/mandos/trunk : revision 237.4.98

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

12

#

13

# Everything else is

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

14

15

16

#

17

# This file is part of Mandos.

18

#

19

# Mandos is free software: you can redistribute it and/or modify it

20

# under the terms of the GNU General Public License as published by

19

21

# the Free Software Foundation, either version 3 of the License, or

20

22

# (at your option) any later version.

21

23

#

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

24

# Mandos is distributed in the hope that it will be useful, but

25

# WITHOUT ANY WARRANTY; without even the implied warranty of

24

26

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

25

27

# GNU General Public License for more details.

26

#

28

#

27

29

# You should have received a copy of the GNU General Public License

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

30

# along with Mandos. If not, see <http://www.gnu.org/licenses/>.

31

#

31

32

# Contact the authors at <mandos@recompile.se>.

32

#

33

#

33

34

35

from __future__ import (division, absolute_import, print_function,

35

36

unicode_literals)

86

87

import xml.dom.minidom

87

88

import inspect

88

89

90

# Try to find the value of SO_BINDTODEVICE:

89

91

try:

92

# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and

93

# newer, and it is also the most natural place for it:

90

94

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

91

95

except AttributeError:

92

96

try:

97

# This is where SO_BINDTODEVICE was up to and including Python

98

# 2.6, and also 3.2:

93

99

from IN import SO_BINDTODEVICE

94

100

except ImportError:

95

SO_BINDTODEVICE = None

101

# In Python 2.7 it seems to have been removed entirely.

102

# Try running the C preprocessor:

103

try:

104

cc = subprocess.Popen(["cc", "--language=c", "-E",

105

"/dev/stdin"],

106

stdin=subprocess.PIPE,

107

stdout=subprocess.PIPE)

108

stdout = cc.communicate(

109

"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]

110

SO_BINDTODEVICE = int(stdout.splitlines()[-1])

111

except (OSError, ValueError, IndexError):

112

# No value found

113

SO_BINDTODEVICE = None

96

114

97

115

if sys.version_info.major == 2:

98

116

str = unicode

99

117

100

version = "1.7.7"

118

version = "1.7.19"

101

119

stored_state_file = "clients.pickle"

102

120

103

121

logger = logging.getLogger()

107

125

if_nametoindex = ctypes.cdll.LoadLibrary(

108

126

ctypes.util.find_library("c")).if_nametoindex

109

127

except (OSError, AttributeError):

110

128

111

129

def if_nametoindex(interface):

112

130

"Get an interface index the hard way, i.e. using fcntl()"

113

131

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

136

154

137

155

def initlogger(debug, level=logging.WARNING):

138

156

"""init logger and add loglevel"""

139

157

140

158

global syslogger

141

159

syslogger = (logging.handlers.SysLogHandler(

142

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

143

address = "/dev/log"))

160

facility=logging.handlers.SysLogHandler.LOG_DAEMON,

161

address="/dev/log"))

144

162

syslogger.setFormatter(logging.Formatter

145

163

('Mandos [%(process)d]: %(levelname)s:'

146

164

' %(message)s'))

147

165

logger.addHandler(syslogger)

148

166

149

167

if debug:

150

168

console = logging.StreamHandler()

151

169

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

163

181

164

182

class PGPEngine(object):

165

183

"""A simple class for OpenPGP symmetric encryption & decryption"""

166

184

167

185

def __init__(self):

168

186

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

169

187

self.gpg = "gpg"

184

202

# Only GPG version 1 has the --no-use-agent option.

185

203

if self.gpg == "gpg" or self.gpg.endswith("/gpg"):

186

204

self.gnupgargs.append("--no-use-agent")

187

205

188

206

def __enter__(self):

189

207

return self

190

208

191

209

def __exit__(self, exc_type, exc_value, traceback):

192

210

self._cleanup()

193

211

return False

194

212

195

213

def __del__(self):

196

214

self._cleanup()

197

215

198

216

def _cleanup(self):

199

217

if self.tempdir is not None:

200

218

# Delete contents of tempdir

201

219

for root, dirs, files in os.walk(self.tempdir,

202

topdown = False):

220

topdown=False):

203

221

for filename in files:

204

222

os.remove(os.path.join(root, filename))

205

223

for dirname in dirs:

207

225

# Remove tempdir

208

226

os.rmdir(self.tempdir)

209

227

self.tempdir = None

210

228

211

229

def password_encode(self, password):

212

230

# Passphrase can not be empty and can not contain newlines or

213

231

# NUL bytes. So we prefix it and hex encode it.

218

236

.replace(b"\n", b"\\n")

219

237

.replace(b"\0", b"\\x00"))

220

238

return encoded

221

239

222

240

def encrypt(self, data, password):

223

241

passphrase = self.password_encode(password)

224

242

with tempfile.NamedTemporaryFile(

229

247

'--passphrase-file',

230

248

passfile.name]

231

249

+ self.gnupgargs,

232

stdin = subprocess.PIPE,

233

stdout = subprocess.PIPE,

234

stderr = subprocess.PIPE)

235

ciphertext, err = proc.communicate(input = data)

250

stdin=subprocess.PIPE,

251

stdout=subprocess.PIPE,

252

stderr=subprocess.PIPE)

253

ciphertext, err = proc.communicate(input=data)

236

254

if proc.returncode != 0:

237

255

raise PGPError(err)

238

256

return ciphertext

239

257

240

258

def decrypt(self, data, password):

241

259

passphrase = self.password_encode(password)

242

260

with tempfile.NamedTemporaryFile(

243

dir = self.tempdir) as passfile:

261

dir=self.tempdir) as passfile:

244

262

passfile.write(passphrase)

245

263

passfile.flush()

246

264

proc = subprocess.Popen([self.gpg, '--decrypt',

247

265

'--passphrase-file',

248

266

passfile.name]

249

267

+ self.gnupgargs,

250

stdin = subprocess.PIPE,

251

stdout = subprocess.PIPE,

252

stderr = subprocess.PIPE)

253

decrypted_plaintext, err = proc.communicate(input = data)

268

stdin=subprocess.PIPE,

269

stdout=subprocess.PIPE,

270

stderr=subprocess.PIPE)

271

decrypted_plaintext, err = proc.communicate(input=data)

254

272

if proc.returncode != 0:

255

273

raise PGPError(err)

256

274

return decrypted_plaintext

257

275

276

258

277

# Pretend that we have an Avahi module

259

278

class Avahi(object):

260

279

"""This isn't so much a class as it is a module-like namespace.

261

280

It is instantiated once, and simulates having an Avahi module."""

262

IF_UNSPEC = -1 # avahi-common/address.h

263

PROTO_UNSPEC = -1 # avahi-common/address.h

264

PROTO_INET = 0 # avahi-common/address.h

265

PROTO_INET6 = 1 # avahi-common/address.h

281

IF_UNSPEC = -1 # avahi-common/address.h

282

PROTO_UNSPEC = -1 # avahi-common/address.h

283

PROTO_INET = 0 # avahi-common/address.h

284

PROTO_INET6 = 1 # avahi-common/address.h

266

285

DBUS_NAME = "org.freedesktop.Avahi"

267

286

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

268

287

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

269

288

DBUS_PATH_SERVER = "/"

289

270

290

def string_array_to_txt_array(self, t):

271

291

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

272

292

for s in t), signature="ay")

273

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

274

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

275

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

276

SERVER_INVALID = 0 # avahi-common/defs.h

277

SERVER_REGISTERING = 1 # avahi-common/defs.h

278

SERVER_RUNNING = 2 # avahi-common/defs.h

279

SERVER_COLLISION = 3 # avahi-common/defs.h

280

SERVER_FAILURE = 4 # avahi-common/defs.h

293

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

294

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

295

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

296

SERVER_INVALID = 0 # avahi-common/defs.h

297

SERVER_REGISTERING = 1 # avahi-common/defs.h

298

SERVER_RUNNING = 2 # avahi-common/defs.h

299

SERVER_COLLISION = 3 # avahi-common/defs.h

300

SERVER_FAILURE = 4 # avahi-common/defs.h

281

301

avahi = Avahi()

282

302

303

283

304

class AvahiError(Exception):

284

305

def __init__(self, value, *args, **kwargs):

285

306

self.value = value

297

318

298

319

class AvahiService(object):

299

320

"""An Avahi (Zeroconf) service.

300

321

301

322

Attributes:

302

323

interface: integer; avahi.IF_UNSPEC or an interface index.

303

324

Used to optionally bind to the specified interface.

315

336

server: D-Bus Server

316

337

bus: dbus.SystemBus()

317

338

"""

318

339

319

340

def __init__(self,

320

interface = avahi.IF_UNSPEC,

321

name = None,

322

servicetype = None,

323

port = None,

324

TXT = None,

325

domain = "",

326

host = "",

327

max_renames = 32768,

328

protocol = avahi.PROTO_UNSPEC,

329

bus = None):

341

interface=avahi.IF_UNSPEC,

342

name=None,

343

servicetype=None,

344

port=None,

345

TXT=None,

346

domain="",

347

host="",

348

max_renames=32768,

349

protocol=avahi.PROTO_UNSPEC,

350

bus=None):

330

351

self.interface = interface

331

352

self.name = name

332

353

self.type = servicetype

341

362

self.server = None

342

363

self.bus = bus

343

364

self.entry_group_state_changed_match = None

344

365

345

366

def rename(self, remove=True):

346

367

"""Derived from the Avahi example code"""

347

368

if self.rename_count >= self.max_renames:

367

388

logger.critical("D-Bus Exception", exc_info=error)

368

389

self.cleanup()

369

390

os._exit(1)

370

391

371

392

def remove(self):

372

393

"""Derived from the Avahi example code"""

373

394

if self.entry_group_state_changed_match is not None:

375

396

self.entry_group_state_changed_match = None

376

397

if self.group is not None:

377

398

self.group.Reset()

378

399

379

400

def add(self):

380

401

"""Derived from the Avahi example code"""

381

402

self.remove()

398

419

dbus.UInt16(self.port),

399

420

avahi.string_array_to_txt_array(self.TXT))

400

421

self.group.Commit()

401

422

402

423

def entry_group_state_changed(self, state, error):

403

424

"""Derived from the Avahi example code"""

404

425

logger.debug("Avahi entry group state change: %i", state)

405

426

406

427

if state == avahi.ENTRY_GROUP_ESTABLISHED:

407

428

logger.debug("Zeroconf service established.")

408

429

elif state == avahi.ENTRY_GROUP_COLLISION:

412

433

logger.critical("Avahi: Error in group state changed %s",

413

434

str(error))

414

435

raise AvahiGroupError("State changed: {!s}".format(error))

415

436

416

437

def cleanup(self):

417

438

"""Derived from the Avahi example code"""

418

439

if self.group is not None:

423

444

pass

424

445

self.group = None

425

446

self.remove()

426

447

427

448

def server_state_changed(self, state, error=None):

428

449

"""Derived from the Avahi example code"""

429

450

logger.debug("Avahi server state change: %i", state)

458

479

logger.debug("Unknown state: %r", state)

459

480

else:

460

481

logger.debug("Unknown state: %r: %r", state, error)

461

482

462

483

def activate(self):

463

484

"""Derived from the Avahi example code"""

464

485

if self.server is None:

475

496

class AvahiServiceToSyslog(AvahiService):

476

497

def rename(self, *args, **kwargs):

477

498

"""Add the new name to the syslog messages"""

478

ret = AvahiService.rename(self, *args, **kwargs)

499

ret = super(AvahiServiceToSyslog, self).rename(*args, **kwargs)

479

500

syslogger.setFormatter(logging.Formatter(

480

501

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

481

502

.format(self.name)))

482

503

return ret

483

504

505

484

506

# Pretend that we have a GnuTLS module

485

507

class GnuTLS(object):

486

508

"""This isn't so much a class as it is a module-like namespace.

487

509

It is instantiated once, and simulates having a GnuTLS module."""

488

489

_library = ctypes.cdll.LoadLibrary(

490

ctypes.util.find_library("gnutls"))

510

511

library = ctypes.util.find_library("gnutls")

512

if library is None:

513

library = ctypes.util.find_library("gnutls-deb0")

514

_library = ctypes.cdll.LoadLibrary(library)

515

del library

491

516

_need_version = b"3.3.0"

517

492

518

def __init__(self):

493

# Need to use class name "GnuTLS" here, since this method is

494

# called before the assignment to the "gnutls" global variable

495

# happens.

496

if GnuTLS.check_version(self._need_version) is None:

497

raise GnuTLS.Error("Needs GnuTLS {} or later"

498

.format(self._need_version))

499

519

# Need to use "self" here, since this method is called before

520

# the assignment to the "gnutls" global variable happens.

521

if self.check_version(self._need_version) is None:

522

raise self.Error("Needs GnuTLS {} or later"

523

.format(self._need_version))

524

500

525

# Unless otherwise indicated, the constants and types below are

501

526

# all from the gnutls/gnutls.h C header file.

502

527

503

528

# Constants

504

529

E_SUCCESS = 0

505

530

E_INTERRUPTED = -52

510

535

CRD_CERTIFICATE = 1

511

536

E_NO_CERTIFICATE_FOUND = -49

512

537

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

513

538

514

539

# Types

515

540

class session_int(ctypes.Structure):

516

541

_fields_ = []

517

542

session_t = ctypes.POINTER(session_int)

543

518

544

class certificate_credentials_st(ctypes.Structure):

519

545

_fields_ = []

520

546

certificate_credentials_t = ctypes.POINTER(

521

547

certificate_credentials_st)

522

548

certificate_type_t = ctypes.c_int

549

523

550

class datum_t(ctypes.Structure):

524

551

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

525

552

('size', ctypes.c_uint)]

553

526

554

class openpgp_crt_int(ctypes.Structure):

527

555

_fields_ = []

528

556

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

529

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

557

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

530

558

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

531

559

credentials_type_t = ctypes.c_int

532

560

transport_ptr_t = ctypes.c_void_p

533

561

close_request_t = ctypes.c_int

534

562

535

563

# Exceptions

536

564

class Error(Exception):

537

565

# We need to use the class name "GnuTLS" here, since this

538

566

# exception might be raised from within GnuTLS.__init__,

539

567

# which is called before the assignment to the "gnutls"

540

568

# global variable has happened.

541

def __init__(self, message = None, code = None, args=()):

569

def __init__(self, message=None, code=None, args=()):

542

570

# Default usage is by a message string, but if a return

543

571

# code is passed, convert it to a string with

544

572

# gnutls.strerror()

547

575

message = GnuTLS.strerror(code)

548

576

return super(GnuTLS.Error, self).__init__(

549

577

message, *args)

550

578

551

579

class CertificateSecurityError(Error):

552

580

pass

553

581

554

582

# Classes

555

583

class Credentials(object):

556

584

def __init__(self):

558

586

gnutls.certificate_allocate_credentials(

559

587

ctypes.byref(self._c_object))

560

588

self.type = gnutls.CRD_CERTIFICATE

561

589

562

590

def __del__(self):

563

591

gnutls.certificate_free_credentials(self._c_object)

564

592

565

593

class ClientSession(object):

566

def __init__(self, socket, credentials = None):

594

def __init__(self, socket, credentials=None):

567

595

self._c_object = gnutls.session_t()

568

596

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

569

597

gnutls.set_default_priority(self._c_object)

577

605

ctypes.cast(credentials._c_object,

578

606

ctypes.c_void_p))

579

607

self.credentials = credentials

580

608

581

609

def __del__(self):

582

610

gnutls.deinit(self._c_object)

583

611

584

612

def handshake(self):

585

613

return gnutls.handshake(self._c_object)

586

614

587

615

def send(self, data):

588

616

data = bytes(data)

589

617

data_len = len(data)

591

619

data_len -= gnutls.record_send(self._c_object,

592

620

data[-data_len:],

593

621

data_len)

594

622

595

623

def bye(self):

596

624

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

597

625

598

626

# Error handling functions

599

627

def _error_code(result):

600

628

"""A function to raise exceptions on errors, suitable

602

630

if result >= 0:

603

631

return result

604

632

if result == gnutls.E_NO_CERTIFICATE_FOUND:

605

raise gnutls.CertificateSecurityError(code = result)

606

raise gnutls.Error(code = result)

607

633

raise gnutls.CertificateSecurityError(code=result)

634

raise gnutls.Error(code=result)

635

608

636

def _retry_on_error(result, func, arguments):

609

637

"""A function to retry on some errors, suitable

610

638

for the 'errcheck' attribute on ctypes functions"""

613

641

return _error_code(result)

614

642

result = func(*arguments)

615

643

return result

616

644

617

645

# Unless otherwise indicated, the function declarations below are

618

646

# all from the gnutls/gnutls.h C header file.

619

647

620

648

# Functions

621

649

priority_set_direct = _library.gnutls_priority_set_direct

622

650

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

623

651

ctypes.POINTER(ctypes.c_char_p)]

624

652

priority_set_direct.restype = _error_code

625

653

626

654

init = _library.gnutls_init

627

655

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

628

656

init.restype = _error_code

629

657

630

658

set_default_priority = _library.gnutls_set_default_priority

631

659

set_default_priority.argtypes = [session_t]

632

660

set_default_priority.restype = _error_code

633

661

634

662

record_send = _library.gnutls_record_send

635

663

record_send.argtypes = [session_t, ctypes.c_void_p,

636

664

ctypes.c_size_t]

637

665

record_send.restype = ctypes.c_ssize_t

638

666

record_send.errcheck = _retry_on_error

639

667

640

668

certificate_allocate_credentials = (

641

669

_library.gnutls_certificate_allocate_credentials)

642

670

certificate_allocate_credentials.argtypes = [

643

671

ctypes.POINTER(certificate_credentials_t)]

644

672

certificate_allocate_credentials.restype = _error_code

645

673

646

674

certificate_free_credentials = (

647

675

_library.gnutls_certificate_free_credentials)

648

certificate_free_credentials.argtypes = [certificate_credentials_t]

676

certificate_free_credentials.argtypes = [

677

certificate_credentials_t]

649

678

certificate_free_credentials.restype = None

650

679

651

680

handshake_set_private_extensions = (

652

681

_library.gnutls_handshake_set_private_extensions)

653

682

handshake_set_private_extensions.argtypes = [session_t,

654

683

ctypes.c_int]

655

684

handshake_set_private_extensions.restype = None

656

685

657

686

credentials_set = _library.gnutls_credentials_set

658

687

credentials_set.argtypes = [session_t, credentials_type_t,

659

688

ctypes.c_void_p]

660

689

credentials_set.restype = _error_code

661

690

662

691

strerror = _library.gnutls_strerror

663

692

strerror.argtypes = [ctypes.c_int]

664

693

strerror.restype = ctypes.c_char_p

665

694

666

695

certificate_type_get = _library.gnutls_certificate_type_get

667

696

certificate_type_get.argtypes = [session_t]

668

697

certificate_type_get.restype = _error_code

669

698

670

699

certificate_get_peers = _library.gnutls_certificate_get_peers

671

700

certificate_get_peers.argtypes = [session_t,

672

701

ctypes.POINTER(ctypes.c_uint)]

673

702

certificate_get_peers.restype = ctypes.POINTER(datum_t)

674

703

675

704

global_set_log_level = _library.gnutls_global_set_log_level

676

705

global_set_log_level.argtypes = [ctypes.c_int]

677

706

global_set_log_level.restype = None

678

707

679

708

global_set_log_function = _library.gnutls_global_set_log_function

680

709

global_set_log_function.argtypes = [log_func]

681

710

global_set_log_function.restype = None

682

711

683

712

deinit = _library.gnutls_deinit

684

713

deinit.argtypes = [session_t]

685

714

deinit.restype = None

686

715

687

716

handshake = _library.gnutls_handshake

688

717

handshake.argtypes = [session_t]

689

718

handshake.restype = _error_code

690

719

handshake.errcheck = _retry_on_error

691

720

692

721

transport_set_ptr = _library.gnutls_transport_set_ptr

693

722

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

694

723

transport_set_ptr.restype = None

695

724

696

725

bye = _library.gnutls_bye

697

726

bye.argtypes = [session_t, close_request_t]

698

727

bye.restype = _error_code

699

728

bye.errcheck = _retry_on_error

700

729

701

730

check_version = _library.gnutls_check_version

702

731

check_version.argtypes = [ctypes.c_char_p]

703

732

check_version.restype = ctypes.c_char_p

704

733

705

734

# All the function declarations below are from gnutls/openpgp.h

706

735

707

736

openpgp_crt_init = _library.gnutls_openpgp_crt_init

708

737

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

709

738

openpgp_crt_init.restype = _error_code

710

739

711

740

openpgp_crt_import = _library.gnutls_openpgp_crt_import

712

741

openpgp_crt_import.argtypes = [openpgp_crt_t,

713

742

ctypes.POINTER(datum_t),

714

743

openpgp_crt_fmt_t]

715

744

openpgp_crt_import.restype = _error_code

716

745

717

746

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

718

747

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

719

748

ctypes.POINTER(ctypes.c_uint)]

720

749

openpgp_crt_verify_self.restype = _error_code

721

750

722

751

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

723

752

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

724

753

openpgp_crt_deinit.restype = None

725

754

726

755

openpgp_crt_get_fingerprint = (

727

756

_library.gnutls_openpgp_crt_get_fingerprint)

728

757

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

730

759

ctypes.POINTER(

731

760

ctypes.c_size_t)]

732

761

openpgp_crt_get_fingerprint.restype = _error_code

733

762

734

763

# Remove non-public functions

735

764

del _error_code, _retry_on_error

736

765

# Create the global "gnutls" object, simulating a module

737

766

gnutls = GnuTLS()

738

767

768

739

769

def call_pipe(connection, # : multiprocessing.Connection

740

770

func, *args, **kwargs):

741

771

"""This function is meant to be called by multiprocessing.Process

742

772

743

773

This function runs func(*args, **kwargs), and writes the resulting

744

774

return value on the provided multiprocessing.Connection.

745

775

"""

746

776

connection.send(func(*args, **kwargs))

747

777

connection.close()

748

778

779

749

780

class Client(object):

750

781

"""A representation of a client host served by this server.

751

782

752

783

Attributes:

753

784

approved: bool(); 'None' if not yet approved/disapproved

754

785

approval_delay: datetime.timedelta(); Time to wait for approval

791

822

disabled, or None

792

823

server_settings: The server_settings dict from main()

793

824

"""

794

825

795

826

runtime_expansions = ("approval_delay", "approval_duration",

796

827

"created", "enabled", "expires",

797

828

"fingerprint", "host", "interval",

808

839

"approved_by_default": "True",

809

840

"enabled": "True",

810

841

}

811

842

812

843

@staticmethod

813

844

def config_parser(config):

814

845

"""Construct a new dict of client settings of this form:

821

852

for client_name in config.sections():

822

853

section = dict(config.items(client_name))

823

854

client = settings[client_name] = {}

824

855

825

856

client["host"] = section["host"]

826

857

# Reformat values from string types to Python types

827

858

client["approved_by_default"] = config.getboolean(

828

859

client_name, "approved_by_default")

829

860

client["enabled"] = config.getboolean(client_name,

830

861

"enabled")

831

862

832

863

# Uppercase and remove spaces from fingerprint for later

833

864

# comparison purposes with return value from the

834

865

# fingerprint() function

858

889

client["last_approval_request"] = None

859

890

client["last_checked_ok"] = None

860

891

client["last_checker_status"] = -2

861

892

862

893

return settings

863

864

def __init__(self, settings, name = None, server_settings=None):

894

895

def __init__(self, settings, name=None, server_settings=None):

865

896

self.name = name

866

897

if server_settings is None:

867

898

server_settings = {}

869

900

# adding all client settings

870

901

for setting, value in settings.items():

871

902

setattr(self, setting, value)

872

903

873

904

if self.enabled:

874

905

if not hasattr(self, "last_enabled"):

875

906

self.last_enabled = datetime.datetime.utcnow()

879

910

else:

880

911

self.last_enabled = None

881

912

self.expires = None

882

913

883

914

logger.debug("Creating client %r", self.name)

884

915

logger.debug(" Fingerprint: %s", self.fingerprint)

885

916

self.created = settings.get("created",

886

917

datetime.datetime.utcnow())

887

918

888

919

# attributes specific for this server instance

889

920

self.checker = None

890

921

self.checker_initiator_tag = None

899

930

for attr in self.__dict__.keys()

900

931

if not attr.startswith("_")]

901

932

self.client_structure.append("client_structure")

902

933

903

934

for name, t in inspect.getmembers(

904

935

type(self), lambda obj: isinstance(obj, property)):

905

936

if not name.startswith("_"):

906

937

self.client_structure.append(name)

907

938

908

939

# Send notice to process children that client state has changed

909

940

def send_changedstate(self):

910

941

with self.changedstate:

911

942

self.changedstate.notify_all()

912

943

913

944

def enable(self):

914

945

"""Start this client's checker and timeout hooks"""

915

946

if getattr(self, "enabled", False):

920

951

self.last_enabled = datetime.datetime.utcnow()

921

952

self.init_checker()

922

953

self.send_changedstate()

923

954

924

955

def disable(self, quiet=True):

925

956

"""Disable this client."""

926

957

if not getattr(self, "enabled", False):

940

971

self.send_changedstate()

941

972

# Do not run this again if called by a GLib.timeout_add

942

973

return False

943

974

944

975

def __del__(self):

945

976

self.disable()

946

977

947

978

def init_checker(self):

948

979

# Schedule a new checker to be started an 'interval' from now,

949

980

# and every interval from then on.

959

990

int(self.timeout.total_seconds() * 1000), self.disable)

960

991

# Also start a new checker *right now*.

961

992

self.start_checker()

962

993

963

994

def checker_callback(self, source, condition, connection,

964

995

command):

965

996

"""The checker has completed, so take appropriate actions."""

968

999

# Read return code from connection (see call_pipe)

969

1000

returncode = connection.recv()

970

1001

connection.close()

971

1002

972

1003

if returncode >= 0:

973

1004

self.last_checker_status = returncode

974

1005

self.last_checker_signal = None

984

1015

logger.warning("Checker for %(name)s crashed?",

985

1016

vars(self))

986

1017

return False

987

1018

988

1019

def checked_ok(self):

989

1020

"""Assert that the client has been seen, alive and well."""

990

1021

self.last_checked_ok = datetime.datetime.utcnow()

991

1022

self.last_checker_status = 0

992

1023

self.last_checker_signal = None

993

1024

self.bump_timeout()

994

1025

995

1026

def bump_timeout(self, timeout=None):

996

1027

"""Bump up the timeout for this client."""

997

1028

if timeout is None:

1003

1034

self.disable_initiator_tag = GLib.timeout_add(

1004

1035

int(timeout.total_seconds() * 1000), self.disable)

1005

1036

self.expires = datetime.datetime.utcnow() + timeout

1006

1037

1007

1038

def need_approval(self):

1008

1039

self.last_approval_request = datetime.datetime.utcnow()

1009

1040

1010

1041

def start_checker(self):

1011

1042

"""Start a new checker subprocess if one is not running.

1012

1043

1013

1044

If a checker already exists, leave it running and do

1014

1045

nothing."""

1015

1046

# The reason for not killing a running checker is that if we

1020

1051

# checkers alone, the checker would have to take more time

1021

1052

# than 'timeout' for the client to be disabled, which is as it

1022

1053

# should be.

1023

1054

1024

1055

if self.checker is not None and not self.checker.is_alive():

1025

1056

logger.warning("Checker was not alive; joining")

1026

1057

self.checker.join()

1030

1061

# Escape attributes for the shell

1031

1062

escaped_attrs = {

1032

1063

attr: re.escape(str(getattr(self, attr)))

1033

for attr in self.runtime_expansions }

1064

for attr in self.runtime_expansions}

1034

1065

try:

1035

1066

command = self.checker_command % escaped_attrs

1036

1067

except TypeError as error:

1048

1079

# The exception is when not debugging but nevertheless

1049

1080

# running in the foreground; use the previously

1050

1081

# created wnull.

1051

popen_args = { "close_fds": True,

1052

"shell": True,

1053

"cwd": "/" }

1082

popen_args = {"close_fds": True,

1083

"shell": True,

1084

"cwd": "/"}

1054

1085

if (not self.server_settings["debug"]

1055

1086

and self.server_settings["foreground"]):

1056

1087

popen_args.update({"stdout": wnull,

1057

"stderr": wnull })

1058

pipe = multiprocessing.Pipe(duplex = False)

1088

"stderr": wnull})

1089

pipe = multiprocessing.Pipe(duplex=False)

1059

1090

self.checker = multiprocessing.Process(

1060

target = call_pipe,

1061

args = (pipe[1], subprocess.call, command),

1062

kwargs = popen_args)

1091

target=call_pipe,

1092

args=(pipe[1], subprocess.call, command),

1093

kwargs=popen_args)

1063

1094

self.checker.start()

1064

1095

self.checker_callback_tag = GLib.io_add_watch(

1065

1096

pipe[0].fileno(), GLib.IO_IN,

1066

1097

self.checker_callback, pipe[0], command)

1067

1098

# Re-run this periodically if run by GLib.timeout_add

1068

1099

return True

1069

1100

1070

1101

def stop_checker(self):

1071

1102

"""Force the checker process, if any, to stop."""

1072

1103

if self.checker_callback_tag:

1085

1116

byte_arrays=False):

1086

1117

"""Decorators for marking methods of a DBusObjectWithProperties to

1087

1118

become properties on the D-Bus.

1088

1119

1089

1120

The decorated method will be called with no arguments by "Get"

1090

1121

and with one argument by "Set".

1091

1122

1092

1123

The parameters, where they are supported, are the same as

1093

1124

dbus.service.method, except there is only "signature", since the

1094

1125

type from Get() and the type sent to Set() is the same.

1098

1129

if byte_arrays and signature != "ay":

1099

1130

raise ValueError("Byte arrays not supported for non-'ay'"

1100

1131

" signature {!r}".format(signature))

1101

1132

1102

1133

def decorator(func):

1103

1134

func._dbus_is_property = True

1104

1135

func._dbus_interface = dbus_interface

1107

1138

func._dbus_name = func.__name__

1108

1139

if func._dbus_name.endswith("_dbus_property"):

1109

1140

func._dbus_name = func._dbus_name[:-14]

1110

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1141

func._dbus_get_args_options = {'byte_arrays': byte_arrays}

1111

1142

return func

1112

1143

1113

1144

return decorator

1114

1145

1115

1146

1116

1147

def dbus_interface_annotations(dbus_interface):

1117

1148

"""Decorator for marking functions returning interface annotations

1118

1149

1119

1150

Usage:

1120

1151

1121

1152

@dbus_interface_annotations("org.example.Interface")

1122

1153

def _foo(self): # Function name does not matter

1123

1154

return {"org.freedesktop.DBus.Deprecated": "true",

1124

1155

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1125

1156

"false"}

1126

1157

"""

1127

1158

1128

1159

def decorator(func):

1129

1160

func._dbus_is_interface = True

1130

1161

func._dbus_interface = dbus_interface

1131

1162

func._dbus_name = dbus_interface

1132

1163

return func

1133

1164

1134

1165

return decorator

1135

1166

1136

1167

1137

1168

def dbus_annotations(annotations):

1138

1169

"""Decorator to annotate D-Bus methods, signals or properties

1139

1170

Usage:

1140

1171

1141

1172

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1142

1173

"org.freedesktop.DBus.Property."

1143

1174

"EmitsChangedSignal": "false"})

1145

1176

access="r")

1146

1177

def Property_dbus_property(self):

1147

1178

return dbus.Boolean(False)

1148

1179

1149

1180

See also the DBusObjectWithAnnotations class.

1150

1181

"""

1151

1182

1152

1183

def decorator(func):

1153

1184

func._dbus_annotations = annotations

1154

1185

return func

1155

1186

1156

1187

return decorator

1157

1188

1158

1189

1176

1207

1177

1208

class DBusObjectWithAnnotations(dbus.service.Object):

1178

1209

"""A D-Bus object with annotations.

1179

1210

1180

1211

Classes inheriting from this can use the dbus_annotations

1181

1212

decorator to add annotations to methods or signals.

1182

1213

"""

1183

1214

1184

1215

@staticmethod

1185

1216

def _is_dbus_thing(thing):

1186

1217

"""Returns a function testing if an attribute is a D-Bus thing

1187

1218

1188

1219

If called like _is_dbus_thing("method") it returns a function

1189

1220

suitable for use as predicate to inspect.getmembers().

1190

1221

"""

1191

1222

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

1192

1223

False)

1193

1224

1194

1225

def _get_all_dbus_things(self, thing):

1195

1226

"""Returns a generator of (name, attribute) pairs

1196

1227

"""

1199

1230

for cls in self.__class__.__mro__

1200

1231

for name, athing in

1201

1232

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1202

1233

1203

1234

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1204

out_signature = "s",

1205

path_keyword = 'object_path',

1206

connection_keyword = 'connection')

1235

out_signature="s",

1236

path_keyword='object_path',

1237

connection_keyword='connection')

1207

1238

def Introspect(self, object_path, connection):

1208

1239

"""Overloading of standard D-Bus method.

1209

1240

1210

1241

Inserts annotation tags on methods and signals.

1211

1242

"""

1212

1243

xmlstring = dbus.service.Object.Introspect(self, object_path,

1213

1244

connection)

1214

1245

try:

1215

1246

document = xml.dom.minidom.parseString(xmlstring)

1216

1247

1217

1248

for if_tag in document.getElementsByTagName("interface"):

1218

1249

# Add annotation tags

1219

1250

for typ in ("method", "signal"):

1246

1277

if_tag.appendChild(ann_tag)

1247

1278

# Fix argument name for the Introspect method itself

1248

1279

if (if_tag.getAttribute("name")

1249

== dbus.INTROSPECTABLE_IFACE):

1280

== dbus.INTROSPECTABLE_IFACE):

1250

1281

for cn in if_tag.getElementsByTagName("method"):

1251

1282

if cn.getAttribute("name") == "Introspect":

1252

1283

for arg in cn.getElementsByTagName("arg"):

1265

1296

1266

1297

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1267

1298

"""A D-Bus object with properties.

1268

1299

1269

1300

Classes inheriting from this can use the dbus_service_property

1270

1301

decorator to expose methods as D-Bus properties. It exposes the

1271

1302

standard Get(), Set(), and GetAll() methods on the D-Bus.

1272

1303

"""

1273

1304

1274

1305

def _get_dbus_property(self, interface_name, property_name):

1275

1306

"""Returns a bound method if one exists which is a D-Bus

1276

1307

property with the specified name and interface.

1281

1312

if (value._dbus_name == property_name

1282

1313

and value._dbus_interface == interface_name):

1283

1314

return value.__get__(self)

1284

1315

1285

1316

# No such property

1286

1317

raise DBusPropertyNotFound("{}:{}.{}".format(

1287

1318

self.dbus_object_path, interface_name, property_name))

1288

1319

1289

1320

@classmethod

1290

1321

def _get_all_interface_names(cls):

1291

1322

"""Get a sequence of all interfaces supported by an object"""

1294

1325

for x in (inspect.getmro(cls))

1295

1326

for attr in dir(x))

1296

1327

if name is not None)

1297

1328

1298

1329

@dbus.service.method(dbus.PROPERTIES_IFACE,

1299

1330

in_signature="ss",

1300

1331

out_signature="v")

1308

1339

if not hasattr(value, "variant_level"):

1309

1340

return value

1310

1341

return type(value)(value, variant_level=value.variant_level+1)

1311

1342

1312

1343

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

1313

1344

def Set(self, interface_name, property_name, value):

1314

1345

"""Standard D-Bus property Set() method, see D-Bus standard.

1326

1357

value = dbus.ByteArray(b''.join(chr(byte)

1327

1358

for byte in value))

1328

1359

prop(value)

1329

1360

1330

1361

@dbus.service.method(dbus.PROPERTIES_IFACE,

1331

1362

in_signature="s",

1332

1363

out_signature="a{sv}")

1333

1364

def GetAll(self, interface_name):

1334

1365

"""Standard D-Bus property GetAll() method, see D-Bus

1335

1366

standard.

1336

1367

1337

1368

Note: Will not include properties with access="write".

1338

1369

"""

1339

1370

properties = {}

1350

1381

properties[name] = value

1351

1382

continue

1352

1383

properties[name] = type(value)(

1353

value, variant_level = value.variant_level + 1)

1384

value, variant_level=value.variant_level + 1)

1354

1385

return dbus.Dictionary(properties, signature="sv")

1355

1386

1356

1387

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1357

1388

def PropertiesChanged(self, interface_name, changed_properties,

1358

1389

invalidated_properties):

1360

1391

standard.

1361

1392

"""

1362

1393

pass

1363

1394

1364

1395

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1365

1396

out_signature="s",

1366

1397

path_keyword='object_path',

1367

1398

connection_keyword='connection')

1368

1399

def Introspect(self, object_path, connection):

1369

1400

"""Overloading of standard D-Bus method.

1370

1401

1371

1402

Inserts property tags and interface annotation tags.

1372

1403

"""

1373

1404

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1375

1406

connection)

1376

1407

try:

1377

1408

document = xml.dom.minidom.parseString(xmlstring)

1378

1409

1379

1410

def make_tag(document, name, prop):

1380

1411

e = document.createElement("property")

1381

1412

e.setAttribute("name", name)

1382

1413

e.setAttribute("type", prop._dbus_signature)

1383

1414

e.setAttribute("access", prop._dbus_access)

1384

1415

return e

1385

1416

1386

1417

for if_tag in document.getElementsByTagName("interface"):

1387

1418

# Add property tags

1388

1419

for tag in (make_tag(document, name, prop)

1430

1461

exc_info=error)

1431

1462

return xmlstring

1432

1463

1464

1433

1465

try:

1434

1466

dbus.OBJECT_MANAGER_IFACE

1435

1467

except AttributeError:

1436

1468

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1437

1469

1470

1438

1471

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1439

1472

"""A D-Bus object with an ObjectManager.

1440

1473

1441

1474

Classes inheriting from this exposes the standard

1442

1475

GetManagedObjects call and the InterfacesAdded and

1443

1476

InterfacesRemoved signals on the standard

1444

1477

"org.freedesktop.DBus.ObjectManager" interface.

1445

1478

1446

1479

Note: No signals are sent automatically; they must be sent

1447

1480

manually.

1448

1481

"""

1449

1482

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1450

out_signature = "a{oa{sa{sv}}}")

1483

out_signature="a{oa{sa{sv}}}")

1451

1484

def GetManagedObjects(self):

1452

1485

"""This function must be overridden"""

1453

1486

raise NotImplementedError()

1454

1487

1455

1488

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1456

signature = "oa{sa{sv}}")

1489

signature="oa{sa{sv}}")

1457

1490

def InterfacesAdded(self, object_path, interfaces_and_properties):

1458

1491

pass

1459

1460

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1492

1493

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")

1461

1494

def InterfacesRemoved(self, object_path, interfaces):

1462

1495

pass

1463

1496

1464

1497

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1465

out_signature = "s",

1466

path_keyword = 'object_path',

1467

connection_keyword = 'connection')

1498

out_signature="s",

1499

path_keyword='object_path',

1500

connection_keyword='connection')

1468

1501

def Introspect(self, object_path, connection):

1469

1502

"""Overloading of standard D-Bus method.

1470

1503

1471

1504

Override return argument name of GetManagedObjects to be

1472

1505

"objpath_interfaces_and_properties"

1473

1506

"""

1476

1509

connection)

1477

1510

try:

1478

1511

document = xml.dom.minidom.parseString(xmlstring)

1479

1512

1480

1513

for if_tag in document.getElementsByTagName("interface"):

1481

1514

# Fix argument name for the GetManagedObjects method

1482

1515

if (if_tag.getAttribute("name")

1483

== dbus.OBJECT_MANAGER_IFACE):

1516

== dbus.OBJECT_MANAGER_IFACE):

1484

1517

for cn in if_tag.getElementsByTagName("method"):

1485

1518

if (cn.getAttribute("name")

1486

1519

== "GetManagedObjects"):

1496

1529

except (AttributeError, xml.dom.DOMException,

1497

1530

xml.parsers.expat.ExpatError) as error:

1498

1531

logger.error("Failed to override Introspection method",

1499

exc_info = error)

1532

exc_info=error)

1500

1533

return xmlstring

1501

1534

1535

1502

1536

def datetime_to_dbus(dt, variant_level=0):

1503

1537

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1504

1538

if dt is None:

1505

return dbus.String("", variant_level = variant_level)

1539

return dbus.String("", variant_level=variant_level)

1506

1540

return dbus.String(dt.isoformat(), variant_level=variant_level)

1507

1541

1508

1542

1511

1545

dbus.service.Object, it will add alternate D-Bus attributes with

1512

1546

interface names according to the "alt_interface_names" mapping.

1513

1547

Usage:

1514

1548

1515

1549

@alternate_dbus_interfaces({"org.example.Interface":

1516

1550

"net.example.AlternateInterface"})

1517

1551

class SampleDBusObject(dbus.service.Object):

1518

1552

@dbus.service.method("org.example.Interface")

1519

1553

def SampleDBusMethod():

1520

1554

pass

1521

1555

1522

1556

The above "SampleDBusMethod" on "SampleDBusObject" will be

1523

1557

reachable via two interfaces: "org.example.Interface" and

1524

1558

"net.example.AlternateInterface", the latter of which will have

1525

1559

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1526

1560

"true", unless "deprecate" is passed with a False value.

1527

1561

1528

1562

This works for methods and signals, and also for D-Bus properties

1529

1563

(from DBusObjectWithProperties) and interfaces (from the

1530

1564

dbus_interface_annotations decorator).

1531

1565

"""

1532

1566

1533

1567

def wrapper(cls):

1534

1568

for orig_interface_name, alt_interface_name in (

1535

1569

alt_interface_names.items()):

1575

1609

attribute._dbus_annotations)

1576

1610

except AttributeError:

1577

1611

pass

1612

1578

1613

# Define a creator of a function to call both the

1579

1614

# original and alternate functions, so both the

1580

1615

# original and alternate signals gets sent when

1583

1618

"""This function is a scope container to pass

1584

1619

func1 and func2 to the "call_both" function

1585

1620

outside of its arguments"""

1586

1621

1587

1622

@functools.wraps(func2)

1588

1623

def call_both(*args, **kwargs):

1589

1624

"""This function will emit two D-Bus

1590

1625

signals by calling func1 and func2"""

1591

1626

func1(*args, **kwargs)

1592

1627

func2(*args, **kwargs)

1593

# Make wrapper function look like a D-Bus signal

1628

# Make wrapper function look like a D-Bus

1629

# signal

1594

1630

for name, attr in inspect.getmembers(func2):

1595

1631

if name.startswith("_dbus_"):

1596

1632

setattr(call_both, name, attr)

1597

1633

1598

1634

return call_both

1599

1635

# Create the "call_both" function and add it to

1600

1636

# the class

1646

1682

(copy_function(attribute)))

1647

1683

if deprecate:

1648

1684

# Deprecate all alternate interfaces

1649

iname="_AlternateDBusNames_interface_annotation{}"

1685

iname = "_AlternateDBusNames_interface_annotation{}"

1650

1686

for interface_name in interface_names:

1651

1687

1652

1688

@dbus_interface_annotations(interface_name)

1653

1689

def func(self):

1654

return { "org.freedesktop.DBus.Deprecated":

1655

"true" }

1690

return {"org.freedesktop.DBus.Deprecated":

1691

"true"}

1656

1692

# Find an unused name

1657

1693

for aname in (iname.format(i)

1658

1694

for i in itertools.count()):

1669

1705

cls = type("{}Alternate".format(cls.__name__),

1670

1706

(cls, ), attr)

1671

1707

return cls

1672

1708

1673

1709

return wrapper

1674

1710

1675

1711

1677

1713

"se.bsnet.fukt.Mandos"})

1678

1714

class ClientDBus(Client, DBusObjectWithProperties):

1679

1715

"""A Client class using D-Bus

1680

1716

1681

1717

Attributes:

1682

1718

dbus_object_path: dbus.ObjectPath

1683

1719

bus: dbus.SystemBus()

1684

1720

"""

1685

1721

1686

1722

runtime_expansions = (Client.runtime_expansions

1687

1723

+ ("dbus_object_path", ))

1688

1724

1689

1725

_interface = "se.recompile.Mandos.Client"

1690

1726

1691

1727

# dbus.service.Object doesn't use super(), so we can't either.

1692

1693

def __init__(self, bus = None, *args, **kwargs):

1728

1729

def __init__(self, bus=None, *args, **kwargs):

1694

1730

self.bus = bus

1695

1731

Client.__init__(self, *args, **kwargs)

1696

1732

# Only now, when this client is initialized, can it show up on

1702

1738

"/clients/" + client_object_name)

1703

1739

DBusObjectWithProperties.__init__(self, self.bus,

1704

1740

self.dbus_object_path)

1705

1741

1706

1742

def notifychangeproperty(transform_func, dbus_name,

1707

1743

type_func=lambda x: x,

1708

1744

variant_level=1,

1710

1746

_interface=_interface):

1711

1747

""" Modify a variable so that it's a property which announces

1712

1748

its changes to DBus.

1713

1749

1714

1750

transform_fun: Function that takes a value and a variant_level

1715

1751

and transforms it to a D-Bus type.

1716

1752

dbus_name: D-Bus name of the variable

1719

1755

variant_level: D-Bus variant level. Default: 1

1720

1756

"""

1721

1757

attrname = "_{}".format(dbus_name)

1722

1758

1723

1759

def setter(self, value):

1724

1760

if hasattr(self, "dbus_object_path"):

1725

1761

if (not hasattr(self, attrname) or

1732

1768

else:

1733

1769

dbus_value = transform_func(

1734

1770

type_func(value),

1735

variant_level = variant_level)

1771

variant_level=variant_level)

1736

1772

self.PropertyChanged(dbus.String(dbus_name),

1737

1773

dbus_value)

1738

1774

self.PropertiesChanged(

1739

1775

_interface,

1740

dbus.Dictionary({ dbus.String(dbus_name):

1741

dbus_value }),

1776

dbus.Dictionary({dbus.String(dbus_name):

1777

dbus_value}),

1742

1778

dbus.Array())

1743

1779

setattr(self, attrname, value)

1744

1780

1745

1781

return property(lambda self: getattr(self, attrname), setter)

1746

1782

1747

1783

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1748

1784

approvals_pending = notifychangeproperty(dbus.Boolean,

1749

1785

"ApprovalPending",

1750

type_func = bool)

1786

type_func=bool)

1751

1787

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1752

1788

last_enabled = notifychangeproperty(datetime_to_dbus,

1753

1789

"LastEnabled")

1754

1790

checker = notifychangeproperty(

1755

1791

dbus.Boolean, "CheckerRunning",

1756

type_func = lambda checker: checker is not None)

1792

type_func=lambda checker: checker is not None)

1757

1793

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1758

1794

"LastCheckedOK")

1759

1795

last_checker_status = notifychangeproperty(dbus.Int16,

1764

1800

"ApprovedByDefault")

1765

1801

approval_delay = notifychangeproperty(

1766

1802

dbus.UInt64, "ApprovalDelay",

1767

type_func = lambda td: td.total_seconds() * 1000)

1803

type_func=lambda td: td.total_seconds() * 1000)

1768

1804

approval_duration = notifychangeproperty(

1769

1805

dbus.UInt64, "ApprovalDuration",

1770

type_func = lambda td: td.total_seconds() * 1000)

1806

type_func=lambda td: td.total_seconds() * 1000)

1771

1807

host = notifychangeproperty(dbus.String, "Host")

1772

1808

timeout = notifychangeproperty(

1773

1809

dbus.UInt64, "Timeout",

1774

type_func = lambda td: td.total_seconds() * 1000)

1810

type_func=lambda td: td.total_seconds() * 1000)

1775

1811

extended_timeout = notifychangeproperty(

1776

1812

dbus.UInt64, "ExtendedTimeout",

1777

type_func = lambda td: td.total_seconds() * 1000)

1813

type_func=lambda td: td.total_seconds() * 1000)

1778

1814

interval = notifychangeproperty(

1779

1815

dbus.UInt64, "Interval",

1780

type_func = lambda td: td.total_seconds() * 1000)

1816

type_func=lambda td: td.total_seconds() * 1000)

1781

1817

checker_command = notifychangeproperty(dbus.String, "Checker")

1782

1818

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1783

1819

invalidate_only=True)

1784

1820

1785

1821

del notifychangeproperty

1786

1822

1787

1823

def __del__(self, *args, **kwargs):

1788

1824

try:

1789

1825

self.remove_from_connection()

1792

1828

if hasattr(DBusObjectWithProperties, "__del__"):

1793

1829

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1794

1830

Client.__del__(self, *args, **kwargs)

1795

1831

1796

1832

def checker_callback(self, source, condition,

1797

1833

connection, command, *args, **kwargs):

1798

1834

ret = Client.checker_callback(self, source, condition,

1814

1850

| self.last_checker_signal),

1815

1851

dbus.String(command))

1816

1852

return ret

1817

1853

1818

1854

def start_checker(self, *args, **kwargs):

1819

1855

old_checker_pid = getattr(self.checker, "pid", None)

1820

1856

r = Client.start_checker(self, *args, **kwargs)

1824

1860

# Emit D-Bus signal

1825

1861

self.CheckerStarted(self.current_checker_command)

1826

1862

return r

1827

1863

1828

1864

def _reset_approved(self):

1829

1865

self.approved = None

1830

1866

return False

1831

1867

1832

1868

def approve(self, value=True):

1833

1869

self.approved = value

1834

1870

GLib.timeout_add(int(self.approval_duration.total_seconds()

1835

1871

* 1000), self._reset_approved)

1836

1872

self.send_changedstate()

1837

1838

## D-Bus methods, signals & properties

1839

1840

## Interfaces

1841

1842

## Signals

1843

1873

1874

# D-Bus methods, signals & properties

1875

1876

# Interfaces

1877

1878

# Signals

1879

1844

1880

# CheckerCompleted - signal

1845

1881

@dbus.service.signal(_interface, signature="nxs")

1846

1882

def CheckerCompleted(self, exitcode, waitstatus, command):

1847

1883

"D-Bus signal"

1848

1884

pass

1849

1885

1850

1886

# CheckerStarted - signal

1851

1887

@dbus.service.signal(_interface, signature="s")

1852

1888

def CheckerStarted(self, command):

1853

1889

"D-Bus signal"

1854

1890

pass

1855

1891

1856

1892

# PropertyChanged - signal

1857

1893

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1858

1894

@dbus.service.signal(_interface, signature="sv")

1859

1895

def PropertyChanged(self, property, value):

1860

1896

"D-Bus signal"

1861

1897

pass

1862

1898

1863

1899

# GotSecret - signal

1864

1900

@dbus.service.signal(_interface)

1865

1901

def GotSecret(self):

1868

1904

server to mandos-client

1869

1905

"""

1870

1906

pass

1871

1907

1872

1908

# Rejected - signal

1873

1909

@dbus.service.signal(_interface, signature="s")

1874

1910

def Rejected(self, reason):

1875

1911

"D-Bus signal"

1876

1912

pass

1877

1913

1878

1914

# NeedApproval - signal

1879

1915

@dbus.service.signal(_interface, signature="tb")

1880

1916

def NeedApproval(self, timeout, default):

1881

1917

"D-Bus signal"

1882

1918

return self.need_approval()

1883

1884

## Methods

1885

1919

1920

# Methods

1921

1886

1922

# Approve - method

1887

1923

@dbus.service.method(_interface, in_signature="b")

1888

1924

def Approve(self, value):

1889

1925

self.approve(value)

1890

1926

1891

1927

# CheckedOK - method

1892

1928

@dbus.service.method(_interface)

1893

1929

def CheckedOK(self):

1894

1930

self.checked_ok()

1895

1931

1896

1932

# Enable - method

1897

1933

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1898

1934

@dbus.service.method(_interface)

1899

1935

def Enable(self):

1900

1936

"D-Bus method"

1901

1937

self.enable()

1902

1938

1903

1939

# StartChecker - method

1904

1940

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1905

1941

@dbus.service.method(_interface)

1906

1942

def StartChecker(self):

1907

1943

"D-Bus method"

1908

1944

self.start_checker()

1909

1945

1910

1946

# Disable - method

1911

1947

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1912

1948

@dbus.service.method(_interface)

1913

1949

def Disable(self):

1914

1950

"D-Bus method"

1915

1951

self.disable()

1916

1952

1917

1953

# StopChecker - method

1918

1954

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1919

1955

@dbus.service.method(_interface)

1920

1956

def StopChecker(self):

1921

1957

self.stop_checker()

1922

1923

## Properties

1924

1958

1959

# Properties

1960

1925

1961

# ApprovalPending - property

1926

1962

@dbus_service_property(_interface, signature="b", access="read")

1927

1963

def ApprovalPending_dbus_property(self):

1928

1964

return dbus.Boolean(bool(self.approvals_pending))

1929

1965

1930

1966

# ApprovedByDefault - property

1931

1967

@dbus_service_property(_interface,

1932

1968

signature="b",

1935

1971

if value is None: # get

1936

1972

return dbus.Boolean(self.approved_by_default)

1937

1973

self.approved_by_default = bool(value)

1938

1974

1939

1975

# ApprovalDelay - property

1940

1976

@dbus_service_property(_interface,

1941

1977

signature="t",

1945

1981

return dbus.UInt64(self.approval_delay.total_seconds()

1946

1982

* 1000)

1947

1983

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1948

1984

1949

1985

# ApprovalDuration - property

1950

1986

@dbus_service_property(_interface,

1951

1987

signature="t",

1955

1991

return dbus.UInt64(self.approval_duration.total_seconds()

1956

1992

* 1000)

1957

1993

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1958

1994

1959

1995

# Name - property

1960

1996

@dbus_annotations(

1961

1997

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1962

1998

@dbus_service_property(_interface, signature="s", access="read")

1963

1999

def Name_dbus_property(self):

1964

2000

return dbus.String(self.name)

1965

2001

1966

2002

# Fingerprint - property

1967

2003

@dbus_annotations(

1968

2004

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1969

2005

@dbus_service_property(_interface, signature="s", access="read")

1970

2006

def Fingerprint_dbus_property(self):

1971

2007

return dbus.String(self.fingerprint)

1972

2008

1973

2009

# Host - property

1974

2010

@dbus_service_property(_interface,

1975

2011

signature="s",

1978

2014

if value is None: # get

1979

2015

return dbus.String(self.host)

1980

2016

self.host = str(value)

1981

2017

1982

2018

# Created - property

1983

2019

@dbus_annotations(

1984

2020

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1985

2021

@dbus_service_property(_interface, signature="s", access="read")

1986

2022

def Created_dbus_property(self):

1987

2023

return datetime_to_dbus(self.created)

1988

2024

1989

2025

# LastEnabled - property

1990

2026

@dbus_service_property(_interface, signature="s", access="read")

1991

2027

def LastEnabled_dbus_property(self):

1992

2028

return datetime_to_dbus(self.last_enabled)

1993

2029

1994

2030

# Enabled - property

1995

2031

@dbus_service_property(_interface,

1996

2032

signature="b",

2002

2038

self.enable()

2003

2039

else:

2004

2040

self.disable()

2005

2041

2006

2042

# LastCheckedOK - property

2007

2043

@dbus_service_property(_interface,

2008

2044

signature="s",

2012

2048

self.checked_ok()

2013

2049

return

2014

2050

return datetime_to_dbus(self.last_checked_ok)

2015

2051

2016

2052

# LastCheckerStatus - property

2017

2053

@dbus_service_property(_interface, signature="n", access="read")

2018

2054

def LastCheckerStatus_dbus_property(self):

2019

2055

return dbus.Int16(self.last_checker_status)

2020

2056

2021

2057

# Expires - property

2022

2058

@dbus_service_property(_interface, signature="s", access="read")

2023

2059

def Expires_dbus_property(self):

2024

2060

return datetime_to_dbus(self.expires)

2025

2061

2026

2062

# LastApprovalRequest - property

2027

2063

@dbus_service_property(_interface, signature="s", access="read")

2028

2064

def LastApprovalRequest_dbus_property(self):

2029

2065

return datetime_to_dbus(self.last_approval_request)

2030

2066

2031

2067

# Timeout - property

2032

2068

@dbus_service_property(_interface,

2033

2069

signature="t",

2052

2088

self.disable_initiator_tag = GLib.timeout_add(

2053

2089

int((self.expires - now).total_seconds() * 1000),

2054

2090

self.disable)

2055

2091

2056

2092

# ExtendedTimeout - property

2057

2093

@dbus_service_property(_interface,

2058

2094

signature="t",

2062

2098

return dbus.UInt64(self.extended_timeout.total_seconds()

2063

2099

* 1000)

2064

2100

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2065

2101

2066

2102

# Interval - property

2067

2103

@dbus_service_property(_interface,

2068

2104

signature="t",

2078

2114

GLib.source_remove(self.checker_initiator_tag)

2079

2115

self.checker_initiator_tag = GLib.timeout_add(

2080

2116

value, self.start_checker)

2081

self.start_checker() # Start one now, too

2082

2117

self.start_checker() # Start one now, too

2118

2083

2119

# Checker - property

2084

2120

@dbus_service_property(_interface,

2085

2121

signature="s",

2088

2124

if value is None: # get

2089

2125

return dbus.String(self.checker_command)

2090

2126

self.checker_command = str(value)

2091

2127

2092

2128

# CheckerRunning - property

2093

2129

@dbus_service_property(_interface,

2094

2130

signature="b",

2100

2136

self.start_checker()

2101

2137

else:

2102

2138

self.stop_checker()

2103

2139

2104

2140

# ObjectPath - property

2105

2141

@dbus_annotations(

2106

2142

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2107

2143

"org.freedesktop.DBus.Deprecated": "true"})

2108

2144

@dbus_service_property(_interface, signature="o", access="read")

2109

2145

def ObjectPath_dbus_property(self):

2110

return self.dbus_object_path # is already a dbus.ObjectPath

2111

2146

return self.dbus_object_path # is already a dbus.ObjectPath

2147

2112

2148

# Secret = property

2113

2149

@dbus_annotations(

2114

2150

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2119

2155

byte_arrays=True)

2120

2156

def Secret_dbus_property(self, value):

2121

2157

self.secret = bytes(value)

2122

2158

2123

2159

del _interface

2124

2160

2125

2161

2129

2165

self._pipe.send(('init', fpr, address))

2130

2166

if not self._pipe.recv():

2131

2167

raise KeyError(fpr)

2132

2168

2133

2169

def __getattribute__(self, name):

2134

2170

if name == '_pipe':

2135

2171

return super(ProxyClient, self).__getattribute__(name)

2138

2174

if data[0] == 'data':

2139

2175

return data[1]

2140

2176

if data[0] == 'function':

2141

2177

2142

2178

def func(*args, **kwargs):

2143

2179

self._pipe.send(('funcall', name, args, kwargs))

2144

2180

return self._pipe.recv()[1]

2145

2181

2146

2182

return func

2147

2183

2148

2184

def __setattr__(self, name, value):

2149

2185

if name == '_pipe':

2150

2186

return super(ProxyClient, self).__setattr__(name, value)

2153

2189

2154

2190

class ClientHandler(socketserver.BaseRequestHandler, object):

2155

2191

"""A class to handle client connections.

2156

2192

2157

2193

Instantiated once for each connection to handle it.

2158

2194

Note: This will run in its own forked process."""

2159

2195

2160

2196

def handle(self):

2161

2197

with contextlib.closing(self.server.child_pipe) as child_pipe:

2162

2198

logger.info("TCP connection from: %s",

2163

2199

str(self.client_address))

2164

2200

logger.debug("Pipe FD: %d",

2165

2201

self.server.child_pipe.fileno())

2166

2202

2167

2203

session = gnutls.ClientSession(self.request)

2168

2169

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

2170

# "+AES-256-CBC", "+SHA1",

2171

# "+COMP-NULL", "+CTYPE-OPENPGP",

2172

# "+DHE-DSS"))

2204

2205

# priority = ':'.join(("NONE", "+VERS-TLS1.1",

2206

# "+AES-256-CBC", "+SHA1",

2207

# "+COMP-NULL", "+CTYPE-OPENPGP",

2208

# "+DHE-DSS"))

2173

2209

# Use a fallback default, since this MUST be set.

2174

2210

priority = self.server.gnutls_priority

2175

2211

if priority is None:

2176

2212

priority = "NORMAL"

2177

gnutls.priority_set_direct(session._c_object, priority,

2213

gnutls.priority_set_direct(session._c_object,

2214

priority.encode("utf-8"),

2178

2215

None)

2179

2216

2180

2217

# Start communication using the Mandos protocol

2181

2218

# Get protocol number

2182

2219

line = self.request.makefile().readline()

2187

2224

except (ValueError, IndexError, RuntimeError) as error:

2188

2225

logger.error("Unknown protocol version: %s", error)

2189

2226

return

2190

2227

2191

2228

# Start GnuTLS connection

2192

2229

try:

2193

2230

session.handshake()

2197

2234

# established. Just abandon the request.

2198

2235

return

2199

2236

logger.debug("Handshake succeeded")

2200

2237

2201

2238

approval_required = False

2202

2239

try:

2203

2240

try:

2207

2244

logger.warning("Bad certificate: %s", error)

2208

2245

return

2209

2246

logger.debug("Fingerprint: %s", fpr)

2210

2247

2211

2248

try:

2212

2249

client = ProxyClient(child_pipe, fpr,

2213

2250

self.client_address)

2214

2251

except KeyError:

2215

2252

return

2216

2253

2217

2254

if client.approval_delay:

2218

2255

delay = client.approval_delay

2219

2256

client.approvals_pending += 1

2220

2257

approval_required = True

2221

2258

2222

2259

while True:

2223

2260

if not client.enabled:

2224

2261

logger.info("Client %s is disabled",

2227

2264

# Emit D-Bus signal

2228

2265

client.Rejected("Disabled")

2229

2266

return

2230

2267

2231

2268

if client.approved or not client.approval_delay:

2232

#We are approved or approval is disabled

2269

# We are approved or approval is disabled

2233

2270

break

2234

2271

elif client.approved is None:

2235

2272

logger.info("Client %s needs approval",

2246

2283

# Emit D-Bus signal

2247

2284

client.Rejected("Denied")

2248

2285

return

2249

2250

#wait until timeout or approved

2286

2287

# wait until timeout or approved

2251

2288

time = datetime.datetime.now()

2252

2289

client.changedstate.acquire()

2253

2290

client.changedstate.wait(delay.total_seconds())

2266

2303

break

2267

2304

else:

2268

2305

delay -= time2 - time

2269

2306

2270

2307

try:

2271

2308

session.send(client.secret)

2272

2309

except gnutls.Error as error:

2273

2310

logger.warning("gnutls send failed",

2274

exc_info = error)

2311

exc_info=error)

2275

2312

return

2276

2313

2277

2314

logger.info("Sending secret to %s", client.name)

2278

2315

# bump the timeout using extended_timeout

2279

2316

client.bump_timeout(client.extended_timeout)

2280

2317

if self.server.use_dbus:

2281

2318

# Emit D-Bus signal

2282

2319

client.GotSecret()

2283

2320

2284

2321

finally:

2285

2322

if approval_required:

2286

2323

client.approvals_pending -= 1

2289

2326

except gnutls.Error as error:

2290

2327

logger.warning("GnuTLS bye failed",

2291

2328

exc_info=error)

2292

2329

2293

2330

@staticmethod

2294

2331

def peer_certificate(session):

2295

2332

"Return the peer's OpenPGP certificate as a bytestring"

2307

2344

return None

2308

2345

cert = cert_list[0]

2309

2346

return ctypes.string_at(cert.data, cert.size)

2310

2347

2311

2348

@staticmethod

2312

2349

def fingerprint(openpgp):

2313

2350

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2346

2383

2347

2384

class MultiprocessingMixIn(object):

2348

2385

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2349

2386

2350

2387

def sub_process_main(self, request, address):

2351

2388

try:

2352

2389

self.finish_request(request, address)

2353

2390

except Exception:

2354

2391

self.handle_error(request, address)

2355

2392

self.close_request(request)

2356

2393

2357

2394

def process_request(self, request, address):

2358

2395

"""Start a new process to process the request."""

2359

proc = multiprocessing.Process(target = self.sub_process_main,

2360

args = (request, address))

2396

proc = multiprocessing.Process(target=self.sub_process_main,

2397

args=(request, address))

2361

2398

proc.start()

2362

2399

return proc

2363

2400

2364

2401

2365

2402

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2366

2403

""" adds a pipe to the MixIn """

2367

2404

2368

2405

def process_request(self, request, client_address):

2369

2406

"""Overrides and wraps the original process_request().

2370

2407

2371

2408

This function creates a new pipe in self.pipe

2372

2409

"""

2373

2410

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2374

2411

2375

2412

proc = MultiprocessingMixIn.process_request(self, request,

2376

2413

client_address)

2377

2414

self.child_pipe.close()

2378

2415

self.add_pipe(parent_pipe, proc)

2379

2416

2380

2417

def add_pipe(self, parent_pipe, proc):

2381

2418

"""Dummy function; override as necessary"""

2382

2419

raise NotImplementedError()

2385

2422

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2386

2423

socketserver.TCPServer, object):

2387

2424

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

2388

2425

2389

2426

Attributes:

2390

2427

enabled: Boolean; whether this server is activated yet

2391

2428

interface: None or a network interface name (string)

2392

2429

use_ipv6: Boolean; to use IPv6 or not

2393

2430

"""

2394

2431

2395

2432

def __init__(self, server_address, RequestHandlerClass,

2396

2433

interface=None,

2397

2434

use_ipv6=True,

2407

2444

self.socketfd = socketfd

2408

2445

# Save the original socket.socket() function

2409

2446

self.socket_socket = socket.socket

2447

2410

2448

# To implement --socket, we monkey patch socket.socket.

2411

#

2449

#

2412

2450

# (When socketserver.TCPServer is a new-style class, we

2413

2451

# could make self.socket into a property instead of monkey

2414

2452

# patching socket.socket.)

2415

#

2453

#

2416

2454

# Create a one-time-only replacement for socket.socket()

2417

2455

@functools.wraps(socket.socket)

2418

2456

def socket_wrapper(*args, **kwargs):

2430

2468

# socket_wrapper(), if socketfd was set.

2431

2469

socketserver.TCPServer.__init__(self, server_address,

2432

2470

RequestHandlerClass)

2433

2471

2434

2472

def server_bind(self):

2435

2473

"""This overrides the normal server_bind() function

2436

2474

to bind to an interface if one was specified, and also NOT to

2437

2475

bind to an address or port if they were not specified."""

2476

global SO_BINDTODEVICE

2438

2477

if self.interface is not None:

2439

2478

if SO_BINDTODEVICE is None:

2440

logger.error("SO_BINDTODEVICE does not exist;"

2441

" cannot bind to interface %s",

2442

self.interface)

2443

else:

2444

try:

2445

self.socket.setsockopt(

2446

socket.SOL_SOCKET, SO_BINDTODEVICE,

2447

(self.interface + "\0").encode("utf-8"))

2448

except socket.error as error:

2449

if error.errno == errno.EPERM:

2450

logger.error("No permission to bind to"

2451

" interface %s", self.interface)

2452

elif error.errno == errno.ENOPROTOOPT:

2453

logger.error("SO_BINDTODEVICE not available;"

2454

" cannot bind to interface %s",

2455

self.interface)

2456

elif error.errno == errno.ENODEV:

2457

logger.error("Interface %s does not exist,"

2458

" cannot bind", self.interface)

2459

else:

2460

raise

2479

# Fall back to a hard-coded value which seems to be

2480

# common enough.

2481

logger.warning("SO_BINDTODEVICE not found, trying 25")

2482

SO_BINDTODEVICE = 25

2483

try:

2484

self.socket.setsockopt(

2485

socket.SOL_SOCKET, SO_BINDTODEVICE,

2486

(self.interface + "\0").encode("utf-8"))

2487

except socket.error as error:

2488

if error.errno == errno.EPERM:

2489

logger.error("No permission to bind to"

2490

" interface %s", self.interface)

2491

elif error.errno == errno.ENOPROTOOPT:

2492

logger.error("SO_BINDTODEVICE not available;"

2493

" cannot bind to interface %s",

2494

self.interface)

2495

elif error.errno == errno.ENODEV:

2496

logger.error("Interface %s does not exist,"

2497

" cannot bind", self.interface)

2498

else:

2499

raise

2461

2500

# Only bind(2) the socket if we really need to.

2462

2501

if self.server_address[0] or self.server_address[1]:

2463

2502

if not self.server_address[0]:

2464

2503

if self.address_family == socket.AF_INET6:

2465

any_address = "::" # in6addr_any

2504

any_address = "::" # in6addr_any

2466

2505

else:

2467

any_address = "0.0.0.0" # INADDR_ANY

2506

any_address = "0.0.0.0" # INADDR_ANY

2468

2507

self.server_address = (any_address,

2469

2508

self.server_address[1])

2470

2509

elif not self.server_address[1]:

2480

2519

2481

2520

class MandosServer(IPv6_TCPServer):

2482

2521

"""Mandos server.

2483

2522

2484

2523

Attributes:

2485

2524

clients: set of Client objects

2486

2525

gnutls_priority GnuTLS priority string

2487

2526

use_dbus: Boolean; to emit D-Bus signals or not

2488

2527

2489

2528

Assumes a GLib.MainLoop event loop.

2490

2529

"""

2491

2530

2492

2531

def __init__(self, server_address, RequestHandlerClass,

2493

2532

interface=None,

2494

2533

use_ipv6=True,

2504

2543

self.gnutls_priority = gnutls_priority

2505

2544

IPv6_TCPServer.__init__(self, server_address,

2506

2545

RequestHandlerClass,

2507

interface = interface,

2508

use_ipv6 = use_ipv6,

2509

socketfd = socketfd)

2510

2546

interface=interface,

2547

use_ipv6=use_ipv6,

2548

socketfd=socketfd)

2549

2511

2550

def server_activate(self):

2512

2551

if self.enabled:

2513

2552

return socketserver.TCPServer.server_activate(self)

2514

2553

2515

2554

def enable(self):

2516

2555

self.enabled = True

2517

2556

2518

2557

def add_pipe(self, parent_pipe, proc):

2519

2558

# Call "handle_ipc" for both data and EOF events

2520

2559

GLib.io_add_watch(

2521

2560

parent_pipe.fileno(),

2522

2561

GLib.IO_IN | GLib.IO_HUP,

2523

2562

functools.partial(self.handle_ipc,

2524

parent_pipe = parent_pipe,

2525

proc = proc))

2526

2563

parent_pipe=parent_pipe,

2564

proc=proc))

2565

2527

2566

def handle_ipc(self, source, condition,

2528

2567

parent_pipe=None,

2529

proc = None,

2568

proc=None,

2530

2569

client_object=None):

2531

2570

# error, or the other end of multiprocessing.Pipe has closed

2532

2571

if condition & (GLib.IO_ERR | GLib.IO_HUP):

2533

2572

# Wait for other process to exit

2534

2573

proc.join()

2535

2574

return False

2536

2575

2537

2576

# Read a request from the child

2538

2577

request = parent_pipe.recv()

2539

2578

command = request[0]

2540

2579

2541

2580

if command == 'init':

2542

fpr = request[1]

2581

fpr = request[1].decode("ascii")

2543

2582

address = request[2]

2544

2583

2545

2584

for c in self.clients.values():

2546

2585

if c.fingerprint == fpr:

2547

2586

client = c

2555

2594

address[0])

2556

2595

parent_pipe.send(False)

2557

2596

return False

2558

2597

2559

2598

GLib.io_add_watch(

2560

2599

parent_pipe.fileno(),

2561

2600

GLib.IO_IN | GLib.IO_HUP,

2562

2601

functools.partial(self.handle_ipc,

2563

parent_pipe = parent_pipe,

2564

proc = proc,

2565

client_object = client))

2602

parent_pipe=parent_pipe,

2603

proc=proc,

2604

client_object=client))

2566

2605

parent_pipe.send(True)

2567

2606

# remove the old hook in favor of the new above hook on

2568

2607

# same fileno

2571

2610

funcname = request[1]

2572

2611

args = request[2]

2573

2612

kwargs = request[3]

2574

2613

2575

2614

parent_pipe.send(('data', getattr(client_object,

2576

2615

funcname)(*args,

2577

2616

**kwargs)))

2578

2617

2579

2618

if command == 'getattr':

2580

2619

attrname = request[1]

2581

2620

if isinstance(client_object.__getattribute__(attrname),

2584

2623

else:

2585

2624

parent_pipe.send((

2586

2625

'data', client_object.__getattribute__(attrname)))

2587

2626

2588

2627

if command == 'setattr':

2589

2628

attrname = request[1]

2590

2629

value = request[2]

2591

2630

setattr(client_object, attrname, value)

2592

2631

2593

2632

return True

2594

2633

2595

2634

2596

2635

def rfc3339_duration_to_delta(duration):

2597

2636

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2598

2637

2599

2638

>>> rfc3339_duration_to_delta("P7D")

2600

2639

datetime.timedelta(7)

2601

2640

>>> rfc3339_duration_to_delta("PT60S")

2611

2650

>>> rfc3339_duration_to_delta("P1DT3M20S")

2612

2651

datetime.timedelta(1, 200)

2613

2652

"""

2614

2653

2615

2654

# Parsing an RFC 3339 duration with regular expressions is not

2616

2655

# possible - there would have to be multiple places for the same

2617

2656

# values, like seconds. The current code, while more esoteric, is

2618

2657

# cleaner without depending on a parsing library. If Python had a

2619

2658

# built-in library for parsing we would use it, but we'd like to

2620

2659

# avoid excessive use of external libraries.

2621

2660

2622

2661

# New type for defining tokens, syntax, and semantics all-in-one

2623

2662

Token = collections.namedtuple("Token", (

2624

2663

"regexp", # To match token; if "value" is not None, must have

2657

2696

frozenset((token_year, token_month,

2658

2697

token_day, token_time,

2659

2698

token_week)))

2660

# Define starting values

2661

value = datetime.timedelta() # Value so far

2699

# Define starting values:

2700

# Value so far

2701

value = datetime.timedelta()

2662

2702

found_token = None

2663

followers = frozenset((token_duration, )) # Following valid tokens

2664

s = duration # String left to parse

2703

# Following valid tokens

2704

followers = frozenset((token_duration, ))

2705

# String left to parse

2706

s = duration

2665

2707

# Loop until end token is found

2666

2708

while found_token is not token_end:

2667

2709

# Search for any currently valid tokens

2691

2733

2692

2734

def string_to_delta(interval):

2693

2735

"""Parse a string and return a datetime.timedelta

2694

2736

2695

2737

>>> string_to_delta('7d')

2696

2738

datetime.timedelta(7)

2697

2739

>>> string_to_delta('60s')

2705

2747

>>> string_to_delta('5m 30s')

2706

2748

datetime.timedelta(0, 330)

2707

2749

"""

2708

2750

2709

2751

try:

2710

2752

return rfc3339_duration_to_delta(interval)

2711

2753

except ValueError:

2712

2754

pass

2713

2755

2714

2756

timevalue = datetime.timedelta(0)

2715

2757

for s in interval.split():

2716

2758

try:

2734

2776

return timevalue

2735

2777

2736

2778

2737

def daemon(nochdir = False, noclose = False):

2779

def daemon(nochdir=False, noclose=False):

2738

2780

"""See daemon(3). Standard BSD Unix function.

2739

2781

2740

2782

This should really exist as os.daemon, but it doesn't (yet)."""

2741

2783

if os.fork():

2742

2784

sys.exit()

2760

2802

2761

2803

2762

2804

def main():

2763

2805

2764

2806

##################################################################

2765

2807

# Parsing of options, both command line and config file

2766

2808

2767

2809

parser = argparse.ArgumentParser()

2768

2810

parser.add_argument("-v", "--version", action="version",

2769

version = "%(prog)s {}".format(version),

2811

version="%(prog)s {}".format(version),

2770

2812

help="show version number and exit")

2771

2813

parser.add_argument("-i", "--interface", metavar="IF",

2772

2814

help="Bind to interface IF")

2808

2850

parser.add_argument("--no-zeroconf", action="store_false",

2809

2851

dest="zeroconf", help="Do not use Zeroconf",

2810

2852

default=None)

2811

2853

2812

2854

options = parser.parse_args()

2813

2855

2814

2856

if options.check:

2815

2857

import doctest

2816

2858

fail_count, test_count = doctest.testmod()

2817

2859

sys.exit(os.EX_OK if fail_count == 0 else 1)

2818

2860

2819

2861

# Default values for config file for server-global settings

2820

server_defaults = { "interface": "",

2821

"address": "",

2822

"port": "",

2823

"debug": "False",

2824

"priority":

2825

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2826

":+SIGN-DSA-SHA256",

2827

"servicename": "Mandos",

2828

"use_dbus": "True",

2829

"use_ipv6": "True",

2830

"debuglevel": "",

2831

"restore": "True",

2832

"socket": "",

2833

"statedir": "/var/lib/mandos",

2834

"foreground": "False",

2835

"zeroconf": "True",

2836

}

2837

2862

server_defaults = {"interface": "",

2863

"address": "",

2864

"port": "",

2865

"debug": "False",

2866

"priority":

2867

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2868

":+SIGN-DSA-SHA256",

2869

"servicename": "Mandos",

2870

"use_dbus": "True",

2871

"use_ipv6": "True",

2872

"debuglevel": "",

2873

"restore": "True",

2874

"socket": "",

2875

"statedir": "/var/lib/mandos",

2876

"foreground": "False",

2877

"zeroconf": "True",

2878

}

2879

2838

2880

# Parse config file for server-global settings

2839

2881

server_config = configparser.SafeConfigParser(server_defaults)

2840

2882

del server_defaults

2842

2884

# Convert the SafeConfigParser object to a dict

2843

2885

server_settings = server_config.defaults()

2844

2886

# Use the appropriate methods on the non-string config options

2845

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

2887

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2888

"foreground", "zeroconf"):

2846

2889

server_settings[option] = server_config.getboolean("DEFAULT",

2847

2890

option)

2848

2891

if server_settings["port"]:

2858

2901

server_settings["socket"] = os.dup(server_settings

2859

2902

["socket"])

2860

2903

del server_config

2861

2904

2862

2905

# Override the settings from the config file with command line

2863

2906

# options, if set.

2864

2907

for option in ("interface", "address", "port", "debug",

2882

2925

if server_settings["debug"]:

2883

2926

server_settings["foreground"] = True

2884

2927

# Now we have our good server settings in "server_settings"

2885

2928

2886

2929

##################################################################

2887

2930

2888

2931

if (not server_settings["zeroconf"]

2889

2932

and not (server_settings["port"]

2890

2933

or server_settings["socket"] != "")):

2891

2934

parser.error("Needs port or socket to work without Zeroconf")

2892

2935

2893

2936

# For convenience

2894

2937

debug = server_settings["debug"]

2895

2938

debuglevel = server_settings["debuglevel"]

2899

2942

stored_state_file)

2900

2943

foreground = server_settings["foreground"]

2901

2944

zeroconf = server_settings["zeroconf"]

2902

2945

2903

2946

if debug:

2904

2947

initlogger(debug, logging.DEBUG)

2905

2948

else:

2908

2951

else:

2909

2952

level = getattr(logging, debuglevel.upper())

2910

2953

initlogger(debug, level)

2911

2954

2912

2955

if server_settings["servicename"] != "Mandos":

2913

2956

syslogger.setFormatter(

2914

2957

logging.Formatter('Mandos ({}) [%(process)d]:'

2915

2958

' %(levelname)s: %(message)s'.format(

2916

2959

server_settings["servicename"])))

2917

2960

2918

2961

# Parse config file with clients

2919

2962

client_config = configparser.SafeConfigParser(Client

2920

2963

.client_defaults)

2921

2964

client_config.read(os.path.join(server_settings["configdir"],

2922

2965

"clients.conf"))

2923

2966

2924

2967

global mandos_dbus_service

2925

2968

mandos_dbus_service = None

2926

2969

2927

2970

socketfd = None

2928

2971

if server_settings["socket"] != "":

2929

2972

socketfd = server_settings["socket"]

2945

2988

except IOError as e:

2946

2989

logger.error("Could not open file %r", pidfilename,

2947

2990

exc_info=e)

2948

2991

2949

2992

for name, group in (("_mandos", "_mandos"),

2950

2993

("mandos", "mandos"),

2951

2994

("nobody", "nogroup")):

2969

3012

.format(uid, gid, os.strerror(error.errno)))

2970

3013

if error.errno != errno.EPERM:

2971

3014

raise

2972

3015

2973

3016

if debug:

2974

3017

# Enable all possible GnuTLS debugging

2975

3018

2976

3019

# "Use a log level over 10 to enable all debugging options."

2977

3020

# - GnuTLS manual

2978

3021

gnutls.global_set_log_level(11)

2979

3022

2980

3023

@gnutls.log_func

2981

3024

def debug_gnutls(level, string):

2982

3025

logger.debug("GnuTLS: %s", string[:-1])

2983

3026

2984

3027

gnutls.global_set_log_function(debug_gnutls)

2985

3028

2986

3029

# Redirect stdin so all checkers get /dev/null

2987

3030

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2988

3031

os.dup2(null, sys.stdin.fileno())

2989

3032

if null > 2:

2990

3033

os.close(null)

2991

3034

2992

3035

# Need to fork before connecting to D-Bus

2993

3036

if not foreground:

2994

3037

# Close all input and output, do double fork, etc.

2995

3038

daemon()

2996

3039

2997

3040

# multiprocessing will use threads, so before we use GLib we need

2998

3041

# to inform GLib that threads will be used.

2999

3042

GLib.threads_init()

3000

3043

3001

3044

global main_loop

3002

3045

# From the Avahi example code

3003

3046

DBusGMainLoop(set_as_default=True)

3020

3063

if zeroconf:

3021

3064

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3022

3065

service = AvahiServiceToSyslog(

3023

name = server_settings["servicename"],

3024

servicetype = "_mandos._tcp",

3025

protocol = protocol,

3026

bus = bus)

3066

name=server_settings["servicename"],

3067

servicetype="_mandos._tcp",

3068

protocol=protocol,

3069

bus=bus)

3027

3070

if server_settings["interface"]:

3028

3071

service.interface = if_nametoindex(

3029

3072

server_settings["interface"].encode("utf-8"))

3030

3073

3031

3074

global multiprocessing_manager

3032

3075

multiprocessing_manager = multiprocessing.Manager()

3033

3076

3034

3077

client_class = Client

3035

3078

if use_dbus:

3036

client_class = functools.partial(ClientDBus, bus = bus)

3037

3079

client_class = functools.partial(ClientDBus, bus=bus)

3080

3038

3081

client_settings = Client.config_parser(client_config)

3039

3082

old_client_settings = {}

3040

3083

clients_data = {}

3041

3084

3042

3085

# This is used to redirect stdout and stderr for checker processes

3043

3086

global wnull

3044

wnull = open(os.devnull, "w") # A writable /dev/null

3087

wnull = open(os.devnull, "w") # A writable /dev/null

3045

3088

# Only used if server is running in foreground but not in debug

3046

3089

# mode

3047

3090

if debug or not foreground:

3048

3091

wnull.close()

3049

3092

3050

3093

# Get client data and settings from last running state.

3051

3094

if server_settings["restore"]:

3052

3095

try:

3053

3096

with open(stored_state_path, "rb") as stored_state:

3054

if sys.version_info.major == 2:

3097

if sys.version_info.major == 2:

3055

3098

clients_data, old_client_settings = pickle.load(

3056

3099

stored_state)

3057

3100

else:

3058

3101

bytes_clients_data, bytes_old_client_settings = (

3059

pickle.load(stored_state, encoding = "bytes"))

3060

### Fix bytes to strings

3061

## clients_data

3102

pickle.load(stored_state, encoding="bytes"))

3103

# Fix bytes to strings

3104

# clients_data

3062

3105

# .keys()

3063

clients_data = { (key.decode("utf-8")

3064

if isinstance(key, bytes)

3065

else key): value

3066

for key, value in

3067

bytes_clients_data.items() }

3106

clients_data = {(key.decode("utf-8")

3107

if isinstance(key, bytes)

3108

else key): value

3109

for key, value in

3110

bytes_clients_data.items()}

3068

3111

del bytes_clients_data

3069

3112

for key in clients_data:

3070

value = { (k.decode("utf-8")

3071

if isinstance(k, bytes) else k): v

3072

for k, v in

3073

clients_data[key].items() }

3113

value = {(k.decode("utf-8")

3114

if isinstance(k, bytes) else k): v

3115

for k, v in

3116

clients_data[key].items()}

3074

3117

clients_data[key] = value

3075

3118

# .client_structure

3076

3119

value["client_structure"] = [

3077

3120

(s.decode("utf-8")

3078

3121

if isinstance(s, bytes)

3079

3122

else s) for s in

3080

value["client_structure"] ]

3123

value["client_structure"]]

3081

3124

# .name & .host

3082

3125

for k in ("name", "host"):

3083

3126

if isinstance(value[k], bytes):

3084

3127

value[k] = value[k].decode("utf-8")

3085

## old_client_settings

3128

# old_client_settings

3086

3129

# .keys()

3087

3130

old_client_settings = {

3088

3131

(key.decode("utf-8")

3089

3132

if isinstance(key, bytes)

3090

3133

else key): value

3091

3134

for key, value in

3092

bytes_old_client_settings.items() }

3135

bytes_old_client_settings.items()}

3093

3136

del bytes_old_client_settings

3094

3137

# .host

3095

3138

for value in old_client_settings.values():

3109

3152

logger.warning("Could not load persistent state: "

3110

3153

"EOFError:",

3111

3154

exc_info=e)

3112

3155

3113

3156

with PGPEngine() as pgp:

3114

3157

for client_name, client in clients_data.items():

3115

3158

# Skip removed clients

3116

3159

if client_name not in client_settings:

3117

3160

continue

3118

3161

3119

3162

# Decide which value to use after restoring saved state.

3120

3163

# We have three different values: Old config file,

3121

3164

# new config file, and saved state.

3132

3175

client[name] = value

3133

3176

except KeyError:

3134

3177

pass

3135

3178

3136

3179

# Clients who has passed its expire date can still be

3137

3180

# enabled if its last checker was successful. A Client

3138

3181

# whose checker succeeded before we stored its state is

3171

3214

client_name))

3172

3215

client["secret"] = (client_settings[client_name]

3173

3216

["secret"])

3174

3217

3175

3218

# Add/remove clients based on new changes made to config

3176

3219

for client_name in (set(old_client_settings)

3177

3220

- set(client_settings)):

3179

3222

for client_name in (set(client_settings)

3180

3223

- set(old_client_settings)):

3181

3224

clients_data[client_name] = client_settings[client_name]

3182

3225

3183

3226

# Create all client objects

3184

3227

for client_name, client in clients_data.items():

3185

3228

tcp_server.clients[client_name] = client_class(

3186

name = client_name,

3187

settings = client,

3188

server_settings = server_settings)

3189

3229

name=client_name,

3230

settings=client,

3231

server_settings=server_settings)

3232

3190

3233

if not tcp_server.clients:

3191

3234

logger.warning("No clients defined")

3192

3235

3193

3236

if not foreground:

3194

3237

if pidfile is not None:

3195

3238

pid = os.getpid()

3201

3244

pidfilename, pid)

3202

3245

del pidfile

3203

3246

del pidfilename

3204

3247

3205

3248

for termsig in (signal.SIGHUP, signal.SIGTERM):

3206

3249

GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,

3207

3250

lambda: main_loop.quit() and False)

3208

3251

3209

3252

if use_dbus:

3210

3253

3211

3254

@alternate_dbus_interfaces(

3212

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3255

{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})

3213

3256

class MandosDBusService(DBusObjectWithObjectManager):

3214

3257

"""A D-Bus proxy object"""

3215

3258

3216

3259

def __init__(self):

3217

3260

dbus.service.Object.__init__(self, bus, "/")

3218

3261

3219

3262

_interface = "se.recompile.Mandos"

3220

3263

3221

3264

@dbus.service.signal(_interface, signature="o")

3222

3265

def ClientAdded(self, objpath):

3223

3266

"D-Bus signal"

3224

3267

pass

3225

3268

3226

3269

@dbus.service.signal(_interface, signature="ss")

3227

3270

def ClientNotFound(self, fingerprint, address):

3228

3271

"D-Bus signal"

3229

3272

pass

3230

3273

3231

3274

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3232

3275

"true"})

3233

3276

@dbus.service.signal(_interface, signature="os")

3234

3277

def ClientRemoved(self, objpath, name):

3235

3278

"D-Bus signal"

3236

3279

pass

3237

3280

3238

3281

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3239

3282

"true"})

3240

3283

@dbus.service.method(_interface, out_signature="ao")

3242

3285

"D-Bus method"

3243

3286

return dbus.Array(c.dbus_object_path for c in

3244

3287

tcp_server.clients.values())

3245

3288

3246

3289

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3247

3290

"true"})

3248

3291

@dbus.service.method(_interface,

3250

3293

def GetAllClientsWithProperties(self):

3251

3294

"D-Bus method"

3252

3295

return dbus.Dictionary(

3253

{ c.dbus_object_path: c.GetAll(

3296

{c.dbus_object_path: c.GetAll(

3254

3297

"se.recompile.Mandos.Client")

3255

for c in tcp_server.clients.values() },

3298

for c in tcp_server.clients.values()},

3256

3299

signature="oa{sv}")

3257

3300

3258

3301

@dbus.service.method(_interface, in_signature="o")

3259

3302

def RemoveClient(self, object_path):

3260

3303

"D-Bus method"

3268

3311

self.client_removed_signal(c)

3269

3312

return

3270

3313

raise KeyError(object_path)

3271

3314

3272

3315

del _interface

3273

3316

3274

3317

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3275

out_signature = "a{oa{sa{sv}}}")

3318

out_signature="a{oa{sa{sv}}}")

3276

3319

def GetManagedObjects(self):

3277

3320

"""D-Bus method"""

3278

3321

return dbus.Dictionary(

3279

{ client.dbus_object_path:

3280

dbus.Dictionary(

3281

{ interface: client.GetAll(interface)

3282

for interface in

3283

client._get_all_interface_names()})

3284

for client in tcp_server.clients.values()})

3285

3322

{client.dbus_object_path:

3323

dbus.Dictionary(

3324

{interface: client.GetAll(interface)

3325

for interface in

3326

client._get_all_interface_names()})

3327

for client in tcp_server.clients.values()})

3328

3286

3329

def client_added_signal(self, client):

3287

3330

"""Send the new standard signal and the old signal"""

3288

3331

if use_dbus:

3290

3333

self.InterfacesAdded(

3291

3334

client.dbus_object_path,

3292

3335

dbus.Dictionary(

3293

{ interface: client.GetAll(interface)

3294

for interface in

3295

client._get_all_interface_names()}))

3336

{interface: client.GetAll(interface)

3337

for interface in

3338

client._get_all_interface_names()}))

3296

3339

# Old signal

3297

3340

self.ClientAdded(client.dbus_object_path)

3298

3341

3299

3342

def client_removed_signal(self, client):

3300

3343

"""Send the new standard signal and the old signal"""

3301

3344

if use_dbus:

3306

3349

# Old signal

3307

3350

self.ClientRemoved(client.dbus_object_path,

3308

3351

client.name)

3309

3352

3310

3353

mandos_dbus_service = MandosDBusService()

3311

3354

3355

# Save modules to variables to exempt the modules from being

3356

# unloaded before the function registered with atexit() is run.

3357

mp = multiprocessing

3358

wn = wnull

3359

3312

3360

def cleanup():

3313

3361

"Cleanup function; run on exit"

3314

3362

if zeroconf:

3315

3363

service.cleanup()

3316

3317

multiprocessing.active_children()

3318

wnull.close()

3364

3365

mp.active_children()

3366

wn.close()

3319

3367

if not (tcp_server.clients or client_settings):

3320

3368

return

3321

3369

3322

3370

# Store client before exiting. Secrets are encrypted with key

3323

3371

# based on what config file has. If config file is

3324

3372

# removed/edited, old secret will thus be unrecovable.

3329

3377

client.encrypted_secret = pgp.encrypt(client.secret,

3330

3378

key)

3331

3379

client_dict = {}

3332

3380

3333

3381

# A list of attributes that can not be pickled

3334

3382

# + secret.

3335

exclude = { "bus", "changedstate", "secret",

3336

"checker", "server_settings" }

3383

exclude = {"bus", "changedstate", "secret",

3384

"checker", "server_settings"}

3337

3385

for name, typ in inspect.getmembers(dbus.service

3338

3386

.Object):

3339

3387

exclude.add(name)

3340

3388

3341

3389

client_dict["encrypted_secret"] = (client

3342

3390

.encrypted_secret)

3343

3391

for attr in client.client_structure:

3344

3392

if attr not in exclude:

3345

3393

client_dict[attr] = getattr(client, attr)

3346

3394

3347

3395

clients[client.name] = client_dict

3348

3396

del client_settings[client.name]["secret"]

3349

3397

3350

3398

try:

3351

3399

with tempfile.NamedTemporaryFile(

3352

3400

mode='wb',

3355

3403

dir=os.path.dirname(stored_state_path),

3356

3404

delete=False) as stored_state:

3357

3405

pickle.dump((clients, client_settings), stored_state,

3358

protocol = 2)

3406

protocol=2)

3359

3407

tempname = stored_state.name

3360

3408

os.rename(tempname, stored_state_path)

3361

3409

except (IOError, OSError) as e:

3371

3419

logger.warning("Could not save persistent state:",

3372

3420

exc_info=e)

3373

3421

raise

3374

3422

3375

3423

# Delete all clients, and settings from config

3376

3424

while tcp_server.clients:

3377

3425

name, client = tcp_server.clients.popitem()

3383

3431

if use_dbus:

3384

3432

mandos_dbus_service.client_removed_signal(client)

3385

3433

client_settings.clear()

3386

3434

3387

3435

atexit.register(cleanup)

3388

3436

3389

3437

for client in tcp_server.clients.values():

3390

3438

if use_dbus:

3391

3439

# Emit D-Bus signal for adding

3393

3441

# Need to initiate checking of clients

3394

3442

if client.enabled:

3395

3443

client.init_checker()

3396

3444

3397

3445

tcp_server.enable()

3398

3446

tcp_server.server_activate()

3399

3447

3400

3448

# Find out what port we got

3401

3449

if zeroconf:

3402

3450

service.port = tcp_server.socket.getsockname()[1]

3407

3455

else: # IPv4

3408

3456

logger.info("Now listening on address %r, port %d",

3409

3457

*tcp_server.socket.getsockname())

3410

3411

#service.interface = tcp_server.socket.getsockname()[3]

3412

3458

3459

# service.interface = tcp_server.socket.getsockname()[3]

3460

3413

3461

try:

3414

3462

if zeroconf:

3415

3463

# From the Avahi example code

3420

3468

cleanup()

3421

3469

sys.exit(1)

3422

3470

# End of Avahi example code

3423

3471

3424

3472

GLib.io_add_watch(tcp_server.fileno(), GLib.IO_IN,

3425

3473

lambda *args, **kwargs:

3426

3474

(tcp_server.handle_request

3427

3475

(*args[2:], **kwargs) or True))

3428

3476

3429

3477

logger.debug("Starting main loop")

3430

3478

main_loop.run()

3431

3479

except AvahiError as error: