/mandos/trunk : revision 237.4.80

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

38

41

39

import SocketServer as socketserver

42

try:

43

import SocketServer as socketserver

44

except ImportError:

45

import socketserver

40

46

import socket

41

47

import argparse

42

48

import datetime

43

49

import errno

44

import gnutls.crypto

45

import gnutls.connection

46

import gnutls.errors

47

import gnutls.library.functions

48

import gnutls.library.constants

49

import gnutls.library.types

50

import ConfigParser as configparser

50

try:

51

import ConfigParser as configparser

52

except ImportError:

53

import configparser

51

54

import sys

52

55

import re

53

56

import os

62

65

import struct

63

66

import fcntl

64

67

import functools

65

import cPickle as pickle

68

try:

69

import cPickle as pickle

70

except ImportError:

71

import pickle

66

72

import multiprocessing

67

73

import types

68

74

import binascii

69

75

import tempfile

70

76

import itertools

71

77

import collections

78

import codecs

72

79

73

80

import dbus

74

81

import dbus.service

75

import gobject

76

import avahi

82

from gi.repository import GLib

77

83

from dbus.mainloop.glib import DBusGMainLoop

78

84

import ctypes

79

85

import ctypes.util

80

86

import xml.dom.minidom

81

87

import inspect

82

88

89

# Try to find the value of SO_BINDTODEVICE:

83

90

try:

91

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

92

# newer, and it is also the most natural place for it:

84

93

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

85

94

except AttributeError:

86

95

try:

96

# This is where SO_BINDTODEVICE was up to and including Python

97

# 2.6, and also 3.2:

87

98

from IN import SO_BINDTODEVICE

88

99

except ImportError:

89

SO_BINDTODEVICE = None

90

91

version = "1.6.8"

100

# In Python 2.7 it seems to have been removed entirely.

101

# Try running the C preprocessor:

102

try:

103

cc = subprocess.Popen(["cc", "--language=c", "-E",

104

"/dev/stdin"],

105

stdin=subprocess.PIPE,

106

stdout=subprocess.PIPE)

107

stdout = cc.communicate(

108

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

109

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

110

except (OSError, ValueError, IndexError):

111

# No value found

112

SO_BINDTODEVICE = None

113

114

if sys.version_info.major == 2:

115

str = unicode

116

117

version = "1.7.10"

92

118

stored_state_file = "clients.pickle"

93

119

94

120

logger = logging.getLogger()

95

121

syslogger = None

96

122

97

123

try:

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

124

if_nametoindex = ctypes.cdll.LoadLibrary(

125

ctypes.util.find_library("c")).if_nametoindex

101

126

except (OSError, AttributeError):

127

102

128

def if_nametoindex(interface):

103

129

"Get an interface index the hard way, i.e. using fcntl()"

104

130

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

109

135

return interface_index

110

136

111

137

138

def copy_function(func):

139

"""Make a copy of a function"""

140

if sys.version_info.major == 2:

141

return types.FunctionType(func.func_code,

142

func.func_globals,

143

func.func_name,

144

func.func_defaults,

145

func.func_closure)

146

else:

147

return types.FunctionType(func.__code__,

148

func.__globals__,

149

func.__name__,

150

func.__defaults__,

151

func.__closure__)

152

153

112

154

def initlogger(debug, level=logging.WARNING):

113

155

"""init logger and add loglevel"""

114

156

115

157

global syslogger

116

syslogger = (logging.handlers.SysLogHandler

117

(facility =

118

logging.handlers.SysLogHandler.LOG_DAEMON,

119

address = "/dev/log"))

158

syslogger = (logging.handlers.SysLogHandler(

159

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

160

address = "/dev/log"))

120

161

syslogger.setFormatter(logging.Formatter

121

162

('Mandos [%(process)d]: %(levelname)s:'

122

163

' %(message)s'))

139

180

140

181

class PGPEngine(object):

141

182

"""A simple class for OpenPGP symmetric encryption & decryption"""

183

142

184

def __init__(self):

143

185

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

186

self.gpg = "gpg"

187

try:

188

output = subprocess.check_output(["gpgconf"])

189

for line in output.splitlines():

190

name, text, path = line.split(b":")

191

if name == "gpg":

192

self.gpg = path

193

break

194

except OSError as e:

195

if e.errno != errno.ENOENT:

196

raise

144

197

self.gnupgargs = ['--batch',

145

'--home', self.tempdir,

198

'--homedir', self.tempdir,

146

199

'--force-mdc',

147

'--quiet',

148

'--no-use-agent']

200

'--quiet']

201

# Only GPG version 1 has the --no-use-agent option.

202

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

203

self.gnupgargs.append("--no-use-agent")

149

204

150

205

def __enter__(self):

151

206

return self

183

238

184

239

def encrypt(self, data, password):

185

240

passphrase = self.password_encode(password)

186

with tempfile.NamedTemporaryFile(dir=self.tempdir

187

) as passfile:

241

with tempfile.NamedTemporaryFile(

242

dir=self.tempdir) as passfile:

188

243

passfile.write(passphrase)

189

244

passfile.flush()

190

proc = subprocess.Popen(['gpg', '--symmetric',

245

proc = subprocess.Popen([self.gpg, '--symmetric',

191

246

'--passphrase-file',

192

247

passfile.name]

193

248

+ self.gnupgargs,

201

256

202

257

def decrypt(self, data, password):

203

258

passphrase = self.password_encode(password)

204

with tempfile.NamedTemporaryFile(dir = self.tempdir

205

) as passfile:

259

with tempfile.NamedTemporaryFile(

260

dir = self.tempdir) as passfile:

206

261

passfile.write(passphrase)

207

262

passfile.flush()

208

proc = subprocess.Popen(['gpg', '--decrypt',

263

proc = subprocess.Popen([self.gpg, '--decrypt',

209

264

'--passphrase-file',

210

265

passfile.name]

211

266

+ self.gnupgargs,

212

267

stdin = subprocess.PIPE,

213

268

stdout = subprocess.PIPE,

214

269

stderr = subprocess.PIPE)

215

decrypted_plaintext, err = proc.communicate(input

216

= data)

270

decrypted_plaintext, err = proc.communicate(input = data)

217

271

if proc.returncode != 0:

218

272

raise PGPError(err)

219

273

return decrypted_plaintext

220

274

275

# Pretend that we have an Avahi module

276

class Avahi(object):

277

"""This isn't so much a class as it is a module-like namespace.

278

It is instantiated once, and simulates having an Avahi module."""

279

IF_UNSPEC = -1 # avahi-common/address.h

280

PROTO_UNSPEC = -1 # avahi-common/address.h

281

PROTO_INET = 0 # avahi-common/address.h

282

PROTO_INET6 = 1 # avahi-common/address.h

283

DBUS_NAME = "org.freedesktop.Avahi"

284

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

285

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

286

DBUS_PATH_SERVER = "/"

287

def string_array_to_txt_array(self, t):

288

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

289

for s in t), signature="ay")

290

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

291

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

292

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

293

SERVER_INVALID = 0 # avahi-common/defs.h

294

SERVER_REGISTERING = 1 # avahi-common/defs.h

295

SERVER_RUNNING = 2 # avahi-common/defs.h

296

SERVER_COLLISION = 3 # avahi-common/defs.h

297

SERVER_FAILURE = 4 # avahi-common/defs.h

298

avahi = Avahi()

221

299

222

300

class AvahiError(Exception):

223

301

def __init__(self, value, *args, **kwargs):

225

303

return super(AvahiError, self).__init__(value, *args,

226

304

**kwargs)

227

305

306

228

307

class AvahiServiceError(AvahiError):

229

308

pass

230

309

310

231

311

class AvahiGroupError(AvahiError):

232

312

pass

233

313

253

333

bus: dbus.SystemBus()

254

334

"""

255

335

256

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

257

servicetype = None, port = None, TXT = None,

258

domain = "", host = "", max_renames = 32768,

259

protocol = avahi.PROTO_UNSPEC, bus = None):

336

def __init__(self,

337

interface = avahi.IF_UNSPEC,

338

name = None,

339

servicetype = None,

340

port = None,

341

TXT = None,

342

domain = "",

343

host = "",

344

max_renames = 32768,

345

protocol = avahi.PROTO_UNSPEC,

346

bus = None):

260

347

self.interface = interface

261

348

self.name = name

262

349

self.type = servicetype

272

359

self.bus = bus

273

360

self.entry_group_state_changed_match = None

274

361

275

def rename(self):

362

def rename(self, remove=True):

276

363

"""Derived from the Avahi example code"""

277

364

if self.rename_count >= self.max_renames:

278

365

logger.critical("No suitable Zeroconf service name found"

279

366

" after %i retries, exiting.",

280

367

self.rename_count)

281

368

raise AvahiServiceError("Too many renames")

282

self.name = unicode(self.server

283

.GetAlternativeServiceName(self.name))

369

self.name = str(

370

self.server.GetAlternativeServiceName(self.name))

371

self.rename_count += 1

284

372

logger.info("Changing Zeroconf service name to %r ...",

285

373

self.name)

286

self.remove()

374

if remove:

375

self.remove()

287

376

try:

288

377

self.add()

289

378

except dbus.exceptions.DBusException as error:

290

logger.critical("D-Bus Exception", exc_info=error)

291

self.cleanup()

292

os._exit(1)

293

self.rename_count += 1

379

if (error.get_dbus_name()

380

== "org.freedesktop.Avahi.CollisionError"):

381

logger.info("Local Zeroconf service name collision.")

382

return self.rename(remove=False)

383

else:

384

logger.critical("D-Bus Exception", exc_info=error)

385

self.cleanup()

386

os._exit(1)

294

387

295

388

def remove(self):

296

389

"""Derived from the Avahi example code"""

334

427

self.rename()

335

428

elif state == avahi.ENTRY_GROUP_FAILURE:

336

429

logger.critical("Avahi: Error in group state changed %s",

337

unicode(error))

338

raise AvahiGroupError("State changed: {!s}"

339

.format(error))

430

str(error))

431

raise AvahiGroupError("State changed: {!s}".format(error))

340

432

341

433

def cleanup(self):

342

434

"""Derived from the Avahi example code"""

352

444

def server_state_changed(self, state, error=None):

353

445

"""Derived from the Avahi example code"""

354

446

logger.debug("Avahi server state change: %i", state)

355

bad_states = { avahi.SERVER_INVALID:

356

"Zeroconf server invalid",

357

avahi.SERVER_REGISTERING: None,

358

avahi.SERVER_COLLISION:

359

"Zeroconf server name collision",

360

avahi.SERVER_FAILURE:

361

"Zeroconf server failure" }

447

bad_states = {

448

avahi.SERVER_INVALID: "Zeroconf server invalid",

449

avahi.SERVER_REGISTERING: None,

450

avahi.SERVER_COLLISION: "Zeroconf server name collision",

451

avahi.SERVER_FAILURE: "Zeroconf server failure",

452

}

362

453

if state in bad_states:

363

454

if bad_states[state] is not None:

364

455

if error is None:

367

458

logger.error(bad_states[state] + ": %r", error)

368

459

self.cleanup()

369

460

elif state == avahi.SERVER_RUNNING:

370

self.add()

461

try:

462

self.add()

463

except dbus.exceptions.DBusException as error:

464

if (error.get_dbus_name()

465

== "org.freedesktop.Avahi.CollisionError"):

466

logger.info("Local Zeroconf service name"

467

" collision.")

468

return self.rename(remove=False)

469

else:

470

logger.critical("D-Bus Exception", exc_info=error)

471

self.cleanup()

472

os._exit(1)

371

473

else:

372

474

if error is None:

373

475

logger.debug("Unknown state: %r", state)

383

485

follow_name_owner_changes=True),

384

486

avahi.DBUS_INTERFACE_SERVER)

385

487

self.server.connect_to_signal("StateChanged",

386

self.server_state_changed)

488

self.server_state_changed)

387

489

self.server_state_changed(self.server.GetState())

388

490

389

491

390

492

class AvahiServiceToSyslog(AvahiService):

391

def rename(self):

493

def rename(self, *args, **kwargs):

392

494

"""Add the new name to the syslog messages"""

393

ret = AvahiService.rename(self)

394

syslogger.setFormatter(logging.Formatter

395

('Mandos ({}) [%(process)d]:'

396

' %(levelname)s: %(message)s'

397

.format(self.name)))

495

ret = AvahiService.rename(self, *args, **kwargs)

496

syslogger.setFormatter(logging.Formatter(

497

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

498

.format(self.name)))

398

499

return ret

399

500

501

# Pretend that we have a GnuTLS module

502

class GnuTLS(object):

503

"""This isn't so much a class as it is a module-like namespace.

504

It is instantiated once, and simulates having a GnuTLS module."""

505

506

_library = ctypes.cdll.LoadLibrary(

507

ctypes.util.find_library("gnutls"))

508

_need_version = b"3.3.0"

509

def __init__(self):

510

# Need to use class name "GnuTLS" here, since this method is

511

# called before the assignment to the "gnutls" global variable

512

# happens.

513

if GnuTLS.check_version(self._need_version) is None:

514

raise GnuTLS.Error("Needs GnuTLS {} or later"

515

.format(self._need_version))

516

517

# Unless otherwise indicated, the constants and types below are

518

# all from the gnutls/gnutls.h C header file.

519

520

# Constants

521

E_SUCCESS = 0

522

E_INTERRUPTED = -52

523

E_AGAIN = -28

524

CRT_OPENPGP = 2

525

CLIENT = 2

526

SHUT_RDWR = 0

527

CRD_CERTIFICATE = 1

528

E_NO_CERTIFICATE_FOUND = -49

529

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

530

531

# Types

532

class session_int(ctypes.Structure):

533

_fields_ = []

534

session_t = ctypes.POINTER(session_int)

535

class certificate_credentials_st(ctypes.Structure):

536

_fields_ = []

537

certificate_credentials_t = ctypes.POINTER(

538

certificate_credentials_st)

539

certificate_type_t = ctypes.c_int

540

class datum_t(ctypes.Structure):

541

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

542

('size', ctypes.c_uint)]

543

class openpgp_crt_int(ctypes.Structure):

544

_fields_ = []

545

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

546

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

547

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

548

credentials_type_t = ctypes.c_int

549

transport_ptr_t = ctypes.c_void_p

550

close_request_t = ctypes.c_int

551

552

# Exceptions

553

class Error(Exception):

554

# We need to use the class name "GnuTLS" here, since this

555

# exception might be raised from within GnuTLS.__init__,

556

# which is called before the assignment to the "gnutls"

557

# global variable has happened.

558

def __init__(self, message = None, code = None, args=()):

559

# Default usage is by a message string, but if a return

560

# code is passed, convert it to a string with

561

# gnutls.strerror()

562

self.code = code

563

if message is None and code is not None:

564

message = GnuTLS.strerror(code)

565

return super(GnuTLS.Error, self).__init__(

566

message, *args)

567

568

class CertificateSecurityError(Error):

569

pass

570

571

# Classes

572

class Credentials(object):

573

def __init__(self):

574

self._c_object = gnutls.certificate_credentials_t()

575

gnutls.certificate_allocate_credentials(

576

ctypes.byref(self._c_object))

577

self.type = gnutls.CRD_CERTIFICATE

578

579

def __del__(self):

580

gnutls.certificate_free_credentials(self._c_object)

581

582

class ClientSession(object):

583

def __init__(self, socket, credentials = None):

584

self._c_object = gnutls.session_t()

585

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

586

gnutls.set_default_priority(self._c_object)

587

gnutls.transport_set_ptr(self._c_object, socket.fileno())

588

gnutls.handshake_set_private_extensions(self._c_object,

589

True)

590

self.socket = socket

591

if credentials is None:

592

credentials = gnutls.Credentials()

593

gnutls.credentials_set(self._c_object, credentials.type,

594

ctypes.cast(credentials._c_object,

595

ctypes.c_void_p))

596

self.credentials = credentials

597

598

def __del__(self):

599

gnutls.deinit(self._c_object)

600

601

def handshake(self):

602

return gnutls.handshake(self._c_object)

603

604

def send(self, data):

605

data = bytes(data)

606

data_len = len(data)

607

while data_len > 0:

608

data_len -= gnutls.record_send(self._c_object,

609

data[-data_len:],

610

data_len)

611

612

def bye(self):

613

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

614

615

# Error handling functions

616

def _error_code(result):

617

"""A function to raise exceptions on errors, suitable

618

for the 'restype' attribute on ctypes functions"""

619

if result >= 0:

620

return result

621

if result == gnutls.E_NO_CERTIFICATE_FOUND:

622

raise gnutls.CertificateSecurityError(code = result)

623

raise gnutls.Error(code = result)

624

625

def _retry_on_error(result, func, arguments):

626

"""A function to retry on some errors, suitable

627

for the 'errcheck' attribute on ctypes functions"""

628

while result < 0:

629

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

630

return _error_code(result)

631

result = func(*arguments)

632

return result

633

634

# Unless otherwise indicated, the function declarations below are

635

# all from the gnutls/gnutls.h C header file.

636

637

# Functions

638

priority_set_direct = _library.gnutls_priority_set_direct

639

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

640

ctypes.POINTER(ctypes.c_char_p)]

641

priority_set_direct.restype = _error_code

642

643

init = _library.gnutls_init

644

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

645

init.restype = _error_code

646

647

set_default_priority = _library.gnutls_set_default_priority

648

set_default_priority.argtypes = [session_t]

649

set_default_priority.restype = _error_code

650

651

record_send = _library.gnutls_record_send

652

record_send.argtypes = [session_t, ctypes.c_void_p,

653

ctypes.c_size_t]

654

record_send.restype = ctypes.c_ssize_t

655

record_send.errcheck = _retry_on_error

656

657

certificate_allocate_credentials = (

658

_library.gnutls_certificate_allocate_credentials)

659

certificate_allocate_credentials.argtypes = [

660

ctypes.POINTER(certificate_credentials_t)]

661

certificate_allocate_credentials.restype = _error_code

662

663

certificate_free_credentials = (

664

_library.gnutls_certificate_free_credentials)

665

certificate_free_credentials.argtypes = [certificate_credentials_t]

666

certificate_free_credentials.restype = None

667

668

handshake_set_private_extensions = (

669

_library.gnutls_handshake_set_private_extensions)

670

handshake_set_private_extensions.argtypes = [session_t,

671

ctypes.c_int]

672

handshake_set_private_extensions.restype = None

673

674

credentials_set = _library.gnutls_credentials_set

675

credentials_set.argtypes = [session_t, credentials_type_t,

676

ctypes.c_void_p]

677

credentials_set.restype = _error_code

678

679

strerror = _library.gnutls_strerror

680

strerror.argtypes = [ctypes.c_int]

681

strerror.restype = ctypes.c_char_p

682

683

certificate_type_get = _library.gnutls_certificate_type_get

684

certificate_type_get.argtypes = [session_t]

685

certificate_type_get.restype = _error_code

686

687

certificate_get_peers = _library.gnutls_certificate_get_peers

688

certificate_get_peers.argtypes = [session_t,

689

ctypes.POINTER(ctypes.c_uint)]

690

certificate_get_peers.restype = ctypes.POINTER(datum_t)

691

692

global_set_log_level = _library.gnutls_global_set_log_level

693

global_set_log_level.argtypes = [ctypes.c_int]

694

global_set_log_level.restype = None

695

696

global_set_log_function = _library.gnutls_global_set_log_function

697

global_set_log_function.argtypes = [log_func]

698

global_set_log_function.restype = None

699

700

deinit = _library.gnutls_deinit

701

deinit.argtypes = [session_t]

702

deinit.restype = None

703

704

handshake = _library.gnutls_handshake

705

handshake.argtypes = [session_t]

706

handshake.restype = _error_code

707

handshake.errcheck = _retry_on_error

708

709

transport_set_ptr = _library.gnutls_transport_set_ptr

710

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

711

transport_set_ptr.restype = None

712

713

bye = _library.gnutls_bye

714

bye.argtypes = [session_t, close_request_t]

715

bye.restype = _error_code

716

bye.errcheck = _retry_on_error

717

718

check_version = _library.gnutls_check_version

719

check_version.argtypes = [ctypes.c_char_p]

720

check_version.restype = ctypes.c_char_p

721

722

# All the function declarations below are from gnutls/openpgp.h

723

724

openpgp_crt_init = _library.gnutls_openpgp_crt_init

725

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

726

openpgp_crt_init.restype = _error_code

727

728

openpgp_crt_import = _library.gnutls_openpgp_crt_import

729

openpgp_crt_import.argtypes = [openpgp_crt_t,

730

ctypes.POINTER(datum_t),

731

openpgp_crt_fmt_t]

732

openpgp_crt_import.restype = _error_code

733

734

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

735

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

736

ctypes.POINTER(ctypes.c_uint)]

737

openpgp_crt_verify_self.restype = _error_code

738

739

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

740

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

741

openpgp_crt_deinit.restype = None

742

743

openpgp_crt_get_fingerprint = (

744

_library.gnutls_openpgp_crt_get_fingerprint)

745

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

746

ctypes.c_void_p,

747

ctypes.POINTER(

748

ctypes.c_size_t)]

749

openpgp_crt_get_fingerprint.restype = _error_code

750

751

# Remove non-public functions

752

del _error_code, _retry_on_error

753

# Create the global "gnutls" object, simulating a module

754

gnutls = GnuTLS()

755

756

def call_pipe(connection, # : multiprocessing.Connection

757

func, *args, **kwargs):

758

"""This function is meant to be called by multiprocessing.Process

759

760

This function runs func(*args, **kwargs), and writes the resulting

761

return value on the provided multiprocessing.Connection.

762

"""

763

connection.send(func(*args, **kwargs))

764

connection.close()

400

765

401

766

class Client(object):

402

767

"""A representation of a client host served by this server.

408

773

checker: subprocess.Popen(); a running checker process used

409

774

to see if the client lives.

410

775

'None' if no process is running.

411

checker_callback_tag: a gobject event source tag, or None

776

checker_callback_tag: a GLib event source tag, or None

412

777

checker_command: string; External command which is run to check

413

778

if client lives. %() expansions are done at

414

779

runtime with vars(self) as dict, so that for

415

780

instance %(name)s can be used in the command.

416

checker_initiator_tag: a gobject event source tag, or None

781

checker_initiator_tag: a GLib event source tag, or None

417

782

created: datetime.datetime(); (UTC) object creation

418

783

client_structure: Object describing what attributes a client has

419

784

and is used for storing the client at exit

420

785

current_checker_command: string; current running checker_command

421

disable_initiator_tag: a gobject event source tag, or None

786

disable_initiator_tag: a GLib event source tag, or None

422

787

enabled: bool()

423

788

fingerprint: string (40 or 32 hexadecimal digits); used to

424

789

uniquely identify the client

429

794

last_checker_status: integer between 0 and 255 reflecting exit

430

795

status of last checker. -1 reflects crashed

431

796

checker, -2 means no checker completed yet.

797

last_checker_signal: The signal which killed the last checker, if

798

last_checker_status is -1

432

799

last_enabled: datetime.datetime(); (UTC) or None

433

800

name: string; from the config file, used in log messages and

434

801

D-Bus identifiers

447

814

"fingerprint", "host", "interval",

448

815

"last_approval_request", "last_checked_ok",

449

816

"last_enabled", "name", "timeout")

450

client_defaults = { "timeout": "PT5M",

451

"extended_timeout": "PT15M",

452

"interval": "PT2M",

453

"checker": "fping -q -- %%(host)s",

454

"host": "",

455

"approval_delay": "PT0S",

456

"approval_duration": "PT1S",

457

"approved_by_default": "True",

458

"enabled": "True",

459

}

817

client_defaults = {

818

"timeout": "PT5M",

819

"extended_timeout": "PT15M",

820

"interval": "PT2M",

821

"checker": "fping -q -- %%(host)s",

822

"host": "",

823

"approval_delay": "PT0S",

824

"approval_duration": "PT1S",

825

"approved_by_default": "True",

826

"enabled": "True",

827

}

460

828

461

829

@staticmethod

462

830

def config_parser(config):

478

846

client["enabled"] = config.getboolean(client_name,

479

847

"enabled")

480

848

849

# Uppercase and remove spaces from fingerprint for later

850

# comparison purposes with return value from the

851

# fingerprint() function

481

852

client["fingerprint"] = (section["fingerprint"].upper()

482

853

.replace(" ", ""))

483

854

if "secret" in section:

484

client["secret"] = section["secret"].decode("base64")

855

client["secret"] = codecs.decode(section["secret"]

856

.encode("utf-8"),

857

"base64")

485

858

elif "secfile" in section:

486

859

with open(os.path.expanduser(os.path.expandvars

487

860

(section["secfile"])),

525

898

self.expires = None

526

899

527

900

logger.debug("Creating client %r", self.name)

528

# Uppercase and remove spaces from fingerprint for later

529

# comparison purposes with return value from the fingerprint()

530

# function

531

901

logger.debug(" Fingerprint: %s", self.fingerprint)

532

902

self.created = settings.get("created",

533

903

datetime.datetime.utcnow())

540

910

self.current_checker_command = None

541

911

self.approved = None

542

912

self.approvals_pending = 0

543

self.changedstate = (multiprocessing_manager

544

.Condition(multiprocessing_manager

545

.Lock()))

546

self.client_structure = [attr for attr in

547

self.__dict__.iterkeys()

913

self.changedstate = multiprocessing_manager.Condition(

914

multiprocessing_manager.Lock())

915

self.client_structure = [attr

916

for attr in self.__dict__.keys()

548

917

if not attr.startswith("_")]

549

918

self.client_structure.append("client_structure")

550

919

551

for name, t in inspect.getmembers(type(self),

552

lambda obj:

553

isinstance(obj,

554

property)):

920

for name, t in inspect.getmembers(

921

type(self), lambda obj: isinstance(obj, property)):

555

922

if not name.startswith("_"):

556

923

self.client_structure.append(name)

557

924

578

945

if not quiet:

579

946

logger.info("Disabling client %s", self.name)

580

947

if getattr(self, "disable_initiator_tag", None) is not None:

581

gobject.source_remove(self.disable_initiator_tag)

948

GLib.source_remove(self.disable_initiator_tag)

582

949

self.disable_initiator_tag = None

583

950

self.expires = None

584

951

if getattr(self, "checker_initiator_tag", None) is not None:

585

gobject.source_remove(self.checker_initiator_tag)

952

GLib.source_remove(self.checker_initiator_tag)

586

953

self.checker_initiator_tag = None

587

954

self.stop_checker()

588

955

self.enabled = False

589

956

if not quiet:

590

957

self.send_changedstate()

591

# Do not run this again if called by a gobject.timeout_add

958

# Do not run this again if called by a GLib.timeout_add

592

959

return False

593

960

594

961

def __del__(self):

598

965

# Schedule a new checker to be started an 'interval' from now,

599

966

# and every interval from then on.

600

967

if self.checker_initiator_tag is not None:

601

gobject.source_remove(self.checker_initiator_tag)

602

self.checker_initiator_tag = (gobject.timeout_add

603

(int(self.interval

604

.total_seconds() * 1000),

605

self.start_checker))

968

GLib.source_remove(self.checker_initiator_tag)

969

self.checker_initiator_tag = GLib.timeout_add(

970

int(self.interval.total_seconds() * 1000),

971

self.start_checker)

606

972

# Schedule a disable() when 'timeout' has passed

607

973

if self.disable_initiator_tag is not None:

608

gobject.source_remove(self.disable_initiator_tag)

609

self.disable_initiator_tag = (gobject.timeout_add

610

(int(self.timeout

611

.total_seconds() * 1000),

612

self.disable))

974

GLib.source_remove(self.disable_initiator_tag)

975

self.disable_initiator_tag = GLib.timeout_add(

976

int(self.timeout.total_seconds() * 1000), self.disable)

613

977

# Also start a new checker *right now*.

614

978

self.start_checker()

615

979

616

def checker_callback(self, pid, condition, command):

980

def checker_callback(self, source, condition, connection,

981

command):

617

982

"""The checker has completed, so take appropriate actions."""

618

983

self.checker_callback_tag = None

619

984

self.checker = None

620

if os.WIFEXITED(condition):

621

self.last_checker_status = os.WEXITSTATUS(condition)

985

# Read return code from connection (see call_pipe)

986

returncode = connection.recv()

987

connection.close()

988

989

if returncode >= 0:

990

self.last_checker_status = returncode

991

self.last_checker_signal = None

622

992

if self.last_checker_status == 0:

623

993

logger.info("Checker for %(name)s succeeded",

624

994

vars(self))

625

995

self.checked_ok()

626

996

else:

627

logger.info("Checker for %(name)s failed",

628

vars(self))

997

logger.info("Checker for %(name)s failed", vars(self))

629

998

else:

630

999

self.last_checker_status = -1

1000

self.last_checker_signal = -returncode

631

1001

logger.warning("Checker for %(name)s crashed?",

632

1002

vars(self))

1003

return False

633

1004

634

1005

def checked_ok(self):

635

1006

"""Assert that the client has been seen, alive and well."""

636

1007

self.last_checked_ok = datetime.datetime.utcnow()

637

1008

self.last_checker_status = 0

1009

self.last_checker_signal = None

638

1010

self.bump_timeout()

639

1011

640

1012

def bump_timeout(self, timeout=None):

642

1014

if timeout is None:

643

1015

timeout = self.timeout

644

1016

if self.disable_initiator_tag is not None:

645

gobject.source_remove(self.disable_initiator_tag)

1017

GLib.source_remove(self.disable_initiator_tag)

646

1018

self.disable_initiator_tag = None

647

1019

if getattr(self, "enabled", False):

648

self.disable_initiator_tag = (gobject.timeout_add

649

(int(timeout.total_seconds()

650

* 1000), self.disable))

1020

self.disable_initiator_tag = GLib.timeout_add(

1021

int(timeout.total_seconds() * 1000), self.disable)

651

1022

self.expires = datetime.datetime.utcnow() + timeout

652

1023

653

1024

def need_approval(self):

667

1038

# than 'timeout' for the client to be disabled, which is as it

668

1039

# should be.

669

1040

670

# If a checker exists, make sure it is not a zombie

671

try:

672

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

673

except AttributeError:

674

pass

675

except OSError as error:

676

if error.errno != errno.ECHILD:

677

raise

678

else:

679

if pid:

680

logger.warning("Checker was a zombie")

681

gobject.source_remove(self.checker_callback_tag)

682

self.checker_callback(pid, status,

683

self.current_checker_command)

1041

if self.checker is not None and not self.checker.is_alive():

1042

logger.warning("Checker was not alive; joining")

1043

self.checker.join()

1044

self.checker = None

684

1045

# Start a new checker if needed

685

1046

if self.checker is None:

686

1047

# Escape attributes for the shell

687

escaped_attrs = { attr:

688

re.escape(unicode(getattr(self,

689

attr)))

690

for attr in self.runtime_expansions }

1048

escaped_attrs = {

1049

attr: re.escape(str(getattr(self, attr)))

1050

for attr in self.runtime_expansions }

691

1051

try:

692

1052

command = self.checker_command % escaped_attrs

693

1053

except TypeError as error:

694

1054

logger.error('Could not format string "%s"',

695

self.checker_command, exc_info=error)

696

return True # Try again later

1055

self.checker_command,

1056

exc_info=error)

1057

return True # Try again later

697

1058

self.current_checker_command = command

698

try:

699

logger.info("Starting checker %r for %s",

700

command, self.name)

701

# We don't need to redirect stdout and stderr, since

702

# in normal mode, that is already done by daemon(),

703

# and in debug mode we don't want to. (Stdin is

704

# always replaced by /dev/null.)

705

# The exception is when not debugging but nevertheless

706

# running in the foreground; use the previously

707

# created wnull.

708

popen_args = {}

709

if (not self.server_settings["debug"]

710

and self.server_settings["foreground"]):

711

popen_args.update({"stdout": wnull,

712

"stderr": wnull })

713

self.checker = subprocess.Popen(command,

714

close_fds=True,

715

shell=True, cwd="/",

716

**popen_args)

717

except OSError as error:

718

logger.error("Failed to start subprocess",

719

exc_info=error)

720

return True

721

self.checker_callback_tag = (gobject.child_watch_add

722

(self.checker.pid,

723

self.checker_callback,

724

data=command))

725

# The checker may have completed before the gobject

726

# watch was added. Check for this.

727

try:

728

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

729

except OSError as error:

730

if error.errno == errno.ECHILD:

731

# This should never happen

732

logger.error("Child process vanished",

733

exc_info=error)

734

return True

735

raise

736

if pid:

737

gobject.source_remove(self.checker_callback_tag)

738

self.checker_callback(pid, status, command)

739

# Re-run this periodically if run by gobject.timeout_add

1059

logger.info("Starting checker %r for %s", command,

1060

self.name)

1061

# We don't need to redirect stdout and stderr, since

1062

# in normal mode, that is already done by daemon(),

1063

# and in debug mode we don't want to. (Stdin is

1064

# always replaced by /dev/null.)

1065

# The exception is when not debugging but nevertheless

1066

# running in the foreground; use the previously

1067

# created wnull.

1068

popen_args = { "close_fds": True,

1069

"shell": True,

1070

"cwd": "/" }

1071

if (not self.server_settings["debug"]

1072

and self.server_settings["foreground"]):

1073

popen_args.update({"stdout": wnull,

1074

"stderr": wnull })

1075

pipe = multiprocessing.Pipe(duplex = False)

1076

self.checker = multiprocessing.Process(

1077

target = call_pipe,

1078

args = (pipe[1], subprocess.call, command),

1079

kwargs = popen_args)

1080

self.checker.start()

1081

self.checker_callback_tag = GLib.io_add_watch(

1082

pipe[0].fileno(), GLib.IO_IN,

1083

self.checker_callback, pipe[0], command)

1084

# Re-run this periodically if run by GLib.timeout_add

740

1085

return True

741

1086

742

1087

def stop_checker(self):

743

1088

"""Force the checker process, if any, to stop."""

744

1089

if self.checker_callback_tag:

745

gobject.source_remove(self.checker_callback_tag)

1090

GLib.source_remove(self.checker_callback_tag)

746

1091

self.checker_callback_tag = None

747

1092

if getattr(self, "checker", None) is None:

748

1093

return

749

1094

logger.debug("Stopping checker for %(name)s", vars(self))

750

try:

751

self.checker.terminate()

752

#time.sleep(0.5)

753

#if self.checker.poll() is None:

754

# self.checker.kill()

755

except OSError as error:

756

if error.errno != errno.ESRCH: # No such process

757

raise

1095

self.checker.terminate()

758

1096

self.checker = None

759

1097

760

1098

761

def dbus_service_property(dbus_interface, signature="v",

762

access="readwrite", byte_arrays=False):

1099

def dbus_service_property(dbus_interface,

1100

signature="v",

1101

access="readwrite",

1102

byte_arrays=False):

763

1103

"""Decorators for marking methods of a DBusObjectWithProperties to

764

1104

become properties on the D-Bus.

765

1105

775

1115

if byte_arrays and signature != "ay":

776

1116

raise ValueError("Byte arrays not supported for non-'ay'"

777

1117

" signature {!r}".format(signature))

1118

778

1119

def decorator(func):

779

1120

func._dbus_is_property = True

780

1121

func._dbus_interface = dbus_interface

785

1126

func._dbus_name = func._dbus_name[:-14]

786

1127

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

787

1128

return func

1129

788

1130

return decorator

789

1131

790

1132

799

1141

"org.freedesktop.DBus.Property.EmitsChangedSignal":

800

1142

"false"}

801

1143

"""

1144

802

1145

def decorator(func):

803

1146

func._dbus_is_interface = True

804

1147

func._dbus_interface = dbus_interface

805

1148

func._dbus_name = dbus_interface

806

1149

return func

1150

807

1151

return decorator

808

1152

809

1153

811

1155

"""Decorator to annotate D-Bus methods, signals or properties

812

1156

Usage:

813

1157

1158

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1159

"org.freedesktop.DBus.Property."

1160

"EmitsChangedSignal": "false"})

814

1161

@dbus_service_property("org.example.Interface", signature="b",

815

1162

access="r")

816

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

817

"org.freedesktop.DBus.Property."

818

"EmitsChangedSignal": "false"})

819

1163

def Property_dbus_property(self):

820

1164

return dbus.Boolean(False)

1165

1166

See also the DBusObjectWithAnnotations class.

821

1167

"""

1168

822

1169

def decorator(func):

823

1170

func._dbus_annotations = annotations

824

1171

return func

1172

825

1173

return decorator

826

1174

827

1175

830

1178

"""

831

1179

pass

832

1180

1181

833

1182

class DBusPropertyAccessException(DBusPropertyException):

834

1183

"""A property's access permissions disallows an operation.

835

1184

"""

842

1191

pass

843

1192

844

1193

845

class DBusObjectWithProperties(dbus.service.Object):

846

"""A D-Bus object with properties.

1194

class DBusObjectWithAnnotations(dbus.service.Object):

1195

"""A D-Bus object with annotations.

847

1196

848

Classes inheriting from this can use the dbus_service_property

849

decorator to expose methods as D-Bus properties. It exposes the

850

standard Get(), Set(), and GetAll() methods on the D-Bus.

1197

Classes inheriting from this can use the dbus_annotations

1198

decorator to add annotations to methods or signals.

851

1199

"""

852

1200

853

1201

@staticmethod

863

1211

def _get_all_dbus_things(self, thing):

864

1212

"""Returns a generator of (name, attribute) pairs

865

1213

"""

866

return ((getattr(athing.__get__(self), "_dbus_name",

867

name),

1214

return ((getattr(athing.__get__(self), "_dbus_name", name),

868

1215

athing.__get__(self))

869

1216

for cls in self.__class__.__mro__

870

1217

for name, athing in

871

inspect.getmembers(cls,

872

self._is_dbus_thing(thing)))

1218

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1219

1220

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1221

out_signature = "s",

1222

path_keyword = 'object_path',

1223

connection_keyword = 'connection')

1224

def Introspect(self, object_path, connection):

1225

"""Overloading of standard D-Bus method.

1226

1227

Inserts annotation tags on methods and signals.

1228

"""

1229

xmlstring = dbus.service.Object.Introspect(self, object_path,

1230

connection)

1231

try:

1232

document = xml.dom.minidom.parseString(xmlstring)

1233

1234

for if_tag in document.getElementsByTagName("interface"):

1235

# Add annotation tags

1236

for typ in ("method", "signal"):

1237

for tag in if_tag.getElementsByTagName(typ):

1238

annots = dict()

1239

for name, prop in (self.

1240

_get_all_dbus_things(typ)):

1241

if (name == tag.getAttribute("name")

1242

and prop._dbus_interface

1243

== if_tag.getAttribute("name")):

1244

annots.update(getattr(

1245

prop, "_dbus_annotations", {}))

1246

for name, value in annots.items():

1247

ann_tag = document.createElement(

1248

"annotation")

1249

ann_tag.setAttribute("name", name)

1250

ann_tag.setAttribute("value", value)

1251

tag.appendChild(ann_tag)

1252

# Add interface annotation tags

1253

for annotation, value in dict(

1254

itertools.chain.from_iterable(

1255

annotations().items()

1256

for name, annotations

1257

in self._get_all_dbus_things("interface")

1258

if name == if_tag.getAttribute("name")

1259

)).items():

1260

ann_tag = document.createElement("annotation")

1261

ann_tag.setAttribute("name", annotation)

1262

ann_tag.setAttribute("value", value)

1263

if_tag.appendChild(ann_tag)

1264

# Fix argument name for the Introspect method itself

1265

if (if_tag.getAttribute("name")

1266

== dbus.INTROSPECTABLE_IFACE):

1267

for cn in if_tag.getElementsByTagName("method"):

1268

if cn.getAttribute("name") == "Introspect":

1269

for arg in cn.getElementsByTagName("arg"):

1270

if (arg.getAttribute("direction")

1271

== "out"):

1272

arg.setAttribute("name",

1273

"xml_data")

1274

xmlstring = document.toxml("utf-8")

1275

document.unlink()

1276

except (AttributeError, xml.dom.DOMException,

1277

xml.parsers.expat.ExpatError) as error:

1278

logger.error("Failed to override Introspection method",

1279

exc_info=error)

1280

return xmlstring

1281

1282

1283

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1284

"""A D-Bus object with properties.

1285

1286

Classes inheriting from this can use the dbus_service_property

1287

decorator to expose methods as D-Bus properties. It exposes the

1288

standard Get(), Set(), and GetAll() methods on the D-Bus.

1289

"""

873

1290

874

1291

def _get_dbus_property(self, interface_name, property_name):

875

1292

"""Returns a bound method if one exists which is a D-Bus

876

1293

property with the specified name and interface.

877

1294

"""

878

for cls in self.__class__.__mro__:

879

for name, value in (inspect.getmembers

880

(cls,

881

self._is_dbus_thing("property"))):

1295

for cls in self.__class__.__mro__:

1296

for name, value in inspect.getmembers(

1297

cls, self._is_dbus_thing("property")):

882

1298

if (value._dbus_name == property_name

883

1299

and value._dbus_interface == interface_name):

884

1300

return value.__get__(self)

885

1301

886

1302

# No such property

887

raise DBusPropertyNotFound(self.dbus_object_path + ":"

888

+ interface_name + "."

889

+ property_name)

890

891

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1303

raise DBusPropertyNotFound("{}:{}.{}".format(

1304

self.dbus_object_path, interface_name, property_name))

1305

1306

@classmethod

1307

def _get_all_interface_names(cls):

1308

"""Get a sequence of all interfaces supported by an object"""

1309

return (name for name in set(getattr(getattr(x, attr),

1310

"_dbus_interface", None)

1311

for x in (inspect.getmro(cls))

1312

for attr in dir(x))

1313

if name is not None)

1314

1315

@dbus.service.method(dbus.PROPERTIES_IFACE,

1316

in_signature="ss",

892

1317

out_signature="v")

893

1318

def Get(self, interface_name, property_name):

894

1319

"""Standard D-Bus property Get() method, see D-Bus standard.

919

1344

for byte in value))

920

1345

prop(value)

921

1346

922

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1347

@dbus.service.method(dbus.PROPERTIES_IFACE,

1348

in_signature="s",

923

1349

out_signature="a{sv}")

924

1350

def GetAll(self, interface_name):

925

1351

"""Standard D-Bus property GetAll() method, see D-Bus

940

1366

if not hasattr(value, "variant_level"):

941

1367

properties[name] = value

942

1368

continue

943

properties[name] = type(value)(value, variant_level=

944

value.variant_level+1)

1369

properties[name] = type(value)(

1370

value, variant_level = value.variant_level + 1)

945

1371

return dbus.Dictionary(properties, signature="sv")

946

1372

1373

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1374

def PropertiesChanged(self, interface_name, changed_properties,

1375

invalidated_properties):

1376

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1377

standard.

1378

"""

1379

pass

1380

947

1381

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

948

1382

out_signature="s",

949

1383

path_keyword='object_path',

953

1387

954

1388

Inserts property tags and interface annotation tags.

955

1389

"""

956

xmlstring = dbus.service.Object.Introspect(self, object_path,

957

connection)

1390

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1391

object_path,

1392

connection)

958

1393

try:

959

1394

document = xml.dom.minidom.parseString(xmlstring)

1395

960

1396

def make_tag(document, name, prop):

961

1397

e = document.createElement("property")

962

1398

e.setAttribute("name", name)

963

1399

e.setAttribute("type", prop._dbus_signature)

964

1400

e.setAttribute("access", prop._dbus_access)

965

1401

return e

1402

966

1403

for if_tag in document.getElementsByTagName("interface"):

967

1404

# Add property tags

968

1405

for tag in (make_tag(document, name, prop)

971

1408

if prop._dbus_interface

972

1409

== if_tag.getAttribute("name")):

973

1410

if_tag.appendChild(tag)

974

# Add annotation tags

975

for typ in ("method", "signal", "property"):

976

for tag in if_tag.getElementsByTagName(typ):

977

annots = dict()

978

for name, prop in (self.

979

_get_all_dbus_things(typ)):

980

if (name == tag.getAttribute("name")

981

and prop._dbus_interface

982

== if_tag.getAttribute("name")):

983

annots.update(getattr

984

(prop,

985

"_dbus_annotations",

986

{}))

987

for name, value in annots.items():

988

ann_tag = document.createElement(

989

"annotation")

990

ann_tag.setAttribute("name", name)

991

ann_tag.setAttribute("value", value)

992

tag.appendChild(ann_tag)

993

# Add interface annotation tags

994

for annotation, value in dict(

995

itertools.chain.from_iterable(

996

annotations().items()

997

for name, annotations in

998

self._get_all_dbus_things("interface")

999

if name == if_tag.getAttribute("name")

1000

)).items():

1001

ann_tag = document.createElement("annotation")

1002

ann_tag.setAttribute("name", annotation)

1003

ann_tag.setAttribute("value", value)

1004

if_tag.appendChild(ann_tag)

1411

# Add annotation tags for properties

1412

for tag in if_tag.getElementsByTagName("property"):

1413

annots = dict()

1414

for name, prop in self._get_all_dbus_things(

1415

"property"):

1416

if (name == tag.getAttribute("name")

1417

and prop._dbus_interface

1418

== if_tag.getAttribute("name")):

1419

annots.update(getattr(

1420

prop, "_dbus_annotations", {}))

1421

for name, value in annots.items():

1422

ann_tag = document.createElement(

1423

"annotation")

1424

ann_tag.setAttribute("name", name)

1425

ann_tag.setAttribute("value", value)

1426

tag.appendChild(ann_tag)

1005

1427

# Add the names to the return values for the

1006

1428

# "org.freedesktop.DBus.Properties" methods

1007

1429

if (if_tag.getAttribute("name")

1025

1447

exc_info=error)

1026

1448

return xmlstring

1027

1449

1450

try:

1451

dbus.OBJECT_MANAGER_IFACE

1452

except AttributeError:

1453

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1454

1455

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1456

"""A D-Bus object with an ObjectManager.

1457

1458

Classes inheriting from this exposes the standard

1459

GetManagedObjects call and the InterfacesAdded and

1460

InterfacesRemoved signals on the standard

1461

"org.freedesktop.DBus.ObjectManager" interface.

1462

1463

Note: No signals are sent automatically; they must be sent

1464

manually.

1465

"""

1466

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1467

out_signature = "a{oa{sa{sv}}}")

1468

def GetManagedObjects(self):

1469

"""This function must be overridden"""

1470

raise NotImplementedError()

1471

1472

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1473

signature = "oa{sa{sv}}")

1474

def InterfacesAdded(self, object_path, interfaces_and_properties):

1475

pass

1476

1477

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1478

def InterfacesRemoved(self, object_path, interfaces):

1479

pass

1480

1481

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1482

out_signature = "s",

1483

path_keyword = 'object_path',

1484

connection_keyword = 'connection')

1485

def Introspect(self, object_path, connection):

1486

"""Overloading of standard D-Bus method.

1487

1488

Override return argument name of GetManagedObjects to be

1489

"objpath_interfaces_and_properties"

1490

"""

1491

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1492

object_path,

1493

connection)

1494

try:

1495

document = xml.dom.minidom.parseString(xmlstring)

1496

1497

for if_tag in document.getElementsByTagName("interface"):

1498

# Fix argument name for the GetManagedObjects method

1499

if (if_tag.getAttribute("name")

1500

== dbus.OBJECT_MANAGER_IFACE):

1501

for cn in if_tag.getElementsByTagName("method"):

1502

if (cn.getAttribute("name")

1503

== "GetManagedObjects"):

1504

for arg in cn.getElementsByTagName("arg"):

1505

if (arg.getAttribute("direction")

1506

== "out"):

1507

arg.setAttribute(

1508

"name",

1509

"objpath_interfaces"

1510

"_and_properties")

1511

xmlstring = document.toxml("utf-8")

1512

document.unlink()

1513

except (AttributeError, xml.dom.DOMException,

1514

xml.parsers.expat.ExpatError) as error:

1515

logger.error("Failed to override Introspection method",

1516

exc_info = error)

1517

return xmlstring

1028

1518

1029

1519

def datetime_to_dbus(dt, variant_level=0):

1030

1520

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1031

1521

if dt is None:

1032

1522

return dbus.String("", variant_level = variant_level)

1033

return dbus.String(dt.isoformat(),

1034

variant_level=variant_level)

1523

return dbus.String(dt.isoformat(), variant_level=variant_level)

1035

1524

1036

1525

1037

1526

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1057

1546

(from DBusObjectWithProperties) and interfaces (from the

1058

1547

dbus_interface_annotations decorator).

1059

1548

"""

1549

1060

1550

def wrapper(cls):

1061

1551

for orig_interface_name, alt_interface_name in (

1062

alt_interface_names.items()):

1552

alt_interface_names.items()):

1063

1553

attr = {}

1064

1554

interface_names = set()

1065

1555

# Go though all attributes of the class

1067

1557

# Ignore non-D-Bus attributes, and D-Bus attributes

1068

1558

# with the wrong interface name

1069

1559

if (not hasattr(attribute, "_dbus_interface")

1070

or not attribute._dbus_interface

1071

.startswith(orig_interface_name)):

1560

or not attribute._dbus_interface.startswith(

1561

orig_interface_name)):

1072

1562

continue

1073

1563

# Create an alternate D-Bus interface name based on

1074

1564

# the current name

1075

alt_interface = (attribute._dbus_interface

1076

.replace(orig_interface_name,

1077

alt_interface_name))

1565

alt_interface = attribute._dbus_interface.replace(

1566

orig_interface_name, alt_interface_name)

1078

1567

interface_names.add(alt_interface)

1079

1568

# Is this a D-Bus signal?

1080

1569

if getattr(attribute, "_dbus_is_signal", False):

1081

1570

# Extract the original non-method undecorated

1082

1571

# function by black magic

1083

nonmethod_func = (dict(

1572

if sys.version_info.major == 2:

1573

nonmethod_func = (dict(

1084

1574

zip(attribute.func_code.co_freevars,

1085

attribute.__closure__))["func"]

1086

.cell_contents)

1575

attribute.__closure__))

1576

["func"].cell_contents)

1577

else:

1578

nonmethod_func = (dict(

1579

zip(attribute.__code__.co_freevars,

1580

attribute.__closure__))

1581

["func"].cell_contents)

1087

1582

# Create a new, but exactly alike, function

1088

1583

# object, and decorate it to be a new D-Bus signal

1089

1584

# with the alternate D-Bus interface name

1090

new_function = (dbus.service.signal

1091

(alt_interface,

1092

attribute._dbus_signature)

1093

(types.FunctionType(

1094

nonmethod_func.func_code,

1095

nonmethod_func.func_globals,

1096

nonmethod_func.func_name,

1097

nonmethod_func.func_defaults,

1098

nonmethod_func.func_closure)))

1585

new_function = copy_function(nonmethod_func)

1586

new_function = (dbus.service.signal(

1587

alt_interface,

1588

attribute._dbus_signature)(new_function))

1099

1589

# Copy annotations, if any

1100

1590

try:

1101

new_function._dbus_annotations = (

1102

dict(attribute._dbus_annotations))

1591

new_function._dbus_annotations = dict(

1592

attribute._dbus_annotations)

1103

1593

except AttributeError:

1104

1594

pass

1105

1595

# Define a creator of a function to call both the

1110

1600

"""This function is a scope container to pass

1111

1601

func1 and func2 to the "call_both" function

1112

1602

outside of its arguments"""

1603

1604

@functools.wraps(func2)

1113

1605

def call_both(*args, **kwargs):

1114

1606

"""This function will emit two D-Bus

1115

1607

signals by calling func1 and func2"""

1116

1608

func1(*args, **kwargs)

1117

1609

func2(*args, **kwargs)

1610

# Make wrapper function look like a D-Bus signal

1611

for name, attr in inspect.getmembers(func2):

1612

if name.startswith("_dbus_"):

1613

setattr(call_both, name, attr)

1614

1118

1615

return call_both

1119

1616

# Create the "call_both" function and add it to

1120

1617

# the class

1125

1622

# object. Decorate it to be a new D-Bus method

1126

1623

# with the alternate D-Bus interface name. Add it

1127

1624

# to the class.

1128

attr[attrname] = (dbus.service.method

1129

(alt_interface,

1130

attribute._dbus_in_signature,

1131

attribute._dbus_out_signature)

1132

(types.FunctionType

1133

(attribute.func_code,

1134

attribute.func_globals,

1135

attribute.func_name,

1136

attribute.func_defaults,

1137

attribute.func_closure)))

1625

attr[attrname] = (

1626

dbus.service.method(

1627

alt_interface,

1628

attribute._dbus_in_signature,

1629

attribute._dbus_out_signature)

1630

(copy_function(attribute)))

1138

1631

# Copy annotations, if any

1139

1632

try:

1140

attr[attrname]._dbus_annotations = (

1141

dict(attribute._dbus_annotations))

1633

attr[attrname]._dbus_annotations = dict(

1634

attribute._dbus_annotations)

1142

1635

except AttributeError:

1143

1636

pass

1144

1637

# Is this a D-Bus property?

1147

1640

# object, and decorate it to be a new D-Bus

1148

1641

# property with the alternate D-Bus interface

1149

1642

# name. Add it to the class.

1150

attr[attrname] = (dbus_service_property

1151

(alt_interface,

1152

attribute._dbus_signature,

1153

attribute._dbus_access,

1154

attribute

1155

._dbus_get_args_options

1156

["byte_arrays"])

1157

(types.FunctionType

1158

(attribute.func_code,

1159

attribute.func_globals,

1160

attribute.func_name,

1161

attribute.func_defaults,

1162

attribute.func_closure)))

1643

attr[attrname] = (dbus_service_property(

1644

alt_interface, attribute._dbus_signature,

1645

attribute._dbus_access,

1646

attribute._dbus_get_args_options

1647

["byte_arrays"])

1648

(copy_function(attribute)))

1163

1649

# Copy annotations, if any

1164

1650

try:

1165

attr[attrname]._dbus_annotations = (

1166

dict(attribute._dbus_annotations))

1651

attr[attrname]._dbus_annotations = dict(

1652

attribute._dbus_annotations)

1167

1653

except AttributeError:

1168

1654

pass

1169

1655

# Is this a D-Bus interface?

1172

1658

# object. Decorate it to be a new D-Bus interface

1173

1659

# with the alternate D-Bus interface name. Add it

1174

1660

# to the class.

1175

attr[attrname] = (dbus_interface_annotations

1176

(alt_interface)

1177

(types.FunctionType

1178

(attribute.func_code,

1179

attribute.func_globals,

1180

attribute.func_name,

1181

attribute.func_defaults,

1182

attribute.func_closure)))

1661

attr[attrname] = (

1662

dbus_interface_annotations(alt_interface)

1663

(copy_function(attribute)))

1183

1664

if deprecate:

1184

1665

# Deprecate all alternate interfaces

1185

1666

iname="_AlternateDBusNames_interface_annotation{}"

1186

1667

for interface_name in interface_names:

1668

1187

1669

@dbus_interface_annotations(interface_name)

1188

1670

def func(self):

1189

1671

return { "org.freedesktop.DBus.Deprecated":

1190

"true" }

1672

"true" }

1191

1673

# Find an unused name

1192

1674

for aname in (iname.format(i)

1193

1675

for i in itertools.count()):

1197

1679

if interface_names:

1198

1680

# Replace the class with a new subclass of it with

1199

1681

# methods, signals, etc. as created above.

1200

cls = type(b"{}Alternate".format(cls.__name__),

1201

(cls,), attr)

1682

if sys.version_info.major == 2:

1683

cls = type(b"{}Alternate".format(cls.__name__),

1684

(cls, ), attr)

1685

else:

1686

cls = type("{}Alternate".format(cls.__name__),

1687

(cls, ), attr)

1202

1688

return cls

1689

1203

1690

return wrapper

1204

1691

1205

1692

1206

1693

@alternate_dbus_interfaces({"se.recompile.Mandos":

1207

"se.bsnet.fukt.Mandos"})

1694

"se.bsnet.fukt.Mandos"})

1208

1695

class ClientDBus(Client, DBusObjectWithProperties):

1209

1696

"""A Client class using D-Bus

1210

1697

1214

1701

"""

1215

1702

1216

1703

runtime_expansions = (Client.runtime_expansions

1217

+ ("dbus_object_path",))

1704

+ ("dbus_object_path", ))

1705

1706

_interface = "se.recompile.Mandos.Client"

1218

1707

1219

1708

# dbus.service.Object doesn't use super(), so we can't either.

1220

1709

1223

1712

Client.__init__(self, *args, **kwargs)

1224

1713

# Only now, when this client is initialized, can it show up on

1225

1714

# the D-Bus

1226

client_object_name = unicode(self.name).translate(

1715

client_object_name = str(self.name).translate(

1227

1716

{ord("."): ord("_"),

1228

1717

ord("-"): ord("_")})

1229

self.dbus_object_path = (dbus.ObjectPath

1230

("/clients/" + client_object_name))

1718

self.dbus_object_path = dbus.ObjectPath(

1719

"/clients/" + client_object_name)

1231

1720

DBusObjectWithProperties.__init__(self, self.bus,

1232

1721

self.dbus_object_path)

1233

1722

1234

def notifychangeproperty(transform_func,

1235

dbus_name, type_func=lambda x: x,

1236

variant_level=1):

1723

def notifychangeproperty(transform_func, dbus_name,

1724

type_func=lambda x: x,

1725

variant_level=1,

1726

invalidate_only=False,

1727

_interface=_interface):

1237

1728

""" Modify a variable so that it's a property which announces

1238

1729

its changes to DBus.

1239

1730

1245

1736

variant_level: D-Bus variant level. Default: 1

1246

1737

"""

1247

1738

attrname = "_{}".format(dbus_name)

1739

1248

1740

def setter(self, value):

1249

1741

if hasattr(self, "dbus_object_path"):

1250

1742

if (not hasattr(self, attrname) or

1251

1743

type_func(getattr(self, attrname, None))

1252

1744

!= type_func(value)):

1253

dbus_value = transform_func(type_func(value),

1254

variant_level

1255

=variant_level)

1256

self.PropertyChanged(dbus.String(dbus_name),

1257

dbus_value)

1745

if invalidate_only:

1746

self.PropertiesChanged(

1747

_interface, dbus.Dictionary(),

1748

dbus.Array((dbus_name, )))

1749

else:

1750

dbus_value = transform_func(

1751

type_func(value),

1752

variant_level = variant_level)

1753

self.PropertyChanged(dbus.String(dbus_name),

1754

dbus_value)

1755

self.PropertiesChanged(

1756

_interface,

1757

dbus.Dictionary({ dbus.String(dbus_name):

1758

dbus_value }),

1759

dbus.Array())

1258

1760

setattr(self, attrname, value)

1259

1761

1260

1762

return property(lambda self: getattr(self, attrname), setter)

1266

1768

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1267

1769

last_enabled = notifychangeproperty(datetime_to_dbus,

1268

1770

"LastEnabled")

1269

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1270

type_func = lambda checker:

1271

checker is not None)

1771

checker = notifychangeproperty(

1772

dbus.Boolean, "CheckerRunning",

1773

type_func = lambda checker: checker is not None)

1272

1774

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1273

1775

"LastCheckedOK")

1274

1776

last_checker_status = notifychangeproperty(dbus.Int16,

1277

1779

datetime_to_dbus, "LastApprovalRequest")

1278

1780

approved_by_default = notifychangeproperty(dbus.Boolean,

1279

1781

"ApprovedByDefault")

1280

approval_delay = notifychangeproperty(dbus.UInt64,

1281

"ApprovalDelay",

1282

type_func =

1283

lambda td: td.total_seconds()

1284

* 1000)

1782

approval_delay = notifychangeproperty(

1783

dbus.UInt64, "ApprovalDelay",

1784

type_func = lambda td: td.total_seconds() * 1000)

1285

1785

approval_duration = notifychangeproperty(

1286

1786

dbus.UInt64, "ApprovalDuration",

1287

1787

type_func = lambda td: td.total_seconds() * 1000)

1288

1788

host = notifychangeproperty(dbus.String, "Host")

1289

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1290

type_func = lambda td:

1291

td.total_seconds() * 1000)

1789

timeout = notifychangeproperty(

1790

dbus.UInt64, "Timeout",

1791

type_func = lambda td: td.total_seconds() * 1000)

1292

1792

extended_timeout = notifychangeproperty(

1293

1793

dbus.UInt64, "ExtendedTimeout",

1294

1794

type_func = lambda td: td.total_seconds() * 1000)

1295

interval = notifychangeproperty(dbus.UInt64,

1296

"Interval",

1297

type_func =

1298

lambda td: td.total_seconds()

1299

* 1000)

1795

interval = notifychangeproperty(

1796

dbus.UInt64, "Interval",

1797

type_func = lambda td: td.total_seconds() * 1000)

1300

1798

checker_command = notifychangeproperty(dbus.String, "Checker")

1799

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1800

invalidate_only=True)

1301

1801

1302

1802

del notifychangeproperty

1303

1803

1310

1810

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1311

1811

Client.__del__(self, *args, **kwargs)

1312

1812

1313

def checker_callback(self, pid, condition, command,

1314

*args, **kwargs):

1315

self.checker_callback_tag = None

1316

self.checker = None

1317

if os.WIFEXITED(condition):

1318

exitstatus = os.WEXITSTATUS(condition)

1813

def checker_callback(self, source, condition,

1814

connection, command, *args, **kwargs):

1815

ret = Client.checker_callback(self, source, condition,

1816

connection, command, *args,

1817

**kwargs)

1818

exitstatus = self.last_checker_status

1819

if exitstatus >= 0:

1319

1820

# Emit D-Bus signal

1320

1821

self.CheckerCompleted(dbus.Int16(exitstatus),

1321

dbus.Int64(condition),

1822

# This is specific to GNU libC

1823

dbus.Int64(exitstatus << 8),

1322

1824

dbus.String(command))

1323

1825

else:

1324

1826

# Emit D-Bus signal

1325

1827

self.CheckerCompleted(dbus.Int16(-1),

1326

dbus.Int64(condition),

1828

dbus.Int64(

1829

# This is specific to GNU libC

1830

(exitstatus << 8)

1831

| self.last_checker_signal),

1327

1832

dbus.String(command))

1328

1329

return Client.checker_callback(self, pid, condition, command,

1330

*args, **kwargs)

1833

return ret

1331

1834

1332

1835

def start_checker(self, *args, **kwargs):

1333

1836

old_checker_pid = getattr(self.checker, "pid", None)

1345

1848

1346

1849

def approve(self, value=True):

1347

1850

self.approved = value

1348

gobject.timeout_add(int(self.approval_duration.total_seconds()

1349

* 1000), self._reset_approved)

1851

GLib.timeout_add(int(self.approval_duration.total_seconds()

1852

* 1000), self._reset_approved)

1350

1853

self.send_changedstate()

1351

1854

1352

1855

## D-Bus methods, signals & properties

1353

_interface = "se.recompile.Mandos.Client"

1354

1856

1355

1857

## Interfaces

1356

1858

1357

@dbus_interface_annotations(_interface)

1358

def _foo(self):

1359

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1360

"false"}

1361

1362

1859

## Signals

1363

1860

1364

1861

# CheckerCompleted - signal

1374

1871

pass

1375

1872

1376

1873

# PropertyChanged - signal

1874

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1377

1875

@dbus.service.signal(_interface, signature="sv")

1378

1876

def PropertyChanged(self, property, value):

1379

1877

"D-Bus signal"

1413

1911

self.checked_ok()

1414

1912

1415

1913

# Enable - method

1914

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1416

1915

@dbus.service.method(_interface)

1417

1916

def Enable(self):

1418

1917

"D-Bus method"

1419

1918

self.enable()

1420

1919

1421

1920

# StartChecker - method

1921

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1422

1922

@dbus.service.method(_interface)

1423

1923

def StartChecker(self):

1424

1924

"D-Bus method"

1425

1925

self.start_checker()

1426

1926

1427

1927

# Disable - method

1928

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1428

1929

@dbus.service.method(_interface)

1429

1930

def Disable(self):

1430

1931

"D-Bus method"

1431

1932

self.disable()

1432

1933

1433

1934

# StopChecker - method

1935

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1434

1936

@dbus.service.method(_interface)

1435

1937

def StopChecker(self):

1436

1938

self.stop_checker()

1443

1945

return dbus.Boolean(bool(self.approvals_pending))

1444

1946

1445

1947

# ApprovedByDefault - property

1446

@dbus_service_property(_interface, signature="b",

1948

@dbus_service_property(_interface,

1949

signature="b",

1447

1950

access="readwrite")

1448

1951

def ApprovedByDefault_dbus_property(self, value=None):

1449

1952

if value is None: # get

1451

1954

self.approved_by_default = bool(value)

1452

1955

1453

1956

# ApprovalDelay - property

1454

@dbus_service_property(_interface, signature="t",

1957

@dbus_service_property(_interface,

1958

signature="t",

1455

1959

access="readwrite")

1456

1960

def ApprovalDelay_dbus_property(self, value=None):

1457

1961

if value is None: # get

1460

1964

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1461

1965

1462

1966

# ApprovalDuration - property

1463

@dbus_service_property(_interface, signature="t",

1967

@dbus_service_property(_interface,

1968

signature="t",

1464

1969

access="readwrite")

1465

1970

def ApprovalDuration_dbus_property(self, value=None):

1466

1971

if value is None: # get

1469

1974

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1470

1975

1471

1976

# Name - property

1977

@dbus_annotations(

1978

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1472

1979

@dbus_service_property(_interface, signature="s", access="read")

1473

1980

def Name_dbus_property(self):

1474

1981

return dbus.String(self.name)

1475

1982

1476

1983

# Fingerprint - property

1984

@dbus_annotations(

1985

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1477

1986

@dbus_service_property(_interface, signature="s", access="read")

1478

1987

def Fingerprint_dbus_property(self):

1479

1988

return dbus.String(self.fingerprint)

1480

1989

1481

1990

# Host - property

1482

@dbus_service_property(_interface, signature="s",

1991

@dbus_service_property(_interface,

1992

signature="s",

1483

1993

access="readwrite")

1484

1994

def Host_dbus_property(self, value=None):

1485

1995

if value is None: # get

1486

1996

return dbus.String(self.host)

1487

self.host = unicode(value)

1997

self.host = str(value)

1488

1998

1489

1999

# Created - property

2000

@dbus_annotations(

2001

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1490

2002

@dbus_service_property(_interface, signature="s", access="read")

1491

2003

def Created_dbus_property(self):

1492

2004

return datetime_to_dbus(self.created)

1497

2009

return datetime_to_dbus(self.last_enabled)

1498

2010

1499

2011

# Enabled - property

1500

@dbus_service_property(_interface, signature="b",

2012

@dbus_service_property(_interface,

2013

signature="b",

1501

2014

access="readwrite")

1502

2015

def Enabled_dbus_property(self, value=None):

1503

2016

if value is None: # get

1508

2021

self.disable()

1509

2022

1510

2023

# LastCheckedOK - property

1511

@dbus_service_property(_interface, signature="s",

2024

@dbus_service_property(_interface,

2025

signature="s",

1512

2026

access="readwrite")

1513

2027

def LastCheckedOK_dbus_property(self, value=None):

1514

2028

if value is not None:

1517

2031

return datetime_to_dbus(self.last_checked_ok)

1518

2032

1519

2033

# LastCheckerStatus - property

1520

@dbus_service_property(_interface, signature="n",

1521

access="read")

2034

@dbus_service_property(_interface, signature="n", access="read")

1522

2035

def LastCheckerStatus_dbus_property(self):

1523

2036

return dbus.Int16(self.last_checker_status)

1524

2037

1533

2046

return datetime_to_dbus(self.last_approval_request)

1534

2047

1535

2048

# Timeout - property

1536

@dbus_service_property(_interface, signature="t",

2049

@dbus_service_property(_interface,

2050

signature="t",

1537

2051

access="readwrite")

1538

2052

def Timeout_dbus_property(self, value=None):

1539

2053

if value is None: # get

1551

2065

if (getattr(self, "disable_initiator_tag", None)

1552

2066

is None):

1553

2067

return

1554

gobject.source_remove(self.disable_initiator_tag)

1555

self.disable_initiator_tag = (

1556

gobject.timeout_add(

1557

int((self.expires - now).total_seconds()

1558

* 1000), self.disable))

2068

GLib.source_remove(self.disable_initiator_tag)

2069

self.disable_initiator_tag = GLib.timeout_add(

2070

int((self.expires - now).total_seconds() * 1000),

2071

self.disable)

1559

2072

1560

2073

# ExtendedTimeout - property

1561

@dbus_service_property(_interface, signature="t",

2074

@dbus_service_property(_interface,

2075

signature="t",

1562

2076

access="readwrite")

1563

2077

def ExtendedTimeout_dbus_property(self, value=None):

1564

2078

if value is None: # get

1567

2081

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1568

2082

1569

2083

# Interval - property

1570

@dbus_service_property(_interface, signature="t",

2084

@dbus_service_property(_interface,

2085

signature="t",

1571

2086

access="readwrite")

1572

2087

def Interval_dbus_property(self, value=None):

1573

2088

if value is None: # get

1577

2092

return

1578

2093

if self.enabled:

1579

2094

# Reschedule checker run

1580

gobject.source_remove(self.checker_initiator_tag)

1581

self.checker_initiator_tag = (gobject.timeout_add

1582

(value, self.start_checker))

1583

self.start_checker() # Start one now, too

2095

GLib.source_remove(self.checker_initiator_tag)

2096

self.checker_initiator_tag = GLib.timeout_add(

2097

value, self.start_checker)

2098

self.start_checker() # Start one now, too

1584

2099

1585

2100

# Checker - property

1586

@dbus_service_property(_interface, signature="s",

2101

@dbus_service_property(_interface,

2102

signature="s",

1587

2103

access="readwrite")

1588

2104

def Checker_dbus_property(self, value=None):

1589

2105

if value is None: # get

1590

2106

return dbus.String(self.checker_command)

1591

self.checker_command = unicode(value)

2107

self.checker_command = str(value)

1592

2108

1593

2109

# CheckerRunning - property

1594

@dbus_service_property(_interface, signature="b",

2110

@dbus_service_property(_interface,

2111

signature="b",

1595

2112

access="readwrite")

1596

2113

def CheckerRunning_dbus_property(self, value=None):

1597

2114

if value is None: # get

1602

2119

self.stop_checker()

1603

2120

1604

2121

# ObjectPath - property

2122

@dbus_annotations(

2123

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2124

"org.freedesktop.DBus.Deprecated": "true"})

1605

2125

@dbus_service_property(_interface, signature="o", access="read")

1606

2126

def ObjectPath_dbus_property(self):

1607

2127

return self.dbus_object_path # is already a dbus.ObjectPath

1608

2128

1609

2129

# Secret = property

1610

@dbus_service_property(_interface, signature="ay",

1611

access="write", byte_arrays=True)

2130

@dbus_annotations(

2131

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2132

"invalidates"})

2133

@dbus_service_property(_interface,

2134

signature="ay",

2135

access="write",

2136

byte_arrays=True)

1612

2137

def Secret_dbus_property(self, value):

1613

2138

self.secret = bytes(value)

1614

2139

1620

2145

self._pipe = child_pipe

1621

2146

self._pipe.send(('init', fpr, address))

1622

2147

if not self._pipe.recv():

1623

raise KeyError()

2148

raise KeyError(fpr)

1624

2149

1625

2150

def __getattribute__(self, name):

1626

2151

if name == '_pipe':

1630

2155

if data[0] == 'data':

1631

2156

return data[1]

1632

2157

if data[0] == 'function':

2158

1633

2159

def func(*args, **kwargs):

1634

2160

self._pipe.send(('funcall', name, args, kwargs))

1635

2161

return self._pipe.recv()[1]

2162

1636

2163

return func

1637

2164

1638

2165

def __setattr__(self, name, value):

1650

2177

def handle(self):

1651

2178

with contextlib.closing(self.server.child_pipe) as child_pipe:

1652

2179

logger.info("TCP connection from: %s",

1653

unicode(self.client_address))

2180

str(self.client_address))

1654

2181

logger.debug("Pipe FD: %d",

1655

2182

self.server.child_pipe.fileno())

1656

2183

1657

session = (gnutls.connection

1658

.ClientSession(self.request,

1659

gnutls.connection

1660

.X509Credentials()))

1661

1662

# Note: gnutls.connection.X509Credentials is really a

1663

# generic GnuTLS certificate credentials object so long as

1664

# no X.509 keys are added to it. Therefore, we can use it

1665

# here despite using OpenPGP certificates.

2184

session = gnutls.ClientSession(self.request)

1666

2185

1667

2186

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1668

2187

# "+AES-256-CBC", "+SHA1",

1672

2191

priority = self.server.gnutls_priority

1673

2192

if priority is None:

1674

2193

priority = "NORMAL"

1675

(gnutls.library.functions

1676

.gnutls_priority_set_direct(session._c_object,

1677

priority, None))

2194

gnutls.priority_set_direct(session._c_object,

2195

priority.encode("utf-8"),

2196

None)

1678

2197

1679

2198

# Start communication using the Mandos protocol

1680

2199

# Get protocol number

1690

2209

# Start GnuTLS connection

1691

2210

try:

1692

2211

session.handshake()

1693

except gnutls.errors.GNUTLSError as error:

2212

except gnutls.Error as error:

1694

2213

logger.warning("Handshake failed: %s", error)

1695

2214

# Do not run session.bye() here: the session is not

1696

2215

# established. Just abandon the request.

1700

2219

approval_required = False

1701

2220

try:

1702

2221

try:

1703

fpr = self.fingerprint(self.peer_certificate

1704

(session))

1705

except (TypeError,

1706

gnutls.errors.GNUTLSError) as error:

2222

fpr = self.fingerprint(

2223

self.peer_certificate(session))

2224

except (TypeError, gnutls.Error) as error:

1707

2225

logger.warning("Bad certificate: %s", error)

1708

2226

return

1709

2227

logger.debug("Fingerprint: %s", fpr)

1722

2240

while True:

1723

2241

if not client.enabled:

1724

2242

logger.info("Client %s is disabled",

1725

client.name)

2243

client.name)

1726

2244

if self.server.use_dbus:

1727

2245

# Emit D-Bus signal

1728

2246

client.Rejected("Disabled")

1767

2285

else:

1768

2286

delay -= time2 - time

1769

2287

1770

sent_size = 0

1771

while sent_size < len(client.secret):

1772

try:

1773

sent = session.send(client.secret[sent_size:])

1774

except gnutls.errors.GNUTLSError as error:

1775

logger.warning("gnutls send failed",

1776

exc_info=error)

1777

return

1778

logger.debug("Sent: %d, remaining: %d",

1779

sent, len(client.secret)

1780

- (sent_size + sent))

1781

sent_size += sent

2288

try:

2289

session.send(client.secret)

2290

except gnutls.Error as error:

2291

logger.warning("gnutls send failed",

2292

exc_info = error)

2293

return

1782

2294

1783

2295

logger.info("Sending secret to %s", client.name)

1784

2296

# bump the timeout using extended_timeout

1792

2304

client.approvals_pending -= 1

1793

2305

try:

1794

2306

session.bye()

1795

except gnutls.errors.GNUTLSError as error:

2307

except gnutls.Error as error:

1796

2308

logger.warning("GnuTLS bye failed",

1797

2309

exc_info=error)

1798

2310

1800

2312

def peer_certificate(session):

1801

2313

"Return the peer's OpenPGP certificate as a bytestring"

1802

2314

# If not an OpenPGP certificate...

1803

if (gnutls.library.functions

1804

.gnutls_certificate_type_get(session._c_object)

1805

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1806

# ...do the normal thing

1807

return session.peer_certificate

2315

if (gnutls.certificate_type_get(session._c_object)

2316

!= gnutls.CRT_OPENPGP):

2317

# ...return invalid data

2318

return b""

1808

2319

list_size = ctypes.c_uint(1)

1809

cert_list = (gnutls.library.functions

1810

.gnutls_certificate_get_peers

2320

cert_list = (gnutls.certificate_get_peers

1811

2321

(session._c_object, ctypes.byref(list_size)))

1812

2322

if not bool(cert_list) and list_size.value != 0:

1813

raise gnutls.errors.GNUTLSError("error getting peer"

1814

" certificate")

2323

raise gnutls.Error("error getting peer certificate")

1815

2324

if list_size.value == 0:

1816

2325

return None

1817

2326

cert = cert_list[0]

1821

2330

def fingerprint(openpgp):

1822

2331

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1823

2332

# New GnuTLS "datum" with the OpenPGP public key

1824

datum = (gnutls.library.types

1825

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1826

ctypes.POINTER

1827

(ctypes.c_ubyte)),

1828

ctypes.c_uint(len(openpgp))))

2333

datum = gnutls.datum_t(

2334

ctypes.cast(ctypes.c_char_p(openpgp),

2335

ctypes.POINTER(ctypes.c_ubyte)),

2336

ctypes.c_uint(len(openpgp)))

1829

2337

# New empty GnuTLS certificate

1830

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1831

(gnutls.library.functions

1832

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2338

crt = gnutls.openpgp_crt_t()

2339

gnutls.openpgp_crt_init(ctypes.byref(crt))

1833

2340

# Import the OpenPGP public key into the certificate

1834

(gnutls.library.functions

1835

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1836

gnutls.library.constants

1837

.GNUTLS_OPENPGP_FMT_RAW))

2341

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2342

gnutls.OPENPGP_FMT_RAW)

1838

2343

# Verify the self signature in the key

1839

2344

crtverify = ctypes.c_uint()

1840

(gnutls.library.functions

1841

.gnutls_openpgp_crt_verify_self(crt, 0,

1842

ctypes.byref(crtverify)))

2345

gnutls.openpgp_crt_verify_self(crt, 0,

2346

ctypes.byref(crtverify))

1843

2347

if crtverify.value != 0:

1844

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1845

raise (gnutls.errors.CertificateSecurityError

1846

("Verify failed"))

2348

gnutls.openpgp_crt_deinit(crt)

2349

raise gnutls.CertificateSecurityError("Verify failed")

1847

2350

# New buffer for the fingerprint

1848

2351

buf = ctypes.create_string_buffer(20)

1849

2352

buf_len = ctypes.c_size_t()

1850

2353

# Get the fingerprint from the certificate into the buffer

1851

(gnutls.library.functions

1852

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1853

ctypes.byref(buf_len)))

2354

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2355

ctypes.byref(buf_len))

1854

2356

# Deinit the certificate

1855

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2357

gnutls.openpgp_crt_deinit(crt)

1856

2358

# Convert the buffer to a Python bytestring

1857

2359

fpr = ctypes.string_at(buf, buf_len.value)

1858

2360

# Convert the bytestring to hexadecimal notation

1862

2364

1863

2365

class MultiprocessingMixIn(object):

1864

2366

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2367

1865

2368

def sub_process_main(self, request, address):

1866

2369

try:

1867

2370

self.finish_request(request, address)

1879

2382

1880

2383

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1881

2384

""" adds a pipe to the MixIn """

2385

1882

2386

def process_request(self, request, client_address):

1883

2387

"""Overrides and wraps the original process_request().

1884

2388

1905

2409

interface: None or a network interface name (string)

1906

2410

use_ipv6: Boolean; to use IPv6 or not

1907

2411

"""

2412

1908

2413

def __init__(self, server_address, RequestHandlerClass,

1909

interface=None, use_ipv6=True, socketfd=None):

2414

interface=None,

2415

use_ipv6=True,

2416

socketfd=None):

1910

2417

"""If socketfd is set, use that file descriptor instead of

1911

2418

creating a new one with socket.socket().

1912

2419

"""

1946

2453

"""This overrides the normal server_bind() function

1947

2454

to bind to an interface if one was specified, and also NOT to

1948

2455

bind to an address or port if they were not specified."""

2456

global SO_BINDTODEVICE

1949

2457

if self.interface is not None:

1950

2458

if SO_BINDTODEVICE is None:

1951

logger.error("SO_BINDTODEVICE does not exist;"

1952

" cannot bind to interface %s",

1953

self.interface)

1954

else:

1955

try:

1956

self.socket.setsockopt(socket.SOL_SOCKET,

1957

SO_BINDTODEVICE,

1958

(self.interface + "\0")

1959

.encode("utf-8"))

1960

except socket.error as error:

1961

if error.errno == errno.EPERM:

1962

logger.error("No permission to bind to"

1963

" interface %s", self.interface)

1964

elif error.errno == errno.ENOPROTOOPT:

1965

logger.error("SO_BINDTODEVICE not available;"

1966

" cannot bind to interface %s",

1967

self.interface)

1968

elif error.errno == errno.ENODEV:

1969

logger.error("Interface %s does not exist,"

1970

" cannot bind", self.interface)

1971

else:

1972

raise

2459

# Fall back to a hard-coded value which seems to be

2460

# common enough.

2461

logger.warning("SO_BINDTODEVICE not found, trying 25")

2462

SO_BINDTODEVICE = 25

2463

try:

2464

self.socket.setsockopt(

2465

socket.SOL_SOCKET, SO_BINDTODEVICE,

2466

(self.interface + "\0").encode("utf-8"))

2467

except socket.error as error:

2468

if error.errno == errno.EPERM:

2469

logger.error("No permission to bind to"

2470

" interface %s", self.interface)

2471

elif error.errno == errno.ENOPROTOOPT:

2472

logger.error("SO_BINDTODEVICE not available;"

2473

" cannot bind to interface %s",

2474

self.interface)

2475

elif error.errno == errno.ENODEV:

2476

logger.error("Interface %s does not exist,"

2477

" cannot bind", self.interface)

2478

else:

2479

raise

1973

2480

# Only bind(2) the socket if we really need to.

1974

2481

if self.server_address[0] or self.server_address[1]:

1975

2482

if not self.server_address[0]:

1980

2487

self.server_address = (any_address,

1981

2488

self.server_address[1])

1982

2489

elif not self.server_address[1]:

1983

self.server_address = (self.server_address[0],

1984

0)

2490

self.server_address = (self.server_address[0], 0)

1985

2491

# if self.interface:

1986

2492

# self.server_address = (self.server_address[0],

1987

2493

# 0, # port

1999

2505

gnutls_priority GnuTLS priority string

2000

2506

use_dbus: Boolean; to emit D-Bus signals or not

2001

2507

2002

Assumes a gobject.MainLoop event loop.

2508

Assumes a GLib.MainLoop event loop.

2003

2509

"""

2510

2004

2511

def __init__(self, server_address, RequestHandlerClass,

2005

interface=None, use_ipv6=True, clients=None,

2006

gnutls_priority=None, use_dbus=True, socketfd=None):

2512

interface=None,

2513

use_ipv6=True,

2514

clients=None,

2515

gnutls_priority=None,

2516

use_dbus=True,

2517

socketfd=None):

2007

2518

self.enabled = False

2008

2519

self.clients = clients

2009

2520

if self.clients is None:

2015

2526

interface = interface,

2016

2527

use_ipv6 = use_ipv6,

2017

2528

socketfd = socketfd)

2529

2018

2530

def server_activate(self):

2019

2531

if self.enabled:

2020

2532

return socketserver.TCPServer.server_activate(self)

2024

2536

2025

2537

def add_pipe(self, parent_pipe, proc):

2026

2538

# Call "handle_ipc" for both data and EOF events

2027

gobject.io_add_watch(parent_pipe.fileno(),

2028

gobject.IO_IN | gobject.IO_HUP,

2029

functools.partial(self.handle_ipc,

2030

parent_pipe =

2031

parent_pipe,

2032

proc = proc))

2539

GLib.io_add_watch(

2540

parent_pipe.fileno(),

2541

GLib.IO_IN | GLib.IO_HUP,

2542

functools.partial(self.handle_ipc,

2543

parent_pipe = parent_pipe,

2544

proc = proc))

2033

2545

2034

def handle_ipc(self, source, condition, parent_pipe=None,

2035

proc = None, client_object=None):

2546

def handle_ipc(self, source, condition,

2547

parent_pipe=None,

2548

proc = None,

2549

client_object=None):

2036

2550

# error, or the other end of multiprocessing.Pipe has closed

2037

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2551

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2038

2552

# Wait for other process to exit

2039

2553

proc.join()

2040

2554

return False

2047

2561

fpr = request[1]

2048

2562

address = request[2]

2049

2563

2050

for c in self.clients.itervalues():

2564

for c in self.clients.values():

2051

2565

if c.fingerprint == fpr:

2052

2566

client = c

2053

2567

break

2061

2575

parent_pipe.send(False)

2062

2576

return False

2063

2577

2064

gobject.io_add_watch(parent_pipe.fileno(),

2065

gobject.IO_IN | gobject.IO_HUP,

2066

functools.partial(self.handle_ipc,

2067

parent_pipe =

2068

parent_pipe,

2069

proc = proc,

2070

client_object =

2071

client))

2578

GLib.io_add_watch(

2579

parent_pipe.fileno(),

2580

GLib.IO_IN | GLib.IO_HUP,

2581

functools.partial(self.handle_ipc,

2582

parent_pipe = parent_pipe,

2583

proc = proc,

2584

client_object = client))

2072

2585

parent_pipe.send(True)

2073

2586

# remove the old hook in favor of the new above hook on

2074

2587

# same fileno

2080

2593

2081

2594

parent_pipe.send(('data', getattr(client_object,

2082

2595

funcname)(*args,

2083

**kwargs)))

2596

**kwargs)))

2084

2597

2085

2598

if command == 'getattr':

2086

2599

attrname = request[1]

2087

if callable(client_object.__getattribute__(attrname)):

2088

parent_pipe.send(('function',))

2600

if isinstance(client_object.__getattribute__(attrname),

2601

collections.Callable):

2602

parent_pipe.send(('function', ))

2089

2603

else:

2090

parent_pipe.send(('data', client_object

2091

.__getattribute__(attrname)))

2604

parent_pipe.send((

2605

'data', client_object.__getattribute__(attrname)))

2092

2606

2093

2607

if command == 'setattr':

2094

2608

attrname = request[1]

2125

2639

# avoid excessive use of external libraries.

2126

2640

2127

2641

# New type for defining tokens, syntax, and semantics all-in-one

2128

Token = collections.namedtuple("Token",

2129

("regexp", # To match token; if

2130

# "value" is not None,

2131

# must have a "group"

2132

# containing digits

2133

"value", # datetime.timedelta or

2134

# None

2135

"followers")) # Tokens valid after

2136

# this token

2642

Token = collections.namedtuple("Token", (

2643

"regexp", # To match token; if "value" is not None, must have

2644

# a "group" containing digits

2645

"value", # datetime.timedelta or None

2646

"followers")) # Tokens valid after this token

2137

2647

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2138

2648

# the "duration" ABNF definition in RFC 3339, Appendix A.

2139

2649

token_end = Token(re.compile(r"$"), None, frozenset())

2140

2650

token_second = Token(re.compile(r"(\d+)S"),

2141

2651

datetime.timedelta(seconds=1),

2142

frozenset((token_end,)))

2652

frozenset((token_end, )))

2143

2653

token_minute = Token(re.compile(r"(\d+)M"),

2144

2654

datetime.timedelta(minutes=1),

2145

2655

frozenset((token_second, token_end)))

2161

2671

frozenset((token_month, token_end)))

2162

2672

token_week = Token(re.compile(r"(\d+)W"),

2163

2673

datetime.timedelta(weeks=1),

2164

frozenset((token_end,)))

2674

frozenset((token_end, )))

2165

2675

token_duration = Token(re.compile(r"P"), None,

2166

2676

frozenset((token_year, token_month,

2167

2677

token_day, token_time,

2169

2679

# Define starting values

2170

2680

value = datetime.timedelta() # Value so far

2171

2681

found_token = None

2172

followers = frozenset((token_duration,)) # Following valid tokens

2682

followers = frozenset((token_duration, )) # Following valid tokens

2173

2683

s = duration # String left to parse

2174

2684

# Loop until end token is found

2175

2685

while found_token is not token_end:

2192

2702

break

2193

2703

else:

2194

2704

# No currently valid tokens were found

2195

raise ValueError("Invalid RFC 3339 duration")

2705

raise ValueError("Invalid RFC 3339 duration: {!r}"

2706

.format(duration))

2196

2707

# End token found

2197

2708

return value

2198

2709

2235

2746

elif suffix == "w":

2236

2747

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2237

2748

else:

2238

raise ValueError("Unknown suffix {!r}"

2239

.format(suffix))

2749

raise ValueError("Unknown suffix {!r}".format(suffix))

2240

2750

except IndexError as e:

2241

2751

raise ValueError(*(e.args))

2242

2752

timevalue += delta

2258

2768

# Close all standard open file descriptors

2259

2769

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2260

2770

if not stat.S_ISCHR(os.fstat(null).st_mode):

2261

raise OSError(errno.ENODEV, "{} not a character device"

2771

raise OSError(errno.ENODEV,

2772

"{} not a character device"

2262

2773

.format(os.devnull))

2263

2774

os.dup2(null, sys.stdin.fileno())

2264

2775

os.dup2(null, sys.stdout.fileno())

2330

2841

"port": "",

2331

2842

"debug": "False",

2332

2843

"priority":

2333

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2844

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2845

":+SIGN-DSA-SHA256",

2334

2846

"servicename": "Mandos",

2335

2847

"use_dbus": "True",

2336

2848

"use_ipv6": "True",

2340

2852

"statedir": "/var/lib/mandos",

2341

2853

"foreground": "False",

2342

2854

"zeroconf": "True",

2343

}

2855

}

2344

2856

2345

2857

# Parse config file for server-global settings

2346

2858

server_config = configparser.SafeConfigParser(server_defaults)

2347

2859

del server_defaults

2348

server_config.read(os.path.join(options.configdir,

2349

"mandos.conf"))

2860

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2350

2861

# Convert the SafeConfigParser object to a dict

2351

2862

server_settings = server_config.defaults()

2352

2863

# Use the appropriate methods on the non-string config options

2370

2881

# Override the settings from the config file with command line

2371

2882

# options, if set.

2372

2883

for option in ("interface", "address", "port", "debug",

2373

"priority", "servicename", "configdir",

2374

"use_dbus", "use_ipv6", "debuglevel", "restore",

2375

"statedir", "socket", "foreground", "zeroconf"):

2884

"priority", "servicename", "configdir", "use_dbus",

2885

"use_ipv6", "debuglevel", "restore", "statedir",

2886

"socket", "foreground", "zeroconf"):

2376

2887

value = getattr(options, option)

2377

2888

if value is not None:

2378

2889

server_settings[option] = value

2393

2904

2394

2905

##################################################################

2395

2906

2396

if (not server_settings["zeroconf"] and

2397

not (server_settings["port"]

2398

or server_settings["socket"] != "")):

2399

parser.error("Needs port or socket to work without"

2400

" Zeroconf")

2907

if (not server_settings["zeroconf"]

2908

and not (server_settings["port"]

2909

or server_settings["socket"] != "")):

2910

parser.error("Needs port or socket to work without Zeroconf")

2401

2911

2402

2912

# For convenience

2403

2913

debug = server_settings["debug"]

2419

2929

initlogger(debug, level)

2420

2930

2421

2931

if server_settings["servicename"] != "Mandos":

2422

syslogger.setFormatter(logging.Formatter

2423

('Mandos ({}) [%(process)d]:'

2424

' %(levelname)s: %(message)s'

2425

.format(server_settings

2426

["servicename"])))

2932

syslogger.setFormatter(

2933

logging.Formatter('Mandos ({}) [%(process)d]:'

2934

' %(levelname)s: %(message)s'.format(

2935

server_settings["servicename"])))

2427

2936

2428

2937

# Parse config file with clients

2429

2938

client_config = configparser.SafeConfigParser(Client

2437

2946

socketfd = None

2438

2947

if server_settings["socket"] != "":

2439

2948

socketfd = server_settings["socket"]

2440

tcp_server = MandosServer((server_settings["address"],

2441

server_settings["port"]),

2442

ClientHandler,

2443

interface=(server_settings["interface"]

2444

or None),

2445

use_ipv6=use_ipv6,

2446

gnutls_priority=

2447

server_settings["priority"],

2448

use_dbus=use_dbus,

2449

socketfd=socketfd)

2949

tcp_server = MandosServer(

2950

(server_settings["address"], server_settings["port"]),

2951

ClientHandler,

2952

interface=(server_settings["interface"] or None),

2953

use_ipv6=use_ipv6,

2954

gnutls_priority=server_settings["priority"],

2955

use_dbus=use_dbus,

2956

socketfd=socketfd)

2450

2957

if not foreground:

2451

2958

pidfilename = "/run/mandos.pid"

2452

2959

if not os.path.isdir("/run/."):

2453

2960

pidfilename = "/var/run/mandos.pid"

2454

2961

pidfile = None

2455

2962

try:

2456

pidfile = open(pidfilename, "w")

2963

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2457

2964

except IOError as e:

2458

2965

logger.error("Could not open file %r", pidfilename,

2459

2966

exc_info=e)

2460

2967

2461

for name in ("_mandos", "mandos", "nobody"):

2968

for name, group in (("_mandos", "_mandos"),

2969

("mandos", "mandos"),

2970

("nobody", "nogroup")):

2462

2971

try:

2463

2972

uid = pwd.getpwnam(name).pw_uid

2464

gid = pwd.getpwnam(name).pw_gid

2973

gid = pwd.getpwnam(group).pw_gid

2465

2974

break

2466

2975

except KeyError:

2467

2976

continue

2471

2980

try:

2472

2981

os.setgid(gid)

2473

2982

os.setuid(uid)

2983

if debug:

2984

logger.debug("Did setuid/setgid to {}:{}".format(uid,

2985

gid))

2474

2986

except OSError as error:

2987

logger.warning("Failed to setuid/setgid to {}:{}: {}"

2988

.format(uid, gid, os.strerror(error.errno)))

2475

2989

if error.errno != errno.EPERM:

2476

2990

raise

2477

2991

2480

2994

2481

2995

# "Use a log level over 10 to enable all debugging options."

2482

2996

# - GnuTLS manual

2483

gnutls.library.functions.gnutls_global_set_log_level(11)

2997

gnutls.global_set_log_level(11)

2484

2998

2485

@gnutls.library.types.gnutls_log_func

2999

@gnutls.log_func

2486

3000

def debug_gnutls(level, string):

2487

3001

logger.debug("GnuTLS: %s", string[:-1])

2488

3002

2489

(gnutls.library.functions

2490

.gnutls_global_set_log_function(debug_gnutls))

3003

gnutls.global_set_log_function(debug_gnutls)

2491

3004

2492

3005

# Redirect stdin so all checkers get /dev/null

2493

3006

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2500

3013

# Close all input and output, do double fork, etc.

2501

3014

daemon()

2502

3015

2503

# multiprocessing will use threads, so before we use gobject we

2504

# need to inform gobject that threads will be used.

2505

gobject.threads_init()

3016

# multiprocessing will use threads, so before we use GLib we need

3017

# to inform GLib that threads will be used.

3018

GLib.threads_init()

2506

3019

2507

3020

global main_loop

2508

3021

# From the Avahi example code

2509

3022

DBusGMainLoop(set_as_default=True)

2510

main_loop = gobject.MainLoop()

3023

main_loop = GLib.MainLoop()

2511

3024

bus = dbus.SystemBus()

2512

3025

# End of Avahi example code

2513

3026

if use_dbus:

2514

3027

try:

2515

3028

bus_name = dbus.service.BusName("se.recompile.Mandos",

2516

bus, do_not_queue=True)

2517

old_bus_name = (dbus.service.BusName

2518

("se.bsnet.fukt.Mandos", bus,

2519

do_not_queue=True))

2520

except dbus.exceptions.NameExistsException as e:

3029

bus,

3030

do_not_queue=True)

3031

old_bus_name = dbus.service.BusName(

3032

"se.bsnet.fukt.Mandos", bus,

3033

do_not_queue=True)

3034

except dbus.exceptions.DBusException as e:

2521

3035

logger.error("Disabling D-Bus:", exc_info=e)

2522

3036

use_dbus = False

2523

3037

server_settings["use_dbus"] = False

2524

3038

tcp_server.use_dbus = False

2525

3039

if zeroconf:

2526

3040

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2527

service = AvahiServiceToSyslog(name =

2528

server_settings["servicename"],

2529

servicetype = "_mandos._tcp",

2530

protocol = protocol, bus = bus)

3041

service = AvahiServiceToSyslog(

3042

name = server_settings["servicename"],

3043

servicetype = "_mandos._tcp",

3044

protocol = protocol,

3045

bus = bus)

2531

3046

if server_settings["interface"]:

2532

service.interface = (if_nametoindex

2533

(server_settings["interface"]

2534

.encode("utf-8")))

3047

service.interface = if_nametoindex(

3048

server_settings["interface"].encode("utf-8"))

2535

3049

2536

3050

global multiprocessing_manager

2537

3051

multiprocessing_manager = multiprocessing.Manager()

2556

3070

if server_settings["restore"]:

2557

3071

try:

2558

3072

with open(stored_state_path, "rb") as stored_state:

2559

clients_data, old_client_settings = (pickle.load

2560

(stored_state))

3073

if sys.version_info.major == 2:

3074

clients_data, old_client_settings = pickle.load(

3075

stored_state)

3076

else:

3077

bytes_clients_data, bytes_old_client_settings = (

3078

pickle.load(stored_state, encoding = "bytes"))

3079

### Fix bytes to strings

3080

## clients_data

3081

# .keys()

3082

clients_data = { (key.decode("utf-8")

3083

if isinstance(key, bytes)

3084

else key): value

3085

for key, value in

3086

bytes_clients_data.items() }

3087

del bytes_clients_data

3088

for key in clients_data:

3089

value = { (k.decode("utf-8")

3090

if isinstance(k, bytes) else k): v

3091

for k, v in

3092

clients_data[key].items() }

3093

clients_data[key] = value

3094

# .client_structure

3095

value["client_structure"] = [

3096

(s.decode("utf-8")

3097

if isinstance(s, bytes)

3098

else s) for s in

3099

value["client_structure"] ]

3100

# .name & .host

3101

for k in ("name", "host"):

3102

if isinstance(value[k], bytes):

3103

value[k] = value[k].decode("utf-8")

3104

## old_client_settings

3105

# .keys()

3106

old_client_settings = {

3107

(key.decode("utf-8")

3108

if isinstance(key, bytes)

3109

else key): value

3110

for key, value in

3111

bytes_old_client_settings.items() }

3112

del bytes_old_client_settings

3113

# .host

3114

for value in old_client_settings.values():

3115

if isinstance(value["host"], bytes):

3116

value["host"] = (value["host"]

3117

.decode("utf-8"))

2561

3118

os.remove(stored_state_path)

2562

3119

except IOError as e:

2563

3120

if e.errno == errno.ENOENT:

2564

logger.warning("Could not load persistent state: {}"

2565

.format(os.strerror(e.errno)))

3121

logger.warning("Could not load persistent state:"

3122

" {}".format(os.strerror(e.errno)))

2566

3123

else:

2567

3124

logger.critical("Could not load persistent state:",

2568

3125

exc_info=e)

2569

3126

raise

2570

3127

except EOFError as e:

2571

3128

logger.warning("Could not load persistent state: "

2572

"EOFError:", exc_info=e)

3129

"EOFError:",

3130

exc_info=e)

2573

3131

2574

3132

with PGPEngine() as pgp:

2575

3133

for client_name, client in clients_data.items():

2587

3145

# For each value in new config, check if it

2588

3146

# differs from the old config value (Except for

2589

3147

# the "secret" attribute)

2590

if (name != "secret" and

2591

value != old_client_settings[client_name]

2592

[name]):

3148

if (name != "secret"

3149

and (value !=

3150

old_client_settings[client_name][name])):

2593

3151

client[name] = value

2594

3152

except KeyError:

2595

3153

pass

2596

3154

2597

3155

# Clients who has passed its expire date can still be

2598

# enabled if its last checker was successful. Clients

3156

# enabled if its last checker was successful. A Client

2599

3157

# whose checker succeeded before we stored its state is

2600

3158

# assumed to have successfully run all checkers during

2601

3159

# downtime.

2604

3162

if not client["last_checked_ok"]:

2605

3163

logger.warning(

2606

3164

"disabling client {} - Client never "

2607

"performed a successful checker"

2608

.format(client_name))

3165

"performed a successful checker".format(

3166

client_name))

2609

3167

client["enabled"] = False

2610

3168

elif client["last_checker_status"] != 0:

2611

3169

logger.warning(

2612

3170

"disabling client {} - Client last"

2613

" checker failed with error code {}"

2614

.format(client_name,

2615

client["last_checker_status"]))

3171

" checker failed with error code"

3172

" {}".format(

3173

client_name,

3174

client["last_checker_status"]))

2616

3175

client["enabled"] = False

2617

3176

else:

2618

client["expires"] = (datetime.datetime

2619

.utcnow()

2620

+ client["timeout"])

3177

client["expires"] = (

3178

datetime.datetime.utcnow()

3179

+ client["timeout"])

2621

3180

logger.debug("Last checker succeeded,"

2622

" keeping {} enabled"

2623

.format(client_name))

3181

" keeping {} enabled".format(

3182

client_name))

2624

3183

try:

2625

client["secret"] = (

2626

pgp.decrypt(client["encrypted_secret"],

2627

client_settings[client_name]

2628

["secret"]))

3184

client["secret"] = pgp.decrypt(

3185

client["encrypted_secret"],

3186

client_settings[client_name]["secret"])

2629

3187

except PGPError:

2630

3188

# If decryption fails, we use secret from new settings

2631

logger.debug("Failed to decrypt {} old secret"

2632

.format(client_name))

2633

client["secret"] = (

2634

client_settings[client_name]["secret"])

3189

logger.debug("Failed to decrypt {} old secret".format(

3190

client_name))

3191

client["secret"] = (client_settings[client_name]

3192

["secret"])

2635

3193

2636

3194

# Add/remove clients based on new changes made to config

2637

3195

for client_name in (set(old_client_settings)

2644

3202

# Create all client objects

2645

3203

for client_name, client in clients_data.items():

2646

3204

tcp_server.clients[client_name] = client_class(

2647

name = client_name, settings = client,

3205

name = client_name,

3206

settings = client,

2648

3207

server_settings = server_settings)

2649

3208

2650

3209

if not tcp_server.clients:

2652

3211

2653

3212

if not foreground:

2654

3213

if pidfile is not None:

3214

pid = os.getpid()

2655

3215

try:

2656

3216

with pidfile:

2657

pid = os.getpid()

2658

pidfile.write("{}\n".format(pid).encode("utf-8"))

3217

print(pid, file=pidfile)

2659

3218

except IOError:

2660

3219

logger.error("Could not write to file %r with PID %d",

2661

3220

pidfilename, pid)

2662

3221

del pidfile

2663

3222

del pidfilename

2664

3223

2665

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2666

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

3224

for termsig in (signal.SIGHUP, signal.SIGTERM):

3225

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3226

lambda: main_loop.quit() and False)

2667

3227

2668

3228

if use_dbus:

2669

@alternate_dbus_interfaces({"se.recompile.Mandos":

2670

"se.bsnet.fukt.Mandos"})

2671

class MandosDBusService(DBusObjectWithProperties):

3229

3230

@alternate_dbus_interfaces(

3231

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3232

class MandosDBusService(DBusObjectWithObjectManager):

2672

3233

"""A D-Bus proxy object"""

3234

2673

3235

def __init__(self):

2674

3236

dbus.service.Object.__init__(self, bus, "/")

3237

2675

3238

_interface = "se.recompile.Mandos"

2676

3239

2677

@dbus_interface_annotations(_interface)

2678

def _foo(self):

2679

return { "org.freedesktop.DBus.Property"

2680

".EmitsChangedSignal":

2681

"false"}

2682

2683

3240

@dbus.service.signal(_interface, signature="o")

2684

3241

def ClientAdded(self, objpath):

2685

3242

"D-Bus signal"

2690

3247

"D-Bus signal"

2691

3248

pass

2692

3249

3250

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3251

"true"})

2693

3252

@dbus.service.signal(_interface, signature="os")

2694

3253

def ClientRemoved(self, objpath, name):

2695

3254

"D-Bus signal"

2696

3255

pass

2697

3256

3257

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3258

"true"})

2698

3259

@dbus.service.method(_interface, out_signature="ao")

2699

3260

def GetAllClients(self):

2700

3261

"D-Bus method"

2701

return dbus.Array(c.dbus_object_path

2702

for c in

2703

tcp_server.clients.itervalues())

3262

return dbus.Array(c.dbus_object_path for c in

3263

tcp_server.clients.values())

2704

3264

3265

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3266

"true"})

2705

3267

@dbus.service.method(_interface,

2706

3268

out_signature="a{oa{sv}}")

2707

3269

def GetAllClientsWithProperties(self):

2708

3270

"D-Bus method"

2709

3271

return dbus.Dictionary(

2710

((c.dbus_object_path, c.GetAll(""))

2711

for c in tcp_server.clients.itervalues()),

3272

{ c.dbus_object_path: c.GetAll(

3273

"se.recompile.Mandos.Client")

3274

for c in tcp_server.clients.values() },

2712

3275

signature="oa{sv}")

2713

3276

2714

3277

@dbus.service.method(_interface, in_signature="o")

2715

3278

def RemoveClient(self, object_path):

2716

3279

"D-Bus method"

2717

for c in tcp_server.clients.itervalues():

3280

for c in tcp_server.clients.values():

2718

3281

if c.dbus_object_path == object_path:

2719

3282

del tcp_server.clients[c.name]

2720

3283

c.remove_from_connection()

2721

# Don't signal anything except ClientRemoved

3284

# Don't signal the disabling

2722

3285

c.disable(quiet=True)

2723

# Emit D-Bus signal

2724

self.ClientRemoved(object_path, c.name)

3286

# Emit D-Bus signal for removal

3287

self.client_removed_signal(c)

2725

3288

return

2726

3289

raise KeyError(object_path)

2727

3290

2728

3291

del _interface

3292

3293

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3294

out_signature = "a{oa{sa{sv}}}")

3295

def GetManagedObjects(self):

3296

"""D-Bus method"""

3297

return dbus.Dictionary(

3298

{ client.dbus_object_path:

3299

dbus.Dictionary(

3300

{ interface: client.GetAll(interface)

3301

for interface in

3302

client._get_all_interface_names()})

3303

for client in tcp_server.clients.values()})

3304

3305

def client_added_signal(self, client):

3306

"""Send the new standard signal and the old signal"""

3307

if use_dbus:

3308

# New standard signal

3309

self.InterfacesAdded(

3310

client.dbus_object_path,

3311

dbus.Dictionary(

3312

{ interface: client.GetAll(interface)

3313

for interface in

3314

client._get_all_interface_names()}))

3315

# Old signal

3316

self.ClientAdded(client.dbus_object_path)

3317

3318

def client_removed_signal(self, client):

3319

"""Send the new standard signal and the old signal"""

3320

if use_dbus:

3321

# New standard signal

3322

self.InterfacesRemoved(

3323

client.dbus_object_path,

3324

client._get_all_interface_names())

3325

# Old signal

3326

self.ClientRemoved(client.dbus_object_path,

3327

client.name)

2729

3328

2730

3329

mandos_dbus_service = MandosDBusService()

2731

3330

3331

# Save modules to variables to exempt the modules from being

3332

# unloaded before the function registered with atexit() is run.

3333

mp = multiprocessing

3334

wn = wnull

2732

3335

def cleanup():

2733

3336

"Cleanup function; run on exit"

2734

3337

if zeroconf:

2735

3338

service.cleanup()

2736

3339

2737

multiprocessing.active_children()

2738

wnull.close()

3340

mp.active_children()

3341

wn.close()

2739

3342

if not (tcp_server.clients or client_settings):

2740

3343

return

2741

3344

2744

3347

# removed/edited, old secret will thus be unrecovable.

2745

3348

clients = {}

2746

3349

with PGPEngine() as pgp:

2747

for client in tcp_server.clients.itervalues():

3350

for client in tcp_server.clients.values():

2748

3351

key = client_settings[client.name]["secret"]

2749

3352

client.encrypted_secret = pgp.encrypt(client.secret,

2750

3353

key)

2754

3357

# + secret.

2755

3358

exclude = { "bus", "changedstate", "secret",

2756

3359

"checker", "server_settings" }

2757

for name, typ in (inspect.getmembers

2758

(dbus.service.Object)):

3360

for name, typ in inspect.getmembers(dbus.service

3361

.Object):

2759

3362

exclude.add(name)

2760

3363

2761

3364

client_dict["encrypted_secret"] = (client

2768

3371

del client_settings[client.name]["secret"]

2769

3372

2770

3373

try:

2771

with (tempfile.NamedTemporaryFile

2772

(mode='wb', suffix=".pickle", prefix='clients-',

2773

dir=os.path.dirname(stored_state_path),

2774

delete=False)) as stored_state:

2775

pickle.dump((clients, client_settings), stored_state)

2776

tempname=stored_state.name

3374

with tempfile.NamedTemporaryFile(

3375

mode='wb',

3376

suffix=".pickle",

3377

prefix='clients-',

3378

dir=os.path.dirname(stored_state_path),

3379

delete=False) as stored_state:

3380

pickle.dump((clients, client_settings), stored_state,

3381

protocol = 2)

3382

tempname = stored_state.name

2777

3383

os.rename(tempname, stored_state_path)

2778

3384

except (IOError, OSError) as e:

2779

3385

if not debug:

2794

3400

name, client = tcp_server.clients.popitem()

2795

3401

if use_dbus:

2796

3402

client.remove_from_connection()

2797

# Don't signal anything except ClientRemoved

3403

# Don't signal the disabling

2798

3404

client.disable(quiet=True)

3405

# Emit D-Bus signal for removal

2799

3406

if use_dbus:

2800

# Emit D-Bus signal

2801

mandos_dbus_service.ClientRemoved(client

2802

.dbus_object_path,

2803

client.name)

3407

mandos_dbus_service.client_removed_signal(client)

2804

3408

client_settings.clear()

2805

3409

2806

3410

atexit.register(cleanup)

2807

3411

2808

for client in tcp_server.clients.itervalues():

3412

for client in tcp_server.clients.values():

2809

3413

if use_dbus:

2810

# Emit D-Bus signal

2811

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3414

# Emit D-Bus signal for adding

3415

mandos_dbus_service.client_added_signal(client)

2812

3416

# Need to initiate checking of clients

2813

3417

if client.enabled:

2814

3418

client.init_checker()

2840

3444

sys.exit(1)

2841

3445

# End of Avahi example code

2842

3446

2843

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2844

lambda *args, **kwargs:

2845

(tcp_server.handle_request

2846

(*args[2:], **kwargs) or True))

3447

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3448

lambda *args, **kwargs:

3449

(tcp_server.handle_request

3450

(*args[2:], **kwargs) or True))

2847

3451

2848

3452

logger.debug("Starting main loop")

2849

3453

main_loop.run()

2859

3463

# Must run before the D-Bus bus name gets deregistered

2860

3464

cleanup()

2861

3465

3466

2862

3467

if __name__ == '__main__':

2863

3468

main()