library.functions

1827

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1828

gnutls.library.constants

1829

.GNUTLS_OPENPGP_FMT_RAW))

2341

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2342

gnutls.OPENPGP_FMT_RAW)

1830

2343

# Verify the self signature in the key

1831

2344

crtverify = ctypes.c_uint()

1832

(gnutls.library.functions

1833

.gnutls_openpgp_crt_verify_self(crt, 0,

1834

ctypes.byref(crtverify)))

2345

gnutls.openpgp_crt_verify_self(crt, 0,

2346

ctypes.byref(crtverify))

1835

2347

if crtverify.value != 0:

1836

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1837

raise (gnutls.errors.CertificateSecurityError

1838

("Verify failed"))

2348

gnutls.openpgp_crt_deinit(crt)

2349

raise gnutls.CertificateSecurityError("Verify failed")

1839

2350

# New buffer for the fingerprint

1840

2351

buf = ctypes.create_string_buffer(20)

1841

2352

buf_len = ctypes.c_size_t()

1842

2353

# Get the fingerprint from the certificate into the buffer

1843

(gnutls.library.functions

1844

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1845

ctypes.byref(buf_len)))

2354

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2355

ctypes.byref(buf_len))

1846

2356

# Deinit the certificate

1847

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2357

gnutls.openpgp_crt_deinit(crt)

1848

2358

# Convert the buffer to a Python bytestring

1849

2359

fpr = ctypes.string_at(buf, buf_len.value)

1850

2360

# Convert the bytestring to hexadecimal notation

1854

2364

1855

2365

class MultiprocessingMixIn(object):

1856

2366

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2367

1857

2368

def sub_process_main(self, request, address):

1858

2369

try:

1859

2370

self.finish_request(request, address)

1864

2375

def process_request(self, request, address):

1865

2376

"""Start a new process to process the request."""

1866

2377

proc = multiprocessing.Process(target = self.sub_process_main,

1867

args = (request,

1868

address))

2378

args = (request, address))

1869

2379

proc.start()

1870

2380

return proc

1871

2381

1872

2382

1873

2383

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1874

2384

""" adds a pipe to the MixIn """

2385

1875

2386

def process_request(self, request, client_address):

1876

2387

"""Overrides and wraps the original process_request().

1877

2388

1886

2397

1887

2398

def add_pipe(self, parent_pipe, proc):

1888

2399

"""Dummy function; override as necessary"""

1889

raise NotImplementedError

2400

raise NotImplementedError()

1890

2401

1891

2402

1892

2403

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1898

2409

interface: None or a network interface name (string)

1899

2410

use_ipv6: Boolean; to use IPv6 or not

1900

2411

"""

2412

1901

2413

def __init__(self, server_address, RequestHandlerClass,

1902

interface=None, use_ipv6=True):

2414

interface=None,

2415

use_ipv6=True,

2416

socketfd=None):

2417

"""If socketfd is set, use that file descriptor instead of

2418

creating a new one with socket.socket().

2419

"""

1903

2420

self.interface = interface

1904

2421

if use_ipv6:

1905

2422

self.address_family = socket.AF_INET6

2423

if socketfd is not None:

2424

# Save the file descriptor

2425

self.socketfd = socketfd

2426

# Save the original socket.socket() function

2427

self.socket_socket = socket.socket

2428

# To implement --socket, we monkey patch socket.socket.

2429

#

2430

# (When socketserver.TCPServer is a new-style class, we

2431

# could make self.socket into a property instead of monkey

2432

# patching socket.socket.)

2433

#

2434

# Create a one-time-only replacement for socket.socket()

2435

@functools.wraps(socket.socket)

2436

def socket_wrapper(*args, **kwargs):

2437

# Restore original function so subsequent calls are

2438

# not affected.

2439

socket.socket = self.socket_socket

2440

del self.socket_socket

2441

# This time only, return a new socket object from the

2442

# saved file descriptor.

2443

return socket.fromfd(self.socketfd, *args, **kwargs)

2444

# Replace socket.socket() function with wrapper

2445

socket.socket = socket_wrapper

2446

# The socketserver.TCPServer.__init__ will call

2447

# socket.socket(), which might be our replacement,

2448

# socket_wrapper(), if socketfd was set.

1906

2449

socketserver.TCPServer.__init__(self, server_address,

1907

2450

RequestHandlerClass)

2451

1908

2452

def server_bind(self):

1909

2453

"""This overrides the normal server_bind() function

1910

2454

to bind to an interface if one was specified, and also NOT to

1911

2455

bind to an address or port if they were not specified."""

1912

2456

if self.interface is not None:

1913

2457

if SO_BINDTODEVICE is None:

1914

logger.error("SO_BINDTODEVICE does not exist;"

1915

" cannot bind to interface %s",

1916

self.interface)

1917

else:

1918

try:

1919

self.socket.setsockopt(socket.SOL_SOCKET,

1920

SO_BINDTODEVICE,

1921

str(self.interface

1922

+ '\0'))

1923

except socket.error as error:

1924

if error[0] == errno.EPERM:

1925

logger.error("No permission to"

1926

" bind to interface %s",

1927

self.interface)

1928

elif error[0] == errno.ENOPROTOOPT:

1929

logger.error("SO_BINDTODEVICE not available;"

1930

" cannot bind to interface %s",

1931

self.interface)

1932

else:

1933

raise

2458

# Fall back to a hard-coded value which seems to be

2459

# common enough.

2460

logger.warning("SO_BINDTODEVICE not found, trying 25")

2461

SO_BINDTODEVICE = 25

2462

try:

2463

self.socket.setsockopt(

2464

socket.SOL_SOCKET, SO_BINDTODEVICE,

2465

(self.interface + "\0").encode("utf-8"))

2466

except socket.error as error:

2467

if error.errno == errno.EPERM:

2468

logger.error("No permission to bind to"

2469

" interface %s", self.interface)

2470

elif error.errno == errno.ENOPROTOOPT:

2471

logger.error("SO_BINDTODEVICE not available;"

2472

" cannot bind to interface %s",

2473

self.interface)

2474

elif error.errno == errno.ENODEV:

2475

logger.error("Interface %s does not exist,"

2476

" cannot bind", self.interface)

2477

else:

2478

raise

1934

2479

# Only bind(2) the socket if we really need to.

1935

2480

if self.server_address[0] or self.server_address[1]:

1936

2481

if not self.server_address[0]:

1937

2482

if self.address_family == socket.AF_INET6:

1938

2483

any_address = "::" # in6addr_any

1939

2484

else:

1940

any_address = socket.INADDR_ANY

2485

any_address = "0.0.0.0" # INADDR_ANY

1941

2486

self.server_address = (any_address,

1942

2487

self.server_address[1])

1943

2488

elif not self.server_address[1]:

1944

self.server_address = (self.server_address[0],

1945

0)

2489

self.server_address = (self.server_address[0], 0)

1946

2490

# if self.interface:

1947

2491

# self.server_address = (self.server_address[0],

1948

2492

# 0, # port

1960

2504

gnutls_priority GnuTLS priority string

1961

2505

use_dbus: Boolean; to emit D-Bus signals or not

1962

2506

1963

Assumes a gobject.MainLoop event loop.

2507

Assumes a GLib.MainLoop event loop.

1964

2508

"""

2509

1965

2510

def __init__(self, server_address, RequestHandlerClass,

1966

interface=None, use_ipv6=True, clients=None,

1967

gnutls_priority=None, use_dbus=True):

2511

interface=None,

2512

use_ipv6=True,

2513

clients=None,

2514

gnutls_priority=None,

2515

use_dbus=True,

2516

socketfd=None):

1968

2517

self.enabled = False

1969

2518

self.clients = clients

1970

2519

if self.clients is None:

1974

2523

IPv6_TCPServer.__init__(self, server_address,

1975

2524

RequestHandlerClass,

1976

2525

interface = interface,

1977

use_ipv6 = use_ipv6)

2526

use_ipv6 = use_ipv6,

2527

socketfd = socketfd)

2528

1978

2529

def server_activate(self):

1979

2530

if self.enabled:

1980

2531

return socketserver.TCPServer.server_activate(self)

1984

2535

1985

2536

def add_pipe(self, parent_pipe, proc):

1986

2537

# Call "handle_ipc" for both data and EOF events

1987

gobject.io_add_watch(parent_pipe.fileno(),

1988

gobject.IO_IN | gobject.IO_HUP,

1989

functools.partial(self.handle_ipc,

1990

parent_pipe =

1991

parent_pipe,

1992

proc = proc))

2538

GLib.io_add_watch(

2539

parent_pipe.fileno(),

2540

GLib.IO_IN | GLib.IO_HUP,

2541

functools.partial(self.handle_ipc,

2542

parent_pipe = parent_pipe,

2543

proc = proc))

1993

2544

1994

def handle_ipc(self, source, condition, parent_pipe=None,

1995

proc = None, client_object=None):

1996

condition_names = {

1997

gobject.IO_IN: "IN", # There is data to read.

1998

gobject.IO_OUT: "OUT", # Data can be written (without

1999

# blocking).

2000

gobject.IO_PRI: "PRI", # There is urgent data to read.

2001

gobject.IO_ERR: "ERR", # Error condition.

2002

gobject.IO_HUP: "HUP" # Hung up (the connection has been

2003

# broken, usually for pipes and

2004

# sockets).

2005

}

2006

conditions_string = ' | '.join(name

2007

for cond, name in

2008

condition_names.iteritems()

2009

if cond & condition)

2545

def handle_ipc(self, source, condition,

2546

parent_pipe=None,

2547

proc = None,

2548

client_object=None):

2010

2549

# error, or the other end of multiprocessing.Pipe has closed

2011

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2550

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2012

2551

# Wait for other process to exit

2013

2552

proc.join()

2014

2553

return False

2021

2560

fpr = request[1]

2022

2561

address = request[2]

2023

2562

2024

for c in self.clients.itervalues():

2563

for c in self.clients.values():

2025

2564

if c.fingerprint == fpr:

2026

2565

client = c

2027

2566

break

2035

2574

parent_pipe.send(False)

2036

2575

return False

2037

2576

2038

gobject.io_add_watch(parent_pipe.fileno(),

2039

gobject.IO_IN | gobject.IO_HUP,

2040

functools.partial(self.handle_ipc,

2041

parent_pipe =

2042

parent_pipe,

2043

proc = proc,

2044

client_object =

2045

client))

2577

GLib.io_add_watch(

2578

parent_pipe.fileno(),

2579

GLib.IO_IN | GLib.IO_HUP,

2580

functools.partial(self.handle_ipc,

2581

parent_pipe = parent_pipe,

2582

proc = proc,

2583

client_object = client))

2046

2584

parent_pipe.send(True)

2047

2585

# remove the old hook in favor of the new above hook on

2048

2586

# same fileno

2054

2592

2055

2593

parent_pipe.send(('data', getattr(client_object,

2056

2594

funcname)(*args,

2057

**kwargs)))

2595

**kwargs)))

2058

2596

2059

2597

if command == 'getattr':

2060

2598

attrname = request[1]

2061

if callable(client_object.__getattribute__(attrname)):

2062

parent_pipe.send(('function',))

2599

if isinstance(client_object.__getattribute__(attrname),

2600

collections.Callable):

2601

parent_pipe.send(('function', ))

2063

2602

else:

2064

parent_pipe.send(('data', client_object

2065

.__getattribute__(attrname)))

2603

parent_pipe.send((

2604

'data', client_object.__getattribute__(attrname)))

2066

2605

2067

2606

if command == 'setattr':

2068

2607

attrname = request[1]

2072

2611

return True

2073

2612

2074

2613

2614

def rfc3339_duration_to_delta(duration):

2615

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2616

2617

>>> rfc3339_duration_to_delta("P7D")

2618

datetime.timedelta(7)

2619

>>> rfc3339_duration_to_delta("PT60S")

2620

datetime.timedelta(0, 60)

2621

>>> rfc3339_duration_to_delta("PT60M")

2622

datetime.timedelta(0, 3600)

2623

>>> rfc3339_duration_to_delta("PT24H")

2624

datetime.timedelta(1)

2625

>>> rfc3339_duration_to_delta("P1W")

2626

datetime.timedelta(7)

2627

>>> rfc3339_duration_to_delta("PT5M30S")

2628

datetime.timedelta(0, 330)

2629

>>> rfc3339_duration_to_delta("P1DT3M20S")

2630

datetime.timedelta(1, 200)

2631

"""

2632

2633

# Parsing an RFC 3339 duration with regular expressions is not

2634

# possible - there would have to be multiple places for the same

2635

# values, like seconds. The current code, while more esoteric, is

2636

# cleaner without depending on a parsing library. If Python had a

2637

# built-in library for parsing we would use it, but we'd like to

2638

# avoid excessive use of external libraries.

2639

2640

# New type for defining tokens, syntax, and semantics all-in-one

2641

Token = collections.namedtuple("Token", (

2642

"regexp", # To match token; if "value" is not None, must have

2643

# a "group" containing digits

2644

"value", # datetime.timedelta or None

2645

"followers")) # Tokens valid after this token

2646

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2647

# the "duration" ABNF definition in RFC 3339, Appendix A.

2648

token_end = Token(re.compile(r"$"), None, frozenset())

2649

token_second = Token(re.compile(r"(\d+)S"),

2650

datetime.timedelta(seconds=1),

2651

frozenset((token_end, )))

2652

token_minute = Token(re.compile(r"(\d+)M"),

2653

datetime.timedelta(minutes=1),

2654

frozenset((token_second, token_end)))

2655

token_hour = Token(re.compile(r"(\d+)H"),

2656

datetime.timedelta(hours=1),

2657

frozenset((token_minute, token_end)))

2658

token_time = Token(re.compile(r"T"),

2659

None,

2660

frozenset((token_hour, token_minute,

2661

token_second)))

2662

token_day = Token(re.compile(r"(\d+)D"),

2663

datetime.timedelta(days=1),

2664

frozenset((token_time, token_end)))

2665

token_month = Token(re.compile(r"(\d+)M"),

2666

datetime.timedelta(weeks=4),

2667

frozenset((token_day, token_end)))

2668

token_year = Token(re.compile(r"(\d+)Y"),

2669

datetime.timedelta(weeks=52),

2670

frozenset((token_month, token_end)))

2671

token_week = Token(re.compile(r"(\d+)W"),

2672

datetime.timedelta(weeks=1),

2673

frozenset((token_end, )))

2674

token_duration = Token(re.compile(r"P"), None,

2675

frozenset((token_year, token_month,

2676

token_day, token_time,

2677

token_week)))

2678

# Define starting values

2679

value = datetime.timedelta() # Value so far

2680

found_token = None

2681

followers = frozenset((token_duration, )) # Following valid tokens

2682

s = duration # String left to parse

2683

# Loop until end token is found

2684

while found_token is not token_end:

2685

# Search for any currently valid tokens

2686

for token in followers:

2687

match = token.regexp.match(s)

2688

if match is not None:

2689

# Token found

2690

if token.value is not None:

2691

# Value found, parse digits

2692

factor = int(match.group(1), 10)

2693

# Add to value so far

2694

value += factor * token.value

2695

# Strip token from string

2696

s = token.regexp.sub("", s, 1)

2697

# Go to found token

2698

found_token = token

2699

# Set valid next tokens

2700

followers = found_token.followers

2701

break

2702

else:

2703

# No currently valid tokens were found

2704

raise ValueError("Invalid RFC 3339 duration: {!r}"

2705

.format(duration))

2706

# End token found

2707

return value

2708

2709

2075

2710

def string_to_delta(interval):

2076

2711

"""Parse a string and return a datetime.timedelta

2077

2712

2088

2723

>>> string_to_delta('5m 30s')

2089

2724

datetime.timedelta(0, 330)

2090

2725

"""

2726

2727

try:

2728

return rfc3339_duration_to_delta(interval)

2729

except ValueError:

2730

pass

2731

2091

2732

timevalue = datetime.timedelta(0)

2092

2733

for s in interval.split():

2093

2734

try:

2094

suffix = unicode(s[-1])

2735

suffix = s[-1]

2095

2736

value = int(s[:-1])

2096

2737

if suffix == "d":

2097

2738

delta = datetime.timedelta(value)

2104

2745

elif suffix == "w":

2105

2746

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2106

2747

else:

2107

raise ValueError("Unknown suffix {0!r}"

2108

.format(suffix))

2109

except (ValueError, IndexError) as e:

2748

raise ValueError("Unknown suffix {!r}".format(suffix))

2749

except IndexError as e:

2110

2750

raise ValueError(*(e.args))

2111

2751

timevalue += delta

2112

2752

return timevalue

2128

2768

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2129

2769

if not stat.S_ISCHR(os.fstat(null).st_mode):

2130

2770

raise OSError(errno.ENODEV,

2131

"{0} not a character device"

2771

"{} not a character device"

2132

2772

.format(os.devnull))

2133

2773

os.dup2(null, sys.stdin.fileno())

2134

2774

os.dup2(null, sys.stdout.fileno())

2144

2784

2145

2785

parser = argparse.ArgumentParser()

2146

2786

parser.add_argument("-v", "--version", action="version",

2147

version = "%(prog)s {0}".format(version),

2787

version = "%(prog)s {}".format(version),

2148

2788

help="show version number and exit")

2149

2789

parser.add_argument("-i", "--interface", metavar="IF",

2150

2790

help="Bind to interface IF")

2156

2796

help="Run self-test")

2157

2797

parser.add_argument("--debug", action="store_true",

2158

2798

help="Debug mode; run in foreground and log"

2159

" to terminal")

2799

" to terminal", default=None)

2160

2800

parser.add_argument("--debuglevel", metavar="LEVEL",

2161

2801

help="Debug level for stdout output")

2162

2802

parser.add_argument("--priority", help="GnuTLS"

2169

2809

" files")

2170

2810

parser.add_argument("--no-dbus", action="store_false",

2171

2811

dest="use_dbus", help="Do not provide D-Bus"

2172

" system bus interface")

2812

" system bus interface", default=None)

2173

2813

parser.add_argument("--no-ipv6", action="store_false",

2174

dest="use_ipv6", help="Do not use IPv6")

2814

dest="use_ipv6", help="Do not use IPv6",

2815

default=None)

2175

2816

parser.add_argument("--no-restore", action="store_false",

2176

2817

dest="restore", help="Do not restore stored"

2177

" state")

2818

" state", default=None)

2819

parser.add_argument("--socket", type=int,

2820

help="Specify a file descriptor to a network"

2821

" socket to use instead of creating one")

2178

2822

parser.add_argument("--statedir", metavar="DIR",

2179

2823

help="Directory to save/restore state in")

2824

parser.add_argument("--foreground", action="store_true",

2825

help="Run in foreground", default=None)

2826

parser.add_argument("--no-zeroconf", action="store_false",

2827

dest="zeroconf", help="Do not use Zeroconf",

2828

default=None)

2180

2829

2181

2830

options = parser.parse_args()

2182

2831

2183

2832

if options.check:

2184

2833

import doctest

2185

doctest.testmod()

2186

sys.exit()

2834

fail_count, test_count = doctest.testmod()

2835

sys.exit(os.EX_OK if fail_count == 0 else 1)

2187

2836

2188

2837

# Default values for config file for server-global settings

2189

2838

server_defaults = { "interface": "",

2191

2840

"port": "",

2192

2841

"debug": "False",

2193

2842

"priority":

2194

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2843

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2844

":+SIGN-DSA-SHA256",

2195

2845

"servicename": "Mandos",

2196

2846

"use_dbus": "True",

2197

2847

"use_ipv6": "True",

2198

2848

"debuglevel": "",

2199

2849

"restore": "True",

2200

"statedir": "/var/lib/mandos"

2201

}

2850

"socket": "",

2851

"statedir": "/var/lib/mandos",

2852

"foreground": "False",

2853

"zeroconf": "True",

2854

}

2202

2855

2203

2856

# Parse config file for server-global settings

2204

2857

server_config = configparser.SafeConfigParser(server_defaults)

2205

2858

del server_defaults

2206

server_config.read(os.path.join(options.configdir,

2207

"mandos.conf"))

2859

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2208

2860

# Convert the SafeConfigParser object to a dict

2209

2861

server_settings = server_config.defaults()

2210

2862

# Use the appropriate methods on the non-string config options

2211

for option in ("debug", "use_dbus", "use_ipv6"):

2863

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

2212

2864

server_settings[option] = server_config.getboolean("DEFAULT",

2213

2865

option)

2214

2866

if server_settings["port"]:

2215

2867

server_settings["port"] = server_config.getint("DEFAULT",

2216

2868

"port")

2869

if server_settings["socket"]:

2870

server_settings["socket"] = server_config.getint("DEFAULT",

2871

"socket")

2872

# Later, stdin will, and stdout and stderr might, be dup'ed

2873

# over with an opened os.devnull. But we don't want this to

2874

# happen with a supplied network socket.

2875

if 0 <= server_settings["socket"] <= 2:

2876

server_settings["socket"] = os.dup(server_settings

2877

["socket"])

2217

2878

del server_config

2218

2879

2219

2880

# Override the settings from the config file with command line

2220

2881

# options, if set.

2221

2882

for option in ("interface", "address", "port", "debug",

2222

"priority", "servicename", "configdir",

2223

"use_dbus", "use_ipv6", "debuglevel", "restore",

2224

"statedir"):

2883

"priority", "servicename", "configdir", "use_dbus",

2884

"use_ipv6", "debuglevel", "restore", "statedir",

2885

"socket", "foreground", "zeroconf"):

2225

2886

value = getattr(options, option)

2226

2887

if value is not None:

2227

2888

server_settings[option] = value

2228

2889

del options

2229

2890

# Force all strings to be unicode

2230

2891

for option in server_settings.keys():

2231

if type(server_settings[option]) is str:

2232

server_settings[option] = unicode(server_settings[option])

2892

if isinstance(server_settings[option], bytes):

2893

server_settings[option] = (server_settings[option]

2894

.decode("utf-8"))

2895

# Force all boolean options to be boolean

2896

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2897

"foreground", "zeroconf"):

2898

server_settings[option] = bool(server_settings[option])

2899

# Debug implies foreground

2900

if server_settings["debug"]:

2901

server_settings["foreground"] = True

2233

2902

# Now we have our good server settings in "server_settings"

2234

2903

2235

2904

##################################################################

2236

2905

2906

if (not server_settings["zeroconf"]

2907

and not (server_settings["port"]

2908

or server_settings["socket"] != "")):

2909

parser.error("Needs port or socket to work without Zeroconf")

2910

2237

2911

# For convenience

2238

2912

debug = server_settings["debug"]

2239

2913

debuglevel = server_settings["debuglevel"]

2241

2915

use_ipv6 = server_settings["use_ipv6"]

2242

2916

stored_state_path = os.path.join(server_settings["statedir"],

2243

2917

stored_state_file)

2918

foreground = server_settings["foreground"]

2919

zeroconf = server_settings["zeroconf"]

2244

2920

2245

2921

if debug:

2246

2922

initlogger(debug, logging.DEBUG)

2252

2928

initlogger(debug, level)

2253

2929

2254

2930

if server_settings["servicename"] != "Mandos":

2255

syslogger.setFormatter(logging.Formatter

2256

('Mandos ({0}) [%(process)d]:'

2257

' %(levelname)s: %(message)s'

2258

.format(server_settings

2259

["servicename"])))

2931

syslogger.setFormatter(

2932

logging.Formatter('Mandos ({}) [%(process)d]:'

2933

' %(levelname)s: %(message)s'.format(

2934

server_settings["servicename"])))

2260

2935

2261

2936

# Parse config file with clients

2262

2937

client_config = configparser.SafeConfigParser(Client

2267

2942

global mandos_dbus_service

2268

2943

mandos_dbus_service = None

2269

2944

2270

tcp_server = MandosServer((server_settings["address"],

2271

server_settings["port"]),

2272

ClientHandler,

2273

interface=(server_settings["interface"]

2274

or None),

2275

use_ipv6=use_ipv6,

2276

gnutls_priority=

2277

server_settings["priority"],

2278

use_dbus=use_dbus)

2279

if not debug:

2280

pidfilename = "/var/run/mandos.pid"

2945

socketfd = None

2946

if server_settings["socket"] != "":

2947

socketfd = server_settings["socket"]

2948

tcp_server = MandosServer(

2949

(server_settings["address"], server_settings["port"]),

2950

ClientHandler,

2951

interface=(server_settings["interface"] or None),

2952

use_ipv6=use_ipv6,

2953

gnutls_priority=server_settings["priority"],

2954

use_dbus=use_dbus,

2955

socketfd=socketfd)

2956

if not foreground:

2957

pidfilename = "/run/mandos.pid"

2958

if not os.path.isdir("/run/."):

2959

pidfilename = "/var/run/mandos.pid"

2960

pidfile = None

2281

2961

try:

2282

pidfile = open(pidfilename, "w")

2962

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2283

2963

except IOError as e:

2284

2964

logger.error("Could not open file %r", pidfilename,

2285

2965

exc_info=e)

2286

2966

2287

for name in ("_mandos", "mandos", "nobody"):

2967

for name, group in (("_mandos", "_mandos"),

2968

("mandos", "mandos"),

2969

("nobody", "nogroup")):

2288

2970

try:

2289

2971

uid = pwd.getpwnam(name).pw_uid

2290

gid = pwd.getpwnam(name).pw_gid

2972

gid = pwd.getpwnam(group).pw_gid

2291

2973

break

2292

2974

except KeyError:

2293

2975

continue

2297

2979

try:

2298

2980

os.setgid(gid)

2299

2981

os.setuid(uid)

2982

if debug:

2983

logger.debug("Did setuid/setgid to {}:{}".format(uid,

2984

gid))

2300

2985

except OSError as error:

2301

if error[0] != errno.EPERM:

2302

raise error

2986

logger.warning("Failed to setuid/setgid to {}:{}: {}"

2987

.format(uid, gid, os.strerror(error.errno)))

2988

if error.errno != errno.EPERM:

2989

raise

2303

2990

2304

2991

if debug:

2305

2992

# Enable all possible GnuTLS debugging

2306

2993

2307

2994

# "Use a log level over 10 to enable all debugging options."

2308

2995

# - GnuTLS manual

2309

gnutls.library.functions.gnutls_global_set_log_level(11)

2996

gnutls.global_set_log_level(11)

2310

2997

2311

@gnutls.library.types.gnutls_log_func

2998

@gnutls.log_func

2312

2999

def debug_gnutls(level, string):

2313

3000

logger.debug("GnuTLS: %s", string[:-1])

2314

3001

2315

(gnutls.library.functions

2316

.gnutls_global_set_log_function(debug_gnutls))

3002

gnutls.global_set_log_function(debug_gnutls)

2317

3003

2318

3004

# Redirect stdin so all checkers get /dev/null

2319

3005

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2322

3008

os.close(null)

2323

3009

2324

3010

# Need to fork before connecting to D-Bus

2325

if not debug:

3011

if not foreground:

2326

3012

# Close all input and output, do double fork, etc.

2327

3013

daemon()

2328

3014

2329

gobject.threads_init()

3015

# multiprocessing will use threads, so before we use GLib we need

3016

# to inform GLib that threads will be used.

3017

GLib.threads_init()

2330

3018

2331

3019

global main_loop

2332

3020

# From the Avahi example code

2333

3021

DBusGMainLoop(set_as_default=True)

2334

main_loop = gobject.MainLoop()

3022

main_loop = GLib.MainLoop()

2335

3023

bus = dbus.SystemBus()

2336

3024

# End of Avahi example code

2337

3025

if use_dbus:

2338

3026

try:

2339

3027

bus_name = dbus.service.BusName("se.recompile.Mandos",

2340

bus, do_not_queue=True)

2341

old_bus_name = (dbus.service.BusName

2342

("se.bsnet.fukt.Mandos", bus,

2343

do_not_queue=True))

2344

except dbus.exceptions.NameExistsException as e:

3028

bus,

3029

do_not_queue=True)

3030

old_bus_name = dbus.service.BusName(

3031

"se.bsnet.fukt.Mandos", bus,

3032

do_not_queue=True)

3033

except dbus.exceptions.DBusException as e:

2345

3034

logger.error("Disabling D-Bus:", exc_info=e)

2346

3035

use_dbus = False

2347

3036

server_settings["use_dbus"] = False

2348

3037

tcp_server.use_dbus = False

2349

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2350

service = AvahiServiceToSyslog(name =

2351

server_settings["servicename"],

2352

servicetype = "_mandos._tcp",

2353

protocol = protocol, bus = bus)

2354

if server_settings["interface"]:

2355

service.interface = (if_nametoindex

2356

(str(server_settings["interface"])))

3038

if zeroconf:

3039

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3040

service = AvahiServiceToSyslog(

3041

name = server_settings["servicename"],

3042

servicetype = "_mandos._tcp",

3043

protocol = protocol,

3044

bus = bus)

3045

if server_settings["interface"]:

3046

service.interface = if_nametoindex(

3047

server_settings["interface"].encode("utf-8"))

2357

3048

2358

3049

global multiprocessing_manager

2359

3050

multiprocessing_manager = multiprocessing.Manager()

2366

3057

old_client_settings = {}

2367

3058

clients_data = {}

2368

3059

3060

# This is used to redirect stdout and stderr for checker processes

3061

global wnull

3062

wnull = open(os.devnull, "w") # A writable /dev/null

3063

# Only used if server is running in foreground but not in debug

3064

# mode

3065

if debug or not foreground:

3066

wnull.close()

3067

2369

3068

# Get client data and settings from last running state.

2370

3069

if server_settings["restore"]:

2371

3070

try:

2372

3071

with open(stored_state_path, "rb") as stored_state:

2373

clients_data, old_client_settings = (pickle.load

2374

(stored_state))

3072

if sys.version_info.major == 2:

3073

clients_data, old_client_settings = pickle.load(

3074

stored_state)

3075

else:

3076

bytes_clients_data, bytes_old_client_settings = (

3077

pickle.load(stored_state, encoding = "bytes"))

3078

### Fix bytes to strings

3079

## clients_data

3080

# .keys()

3081

clients_data = { (key.decode("utf-8")

3082

if isinstance(key, bytes)

3083

else key): value

3084

for key, value in

3085

bytes_clients_data.items() }

3086

del bytes_clients_data

3087

for key in clients_data:

3088

value = { (k.decode("utf-8")

3089

if isinstance(k, bytes) else k): v

3090

for k, v in

3091

clients_data[key].items() }

3092

clients_data[key] = value

3093

# .client_structure

3094

value["client_structure"] = [

3095

(s.decode("utf-8")

3096

if isinstance(s, bytes)

3097

else s) for s in

3098

value["client_structure"] ]

3099

# .name & .host

3100

for k in ("name", "host"):

3101

if isinstance(value[k], bytes):

3102

value[k] = value[k].decode("utf-8")

3103

## old_client_settings

3104

# .keys()

3105

old_client_settings = {

3106

(key.decode("utf-8")

3107

if isinstance(key, bytes)

3108

else key): value

3109

for key, value in

3110

bytes_old_client_settings.items() }

3111

del bytes_old_client_settings

3112

# .host

3113

for value in old_client_settings.values():

3114

if isinstance(value["host"], bytes):

3115

value["host"] = (value["host"]

3116

.decode("utf-8"))

2375

3117

os.remove(stored_state_path)

2376

3118

except IOError as e:

2377

3119

if e.errno == errno.ENOENT:

2378

logger.warning("Could not load persistent state: {0}"

2379

.format(os.strerror(e.errno)))

3120

logger.warning("Could not load persistent state:"

3121

" {}".format(os.strerror(e.errno)))

2380

3122

else:

2381

3123

logger.critical("Could not load persistent state:",

2382

3124

exc_info=e)

2383

3125

raise

2384

3126

except EOFError as e:

2385

3127

logger.warning("Could not load persistent state: "

2386

"EOFError:", exc_info=e)

3128

"EOFError:",

3129

exc_info=e)

2387

3130

2388

3131

with PGPEngine() as pgp:

2389

for client_name, client in clients_data.iteritems():

3132

for client_name, client in clients_data.items():

3133

# Skip removed clients

3134

if client_name not in client_settings:

3135

continue

3136

2390

3137

# Decide which value to use after restoring saved state.

2391

3138

# We have three different values: Old config file,

2392

3139

# new config file, and saved state.

2397

3144

# For each value in new config, check if it

2398

3145

# differs from the old config value (Except for

2399

3146

# the "secret" attribute)

2400

if (name != "secret" and

2401

value != old_client_settings[client_name]

2402

[name]):

3147

if (name != "secret"

3148

and (value !=

3149

old_client_settings[client_name][name])):

2403

3150

client[name] = value

2404

3151

except KeyError:

2405

3152

pass

2406

3153

2407

3154

# Clients who has passed its expire date can still be

2408

# enabled if its last checker was successful. Clients

3155

# enabled if its last checker was successful. A Client

2409

3156

# whose checker succeeded before we stored its state is

2410

3157

# assumed to have successfully run all checkers during

2411

3158

# downtime.

2413

3160

if datetime.datetime.utcnow() >= client["expires"]:

2414

3161

if not client["last_checked_ok"]:

2415

3162

logger.warning(

2416

"disabling client {0} - Client never "

2417

"performed a successful checker"

2418

.format(client_name))

3163

"disabling client {} - Client never "

3164

"performed a successful checker".format(

3165

client_name))

2419

3166

client["enabled"] = False

2420

3167

elif client["last_checker_status"] != 0:

2421

3168

logger.warning(

2422

"disabling client {0} - Client "

2423

"last checker failed with error code {1}"

2424

.format(client_name,

2425

client["last_checker_status"]))

3169

"disabling client {} - Client last"

3170

" checker failed with error code"

3171

" {}".format(

3172

client_name,

3173

client["last_checker_status"]))

2426

3174

client["enabled"] = False

2427

3175

else:

2428

client["expires"] = (datetime.datetime

2429

.utcnow()

2430

+ client["timeout"])

3176

client["expires"] = (

3177

datetime.datetime.utcnow()

3178

+ client["timeout"])

2431

3179

logger.debug("Last checker succeeded,"

2432

" keeping {0} enabled"

2433

.format(client_name))

3180

" keeping {} enabled".format(

3181

client_name))

2434

3182

try:

2435

client["secret"] = (

2436

pgp.decrypt(client["encrypted_secret"],

2437

client_settings[client_name]

2438

["secret"]))

3183

client["secret"] = pgp.decrypt(

3184

client["encrypted_secret"],

3185

client_settings[client_name]["secret"])

2439

3186

except PGPError:

2440

3187

# If decryption fails, we use secret from new settings

2441

logger.debug("Failed to decrypt {0} old secret"

2442

.format(client_name))

2443

client["secret"] = (

2444

client_settings[client_name]["secret"])

3188

logger.debug("Failed to decrypt {} old secret".format(

3189

client_name))

3190

client["secret"] = (client_settings[client_name]

3191

["secret"])

2445

3192

2446

3193

# Add/remove clients based on new changes made to config

2447

3194

for client_name in (set(old_client_settings)

2452

3199

clients_data[client_name] = client_settings[client_name]

2453

3200

2454

3201

# Create all client objects

2455

for client_name, client in clients_data.iteritems():

3202

for client_name, client in clients_data.items():

2456

3203

tcp_server.clients[client_name] = client_class(

2457

name = client_name, settings = client)

3204

name = client_name,

3205

settings = client,

3206

server_settings = server_settings)

2458

3207

2459

3208

if not tcp_server.clients:

2460

3209

logger.warning("No clients defined")

2461

3210

2462

if not debug:

2463

try:

2464

with pidfile:

2465

pid = os.getpid()

2466

pidfile.write(str(pid) + "\n".encode("utf-8"))

2467

del pidfile

2468

except IOError:

2469

logger.error("Could not write to file %r with PID %d",

2470

pidfilename, pid)

2471

except NameError:

2472

# "pidfile" was never created

2473

pass

3211

if not foreground:

3212

if pidfile is not None:

3213

pid = os.getpid()

3214

try:

3215

with pidfile:

3216

print(pid, file=pidfile)

3217

except IOError:

3218

logger.error("Could not write to file %r with PID %d",

3219

pidfilename, pid)

3220

del pidfile

2474

3221

del pidfilename

2475

signal.signal(signal.SIGINT, signal.SIG_IGN)

2476

3222

2477

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2478

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

3223

for termsig in (signal.SIGHUP, signal.SIGTERM):

3224

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3225

lambda: main_loop.quit() and False)

2479

3226

2480

3227

if use_dbus:

2481

@alternate_dbus_interfaces({"se.recompile.Mandos":

2482

"se.bsnet.fukt.Mandos"})

2483

class MandosDBusService(DBusObjectWithProperties):

3228

3229

@alternate_dbus_interfaces(

3230

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3231

class MandosDBusService(DBusObjectWithObjectManager):

2484

3232

"""A D-Bus proxy object"""

3233

2485

3234

def __init__(self):

2486

3235

dbus.service.Object.__init__(self, bus, "/")

3236

2487

3237

_interface = "se.recompile.Mandos"

2488

3238

2489

@dbus_interface_annotations(_interface)

2490

def _foo(self):

2491

return { "org.freedesktop.DBus.Property"

2492

".EmitsChangedSignal":

2493

"false"}

2494

2495

3239

@dbus.service.signal(_interface, signature="o")

2496

3240

def ClientAdded(self, objpath):

2497

3241

"D-Bus signal"

2502

3246

"D-Bus signal"

2503

3247

pass

2504

3248

3249

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3250

"true"})

2505

3251

@dbus.service.signal(_interface, signature="os")

2506

3252

def ClientRemoved(self, objpath, name):

2507

3253

"D-Bus signal"

2508

3254

pass

2509

3255

3256

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3257

"true"})

2510

3258

@dbus.service.method(_interface, out_signature="ao")

2511

3259

def GetAllClients(self):

2512

3260

"D-Bus method"

2513

return dbus.Array(c.dbus_object_path

2514

for c in

2515

tcp_server.clients.itervalues())

3261

return dbus.Array(c.dbus_object_path for c in

3262

tcp_server.clients.values())

2516

3263

3264

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3265

"true"})

2517

3266

@dbus.service.method(_interface,

2518

3267

out_signature="a{oa{sv}}")

2519

3268

def GetAllClientsWithProperties(self):

2520

3269

"D-Bus method"

2521

3270

return dbus.Dictionary(

2522

((c.dbus_object_path, c.GetAll(""))

2523

for c in tcp_server.clients.itervalues()),

3271

{ c.dbus_object_path: c.GetAll(

3272

"se.recompile.Mandos.Client")

3273

for c in tcp_server.clients.values() },

2524

3274

signature="oa{sv}")

2525

3275

2526

3276

@dbus.service.method(_interface, in_signature="o")

2527

3277

def RemoveClient(self, object_path):

2528

3278

"D-Bus method"

2529

for c in tcp_server.clients.itervalues():

3279

for c in tcp_server.clients.values():

2530

3280

if c.dbus_object_path == object_path:

2531

3281

del tcp_server.clients[c.name]

2532

3282

c.remove_from_connection()

2533

# Don't signal anything except ClientRemoved

3283

# Don't signal the disabling

2534

3284

c.disable(quiet=True)

2535

# Emit D-Bus signal

2536

self.ClientRemoved(object_path, c.name)

3285

# Emit D-Bus signal for removal

3286

self.client_removed_signal(c)

2537

3287

return

2538

3288

raise KeyError(object_path)

2539

3289

2540

3290

del _interface

3291

3292

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3293

out_signature = "a{oa{sa{sv}}}")

3294

def GetManagedObjects(self):

3295

"""D-Bus method"""

3296

return dbus.Dictionary(

3297

{ client.dbus_object_path:

3298

dbus.Dictionary(

3299

{ interface: client.GetAll(interface)

3300

for interface in

3301

client._get_all_interface_names()})

3302

for client in tcp_server.clients.values()})

3303

3304

def client_added_signal(self, client):

3305

"""Send the new standard signal and the old signal"""

3306

if use_dbus:

3307

# New standard signal

3308

self.InterfacesAdded(

3309

client.dbus_object_path,

3310

dbus.Dictionary(

3311

{ interface: client.GetAll(interface)

3312

for interface in

3313

client._get_all_interface_names()}))

3314

# Old signal

3315

self.ClientAdded(client.dbus_object_path)

3316

3317

def client_removed_signal(self, client):

3318

"""Send the new standard signal and the old signal"""

3319

if use_dbus:

3320

# New standard signal

3321

self.InterfacesRemoved(

3322

client.dbus_object_path,

3323

client._get_all_interface_names())

3324

# Old signal

3325

self.ClientRemoved(client.dbus_object_path,

3326

client.name)

2541

3327

2542

3328

mandos_dbus_service = MandosDBusService()

2543

3329

3330

# Save modules to variables to exempt the modules from being

3331

# unloaded before the function registered with atexit() is run.

3332

mp = multiprocessing

3333

wn = wnull

2544

3334

def cleanup():

2545

3335

"Cleanup function; run on exit"

2546

service.cleanup()

3336

if zeroconf:

3337

service.cleanup()

2547

3338

2548

multiprocessing.active_children()

3339

mp.active_children()

3340

wn.close()

2549

3341

if not (tcp_server.clients or client_settings):

2550

3342

return

2551

3343

2554

3346

# removed/edited, old secret will thus be unrecovable.

2555

3347

clients = {}

2556

3348

with PGPEngine() as pgp:

2557

for client in tcp_server.clients.itervalues():

3349

for client in tcp_server.clients.values():

2558

3350

key = client_settings[client.name]["secret"]

2559

3351

client.encrypted_secret = pgp.encrypt(client.secret,

2560

3352

key)

2562

3354

2563

3355

# A list of attributes that can not be pickled

2564

3356

# + secret.

2565

exclude = set(("bus", "changedstate", "secret",

2566

"checker"))

2567

for name, typ in (inspect.getmembers

2568

(dbus.service.Object)):

3357

exclude = { "bus", "changedstate", "secret",

3358

"checker", "server_settings" }

3359

for name, typ in inspect.getmembers(dbus.service

3360

.Object):

2569

3361

exclude.add(name)

2570

3362

2571

3363

client_dict["encrypted_secret"] = (client

2578

3370

del client_settings[client.name]["secret"]

2579

3371

2580

3372

try:

2581

tempfd, tempname = tempfile.mkstemp(suffix=".pickle",

2582

prefix="clients-",

2583

dir=os.path.dirname

2584

(stored_state_path))

2585

with os.fdopen(tempfd, "wb") as stored_state:

2586

pickle.dump((clients, client_settings), stored_state)

3373

with tempfile.NamedTemporaryFile(

3374

mode='wb',

3375

suffix=".pickle",

3376

prefix='clients-',

3377

dir=os.path.dirname(stored_state_path),

3378

delete=False) as stored_state:

3379

pickle.dump((clients, client_settings), stored_state,

3380

protocol = 2)

3381

tempname = stored_state.name

2587

3382

os.rename(tempname, stored_state_path)

2588

3383

except (IOError, OSError) as e:

2589

3384

if not debug:

2592

3387

except NameError:

2593

3388

pass

2594

3389

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2595

logger.warning("Could not save persistent state: {0}"

3390

logger.warning("Could not save persistent state: {}"

2596

3391

.format(os.strerror(e.errno)))

2597

3392

else:

2598

3393

logger.warning("Could not save persistent state:",

2599

3394

exc_info=e)

2600

raise e

3395

raise

2601

3396

2602

3397

# Delete all clients, and settings from config

2603

3398

while tcp_server.clients:

2604

3399

name, client = tcp_server.clients.popitem()

2605

3400

if use_dbus:

2606

3401

client.remove_from_connection()

2607

# Don't signal anything except ClientRemoved

3402

# Don't signal the disabling

2608

3403

client.disable(quiet=True)

3404

# Emit D-Bus signal for removal

2609

3405

if use_dbus:

2610

# Emit D-Bus signal

2611

mandos_dbus_service.ClientRemoved(client

2612

.dbus_object_path,

2613

client.name)

3406

mandos_dbus_service.client_removed_signal(client)

2614

3407

client_settings.clear()

2615

3408

2616

3409

atexit.register(cleanup)

2617

3410

2618

for client in tcp_server.clients.itervalues():

3411

for client in tcp_server.clients.values():

2619

3412

if use_dbus:

2620

# Emit D-Bus signal

2621

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3413

# Emit D-Bus signal for adding

3414

mandos_dbus_service.client_added_signal(client)

2622

3415

# Need to initiate checking of clients

2623

3416

if client.enabled:

2624

3417

client.init_checker()

2627

3420

tcp_server.server_activate()

2628

3421

2629

3422

# Find out what port we got

2630

service.port = tcp_server.socket.getsockname()[1]

3423

if zeroconf:

3424

service.port = tcp_server.socket.getsockname()[1]

2631

3425

if use_ipv6:

2632

3426

logger.info("Now listening on address %r, port %d,"

2633

3427

" flowinfo %d, scope_id %d",

2639

3433

#service.interface = tcp_server.socket.getsockname()[3]

2640

3434

2641

3435

try:

2642

# From the Avahi example code

2643

try:

2644

service.activate()

2645

except dbus.exceptions.DBusException as error:

2646

logger.critical("D-Bus Exception", exc_info=error)

2647

cleanup()

2648

sys.exit(1)

2649

# End of Avahi example code

3436

if zeroconf:

3437

# From the Avahi example code

3438

try:

3439

service.activate()

3440

except dbus.exceptions.DBusException as error:

3441

logger.critical("D-Bus Exception", exc_info=error)

3442

cleanup()

3443

sys.exit(1)

3444

# End of Avahi example code

2650

3445

2651

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2652

lambda *args, **kwargs:

2653

(tcp_server.handle_request

2654

(*args[2:], **kwargs) or True))

3446

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3447

lambda *args, **kwargs:

3448

(tcp_server.handle_request

3449

(*args[2:], **kwargs) or True))

2655

3450

2656

3451

logger.debug("Starting main loop")

2657

3452

main_loop.run()

2667

3462

# Must run before the D-Bus bus name gets deregistered

2668

3463

cleanup()

2669

3464

3465

2670

3466

if __name__ == '__main__':

2671

3467

main()