/mandos/trunk : revision 24.1.180

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

try:

38

from future_builtins import *

39

except ImportError:

40

pass

41

42

try:

43

import SocketServer as socketserver

44

except ImportError:

45

import socketserver

37

import SocketServer as socketserver

46

38

import socket

47

39

import argparse

48

40

import datetime

49

41

import errno

50

try:

51

import ConfigParser as configparser

52

except ImportError:

53

import configparser

42

import gnutls.crypto

43

import gnutls.connection

44

import gnutls.errors

45

import gnutls.library.functions

46

import gnutls.library.constants

47

import gnutls.library.types

48

import ConfigParser as configparser

54

49

import sys

55

50

import re

56

51

import os

65

60

import struct

66

61

import fcntl

67

62

import functools

68

try:

69

import cPickle as pickle

70

except ImportError:

71

import pickle

63

import cPickle as pickle

72

64

import multiprocessing

73

import types

74

import binascii

75

import tempfile

76

import itertools

77

import collections

78

import codecs

79

65

80

66

import dbus

81

67

import dbus.service

82

try:

83

from gi.repository import GObject

84

except ImportError:

85

import gobject as GObject

68

import gobject

69

import avahi

86

70

from dbus.mainloop.glib import DBusGMainLoop

87

71

import ctypes

88

72

import ctypes.util

97

81

except ImportError:

98

82

SO_BINDTODEVICE = None

99

83

100

if sys.version_info.major == 2:

101

str = unicode

102

103

version = "1.7.5"

104

stored_state_file = "clients.pickle"

105

106

logger = logging.getLogger()

107

syslogger = None

108

109

try:

110

if_nametoindex = ctypes.cdll.LoadLibrary(

111

ctypes.util.find_library("c")).if_nametoindex

112

except (OSError, AttributeError):

113

114

def if_nametoindex(interface):

115

"Get an interface index the hard way, i.e. using fcntl()"

116

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

117

with contextlib.closing(socket.socket()) as s:

118

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

119

struct.pack(b"16s16x", interface))

120

interface_index = struct.unpack("I", ifreq[16:20])[0]

121

return interface_index

122

123

124

def copy_function(func):

125

"""Make a copy of a function"""

126

if sys.version_info.major == 2:

127

return types.FunctionType(func.func_code,

128

func.func_globals,

129

func.func_name,

130

func.func_defaults,

131

func.func_closure)

132

else:

133

return types.FunctionType(func.__code__,

134

func.__globals__,

135

func.__name__,

136

func.__defaults__,

137

func.__closure__)

138

139

140

def initlogger(debug, level=logging.WARNING):

141

"""init logger and add loglevel"""

142

143

global syslogger

144

syslogger = (logging.handlers.SysLogHandler(

145

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

146

address = "/dev/log"))

147

syslogger.setFormatter(logging.Formatter

148

('Mandos [%(process)d]: %(levelname)s:'

149

' %(message)s'))

150

logger.addHandler(syslogger)

151

152

if debug:

153

console = logging.StreamHandler()

154

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

155

' [%(process)d]:'

156

' %(levelname)s:'

157

' %(message)s'))

158

logger.addHandler(console)

159

logger.setLevel(level)

160

161

162

class PGPError(Exception):

163

"""Exception if encryption/decryption fails"""

164

pass

165

166

167

class PGPEngine(object):

168

"""A simple class for OpenPGP symmetric encryption & decryption"""

169

170

def __init__(self):

171

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

172

self.gpg = "gpg"

173

try:

174

output = subprocess.check_output(["gpgconf"])

175

for line in output.splitlines():

176

name, text, path = line.split(b":")

177

if name == "gpg":

178

self.gpg = path

179

break

180

except OSError as e:

181

if e.errno != errno.ENOENT:

182

raise

183

self.gnupgargs = ['--batch',

184

'--homedir', self.tempdir,

185

'--force-mdc',

186

'--quiet',

187

'--no-use-agent']

188

189

def __enter__(self):

190

return self

191

192

def __exit__(self, exc_type, exc_value, traceback):

193

self._cleanup()

194

return False

195

196

def __del__(self):

197

self._cleanup()

198

199

def _cleanup(self):

200

if self.tempdir is not None:

201

# Delete contents of tempdir

202

for root, dirs, files in os.walk(self.tempdir,

203

topdown = False):

204

for filename in files:

205

os.remove(os.path.join(root, filename))

206

for dirname in dirs:

207

os.rmdir(os.path.join(root, dirname))

208

# Remove tempdir

209

os.rmdir(self.tempdir)

210

self.tempdir = None

211

212

def password_encode(self, password):

213

# Passphrase can not be empty and can not contain newlines or

214

# NUL bytes. So we prefix it and hex encode it.

215

encoded = b"mandos" + binascii.hexlify(password)

216

if len(encoded) > 2048:

217

# GnuPG can't handle long passwords, so encode differently

218

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

219

.replace(b"\n", b"\\n")

220

.replace(b"\0", b"\\x00"))

221

return encoded

222

223

def encrypt(self, data, password):

224

passphrase = self.password_encode(password)

225

with tempfile.NamedTemporaryFile(

226

dir=self.tempdir) as passfile:

227

passfile.write(passphrase)

228

passfile.flush()

229

proc = subprocess.Popen([self.gpg, '--symmetric',

230

'--passphrase-file',

231

passfile.name]

232

+ self.gnupgargs,

233

stdin = subprocess.PIPE,

234

stdout = subprocess.PIPE,

235

stderr = subprocess.PIPE)

236

ciphertext, err = proc.communicate(input = data)

237

if proc.returncode != 0:

238

raise PGPError(err)

239

return ciphertext

240

241

def decrypt(self, data, password):

242

passphrase = self.password_encode(password)

243

with tempfile.NamedTemporaryFile(

244

dir = self.tempdir) as passfile:

245

passfile.write(passphrase)

246

passfile.flush()

247

proc = subprocess.Popen([self.gpg, '--decrypt',

248

'--passphrase-file',

249

passfile.name]

250

+ self.gnupgargs,

251

stdin = subprocess.PIPE,

252

stdout = subprocess.PIPE,

253

stderr = subprocess.PIPE)

254

decrypted_plaintext, err = proc.communicate(input = data)

255

if proc.returncode != 0:

256

raise PGPError(err)

257

return decrypted_plaintext

258

259

# Pretend that we have an Avahi module

260

class Avahi(object):

261

"""This isn't so much a class as it is a module-like namespace.

262

It is instantiated once, and simulates having an Avahi module."""

263

IF_UNSPEC = -1 # avahi-common/address.h

264

PROTO_UNSPEC = -1 # avahi-common/address.h

265

PROTO_INET = 0 # avahi-common/address.h

266

PROTO_INET6 = 1 # avahi-common/address.h

267

DBUS_NAME = "org.freedesktop.Avahi"

268

DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"

269

DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"

270

DBUS_PATH_SERVER = "/"

271

def string_array_to_txt_array(self, t):

272

return dbus.Array((dbus.ByteArray(s.encode("utf-8"))

273

for s in t), signature="ay")

274

ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h

275

ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h

276

ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h

277

SERVER_INVALID = 0 # avahi-common/defs.h

278

SERVER_REGISTERING = 1 # avahi-common/defs.h

279

SERVER_RUNNING = 2 # avahi-common/defs.h

280

SERVER_COLLISION = 3 # avahi-common/defs.h

281

SERVER_FAILURE = 4 # avahi-common/defs.h

282

avahi = Avahi()

84

85

version = "1.3.1"

86

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

89

syslogger = (logging.handlers.SysLogHandler

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

address = str("/dev/log")))

92

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

95

logger.addHandler(syslogger)

96

97

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

101

logger.addHandler(console)

283

102

284

103

class AvahiError(Exception):

285

104

def __init__(self, value, *args, **kwargs):

286

105

self.value = value

287

return super(AvahiError, self).__init__(value, *args,

288

**kwargs)

289

106

super(AvahiError, self).__init__(value, *args, **kwargs)

107

def __unicode__(self):

108

return unicode(repr(self.value))

290

109

291

110

class AvahiServiceError(AvahiError):

292

111

pass

293

112

294

295

113

class AvahiGroupError(AvahiError):

296

114

pass

297

115

304

122

Used to optionally bind to the specified interface.

305

123

name: string; Example: 'Mandos'

306

124

type: string; Example: '_mandos._tcp'.

307

See <https://www.iana.org/assignments/service-names-port-numbers>

125

See <http://www.dns-sd.org/ServiceTypes.html>

308

126

port: integer; what port to announce

309

127

TXT: list of strings; TXT record for the service

310

128

domain: string; Domain to publish on, default to .local if empty.

316

134

server: D-Bus Server

317

135

bus: dbus.SystemBus()

318

136

"""

319

320

def __init__(self,

321

interface = avahi.IF_UNSPEC,

322

name = None,

323

servicetype = None,

324

port = None,

325

TXT = None,

326

domain = "",

327

host = "",

328

max_renames = 32768,

329

protocol = avahi.PROTO_UNSPEC,

330

bus = None):

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

138

servicetype = None, port = None, TXT = None,

139

domain = "", host = "", max_renames = 32768,

140

protocol = avahi.PROTO_UNSPEC, bus = None):

331

141

self.interface = interface

332

142

self.name = name

333

143

self.type = servicetype

342

152

self.server = None

343

153

self.bus = bus

344

154

self.entry_group_state_changed_match = None

345

346

def rename(self, remove=True):

155

def rename(self):

347

156

"""Derived from the Avahi example code"""

348

157

if self.rename_count >= self.max_renames:

349

158

logger.critical("No suitable Zeroconf service name found"

350

159

" after %i retries, exiting.",

351

160

self.rename_count)

352

161

raise AvahiServiceError("Too many renames")

353

self.name = str(

354

self.server.GetAlternativeServiceName(self.name))

355

self.rename_count += 1

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

356

163

logger.info("Changing Zeroconf service name to %r ...",

357

164

self.name)

358

if remove:

359

self.remove()

165

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

168

% self.name))

169

self.remove()

360

170

try:

361

171

self.add()

362

172

except dbus.exceptions.DBusException as error:

363

if (error.get_dbus_name()

364

== "org.freedesktop.Avahi.CollisionError"):

365

logger.info("Local Zeroconf service name collision.")

366

return self.rename(remove=False)

367

else:

368

logger.critical("D-Bus Exception", exc_info=error)

369

self.cleanup()

370

os._exit(1)

371

173

logger.critical("DBusException: %s", error)

174

self.cleanup()

175

os._exit(1)

176

self.rename_count += 1

372

177

def remove(self):

373

178

"""Derived from the Avahi example code"""

374

179

if self.entry_group_state_changed_match is not None:

376

181

self.entry_group_state_changed_match = None

377

182

if self.group is not None:

378

183

self.group.Reset()

379

380

184

def add(self):

381

185

"""Derived from the Avahi example code"""

382

186

self.remove()

387

191

avahi.DBUS_INTERFACE_ENTRY_GROUP)

388

192

self.entry_group_state_changed_match = (

389

193

self.group.connect_to_signal(

390

'StateChanged', self.entry_group_state_changed))

194

'StateChanged', self .entry_group_state_changed))

391

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

392

196

self.name, self.type)

393

197

self.group.AddService(

399

203

dbus.UInt16(self.port),

400

204

avahi.string_array_to_txt_array(self.TXT))

401

205

self.group.Commit()

402

403

206

def entry_group_state_changed(self, state, error):

404

207

"""Derived from the Avahi example code"""

405

208

logger.debug("Avahi entry group state change: %i", state)

411

214

self.rename()

412

215

elif state == avahi.ENTRY_GROUP_FAILURE:

413

216

logger.critical("Avahi: Error in group state changed %s",

414

str(error))

415

raise AvahiGroupError("State changed: {!s}".format(error))

416

217

unicode(error))

218

raise AvahiGroupError("State changed: %s"

219

% unicode(error))

417

220

def cleanup(self):

418

221

"""Derived from the Avahi example code"""

419

222

if self.group is not None:

420

223

try:

421

224

self.group.Free()

422

225

except (dbus.exceptions.UnknownMethodException,

423

dbus.exceptions.DBusException):

226

dbus.exceptions.DBusException) as e:

424

227

pass

425

228

self.group = None

426

229

self.remove()

427

428

230

def server_state_changed(self, state, error=None):

429

231

"""Derived from the Avahi example code"""

430

232

logger.debug("Avahi server state change: %i", state)

431

bad_states = {

432

avahi.SERVER_INVALID: "Zeroconf server invalid",

433

avahi.SERVER_REGISTERING: None,

434

avahi.SERVER_COLLISION: "Zeroconf server name collision",

435

avahi.SERVER_FAILURE: "Zeroconf server failure",

436

}

233

bad_states = { avahi.SERVER_INVALID:

234

"Zeroconf server invalid",

235

avahi.SERVER_REGISTERING: None,

236

avahi.SERVER_COLLISION:

237

"Zeroconf server name collision",

238

avahi.SERVER_FAILURE:

239

"Zeroconf server failure" }

437

240

if state in bad_states:

438

241

if bad_states[state] is not None:

439

242

if error is None:

442

245

logger.error(bad_states[state] + ": %r", error)

443

246

self.cleanup()

444

247

elif state == avahi.SERVER_RUNNING:

445

try:

446

self.add()

447

except dbus.exceptions.DBusException as error:

448

if (error.get_dbus_name()

449

== "org.freedesktop.Avahi.CollisionError"):

450

logger.info("Local Zeroconf service name"

451

" collision.")

452

return self.rename(remove=False)

453

else:

454

logger.critical("D-Bus Exception", exc_info=error)

455

self.cleanup()

456

os._exit(1)

248

self.add()

457

249

else:

458

250

if error is None:

459

251

logger.debug("Unknown state: %r", state)

460

252

else:

461

253

logger.debug("Unknown state: %r: %r", state, error)

462

463

254

def activate(self):

464

255

"""Derived from the Avahi example code"""

465

256

if self.server is None:

469

260

follow_name_owner_changes=True),

470

261

avahi.DBUS_INTERFACE_SERVER)

471

262

self.server.connect_to_signal("StateChanged",

472

self.server_state_changed)

263

self.server_state_changed)

473

264

self.server_state_changed(self.server.GetState())

474

265

475

266

476

class AvahiServiceToSyslog(AvahiService):

477

def rename(self, *args, **kwargs):

478

"""Add the new name to the syslog messages"""

479

ret = AvahiService.rename(self, *args, **kwargs)

480

syslogger.setFormatter(logging.Formatter(

481

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

482

.format(self.name)))

483

return ret

484

485

# Pretend that we have a GnuTLS module

486

class GnuTLS(object):

487

"""This isn't so much a class as it is a module-like namespace.

488

It is instantiated once, and simulates having a GnuTLS module."""

489

490

_library = ctypes.cdll.LoadLibrary(

491

ctypes.util.find_library("gnutls"))

492

_need_version = b"3.3.0"

493

def __init__(self):

494

# Need to use class name "GnuTLS" here, since this method is

495

# called before the assignment to the "gnutls" global variable

496

# happens.

497

if GnuTLS.check_version(self._need_version) is None:

498

raise GnuTLS.Error("Needs GnuTLS {} or later"

499

.format(self._need_version))

500

501

# Unless otherwise indicated, the constants and types below are

502

# all from the gnutls/gnutls.h C header file.

503

504

# Constants

505

E_SUCCESS = 0

506

E_INTERRUPTED = -52

507

E_AGAIN = -28

508

CRT_OPENPGP = 2

509

CLIENT = 2

510

SHUT_RDWR = 0

511

CRD_CERTIFICATE = 1

512

E_NO_CERTIFICATE_FOUND = -49

513

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

514

515

# Types

516

class session_int(ctypes.Structure):

517

_fields_ = []

518

session_t = ctypes.POINTER(session_int)

519

class certificate_credentials_st(ctypes.Structure):

520

_fields_ = []

521

certificate_credentials_t = ctypes.POINTER(

522

certificate_credentials_st)

523

certificate_type_t = ctypes.c_int

524

class datum_t(ctypes.Structure):

525

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

526

('size', ctypes.c_uint)]

527

class openpgp_crt_int(ctypes.Structure):

528

_fields_ = []

529

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

530

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

531

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

532

credentials_type_t = ctypes.c_int

533

transport_ptr_t = ctypes.c_void_p

534

close_request_t = ctypes.c_int

535

536

# Exceptions

537

class Error(Exception):

538

# We need to use the class name "GnuTLS" here, since this

539

# exception might be raised from within GnuTLS.__init__,

540

# which is called before the assignment to the "gnutls"

541

# global variable has happened.

542

def __init__(self, message = None, code = None, args=()):

543

# Default usage is by a message string, but if a return

544

# code is passed, convert it to a string with

545

# gnutls.strerror()

546

self.code = code

547

if message is None and code is not None:

548

message = GnuTLS.strerror(code)

549

return super(GnuTLS.Error, self).__init__(

550

message, *args)

551

552

class CertificateSecurityError(Error):

553

pass

554

555

# Classes

556

class Credentials(object):

557

def __init__(self):

558

self._c_object = gnutls.certificate_credentials_t()

559

gnutls.certificate_allocate_credentials(

560

ctypes.byref(self._c_object))

561

self.type = gnutls.CRD_CERTIFICATE

562

563

def __del__(self):

564

gnutls.certificate_free_credentials(self._c_object)

565

566

class ClientSession(object):

567

def __init__(self, socket, credentials = None):

568

self._c_object = gnutls.session_t()

569

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

570

gnutls.set_default_priority(self._c_object)

571

gnutls.transport_set_ptr(self._c_object, socket.fileno())

572

gnutls.handshake_set_private_extensions(self._c_object,

573

True)

574

self.socket = socket

575

if credentials is None:

576

credentials = gnutls.Credentials()

577

gnutls.credentials_set(self._c_object, credentials.type,

578

ctypes.cast(credentials._c_object,

579

ctypes.c_void_p))

580

self.credentials = credentials

581

582

def __del__(self):

583

gnutls.deinit(self._c_object)

584

585

def handshake(self):

586

return gnutls.handshake(self._c_object)

587

588

def send(self, data):

589

data = bytes(data)

590

data_len = len(data)

591

while data_len > 0:

592

data_len -= gnutls.record_send(self._c_object,

593

data[-data_len:],

594

data_len)

595

596

def bye(self):

597

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

598

599

# Error handling functions

600

def _error_code(result):

601

"""A function to raise exceptions on errors, suitable

602

for the 'restype' attribute on ctypes functions"""

603

if result >= 0:

604

return result

605

if result == gnutls.E_NO_CERTIFICATE_FOUND:

606

raise gnutls.CertificateSecurityError(code = result)

607

raise gnutls.Error(code = result)

608

609

def _retry_on_error(result, func, arguments):

610

"""A function to retry on some errors, suitable

611

for the 'errcheck' attribute on ctypes functions"""

612

while result < 0:

613

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

614

return _error_code(result)

615

result = func(*arguments)

616

return result

617

618

# Unless otherwise indicated, the function declarations below are

619

# all from the gnutls/gnutls.h C header file.

620

621

# Functions

622

priority_set_direct = _library.gnutls_priority_set_direct

623

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

624

ctypes.POINTER(ctypes.c_char_p)]

625

priority_set_direct.restype = _error_code

626

627

init = _library.gnutls_init

628

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

629

init.restype = _error_code

630

631

set_default_priority = _library.gnutls_set_default_priority

632

set_default_priority.argtypes = [session_t]

633

set_default_priority.restype = _error_code

634

635

record_send = _library.gnutls_record_send

636

record_send.argtypes = [session_t, ctypes.c_void_p,

637

ctypes.c_size_t]

638

record_send.restype = ctypes.c_ssize_t

639

record_send.errcheck = _retry_on_error

640

641

certificate_allocate_credentials = (

642

_library.gnutls_certificate_allocate_credentials)

643

certificate_allocate_credentials.argtypes = [

644

ctypes.POINTER(certificate_credentials_t)]

645

certificate_allocate_credentials.restype = _error_code

646

647

certificate_free_credentials = (

648

_library.gnutls_certificate_free_credentials)

649

certificate_free_credentials.argtypes = [certificate_credentials_t]

650

certificate_free_credentials.restype = None

651

652

handshake_set_private_extensions = (

653

_library.gnutls_handshake_set_private_extensions)

654

handshake_set_private_extensions.argtypes = [session_t,

655

ctypes.c_int]

656

handshake_set_private_extensions.restype = None

657

658

credentials_set = _library.gnutls_credentials_set

659

credentials_set.argtypes = [session_t, credentials_type_t,

660

ctypes.c_void_p]

661

credentials_set.restype = _error_code

662

663

strerror = _library.gnutls_strerror

664

strerror.argtypes = [ctypes.c_int]

665

strerror.restype = ctypes.c_char_p

666

667

certificate_type_get = _library.gnutls_certificate_type_get

668

certificate_type_get.argtypes = [session_t]

669

certificate_type_get.restype = _error_code

670

671

certificate_get_peers = _library.gnutls_certificate_get_peers

672

certificate_get_peers.argtypes = [session_t,

673

ctypes.POINTER(ctypes.c_uint)]

674

certificate_get_peers.restype = ctypes.POINTER(datum_t)

675

676

global_set_log_level = _library.gnutls_global_set_log_level

677

global_set_log_level.argtypes = [ctypes.c_int]

678

global_set_log_level.restype = None

679

680

global_set_log_function = _library.gnutls_global_set_log_function

681

global_set_log_function.argtypes = [log_func]

682

global_set_log_function.restype = None

683

684

deinit = _library.gnutls_deinit

685

deinit.argtypes = [session_t]

686

deinit.restype = None

687

688

handshake = _library.gnutls_handshake

689

handshake.argtypes = [session_t]

690

handshake.restype = _error_code

691

handshake.errcheck = _retry_on_error

692

693

transport_set_ptr = _library.gnutls_transport_set_ptr

694

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

695

transport_set_ptr.restype = None

696

697

bye = _library.gnutls_bye

698

bye.argtypes = [session_t, close_request_t]

699

bye.restype = _error_code

700

bye.errcheck = _retry_on_error

701

702

check_version = _library.gnutls_check_version

703

check_version.argtypes = [ctypes.c_char_p]

704

check_version.restype = ctypes.c_char_p

705

706

# All the function declarations below are from gnutls/openpgp.h

707

708

openpgp_crt_init = _library.gnutls_openpgp_crt_init

709

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

710

openpgp_crt_init.restype = _error_code

711

712

openpgp_crt_import = _library.gnutls_openpgp_crt_import

713

openpgp_crt_import.argtypes = [openpgp_crt_t,

714

ctypes.POINTER(datum_t),

715

openpgp_crt_fmt_t]

716

openpgp_crt_import.restype = _error_code

717

718

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

719

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

720

ctypes.POINTER(ctypes.c_uint)]

721

openpgp_crt_verify_self.restype = _error_code

722

723

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

724

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

725

openpgp_crt_deinit.restype = None

726

727

openpgp_crt_get_fingerprint = (

728

_library.gnutls_openpgp_crt_get_fingerprint)

729

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

730

ctypes.c_void_p,

731

ctypes.POINTER(

732

ctypes.c_size_t)]

733

openpgp_crt_get_fingerprint.restype = _error_code

734

735

# Remove non-public functions

736

del _error_code, _retry_on_error

737

# Create the global "gnutls" object, simulating a module

738

gnutls = GnuTLS()

739

740

def call_pipe(connection, # : multiprocessing.Connection

741

func, *args, **kwargs):

742

"""This function is meant to be called by multiprocessing.Process

743

744

This function runs func(*args, **kwargs), and writes the resulting

745

return value on the provided multiprocessing.Connection.

746

"""

747

connection.send(func(*args, **kwargs))

748

connection.close()

749

750

267

class Client(object):

751

268

"""A representation of a client host served by this server.

752

269

753

270

Attributes:

754

approved: bool(); 'None' if not yet approved/disapproved

271

_approved: bool(); 'None' if not yet approved/disapproved

755

272

approval_delay: datetime.timedelta(); Time to wait for approval

756

273

approval_duration: datetime.timedelta(); Duration of one approval

757

274

checker: subprocess.Popen(); a running checker process used

758

275

to see if the client lives.

759

276

'None' if no process is running.

760

checker_callback_tag: a GObject event source tag, or None

277

checker_callback_tag: a gobject event source tag, or None

761

278

checker_command: string; External command which is run to check

762

279

if client lives. %() expansions are done at

763

280

runtime with vars(self) as dict, so that for

764

281

instance %(name)s can be used in the command.

765

checker_initiator_tag: a GObject event source tag, or None

282

checker_initiator_tag: a gobject event source tag, or None

766

283

created: datetime.datetime(); (UTC) object creation

767

client_structure: Object describing what attributes a client has

768

and is used for storing the client at exit

769

284

current_checker_command: string; current running checker_command

770

disable_initiator_tag: a GObject event source tag, or None

285

disable_hook: If set, called by disable() as disable_hook(self)

286

disable_initiator_tag: a gobject event source tag, or None

771

287

enabled: bool()

772

288

fingerprint: string (40 or 32 hexadecimal digits); used to

773

289

uniquely identify the client

775

291

interval: datetime.timedelta(); How often to start a new checker

776

292

last_approval_request: datetime.datetime(); (UTC) or None

777

293

last_checked_ok: datetime.datetime(); (UTC) or None

778

last_checker_status: integer between 0 and 255 reflecting exit

779

status of last checker. -1 reflects crashed

780

checker, -2 means no checker completed yet.

781

last_checker_signal: The signal which killed the last checker, if

782

last_checker_status is -1

783

last_enabled: datetime.datetime(); (UTC) or None

294

last_enabled: datetime.datetime(); (UTC)

784

295

name: string; from the config file, used in log messages and

785

296

D-Bus identifiers

786

297

secret: bytestring; sent verbatim (over TLS) to client

787

298

timeout: datetime.timedelta(); How long from last_checked_ok

788

299

until this client is disabled

789

extended_timeout: extra long timeout when secret has been sent

300

extended_timeout: extra long timeout when password has been sent

790

301

runtime_expansions: Allowed attributes for runtime expansion.

791

expires: datetime.datetime(); time (UTC) when a client will be

302

expire: datetime.datetime(); time (UTC) when a client will be

792

303

disabled, or None

793

server_settings: The server_settings dict from main()

794

304

"""

795

305

796

306

runtime_expansions = ("approval_delay", "approval_duration",

797

"created", "enabled", "expires",

798

"fingerprint", "host", "interval",

799

"last_approval_request", "last_checked_ok",

307

"created", "enabled", "fingerprint",

308

"host", "interval", "last_checked_ok",

800

309

"last_enabled", "name", "timeout")

801

client_defaults = {

802

"timeout": "PT5M",

803

"extended_timeout": "PT15M",

804

"interval": "PT2M",

805

"checker": "fping -q -- %%(host)s",

806

"host": "",

807

"approval_delay": "PT0S",

808

"approval_duration": "PT1S",

809

"approved_by_default": "True",

810

"enabled": "True",

811

}

812

310

813

311

@staticmethod

814

def config_parser(config):

815

"""Construct a new dict of client settings of this form:

816

{ client_name: {setting_name: value, ...}, ...}

817

with exceptions for any special settings as defined above.

818

NOTE: Must be a pure function. Must return the same result

819

value given the same arguments.

820

"""

821

settings = {}

822

for client_name in config.sections():

823

section = dict(config.items(client_name))

824

client = settings[client_name] = {}

825

826

client["host"] = section["host"]

827

# Reformat values from string types to Python types

828

client["approved_by_default"] = config.getboolean(

829

client_name, "approved_by_default")

830

client["enabled"] = config.getboolean(client_name,

831

"enabled")

832

833

# Uppercase and remove spaces from fingerprint for later

834

# comparison purposes with return value from the

835

# fingerprint() function

836

client["fingerprint"] = (section["fingerprint"].upper()

837

.replace(" ", ""))

838

if "secret" in section:

839

client["secret"] = codecs.decode(section["secret"]

840

.encode("utf-8"),

841

"base64")

842

elif "secfile" in section:

843

with open(os.path.expanduser(os.path.expandvars

844

(section["secfile"])),

845

"rb") as secfile:

846

client["secret"] = secfile.read()

847

else:

848

raise TypeError("No secret or secfile for section {}"

849

.format(section))

850

client["timeout"] = string_to_delta(section["timeout"])

851

client["extended_timeout"] = string_to_delta(

852

section["extended_timeout"])

853

client["interval"] = string_to_delta(section["interval"])

854

client["approval_delay"] = string_to_delta(

855

section["approval_delay"])

856

client["approval_duration"] = string_to_delta(

857

section["approval_duration"])

858

client["checker_command"] = section["checker"]

859

client["last_approval_request"] = None

860

client["last_checked_ok"] = None

861

client["last_checker_status"] = -2

862

863

return settings

864

865

def __init__(self, settings, name = None, server_settings=None):

312

def _timedelta_to_milliseconds(td):

313

"Convert a datetime.timedelta() to milliseconds"

314

return ((td.days * 24 * 60 * 60 * 1000)

315

+ (td.seconds * 1000)

316

+ (td.microseconds // 1000))

317

318

def timeout_milliseconds(self):

319

"Return the 'timeout' attribute in milliseconds"

320

return self._timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return self._timedelta_to_milliseconds(self.extended_timeout)

325

326

def interval_milliseconds(self):

327

"Return the 'interval' attribute in milliseconds"

328

return self._timedelta_to_milliseconds(self.interval)

329

330

def approval_delay_milliseconds(self):

331

return self._timedelta_to_milliseconds(self.approval_delay)

332

333

def __init__(self, name = None, disable_hook=None, config=None):

334

"""Note: the 'checker' key in 'config' sets the

335

'checker_command' attribute and *not* the 'checker'

336

attribute."""

866

337

self.name = name

867

if server_settings is None:

868

server_settings = {}

869

self.server_settings = server_settings

870

# adding all client settings

871

for setting, value in settings.items():

872

setattr(self, setting, value)

873

874

if self.enabled:

875

if not hasattr(self, "last_enabled"):

876

self.last_enabled = datetime.datetime.utcnow()

877

if not hasattr(self, "expires"):

878

self.expires = (datetime.datetime.utcnow()

879

+ self.timeout)

880

else:

881

self.last_enabled = None

882

self.expires = None

883

338

if config is None:

339

config = {}

884

340

logger.debug("Creating client %r", self.name)

341

# Uppercase and remove spaces from fingerprint for later

342

# comparison purposes with return value from the fingerprint()

343

# function

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

885

346

logger.debug(" Fingerprint: %s", self.fingerprint)

886

self.created = settings.get("created",

887

datetime.datetime.utcnow())

888

889

# attributes specific for this server instance

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

350

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

352

"rb") as secfile:

353

self.secret = secfile.read()

354

else:

355

raise TypeError("No secret or secfile for client %s"

356

% self.name)

357

self.host = config.get("host", "")

358

self.created = datetime.datetime.utcnow()

359

self.enabled = False

360

self.last_approval_request = None

361

self.last_enabled = None

362

self.last_checked_ok = None

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

366

self.disable_hook = disable_hook

890

367

self.checker = None

891

368

self.checker_initiator_tag = None

892

369

self.disable_initiator_tag = None

370

self.expires = None

893

371

self.checker_callback_tag = None

372

self.checker_command = config["checker"]

894

373

self.current_checker_command = None

895

self.approved = None

374

self.last_connect = None

375

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

377

True)

896

378

self.approvals_pending = 0

897

self.changedstate = multiprocessing_manager.Condition(

898

multiprocessing_manager.Lock())

899

self.client_structure = [attr

900

for attr in self.__dict__.keys()

901

if not attr.startswith("_")]

902

self.client_structure.append("client_structure")

903

904

for name, t in inspect.getmembers(

905

type(self), lambda obj: isinstance(obj, property)):

906

if not name.startswith("_"):

907

self.client_structure.append(name)

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

908

384

909

# Send notice to process children that client state has changed

910

385

def send_changedstate(self):

911

with self.changedstate:

912

self.changedstate.notify_all()

913

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

914

390

def enable(self):

915

391

"""Start this client's checker and timeout hooks"""

916

392

if getattr(self, "enabled", False):

917

393

# Already enabled

918

394

return

395

self.send_changedstate()

396

self.last_enabled = datetime.datetime.utcnow()

397

# Schedule a new checker to be started an 'interval' from now,

398

# and every interval from then on.

399

self.checker_initiator_tag = (gobject.timeout_add

400

(self.interval_milliseconds(),

401

self.start_checker))

402

# Schedule a disable() when 'timeout' has passed

919

403

self.expires = datetime.datetime.utcnow() + self.timeout

404

self.disable_initiator_tag = (gobject.timeout_add

405

(self.timeout_milliseconds(),

406

self.disable))

920

407

self.enabled = True

921

self.last_enabled = datetime.datetime.utcnow()

922

self.init_checker()

923

self.send_changedstate()

408

# Also start a new checker *right now*.

409

self.start_checker()

924

410

925

411

def disable(self, quiet=True):

926

412

"""Disable this client."""

927

413

if not getattr(self, "enabled", False):

928

414

return False

929

415

if not quiet:

416

self.send_changedstate()

417

if not quiet:

930

418

logger.info("Disabling client %s", self.name)

931

if getattr(self, "disable_initiator_tag", None) is not None:

932

GObject.source_remove(self.disable_initiator_tag)

419

if getattr(self, "disable_initiator_tag", False):

420

gobject.source_remove(self.disable_initiator_tag)

933

421

self.disable_initiator_tag = None

934

422

self.expires = None

935

if getattr(self, "checker_initiator_tag", None) is not None:

936

GObject.source_remove(self.checker_initiator_tag)

423

if getattr(self, "checker_initiator_tag", False):

424

gobject.source_remove(self.checker_initiator_tag)

937

425

self.checker_initiator_tag = None

938

426

self.stop_checker()

427

if self.disable_hook:

428

self.disable_hook(self)

939

429

self.enabled = False

940

if not quiet:

941

self.send_changedstate()

942

# Do not run this again if called by a GObject.timeout_add

430

# Do not run this again if called by a gobject.timeout_add

943

431

return False

944

432

945

433

def __del__(self):

434

self.disable_hook = None

946

435

self.disable()

947

436

948

def init_checker(self):

949

# Schedule a new checker to be started an 'interval' from now,

950

# and every interval from then on.

951

if self.checker_initiator_tag is not None:

952

GObject.source_remove(self.checker_initiator_tag)

953

self.checker_initiator_tag = GObject.timeout_add(

954

int(self.interval.total_seconds() * 1000),

955

self.start_checker)

956

# Schedule a disable() when 'timeout' has passed

957

if self.disable_initiator_tag is not None:

958

GObject.source_remove(self.disable_initiator_tag)

959

self.disable_initiator_tag = GObject.timeout_add(

960

int(self.timeout.total_seconds() * 1000), self.disable)

961

# Also start a new checker *right now*.

962

self.start_checker()

963

964

def checker_callback(self, source, condition, connection,

965

command):

437

def checker_callback(self, pid, condition, command):

966

438

"""The checker has completed, so take appropriate actions."""

967

439

self.checker_callback_tag = None

968

440

self.checker = None

969

# Read return code from connection (see call_pipe)

970

returncode = connection.recv()

971

connection.close()

972

973

if returncode >= 0:

974

self.last_checker_status = returncode

975

self.last_checker_signal = None

976

if self.last_checker_status == 0:

441

if os.WIFEXITED(condition):

442

exitstatus = os.WEXITSTATUS(condition)

443

if exitstatus == 0:

977

444

logger.info("Checker for %(name)s succeeded",

978

445

vars(self))

979

446

self.checked_ok()

980

447

else:

981

logger.info("Checker for %(name)s failed", vars(self))

448

logger.info("Checker for %(name)s failed",

449

vars(self))

982

450

else:

983

self.last_checker_status = -1

984

self.last_checker_signal = -returncode

985

451

logger.warning("Checker for %(name)s crashed?",

986

452

vars(self))

987

return False

988

989

def checked_ok(self):

990

"""Assert that the client has been seen, alive and well."""

991

self.last_checked_ok = datetime.datetime.utcnow()

992

self.last_checker_status = 0

993

self.last_checker_signal = None

994

self.bump_timeout()

995

996

def bump_timeout(self, timeout=None):

997

"""Bump up the timeout for this client."""

453

454

def checked_ok(self, timeout=None):

455

"""Bump up the timeout for this client.

456

457

This should only be called when the client has been seen,

458

alive and well.

459

"""

998

460

if timeout is None:

999

461

timeout = self.timeout

1000

if self.disable_initiator_tag is not None:

1001

GObject.source_remove(self.disable_initiator_tag)

1002

self.disable_initiator_tag = None

1003

if getattr(self, "enabled", False):

1004

self.disable_initiator_tag = GObject.timeout_add(

1005

int(timeout.total_seconds() * 1000), self.disable)

1006

self.expires = datetime.datetime.utcnow() + timeout

462

self.last_checked_ok = datetime.datetime.utcnow()

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

465

self.disable_initiator_tag = (gobject.timeout_add

466

(self._timedelta_to_milliseconds(timeout),

467

self.disable))

1007

468

1008

469

def need_approval(self):

1009

470

self.last_approval_request = datetime.datetime.utcnow()

1014

475

If a checker already exists, leave it running and do

1015

476

nothing."""

1016

477

# The reason for not killing a running checker is that if we

1017

# did that, and if a checker (for some reason) started running

1018

# slowly and taking more than 'interval' time, then the client

1019

# would inevitably timeout, since no checker would get a

1020

# chance to run to completion. If we instead leave running

478

# did that, then if a checker (for some reason) started

479

# running slowly and taking more than 'interval' time, the

480

# client would inevitably timeout, since no checker would get

481

# a chance to run to completion. If we instead leave running

1021

482

# checkers alone, the checker would have to take more time

1022

483

# than 'timeout' for the client to be disabled, which is as it

1023

484

# should be.

1024

485

1025

if self.checker is not None and not self.checker.is_alive():

1026

logger.warning("Checker was not alive; joining")

1027

self.checker.join()

1028

self.checker = None

486

# If a checker exists, make sure it is not a zombie

487

try:

488

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

489

except (AttributeError, OSError) as error:

490

if (isinstance(error, OSError)

491

and error.errno != errno.ECHILD):

492

raise error

493

else:

494

if pid:

495

logger.warning("Checker was a zombie")

496

gobject.source_remove(self.checker_callback_tag)

497

self.checker_callback(pid, status,

498

self.current_checker_command)

1029

499

# Start a new checker if needed

1030

500

if self.checker is None:

1031

# Escape attributes for the shell

1032

escaped_attrs = {

1033

attr: re.escape(str(getattr(self, attr)))

1034

for attr in self.runtime_expansions }

1035

501

try:

1036

command = self.checker_command % escaped_attrs

1037

except TypeError as error:

1038

logger.error('Could not format string "%s"',

1039

self.checker_command,

1040

exc_info=error)

1041

return True # Try again later

502

# In case checker_command has exactly one % operator

503

command = self.checker_command % self.host

504

except TypeError:

505

# Escape attributes for the shell

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

514

try:

515

command = self.checker_command % escaped_attrs

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

519

return True # Try again later

1042

520

self.current_checker_command = command

1043

logger.info("Starting checker %r for %s", command,

1044

self.name)

1045

# We don't need to redirect stdout and stderr, since

1046

# in normal mode, that is already done by daemon(),

1047

# and in debug mode we don't want to. (Stdin is

1048

# always replaced by /dev/null.)

1049

# The exception is when not debugging but nevertheless

1050

# running in the foreground; use the previously

1051

# created wnull.

1052

popen_args = { "close_fds": True,

1053

"shell": True,

1054

"cwd": "/" }

1055

if (not self.server_settings["debug"]

1056

and self.server_settings["foreground"]):

1057

popen_args.update({"stdout": wnull,

1058

"stderr": wnull })

1059

pipe = multiprocessing.Pipe(duplex = False)

1060

self.checker = multiprocessing.Process(

1061

target = call_pipe,

1062

args = (pipe[1], subprocess.call, command),

1063

kwargs = popen_args)

1064

self.checker.start()

1065

self.checker_callback_tag = GObject.io_add_watch(

1066

pipe[0].fileno(), GObject.IO_IN,

1067

self.checker_callback, pipe[0], command)

1068

# Re-run this periodically if run by GObject.timeout_add

521

try:

522

logger.info("Starting checker %r for %s",

523

command, self.name)

524

# We don't need to redirect stdout and stderr, since

525

# in normal mode, that is already done by daemon(),

526

# and in debug mode we don't want to. (Stdin is

527

# always replaced by /dev/null.)

528

self.checker = subprocess.Popen(command,

529

close_fds=True,

530

shell=True, cwd="/")

531

self.checker_callback_tag = (gobject.child_watch_add

532

(self.checker.pid,

533

self.checker_callback,

534

data=command))

535

# The checker may have completed before the gobject

536

# watch was added. Check for this.

537

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

538

if pid:

539

gobject.source_remove(self.checker_callback_tag)

540

self.checker_callback(pid, status, command)

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

543

error)

544

# Re-run this periodically if run by gobject.timeout_add

1069

545

return True

1070

546

1071

547

def stop_checker(self):

1072

548

"""Force the checker process, if any, to stop."""

1073

549

if self.checker_callback_tag:

1074

GObject.source_remove(self.checker_callback_tag)

550

gobject.source_remove(self.checker_callback_tag)

1075

551

self.checker_callback_tag = None

1076

552

if getattr(self, "checker", None) is None:

1077

553

return

1078

554

logger.debug("Stopping checker for %(name)s", vars(self))

1079

self.checker.terminate()

555

try:

556

os.kill(self.checker.pid, signal.SIGTERM)

557

#time.sleep(0.5)

558

#if self.checker.poll() is None:

559

# os.kill(self.checker.pid, signal.SIGKILL)

560

except OSError as error:

561

if error.errno != errno.ESRCH: # No such process

562

raise

1080

563

self.checker = None

1081

564

1082

1083

def dbus_service_property(dbus_interface,

1084

signature="v",

1085

access="readwrite",

1086

byte_arrays=False):

565

def dbus_service_property(dbus_interface, signature="v",

566

access="readwrite", byte_arrays=False):

1087

567

"""Decorators for marking methods of a DBusObjectWithProperties to

1088

568

become properties on the D-Bus.

1089

569

1098

578

# "Set" method, so we fail early here:

1099

579

if byte_arrays and signature != "ay":

1100

580

raise ValueError("Byte arrays not supported for non-'ay'"

1101

" signature {!r}".format(signature))

1102

581

" signature %r" % signature)

1103

582

def decorator(func):

1104

583

func._dbus_is_property = True

1105

584

func._dbus_interface = dbus_interface

1110

589

func._dbus_name = func._dbus_name[:-14]

1111

590

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

1112

591

return func

1113

1114

return decorator

1115

1116

1117

def dbus_interface_annotations(dbus_interface):

1118

"""Decorator for marking functions returning interface annotations

1119

1120

Usage:

1121

1122

@dbus_interface_annotations("org.example.Interface")

1123

def _foo(self): # Function name does not matter

1124

return {"org.freedesktop.DBus.Deprecated": "true",

1125

"org.freedesktop.DBus.Property.EmitsChangedSignal":

1126

"false"}

1127

"""

1128

1129

def decorator(func):

1130

func._dbus_is_interface = True

1131

func._dbus_interface = dbus_interface

1132

func._dbus_name = dbus_interface

1133

return func

1134

1135

return decorator

1136

1137

1138

def dbus_annotations(annotations):

1139

"""Decorator to annotate D-Bus methods, signals or properties

1140

Usage:

1141

1142

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

1143

"org.freedesktop.DBus.Property."

1144

"EmitsChangedSignal": "false"})

1145

@dbus_service_property("org.example.Interface", signature="b",

1146

access="r")

1147

def Property_dbus_property(self):

1148

return dbus.Boolean(False)

1149

1150

See also the DBusObjectWithAnnotations class.

1151

"""

1152

1153

def decorator(func):

1154

func._dbus_annotations = annotations

1155

return func

1156

1157

592

return decorator

1158

593

1159

594

1160

595

class DBusPropertyException(dbus.exceptions.DBusException):

1161

596

"""A base class for D-Bus property-related exceptions

1162

597

"""

1163

pass

598

def __unicode__(self):

599

return unicode(str(self))

1164

600

1165

601

1166

602

class DBusPropertyAccessException(DBusPropertyException):

1175

611

pass

1176

612

1177

613

1178

class DBusObjectWithAnnotations(dbus.service.Object):

1179

"""A D-Bus object with annotations.

1180

1181

Classes inheriting from this can use the dbus_annotations

1182

decorator to add annotations to methods or signals.

1183

"""

1184

1185

@staticmethod

1186

def _is_dbus_thing(thing):

1187

"""Returns a function testing if an attribute is a D-Bus thing

1188

1189

If called like _is_dbus_thing("method") it returns a function

1190

suitable for use as predicate to inspect.getmembers().

1191

"""

1192

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

1193

False)

1194

1195

def _get_all_dbus_things(self, thing):

1196

"""Returns a generator of (name, attribute) pairs

1197

"""

1198

return ((getattr(athing.__get__(self), "_dbus_name", name),

1199

athing.__get__(self))

1200

for cls in self.__class__.__mro__

1201

for name, athing in

1202

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1203

1204

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1205

out_signature = "s",

1206

path_keyword = 'object_path',

1207

connection_keyword = 'connection')

1208

def Introspect(self, object_path, connection):

1209

"""Overloading of standard D-Bus method.

1210

1211

Inserts annotation tags on methods and signals.

1212

"""

1213

xmlstring = dbus.service.Object.Introspect(self, object_path,

1214

connection)

1215

try:

1216

document = xml.dom.minidom.parseString(xmlstring)

1217

1218

for if_tag in document.getElementsByTagName("interface"):

1219

# Add annotation tags

1220

for typ in ("method", "signal"):

1221

for tag in if_tag.getElementsByTagName(typ):

1222

annots = dict()

1223

for name, prop in (self.

1224

_get_all_dbus_things(typ)):

1225

if (name == tag.getAttribute("name")

1226

and prop._dbus_interface

1227

== if_tag.getAttribute("name")):

1228

annots.update(getattr(

1229

prop, "_dbus_annotations", {}))

1230

for name, value in annots.items():

1231

ann_tag = document.createElement(

1232

"annotation")

1233

ann_tag.setAttribute("name", name)

1234

ann_tag.setAttribute("value", value)

1235

tag.appendChild(ann_tag)

1236

# Add interface annotation tags

1237

for annotation, value in dict(

1238

itertools.chain.from_iterable(

1239

annotations().items()

1240

for name, annotations

1241

in self._get_all_dbus_things("interface")

1242

if name == if_tag.getAttribute("name")

1243

)).items():

1244

ann_tag = document.createElement("annotation")

1245

ann_tag.setAttribute("name", annotation)

1246

ann_tag.setAttribute("value", value)

1247

if_tag.appendChild(ann_tag)

1248

# Fix argument name for the Introspect method itself

1249

if (if_tag.getAttribute("name")

1250

== dbus.INTROSPECTABLE_IFACE):

1251

for cn in if_tag.getElementsByTagName("method"):

1252

if cn.getAttribute("name") == "Introspect":

1253

for arg in cn.getElementsByTagName("arg"):

1254

if (arg.getAttribute("direction")

1255

== "out"):

1256

arg.setAttribute("name",

1257

"xml_data")

1258

xmlstring = document.toxml("utf-8")

1259

document.unlink()

1260

except (AttributeError, xml.dom.DOMException,

1261

xml.parsers.expat.ExpatError) as error:

1262

logger.error("Failed to override Introspection method",

1263

exc_info=error)

1264

return xmlstring

1265

1266

1267

class DBusObjectWithProperties(DBusObjectWithAnnotations):

614

class DBusObjectWithProperties(dbus.service.Object):

1268

615

"""A D-Bus object with properties.

1269

616

1270

617

Classes inheriting from this can use the dbus_service_property

1271

618

decorator to expose methods as D-Bus properties. It exposes the

1272

619

standard Get(), Set(), and GetAll() methods on the D-Bus.

1273

620

"""

1274

621

622

@staticmethod

623

def _is_dbus_property(obj):

624

return getattr(obj, "_dbus_is_property", False)

625

626

def _get_all_dbus_properties(self):

627

"""Returns a generator of (name, attribute) pairs

628

"""

629

return ((prop._dbus_name, prop)

630

for name, prop in

631

inspect.getmembers(self, self._is_dbus_property))

632

1275

633

def _get_dbus_property(self, interface_name, property_name):

1276

634

"""Returns a bound method if one exists which is a D-Bus

1277

635

property with the specified name and interface.

1278

636

"""

1279

for cls in self.__class__.__mro__:

1280

for name, value in inspect.getmembers(

1281

cls, self._is_dbus_thing("property")):

1282

if (value._dbus_name == property_name

1283

and value._dbus_interface == interface_name):

1284

return value.__get__(self)

1285

637

for name in (property_name,

638

property_name + "_dbus_property"):

639

prop = getattr(self, name, None)

640

if (prop is None

641

or not self._is_dbus_property(prop)

642

or prop._dbus_name != property_name

643

or (interface_name and prop._dbus_interface

644

and interface_name != prop._dbus_interface)):

645

continue

646

return prop

1286

647

# No such property

1287

raise DBusPropertyNotFound("{}:{}.{}".format(

1288

self.dbus_object_path, interface_name, property_name))

1289

1290

@classmethod

1291

def _get_all_interface_names(cls):

1292

"""Get a sequence of all interfaces supported by an object"""

1293

return (name for name in set(getattr(getattr(x, attr),

1294

"_dbus_interface", None)

1295

for x in (inspect.getmro(cls))

1296

for attr in dir(x))

1297

if name is not None)

1298

1299

@dbus.service.method(dbus.PROPERTIES_IFACE,

1300

in_signature="ss",

648

raise DBusPropertyNotFound(self.dbus_object_path + ":"

649

+ interface_name + "."

650

+ property_name)

651

652

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

1301

653

out_signature="v")

1302

654

def Get(self, interface_name, property_name):

1303

655

"""Standard D-Bus property Get() method, see D-Bus standard.

1321

673

# The byte_arrays option is not supported yet on

1322

674

# signatures other than "ay".

1323

675

if prop._dbus_signature != "ay":

1324

raise ValueError("Byte arrays not supported for non-"

1325

"'ay' signature {!r}"

1326

.format(prop._dbus_signature))

1327

value = dbus.ByteArray(b''.join(chr(byte)

1328

for byte in value))

676

raise ValueError

677

value = dbus.ByteArray(''.join(unichr(byte)

678

for byte in value))

1329

679

prop(value)

1330

680

1331

@dbus.service.method(dbus.PROPERTIES_IFACE,

1332

in_signature="s",

681

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1333

682

out_signature="a{sv}")

1334

683

def GetAll(self, interface_name):

1335

684

"""Standard D-Bus property GetAll() method, see D-Bus

1336

685

standard.

1337

686

1338

687

Note: Will not include properties with access="write".

1339

688

"""

1340

properties = {}

1341

for name, prop in self._get_all_dbus_things("property"):

689

all = {}

690

for name, prop in self._get_all_dbus_properties():

1342

691

if (interface_name

1343

692

and interface_name != prop._dbus_interface):

1344

693

# Interface non-empty but did not match

1348

697

continue

1349

698

value = prop()

1350

699

if not hasattr(value, "variant_level"):

1351

properties[name] = value

700

all[name] = value

1352

701

continue

1353

properties[name] = type(value)(

1354

value, variant_level = value.variant_level + 1)

1355

return dbus.Dictionary(properties, signature="sv")

1356

1357

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1358

def PropertiesChanged(self, interface_name, changed_properties,

1359

invalidated_properties):

1360

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1361

standard.

1362

"""

1363

pass

702

all[name] = type(value)(value, variant_level=

703

value.variant_level+1)

704

return dbus.Dictionary(all, signature="sv")

1364

705

1365

706

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1366

707

out_signature="s",

1367

708

path_keyword='object_path',

1368

709

connection_keyword='connection')

1369

710

def Introspect(self, object_path, connection):

1370

"""Overloading of standard D-Bus method.

1371

1372

Inserts property tags and interface annotation tags.

711

"""Standard D-Bus method, overloaded to insert property tags.

1373

712

"""

1374

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1375

object_path,

1376

connection)

713

xmlstring = dbus.service.Object.Introspect(self, object_path,

714

connection)

1377

715

try:

1378

716

document = xml.dom.minidom.parseString(xmlstring)

1379

1380

717

def make_tag(document, name, prop):

1381

718

e = document.createElement("property")

1382

719

e.setAttribute("name", name)

1383

720

e.setAttribute("type", prop._dbus_signature)

1384

721

e.setAttribute("access", prop._dbus_access)

1385

722

return e

1386

1387

723

for if_tag in document.getElementsByTagName("interface"):

1388

# Add property tags

1389

724

for tag in (make_tag(document, name, prop)

1390

725

for name, prop

1391

in self._get_all_dbus_things("property")

726

in self._get_all_dbus_properties()

1392

727

if prop._dbus_interface

1393

728

== if_tag.getAttribute("name")):

1394

729

if_tag.appendChild(tag)

1395

# Add annotation tags for properties

1396

for tag in if_tag.getElementsByTagName("property"):

1397

annots = dict()

1398

for name, prop in self._get_all_dbus_things(

1399

"property"):

1400

if (name == tag.getAttribute("name")

1401

and prop._dbus_interface

1402

== if_tag.getAttribute("name")):

1403

annots.update(getattr(

1404

prop, "_dbus_annotations", {}))

1405

for name, value in annots.items():

1406

ann_tag = document.createElement(

1407

"annotation")

1408

ann_tag.setAttribute("name", name)

1409

ann_tag.setAttribute("value", value)

1410

tag.appendChild(ann_tag)

1411

730

# Add the names to the return values for the

1412

731

# "org.freedesktop.DBus.Properties" methods

1413

732

if (if_tag.getAttribute("name")

1428

747

except (AttributeError, xml.dom.DOMException,

1429

748

xml.parsers.expat.ExpatError) as error:

1430

749

logger.error("Failed to override Introspection method",

1431

exc_info=error)

1432

return xmlstring

1433

1434

try:

1435

dbus.OBJECT_MANAGER_IFACE

1436

except AttributeError:

1437

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1438

1439

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1440

"""A D-Bus object with an ObjectManager.

1441

1442

Classes inheriting from this exposes the standard

1443

GetManagedObjects call and the InterfacesAdded and

1444

InterfacesRemoved signals on the standard

1445

"org.freedesktop.DBus.ObjectManager" interface.

1446

1447

Note: No signals are sent automatically; they must be sent

1448

manually.

1449

"""

1450

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1451

out_signature = "a{oa{sa{sv}}}")

1452

def GetManagedObjects(self):

1453

"""This function must be overridden"""

1454

raise NotImplementedError()

1455

1456

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1457

signature = "oa{sa{sv}}")

1458

def InterfacesAdded(self, object_path, interfaces_and_properties):

1459

pass

1460

1461

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1462

def InterfacesRemoved(self, object_path, interfaces):

1463

pass

1464

1465

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1466

out_signature = "s",

1467

path_keyword = 'object_path',

1468

connection_keyword = 'connection')

1469

def Introspect(self, object_path, connection):

1470

"""Overloading of standard D-Bus method.

1471

1472

Override return argument name of GetManagedObjects to be

1473

"objpath_interfaces_and_properties"

1474

"""

1475

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1476

object_path,

1477

connection)

1478

try:

1479

document = xml.dom.minidom.parseString(xmlstring)

1480

1481

for if_tag in document.getElementsByTagName("interface"):

1482

# Fix argument name for the GetManagedObjects method

1483

if (if_tag.getAttribute("name")

1484

== dbus.OBJECT_MANAGER_IFACE):

1485

for cn in if_tag.getElementsByTagName("method"):

1486

if (cn.getAttribute("name")

1487

== "GetManagedObjects"):

1488

for arg in cn.getElementsByTagName("arg"):

1489

if (arg.getAttribute("direction")

1490

== "out"):

1491

arg.setAttribute(

1492

"name",

1493

"objpath_interfaces"

1494

"_and_properties")

1495

xmlstring = document.toxml("utf-8")

1496

document.unlink()

1497

except (AttributeError, xml.dom.DOMException,

1498

xml.parsers.expat.ExpatError) as error:

1499

logger.error("Failed to override Introspection method",

1500

exc_info = error)

1501

return xmlstring

1502

1503

def datetime_to_dbus(dt, variant_level=0):

1504

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1505

if dt is None:

1506

return dbus.String("", variant_level = variant_level)

1507

return dbus.String(dt.isoformat(), variant_level=variant_level)

1508

1509

1510

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1511

"""A class decorator; applied to a subclass of

1512

dbus.service.Object, it will add alternate D-Bus attributes with

1513

interface names according to the "alt_interface_names" mapping.

1514

Usage:

1515

1516

@alternate_dbus_interfaces({"org.example.Interface":

1517

"net.example.AlternateInterface"})

1518

class SampleDBusObject(dbus.service.Object):

1519

@dbus.service.method("org.example.Interface")

1520

def SampleDBusMethod():

1521

pass

1522

1523

The above "SampleDBusMethod" on "SampleDBusObject" will be

1524

reachable via two interfaces: "org.example.Interface" and

1525

"net.example.AlternateInterface", the latter of which will have

1526

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1527

"true", unless "deprecate" is passed with a False value.

1528

1529

This works for methods and signals, and also for D-Bus properties

1530

(from DBusObjectWithProperties) and interfaces (from the

1531

dbus_interface_annotations decorator).

1532

"""

1533

1534

def wrapper(cls):

1535

for orig_interface_name, alt_interface_name in (

1536

alt_interface_names.items()):

1537

attr = {}

1538

interface_names = set()

1539

# Go though all attributes of the class

1540

for attrname, attribute in inspect.getmembers(cls):

1541

# Ignore non-D-Bus attributes, and D-Bus attributes

1542

# with the wrong interface name

1543

if (not hasattr(attribute, "_dbus_interface")

1544

or not attribute._dbus_interface.startswith(

1545

orig_interface_name)):

1546

continue

1547

# Create an alternate D-Bus interface name based on

1548

# the current name

1549

alt_interface = attribute._dbus_interface.replace(

1550

orig_interface_name, alt_interface_name)

1551

interface_names.add(alt_interface)

1552

# Is this a D-Bus signal?

1553

if getattr(attribute, "_dbus_is_signal", False):

1554

# Extract the original non-method undecorated

1555

# function by black magic

1556

if sys.version_info.major == 2:

1557

nonmethod_func = (dict(

1558

zip(attribute.func_code.co_freevars,

1559

attribute.__closure__))

1560

["func"].cell_contents)

1561

else:

1562

nonmethod_func = (dict(

1563

zip(attribute.__code__.co_freevars,

1564

attribute.__closure__))

1565

["func"].cell_contents)

1566

# Create a new, but exactly alike, function

1567

# object, and decorate it to be a new D-Bus signal

1568

# with the alternate D-Bus interface name

1569

new_function = copy_function(nonmethod_func)

1570

new_function = (dbus.service.signal(

1571

alt_interface,

1572

attribute._dbus_signature)(new_function))

1573

# Copy annotations, if any

1574

try:

1575

new_function._dbus_annotations = dict(

1576

attribute._dbus_annotations)

1577

except AttributeError:

1578

pass

1579

# Define a creator of a function to call both the

1580

# original and alternate functions, so both the

1581

# original and alternate signals gets sent when

1582

# the function is called

1583

def fixscope(func1, func2):

1584

"""This function is a scope container to pass

1585

func1 and func2 to the "call_both" function

1586

outside of its arguments"""

1587

1588

@functools.wraps(func2)

1589

def call_both(*args, **kwargs):

1590

"""This function will emit two D-Bus

1591

signals by calling func1 and func2"""

1592

func1(*args, **kwargs)

1593

func2(*args, **kwargs)

1594

# Make wrapper function look like a D-Bus signal

1595

for name, attr in inspect.getmembers(func2):

1596

if name.startswith("_dbus_"):

1597

setattr(call_both, name, attr)

1598

1599

return call_both

1600

# Create the "call_both" function and add it to

1601

# the class

1602

attr[attrname] = fixscope(attribute, new_function)

1603

# Is this a D-Bus method?

1604

elif getattr(attribute, "_dbus_is_method", False):

1605

# Create a new, but exactly alike, function

1606

# object. Decorate it to be a new D-Bus method

1607

# with the alternate D-Bus interface name. Add it

1608

# to the class.

1609

attr[attrname] = (

1610

dbus.service.method(

1611

alt_interface,

1612

attribute._dbus_in_signature,

1613

attribute._dbus_out_signature)

1614

(copy_function(attribute)))

1615

# Copy annotations, if any

1616

try:

1617

attr[attrname]._dbus_annotations = dict(

1618

attribute._dbus_annotations)

1619

except AttributeError:

1620

pass

1621

# Is this a D-Bus property?

1622

elif getattr(attribute, "_dbus_is_property", False):

1623

# Create a new, but exactly alike, function

1624

# object, and decorate it to be a new D-Bus

1625

# property with the alternate D-Bus interface

1626

# name. Add it to the class.

1627

attr[attrname] = (dbus_service_property(

1628

alt_interface, attribute._dbus_signature,

1629

attribute._dbus_access,

1630

attribute._dbus_get_args_options

1631

["byte_arrays"])

1632

(copy_function(attribute)))

1633

# Copy annotations, if any

1634

try:

1635

attr[attrname]._dbus_annotations = dict(

1636

attribute._dbus_annotations)

1637

except AttributeError:

1638

pass

1639

# Is this a D-Bus interface?

1640

elif getattr(attribute, "_dbus_is_interface", False):

1641

# Create a new, but exactly alike, function

1642

# object. Decorate it to be a new D-Bus interface

1643

# with the alternate D-Bus interface name. Add it

1644

# to the class.

1645

attr[attrname] = (

1646

dbus_interface_annotations(alt_interface)

1647

(copy_function(attribute)))

1648

if deprecate:

1649

# Deprecate all alternate interfaces

1650

iname="_AlternateDBusNames_interface_annotation{}"

1651

for interface_name in interface_names:

1652

1653

@dbus_interface_annotations(interface_name)

1654

def func(self):

1655

return { "org.freedesktop.DBus.Deprecated":

1656

"true" }

1657

# Find an unused name

1658

for aname in (iname.format(i)

1659

for i in itertools.count()):

1660

if aname not in attr:

1661

attr[aname] = func

1662

break

1663

if interface_names:

1664

# Replace the class with a new subclass of it with

1665

# methods, signals, etc. as created above.

1666

if sys.version_info.major == 2:

1667

cls = type(b"{}Alternate".format(cls.__name__),

1668

(cls, ), attr)

1669

else:

1670

cls = type("{}Alternate".format(cls.__name__),

1671

(cls, ), attr)

1672

return cls

1673

1674

return wrapper

1675

1676

1677

@alternate_dbus_interfaces({"se.recompile.Mandos":

1678

"se.bsnet.fukt.Mandos"})

750

error)

751

return xmlstring

752

753

1679

754

class ClientDBus(Client, DBusObjectWithProperties):

1680

755

"""A Client class using D-Bus

1681

756

1685

760

"""

1686

761

1687

762

runtime_expansions = (Client.runtime_expansions

1688

+ ("dbus_object_path", ))

1689

1690

_interface = "se.recompile.Mandos.Client"

763

+ ("dbus_object_path",))

1691

764

1692

765

# dbus.service.Object doesn't use super(), so we can't either.

1693

766

1694

767

def __init__(self, bus = None, *args, **kwargs):

768

self._approvals_pending = 0

1695

769

self.bus = bus

1696

770

Client.__init__(self, *args, **kwargs)

1697

771

# Only now, when this client is initialized, can it show up on

1698

772

# the D-Bus

1699

client_object_name = str(self.name).translate(

773

client_object_name = unicode(self.name).translate(

1700

774

{ord("."): ord("_"),

1701

775

ord("-"): ord("_")})

1702

self.dbus_object_path = dbus.ObjectPath(

1703

"/clients/" + client_object_name)

776

self.dbus_object_path = (dbus.ObjectPath

777

("/clients/" + client_object_name))

1704

778

DBusObjectWithProperties.__init__(self, self.bus,

1705

779

self.dbus_object_path)

1706

1707

def notifychangeproperty(transform_func, dbus_name,

1708

type_func=lambda x: x,

1709

variant_level=1,

1710

invalidate_only=False,

1711

_interface=_interface):

1712

""" Modify a variable so that it's a property which announces

1713

its changes to DBus.

1714

1715

transform_fun: Function that takes a value and a variant_level

1716

and transforms it to a D-Bus type.

1717

dbus_name: D-Bus name of the variable

1718

type_func: Function that transform the value before sending it

1719

to the D-Bus. Default: no transform

1720

variant_level: D-Bus variant level. Default: 1

1721

"""

1722

attrname = "_{}".format(dbus_name)

1723

1724

def setter(self, value):

1725

if hasattr(self, "dbus_object_path"):

1726

if (not hasattr(self, attrname) or

1727

type_func(getattr(self, attrname, None))

1728

!= type_func(value)):

1729

if invalidate_only:

1730

self.PropertiesChanged(

1731

_interface, dbus.Dictionary(),

1732

dbus.Array((dbus_name, )))

1733

else:

1734

dbus_value = transform_func(

1735

type_func(value),

1736

variant_level = variant_level)

1737

self.PropertyChanged(dbus.String(dbus_name),

1738

dbus_value)

1739

self.PropertiesChanged(

1740

_interface,

1741

dbus.Dictionary({ dbus.String(dbus_name):

1742

dbus_value }),

1743

dbus.Array())

1744

setattr(self, attrname, value)

1745

1746

return property(lambda self: getattr(self, attrname), setter)

1747

1748

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1749

approvals_pending = notifychangeproperty(dbus.Boolean,

1750

"ApprovalPending",

1751

type_func = bool)

1752

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1753

last_enabled = notifychangeproperty(datetime_to_dbus,

1754

"LastEnabled")

1755

checker = notifychangeproperty(

1756

dbus.Boolean, "CheckerRunning",

1757

type_func = lambda checker: checker is not None)

1758

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1759

"LastCheckedOK")

1760

last_checker_status = notifychangeproperty(dbus.Int16,

1761

"LastCheckerStatus")

1762

last_approval_request = notifychangeproperty(

1763

datetime_to_dbus, "LastApprovalRequest")

1764

approved_by_default = notifychangeproperty(dbus.Boolean,

1765

"ApprovedByDefault")

1766

approval_delay = notifychangeproperty(

1767

dbus.UInt64, "ApprovalDelay",

1768

type_func = lambda td: td.total_seconds() * 1000)

1769

approval_duration = notifychangeproperty(

1770

dbus.UInt64, "ApprovalDuration",

1771

type_func = lambda td: td.total_seconds() * 1000)

1772

host = notifychangeproperty(dbus.String, "Host")

1773

timeout = notifychangeproperty(

1774

dbus.UInt64, "Timeout",

1775

type_func = lambda td: td.total_seconds() * 1000)

1776

extended_timeout = notifychangeproperty(

1777

dbus.UInt64, "ExtendedTimeout",

1778

type_func = lambda td: td.total_seconds() * 1000)

1779

interval = notifychangeproperty(

1780

dbus.UInt64, "Interval",

1781

type_func = lambda td: td.total_seconds() * 1000)

1782

checker_command = notifychangeproperty(dbus.String, "Checker")

1783

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1784

invalidate_only=True)

1785

1786

del notifychangeproperty

780

def _set_expires(self, value):

781

old_value = getattr(self, "_expires", None)

782

self._expires = value

783

if hasattr(self, "dbus_object_path") and old_value != value:

784

dbus_time = (self._datetime_to_dbus(self._expires,

785

variant_level=1))

786

self.PropertyChanged(dbus.String("Expires"),

787

dbus_time)

788

expires = property(lambda self: self._expires, _set_expires)

789

del _set_expires

790

791

def _get_approvals_pending(self):

792

return self._approvals_pending

793

def _set_approvals_pending(self, value):

794

old_value = self._approvals_pending

795

self._approvals_pending = value

796

bval = bool(value)

797

if (hasattr(self, "dbus_object_path")

798

and bval is not bool(old_value)):

799

dbus_bool = dbus.Boolean(bval, variant_level=1)

800

self.PropertyChanged(dbus.String("ApprovalPending"),

801

dbus_bool)

802

803

approvals_pending = property(_get_approvals_pending,

804

_set_approvals_pending)

805

del _get_approvals_pending, _set_approvals_pending

806

807

@staticmethod

808

def _datetime_to_dbus(dt, variant_level=0):

809

"""Convert a UTC datetime.datetime() to a D-Bus type."""

810

if dt is None:

811

return dbus.String("", variant_level = variant_level)

812

return dbus.String(dt.isoformat(),

813

variant_level=variant_level)

814

815

def enable(self):

816

oldstate = getattr(self, "enabled", False)

817

r = Client.enable(self)

818

if oldstate != self.enabled:

819

# Emit D-Bus signals

820

self.PropertyChanged(dbus.String("Enabled"),

821

dbus.Boolean(True, variant_level=1))

822

self.PropertyChanged(

823

dbus.String("LastEnabled"),

824

self._datetime_to_dbus(self.last_enabled,

825

variant_level=1))

826

return r

827

828

def disable(self, quiet = False):

829

oldstate = getattr(self, "enabled", False)

830

r = Client.disable(self, quiet=quiet)

831

if not quiet and oldstate != self.enabled:

832

# Emit D-Bus signal

833

self.PropertyChanged(dbus.String("Enabled"),

834

dbus.Boolean(False, variant_level=1))

835

return r

1787

836

1788

837

def __del__(self, *args, **kwargs):

1789

838

try:

1794

843

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1795

844

Client.__del__(self, *args, **kwargs)

1796

845

1797

def checker_callback(self, source, condition,

1798

connection, command, *args, **kwargs):

1799

ret = Client.checker_callback(self, source, condition,

1800

connection, command, *args,

1801

**kwargs)

1802

exitstatus = self.last_checker_status

1803

if exitstatus >= 0:

846

def checker_callback(self, pid, condition, command,

847

*args, **kwargs):

848

self.checker_callback_tag = None

849

self.checker = None

850

# Emit D-Bus signal

851

self.PropertyChanged(dbus.String("CheckerRunning"),

852

dbus.Boolean(False, variant_level=1))

853

if os.WIFEXITED(condition):

854

exitstatus = os.WEXITSTATUS(condition)

1804

855

# Emit D-Bus signal

1805

856

self.CheckerCompleted(dbus.Int16(exitstatus),

1806

# This is specific to GNU libC

1807

dbus.Int64(exitstatus << 8),

857

dbus.Int64(condition),

1808

858

dbus.String(command))

1809

859

else:

1810

860

# Emit D-Bus signal

1811

861

self.CheckerCompleted(dbus.Int16(-1),

1812

dbus.Int64(

1813

# This is specific to GNU libC

1814

(exitstatus << 8)

1815

| self.last_checker_signal),

862

dbus.Int64(condition),

1816

863

dbus.String(command))

1817

return ret

864

865

return Client.checker_callback(self, pid, condition, command,

866

*args, **kwargs)

867

868

def checked_ok(self, *args, **kwargs):

869

Client.checked_ok(self, *args, **kwargs)

870

# Emit D-Bus signal

871

self.PropertyChanged(

872

dbus.String("LastCheckedOK"),

873

(self._datetime_to_dbus(self.last_checked_ok,

874

variant_level=1)))

875

876

def need_approval(self, *args, **kwargs):

877

r = Client.need_approval(self, *args, **kwargs)

878

# Emit D-Bus signal

879

self.PropertyChanged(

880

dbus.String("LastApprovalRequest"),

881

(self._datetime_to_dbus(self.last_approval_request,

882

variant_level=1)))

883

return r

1818

884

1819

885

def start_checker(self, *args, **kwargs):

1820

old_checker_pid = getattr(self.checker, "pid", None)

886

old_checker = self.checker

887

if self.checker is not None:

888

old_checker_pid = self.checker.pid

889

else:

890

old_checker_pid = None

1821

891

r = Client.start_checker(self, *args, **kwargs)

1822

892

# Only if new checker process was started

1823

893

if (self.checker is not None

1824

894

and old_checker_pid != self.checker.pid):

1825

895

# Emit D-Bus signal

1826

896

self.CheckerStarted(self.current_checker_command)

897

self.PropertyChanged(

898

dbus.String("CheckerRunning"),

899

dbus.Boolean(True, variant_level=1))

1827

900

return r

1828

901

902

def stop_checker(self, *args, **kwargs):

903

old_checker = getattr(self, "checker", None)

904

r = Client.stop_checker(self, *args, **kwargs)

905

if (old_checker is not None

906

and getattr(self, "checker", None) is None):

907

self.PropertyChanged(dbus.String("CheckerRunning"),

908

dbus.Boolean(False, variant_level=1))

909

return r

910

1829

911

def _reset_approved(self):

1830

self.approved = None

912

self._approved = None

1831

913

return False

1832

914

1833

915

def approve(self, value=True):

1834

self.approved = value

1835

GObject.timeout_add(int(self.approval_duration.total_seconds()

1836

* 1000), self._reset_approved)

1837

916

self.send_changedstate()

917

self._approved = value

918

gobject.timeout_add(self._timedelta_to_milliseconds

919

(self.approval_duration),

920

self._reset_approved)

921

1838

922

1839

923

## D-Bus methods, signals & properties

1840

1841

## Interfaces

924

_interface = "se.bsnet.fukt.Mandos.Client"

1842

925

1843

926

## Signals

1844

927

1855

938

pass

1856

939

1857

940

# PropertyChanged - signal

1858

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1859

941

@dbus.service.signal(_interface, signature="sv")

1860

942

def PropertyChanged(self, property, value):

1861

943

"D-Bus signal"

1895

977

self.checked_ok()

1896

978

1897

979

# Enable - method

1898

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1899

980

@dbus.service.method(_interface)

1900

981

def Enable(self):

1901

982

"D-Bus method"

1902

983

self.enable()

1903

984

1904

985

# StartChecker - method

1905

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1906

986

@dbus.service.method(_interface)

1907

987

def StartChecker(self):

1908

988

"D-Bus method"

1909

989

self.start_checker()

1910

990

1911

991

# Disable - method

1912

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1913

992

@dbus.service.method(_interface)

1914

993

def Disable(self):

1915

994

"D-Bus method"

1916

995

self.disable()

1917

996

1918

997

# StopChecker - method

1919

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1920

998

@dbus.service.method(_interface)

1921

999

def StopChecker(self):

1922

1000

self.stop_checker()

1929

1007

return dbus.Boolean(bool(self.approvals_pending))

1930

1008

1931

1009

# ApprovedByDefault - property

1932

@dbus_service_property(_interface,

1933

signature="b",

1010

@dbus_service_property(_interface, signature="b",

1934

1011

access="readwrite")

1935

1012

def ApprovedByDefault_dbus_property(self, value=None):

1936

1013

if value is None: # get

1937

1014

return dbus.Boolean(self.approved_by_default)

1015

old_value = self.approved_by_default

1938

1016

self.approved_by_default = bool(value)

1017

# Emit D-Bus signal

1018

if old_value != self.approved_by_default:

1019

self.PropertyChanged(dbus.String("ApprovedByDefault"),

1020

dbus.Boolean(value, variant_level=1))

1939

1021

1940

1022

# ApprovalDelay - property

1941

@dbus_service_property(_interface,

1942

signature="t",

1023

@dbus_service_property(_interface, signature="t",

1943

1024

access="readwrite")

1944

1025

def ApprovalDelay_dbus_property(self, value=None):

1945

1026

if value is None: # get

1946

return dbus.UInt64(self.approval_delay.total_seconds()

1947

* 1000)

1027

return dbus.UInt64(self.approval_delay_milliseconds())

1028

old_value = self.approval_delay

1948

1029

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1030

# Emit D-Bus signal

1031

if old_value != self.approval_delay:

1032

self.PropertyChanged(dbus.String("ApprovalDelay"),

1033

dbus.UInt64(value, variant_level=1))

1949

1034

1950

1035

# ApprovalDuration - property

1951

@dbus_service_property(_interface,

1952

signature="t",

1036

@dbus_service_property(_interface, signature="t",

1953

1037

access="readwrite")

1954

1038

def ApprovalDuration_dbus_property(self, value=None):

1955

1039

if value is None: # get

1956

return dbus.UInt64(self.approval_duration.total_seconds()

1957

* 1000)

1040

return dbus.UInt64(self._timedelta_to_milliseconds(

1041

self.approval_duration))

1042

old_value = self.approval_duration

1958

1043

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1044

# Emit D-Bus signal

1045

if old_value != self.approval_duration:

1046

self.PropertyChanged(dbus.String("ApprovalDuration"),

1047

dbus.UInt64(value, variant_level=1))

1959

1048

1960

1049

# Name - property

1961

@dbus_annotations(

1962

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1963

1050

@dbus_service_property(_interface, signature="s", access="read")

1964

1051

def Name_dbus_property(self):

1965

1052

return dbus.String(self.name)

1966

1053

1967

1054

# Fingerprint - property

1968

@dbus_annotations(

1969

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1970

1055

@dbus_service_property(_interface, signature="s", access="read")

1971

1056

def Fingerprint_dbus_property(self):

1972

1057

return dbus.String(self.fingerprint)

1973

1058

1974

1059

# Host - property

1975

@dbus_service_property(_interface,

1976

signature="s",

1060

@dbus_service_property(_interface, signature="s",

1977

1061

access="readwrite")

1978

1062

def Host_dbus_property(self, value=None):

1979

1063

if value is None: # get

1980

1064

return dbus.String(self.host)

1981

self.host = str(value)

1065

old_value = self.host

1066

self.host = value

1067

# Emit D-Bus signal

1068

if old_value != self.host:

1069

self.PropertyChanged(dbus.String("Host"),

1070

dbus.String(value, variant_level=1))

1982

1071

1983

1072

# Created - property

1984

@dbus_annotations(

1985

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1986

1073

@dbus_service_property(_interface, signature="s", access="read")

1987

1074

def Created_dbus_property(self):

1988

return datetime_to_dbus(self.created)

1075

return dbus.String(self._datetime_to_dbus(self.created))

1989

1076

1990

1077

# LastEnabled - property

1991

1078

@dbus_service_property(_interface, signature="s", access="read")

1992

1079

def LastEnabled_dbus_property(self):

1993

return datetime_to_dbus(self.last_enabled)

1080

return self._datetime_to_dbus(self.last_enabled)

1994

1081

1995

1082

# Enabled - property

1996

@dbus_service_property(_interface,

1997

signature="b",

1083

@dbus_service_property(_interface, signature="b",

1998

1084

access="readwrite")

1999

1085

def Enabled_dbus_property(self, value=None):

2000

1086

if value is None: # get

2005

1091

self.disable()

2006

1092

2007

1093

# LastCheckedOK - property

2008

@dbus_service_property(_interface,

2009

signature="s",

1094

@dbus_service_property(_interface, signature="s",

2010

1095

access="readwrite")

2011

1096

def LastCheckedOK_dbus_property(self, value=None):

2012

1097

if value is not None:

2013

1098

self.checked_ok()

2014

1099

return

2015

return datetime_to_dbus(self.last_checked_ok)

2016

2017

# LastCheckerStatus - property

2018

@dbus_service_property(_interface, signature="n", access="read")

2019

def LastCheckerStatus_dbus_property(self):

2020

return dbus.Int16(self.last_checker_status)

1100

return self._datetime_to_dbus(self.last_checked_ok)

2021

1101

2022

1102

# Expires - property

2023

1103

@dbus_service_property(_interface, signature="s", access="read")

2024

1104

def Expires_dbus_property(self):

2025

return datetime_to_dbus(self.expires)

1105

return self._datetime_to_dbus(self.expires)

2026

1106

2027

1107

# LastApprovalRequest - property

2028

1108

@dbus_service_property(_interface, signature="s", access="read")

2029

1109

def LastApprovalRequest_dbus_property(self):

2030

return datetime_to_dbus(self.last_approval_request)

1110

return self._datetime_to_dbus(self.last_approval_request)

2031

1111

2032

1112

# Timeout - property

2033

@dbus_service_property(_interface,

2034

signature="t",

1113

@dbus_service_property(_interface, signature="t",

2035

1114

access="readwrite")

2036

1115

def Timeout_dbus_property(self, value=None):

2037

1116

if value is None: # get

2038

return dbus.UInt64(self.timeout.total_seconds() * 1000)

2039

old_timeout = self.timeout

1117

return dbus.UInt64(self.timeout_milliseconds())

1118

old_value = self.timeout

2040

1119

self.timeout = datetime.timedelta(0, 0, 0, value)

2041

# Reschedule disabling

2042

if self.enabled:

2043

now = datetime.datetime.utcnow()

2044

self.expires += self.timeout - old_timeout

2045

if self.expires <= now:

2046

# The timeout has passed

2047

self.disable()

2048

else:

2049

if (getattr(self, "disable_initiator_tag", None)

2050

is None):

2051

return

2052

GObject.source_remove(self.disable_initiator_tag)

2053

self.disable_initiator_tag = GObject.timeout_add(

2054

int((self.expires - now).total_seconds() * 1000),

2055

self.disable)

2056

1120

# Emit D-Bus signal

1121

if old_value != self.timeout:

1122

self.PropertyChanged(dbus.String("Timeout"),

1123

dbus.UInt64(value, variant_level=1))

1124

if getattr(self, "disable_initiator_tag", None) is None:

1125

return

1126

# Reschedule timeout

1127

gobject.source_remove(self.disable_initiator_tag)

1128

self.disable_initiator_tag = None

1129

self.expires = None

1130

time_to_die = (self.

1131

_timedelta_to_milliseconds((self

1132

.last_checked_ok

1133

+ self.timeout)

1134

- datetime.datetime

1135

.utcnow()))

1136

if time_to_die <= 0:

1137

# The timeout has passed

1138

self.disable()

1139

else:

1140

self.expires = (datetime.datetime.utcnow()

1141

+ datetime.timedelta(milliseconds = time_to_die))

1142

self.disable_initiator_tag = (gobject.timeout_add

1143

(time_to_die, self.disable))

1144

2057

1145

# ExtendedTimeout - property

2058

@dbus_service_property(_interface,

2059

signature="t",

1146

@dbus_service_property(_interface, signature="t",

2060

1147

access="readwrite")

2061

1148

def ExtendedTimeout_dbus_property(self, value=None):

2062

1149

if value is None: # get

2063

return dbus.UInt64(self.extended_timeout.total_seconds()

2064

* 1000)

1150

return dbus.UInt64(self.extended_timeout_milliseconds())

1151

old_value = self.extended_timeout

2065

1152

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

2066

1153

# Emit D-Bus signal

1154

if old_value != self.extended_timeout:

1155

self.PropertyChanged(dbus.String("ExtendedTimeout"),

1156

dbus.UInt64(value, variant_level=1))

1157

2067

1158

# Interval - property

2068

@dbus_service_property(_interface,

2069

signature="t",

1159

@dbus_service_property(_interface, signature="t",

2070

1160

access="readwrite")

2071

1161

def Interval_dbus_property(self, value=None):

2072

1162

if value is None: # get

2073

return dbus.UInt64(self.interval.total_seconds() * 1000)

1163

return dbus.UInt64(self.interval_milliseconds())

1164

old_value = self.interval

2074

1165

self.interval = datetime.timedelta(0, 0, 0, value)

1166

# Emit D-Bus signal

1167

if old_value != self.interval:

1168

self.PropertyChanged(dbus.String("Interval"),

1169

dbus.UInt64(value, variant_level=1))

2075

1170

if getattr(self, "checker_initiator_tag", None) is None:

2076

1171

return

2077

if self.enabled:

2078

# Reschedule checker run

2079

GObject.source_remove(self.checker_initiator_tag)

2080

self.checker_initiator_tag = GObject.timeout_add(

2081

value, self.start_checker)

2082

self.start_checker() # Start one now, too

2083

1172

# Reschedule checker run

1173

gobject.source_remove(self.checker_initiator_tag)

1174

self.checker_initiator_tag = (gobject.timeout_add

1175

(value, self.start_checker))

1176

self.start_checker() # Start one now, too

1177

2084

1178

# Checker - property

2085

@dbus_service_property(_interface,

2086

signature="s",

1179

@dbus_service_property(_interface, signature="s",

2087

1180

access="readwrite")

2088

1181

def Checker_dbus_property(self, value=None):

2089

1182

if value is None: # get

2090

1183

return dbus.String(self.checker_command)

2091

self.checker_command = str(value)

1184

old_value = self.checker_command

1185

self.checker_command = value

1186

# Emit D-Bus signal

1187

if old_value != self.checker_command:

1188

self.PropertyChanged(dbus.String("Checker"),

1189

dbus.String(self.checker_command,

1190

variant_level=1))

2092

1191

2093

1192

# CheckerRunning - property

2094

@dbus_service_property(_interface,

2095

signature="b",

1193

@dbus_service_property(_interface, signature="b",

2096

1194

access="readwrite")

2097

1195

def CheckerRunning_dbus_property(self, value=None):

2098

1196

if value is None: # get

2103

1201

self.stop_checker()

2104

1202

2105

1203

# ObjectPath - property

2106

@dbus_annotations(

2107

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2108

"org.freedesktop.DBus.Deprecated": "true"})

2109

1204

@dbus_service_property(_interface, signature="o", access="read")

2110

1205

def ObjectPath_dbus_property(self):

2111

1206

return self.dbus_object_path # is already a dbus.ObjectPath

2112

1207

2113

1208

# Secret = property

2114

@dbus_annotations(

2115

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2116

"invalidates"})

2117

@dbus_service_property(_interface,

2118

signature="ay",

2119

access="write",

2120

byte_arrays=True)

1209

@dbus_service_property(_interface, signature="ay",

1210

access="write", byte_arrays=True)

2121

1211

def Secret_dbus_property(self, value):

2122

self.secret = bytes(value)

1212

self.secret = str(value)

2123

1213

2124

1214

del _interface

2125

1215

2129

1219

self._pipe = child_pipe

2130

1220

self._pipe.send(('init', fpr, address))

2131

1221

if not self._pipe.recv():

2132

raise KeyError(fpr)

2133

1222

raise KeyError()

1223

2134

1224

def __getattribute__(self, name):

2135

if name == '_pipe':

1225

if(name == '_pipe'):

2136

1226

return super(ProxyClient, self).__getattribute__(name)

2137

1227

self._pipe.send(('getattr', name))

2138

1228

data = self._pipe.recv()

2139

1229

if data[0] == 'data':

2140

1230

return data[1]

2141

1231

if data[0] == 'function':

2142

2143

1232

def func(*args, **kwargs):

2144

1233

self._pipe.send(('funcall', name, args, kwargs))

2145

1234

return self._pipe.recv()[1]

2146

2147

1235

return func

2148

1236

2149

1237

def __setattr__(self, name, value):

2150

if name == '_pipe':

1238

if(name == '_pipe'):

2151

1239

return super(ProxyClient, self).__setattr__(name, value)

2152

1240

self._pipe.send(('setattr', name, value))

2153

1241

2161

1249

def handle(self):

2162

1250

with contextlib.closing(self.server.child_pipe) as child_pipe:

2163

1251

logger.info("TCP connection from: %s",

2164

str(self.client_address))

1252

unicode(self.client_address))

2165

1253

logger.debug("Pipe FD: %d",

2166

1254

self.server.child_pipe.fileno())

2167

2168

session = gnutls.ClientSession(self.request)

2169

1255

1256

session = (gnutls.connection

1257

.ClientSession(self.request,

1258

gnutls.connection

1259

.X509Credentials()))

1260

1261

# Note: gnutls.connection.X509Credentials is really a

1262

# generic GnuTLS certificate credentials object so long as

1263

# no X.509 keys are added to it. Therefore, we can use it

1264

# here despite using OpenPGP certificates.

1265

2170

1266

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

2171

1267

# "+AES-256-CBC", "+SHA1",

2172

1268

# "+COMP-NULL", "+CTYPE-OPENPGP",

2175

1271

priority = self.server.gnutls_priority

2176

1272

if priority is None:

2177

1273

priority = "NORMAL"

2178

gnutls.priority_set_direct(session._c_object, priority,

2179

None)

2180

1274

(gnutls.library.functions

1275

.gnutls_priority_set_direct(session._c_object,

1276

priority, None))

1277

2181

1278

# Start communication using the Mandos protocol

2182

1279

# Get protocol number

2183

1280

line = self.request.makefile().readline()

2184

1281

logger.debug("Protocol version: %r", line)

2185

1282

try:

2186

1283

if int(line.strip().split()[0]) > 1:

2187

raise RuntimeError(line)

1284

raise RuntimeError

2188

1285

except (ValueError, IndexError, RuntimeError) as error:

2189

1286

logger.error("Unknown protocol version: %s", error)

2190

1287

return

2191

1288

2192

1289

# Start GnuTLS connection

2193

1290

try:

2194

1291

session.handshake()

2195

except gnutls.Error as error:

1292

except gnutls.errors.GNUTLSError as error:

2196

1293

logger.warning("Handshake failed: %s", error)

2197

1294

# Do not run session.bye() here: the session is not

2198

1295

# established. Just abandon the request.

2199

1296

return

2200

1297

logger.debug("Handshake succeeded")

2201

1298

2202

1299

approval_required = False

2203

1300

try:

2204

1301

try:

2205

fpr = self.fingerprint(

2206

self.peer_certificate(session))

2207

except (TypeError, gnutls.Error) as error:

1302

fpr = self.fingerprint(self.peer_certificate

1303

(session))

1304

except (TypeError,

1305

gnutls.errors.GNUTLSError) as error:

2208

1306

logger.warning("Bad certificate: %s", error)

2209

1307

return

2210

1308

logger.debug("Fingerprint: %s", fpr)

2211

1309

2212

1310

try:

2213

1311

client = ProxyClient(child_pipe, fpr,

2214

1312

self.client_address)

2223

1321

while True:

2224

1322

if not client.enabled:

2225

1323

logger.info("Client %s is disabled",

2226

client.name)

1324

client.name)

2227

1325

if self.server.use_dbus:

2228

1326

# Emit D-Bus signal

2229

client.Rejected("Disabled")

1327

client.Rejected("Disabled")

2230

1328

return

2231

1329

2232

if client.approved or not client.approval_delay:

1330

if client._approved or not client.approval_delay:

2233

1331

#We are approved or approval is disabled

2234

1332

break

2235

elif client.approved is None:

1333

elif client._approved is None:

2236

1334

logger.info("Client %s needs approval",

2237

1335

client.name)

2238

1336

if self.server.use_dbus:

2239

1337

# Emit D-Bus signal

2240

1338

client.NeedApproval(

2241

client.approval_delay.total_seconds()

2242

* 1000, client.approved_by_default)

1339

client.approval_delay_milliseconds(),

1340

client.approved_by_default)

2243

1341

else:

2244

1342

logger.warning("Client %s was not approved",

2245

1343

client.name)

2249

1347

return

2250

1348

2251

1349

#wait until timeout or approved

1350

#x = float(client._timedelta_to_milliseconds(delay))

2252

1351

time = datetime.datetime.now()

2253

1352

client.changedstate.acquire()

2254

client.changedstate.wait(delay.total_seconds())

1353

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

2255

1354

client.changedstate.release()

2256

1355

time2 = datetime.datetime.now()

2257

1356

if (time2 - time) >= delay:

2268

1367

else:

2269

1368

delay -= time2 - time

2270

1369

2271

try:

2272

session.send(client.secret)

2273

except gnutls.Error as error:

2274

logger.warning("gnutls send failed",

2275

exc_info = error)

2276

return

2277

1370

sent_size = 0

1371

while sent_size < len(client.secret):

1372

try:

1373

sent = session.send(client.secret[sent_size:])

1374

except gnutls.errors.GNUTLSError as error:

1375

logger.warning("gnutls send failed")

1376

return

1377

logger.debug("Sent: %d, remaining: %d",

1378

sent, len(client.secret)

1379

- (sent_size + sent))

1380

sent_size += sent

1381

2278

1382

logger.info("Sending secret to %s", client.name)

2279

# bump the timeout using extended_timeout

2280

client.bump_timeout(client.extended_timeout)

1383

# bump the timeout as if seen

1384

client.checked_ok(client.extended_timeout)

2281

1385

if self.server.use_dbus:

2282

1386

# Emit D-Bus signal

2283

1387

client.GotSecret()

2287

1391

client.approvals_pending -= 1

2288

1392

try:

2289

1393

session.bye()

2290

except gnutls.Error as error:

2291

logger.warning("GnuTLS bye failed",

2292

exc_info=error)

1394

except gnutls.errors.GNUTLSError as error:

1395

logger.warning("GnuTLS bye failed")

2293

1396

2294

1397

@staticmethod

2295

1398

def peer_certificate(session):

2296

1399

"Return the peer's OpenPGP certificate as a bytestring"

2297

1400

# If not an OpenPGP certificate...

2298

if (gnutls.certificate_type_get(session._c_object)

2299

!= gnutls.CRT_OPENPGP):

2300

# ...return invalid data

2301

return b""

1401

if (gnutls.library.functions

1402

.gnutls_certificate_type_get(session._c_object)

1403

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1404

# ...do the normal thing

1405

return session.peer_certificate

2302

1406

list_size = ctypes.c_uint(1)

2303

cert_list = (gnutls.certificate_get_peers

1407

cert_list = (gnutls.library.functions

1408

.gnutls_certificate_get_peers

2304

1409

(session._c_object, ctypes.byref(list_size)))

2305

1410

if not bool(cert_list) and list_size.value != 0:

2306

raise gnutls.Error("error getting peer certificate")

1411

raise gnutls.errors.GNUTLSError("error getting peer"

1412

" certificate")

2307

1413

if list_size.value == 0:

2308

1414

return None

2309

1415

cert = cert_list[0]

2313

1419

def fingerprint(openpgp):

2314

1420

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2315

1421

# New GnuTLS "datum" with the OpenPGP public key

2316

datum = gnutls.datum_t(

2317

ctypes.cast(ctypes.c_char_p(openpgp),

2318

ctypes.POINTER(ctypes.c_ubyte)),

2319

ctypes.c_uint(len(openpgp)))

1422

datum = (gnutls.library.types

1423

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1424

ctypes.POINTER

1425

(ctypes.c_ubyte)),

1426

ctypes.c_uint(len(openpgp))))

2320

1427

# New empty GnuTLS certificate

2321

crt = gnutls.openpgp_crt_t()

2322

gnutls.openpgp_crt_init(ctypes.byref(crt))

1428

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1429

(gnutls.library.functions

1430

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2323

1431

# Import the OpenPGP public key into the certificate

2324

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2325

gnutls.OPENPGP_FMT_RAW)

1432

(gnutls.library.functions

1433

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1434

gnutls.library.constants

1435

.GNUTLS_OPENPGP_FMT_RAW))

2326

1436

# Verify the self signature in the key

2327

1437

crtverify = ctypes.c_uint()

2328

gnutls.openpgp_crt_verify_self(crt, 0,

2329

ctypes.byref(crtverify))

1438

(gnutls.library.functions

1439

.gnutls_openpgp_crt_verify_self(crt, 0,

1440

ctypes.byref(crtverify)))

2330

1441

if crtverify.value != 0:

2331

gnutls.openpgp_crt_deinit(crt)

2332

raise gnutls.CertificateSecurityError("Verify failed")

1442

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1443

raise (gnutls.errors.CertificateSecurityError

1444

("Verify failed"))

2333

1445

# New buffer for the fingerprint

2334

1446

buf = ctypes.create_string_buffer(20)

2335

1447

buf_len = ctypes.c_size_t()

2336

1448

# Get the fingerprint from the certificate into the buffer

2337

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2338

ctypes.byref(buf_len))

1449

(gnutls.library.functions

1450

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1451

ctypes.byref(buf_len)))

2339

1452

# Deinit the certificate

2340

gnutls.openpgp_crt_deinit(crt)

1453

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2341

1454

# Convert the buffer to a Python bytestring

2342

1455

fpr = ctypes.string_at(buf, buf_len.value)

2343

1456

# Convert the bytestring to hexadecimal notation

2344

hex_fpr = binascii.hexlify(fpr).upper()

1457

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

2345

1458

return hex_fpr

2346

1459

2347

1460

2348

1461

class MultiprocessingMixIn(object):

2349

1462

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2350

2351

1463

def sub_process_main(self, request, address):

2352

1464

try:

2353

1465

self.finish_request(request, address)

2354

except Exception:

1466

except:

2355

1467

self.handle_error(request, address)

2356

1468

self.close_request(request)

2357

1469

2358

1470

def process_request(self, request, address):

2359

1471

"""Start a new process to process the request."""

2360

proc = multiprocessing.Process(target = self.sub_process_main,

2361

args = (request, address))

2362

proc.start()

2363

return proc

2364

1472

multiprocessing.Process(target = self.sub_process_main,

1473

args = (request, address)).start()

2365

1474

2366

1475

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2367

1476

""" adds a pipe to the MixIn """

2368

2369

1477

def process_request(self, request, client_address):

2370

1478

"""Overrides and wraps the original process_request().

2371

1479

2372

1480

This function creates a new pipe in self.pipe

2373

1481

"""

2374

1482

parent_pipe, self.child_pipe = multiprocessing.Pipe()

2375

2376

proc = MultiprocessingMixIn.process_request(self, request,

2377

client_address)

1483

1484

super(MultiprocessingMixInWithPipe,

1485

self).process_request(request, client_address)

2378

1486

self.child_pipe.close()

2379

self.add_pipe(parent_pipe, proc)

2380

2381

def add_pipe(self, parent_pipe, proc):

1487

self.add_pipe(parent_pipe)

1488

1489

def add_pipe(self, parent_pipe):

2382

1490

"""Dummy function; override as necessary"""

2383

raise NotImplementedError()

2384

1491

raise NotImplementedError

2385

1492

2386

1493

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2387

1494

socketserver.TCPServer, object):

2392

1499

interface: None or a network interface name (string)

2393

1500

use_ipv6: Boolean; to use IPv6 or not

2394

1501

"""

2395

2396

1502

def __init__(self, server_address, RequestHandlerClass,

2397

interface=None,

2398

use_ipv6=True,

2399

socketfd=None):

2400

"""If socketfd is set, use that file descriptor instead of

2401

creating a new one with socket.socket().

2402

"""

1503

interface=None, use_ipv6=True):

2403

1504

self.interface = interface

2404

1505

if use_ipv6:

2405

1506

self.address_family = socket.AF_INET6

2406

if socketfd is not None:

2407

# Save the file descriptor

2408

self.socketfd = socketfd

2409

# Save the original socket.socket() function

2410

self.socket_socket = socket.socket

2411

# To implement --socket, we monkey patch socket.socket.

2412

#

2413

# (When socketserver.TCPServer is a new-style class, we

2414

# could make self.socket into a property instead of monkey

2415

# patching socket.socket.)

2416

#

2417

# Create a one-time-only replacement for socket.socket()

2418

@functools.wraps(socket.socket)

2419

def socket_wrapper(*args, **kwargs):

2420

# Restore original function so subsequent calls are

2421

# not affected.

2422

socket.socket = self.socket_socket

2423

del self.socket_socket

2424

# This time only, return a new socket object from the

2425

# saved file descriptor.

2426

return socket.fromfd(self.socketfd, *args, **kwargs)

2427

# Replace socket.socket() function with wrapper

2428

socket.socket = socket_wrapper

2429

# The socketserver.TCPServer.__init__ will call

2430

# socket.socket(), which might be our replacement,

2431

# socket_wrapper(), if socketfd was set.

2432

1507

socketserver.TCPServer.__init__(self, server_address,

2433

1508

RequestHandlerClass)

2434

2435

1509

def server_bind(self):

2436

1510

"""This overrides the normal server_bind() function

2437

1511

to bind to an interface if one was specified, and also NOT to

2443

1517

self.interface)

2444

1518

else:

2445

1519

try:

2446

self.socket.setsockopt(

2447

socket.SOL_SOCKET, SO_BINDTODEVICE,

2448

(self.interface + "\0").encode("utf-8"))

1520

self.socket.setsockopt(socket.SOL_SOCKET,

1521

SO_BINDTODEVICE,

1522

str(self.interface

1523

+ '\0'))

2449

1524

except socket.error as error:

2450

if error.errno == errno.EPERM:

2451

logger.error("No permission to bind to"

2452

" interface %s", self.interface)

2453

elif error.errno == errno.ENOPROTOOPT:

1525

if error[0] == errno.EPERM:

1526

logger.error("No permission to"

1527

" bind to interface %s",

1528

self.interface)

1529

elif error[0] == errno.ENOPROTOOPT:

2454

1530

logger.error("SO_BINDTODEVICE not available;"

2455

1531

" cannot bind to interface %s",

2456

1532

self.interface)

2457

elif error.errno == errno.ENODEV:

2458

logger.error("Interface %s does not exist,"

2459

" cannot bind", self.interface)

2460

1533

else:

2461

1534

raise

2462

1535

# Only bind(2) the socket if we really need to.

2465

1538

if self.address_family == socket.AF_INET6:

2466

1539

any_address = "::" # in6addr_any

2467

1540

else:

2468

any_address = "0.0.0.0" # INADDR_ANY

1541

any_address = socket.INADDR_ANY

2469

1542

self.server_address = (any_address,

2470

1543

self.server_address[1])

2471

1544

elif not self.server_address[1]:

2472

self.server_address = (self.server_address[0], 0)

1545

self.server_address = (self.server_address[0],

1546

0)

2473

1547

# if self.interface:

2474

1548

# self.server_address = (self.server_address[0],

2475

1549

# 0, # port

2487

1561

gnutls_priority GnuTLS priority string

2488

1562

use_dbus: Boolean; to emit D-Bus signals or not

2489

1563

2490

Assumes a GObject.MainLoop event loop.

1564

Assumes a gobject.MainLoop event loop.

2491

1565

"""

2492

2493

1566

def __init__(self, server_address, RequestHandlerClass,

2494

interface=None,

2495

use_ipv6=True,

2496

clients=None,

2497

gnutls_priority=None,

2498

use_dbus=True,

2499

socketfd=None):

1567

interface=None, use_ipv6=True, clients=None,

1568

gnutls_priority=None, use_dbus=True):

2500

1569

self.enabled = False

2501

1570

self.clients = clients

2502

1571

if self.clients is None:

2503

self.clients = {}

1572

self.clients = set()

2504

1573

self.use_dbus = use_dbus

2505

1574

self.gnutls_priority = gnutls_priority

2506

1575

IPv6_TCPServer.__init__(self, server_address,

2507

1576

RequestHandlerClass,

2508

1577

interface = interface,

2509

use_ipv6 = use_ipv6,

2510

socketfd = socketfd)

2511

1578

use_ipv6 = use_ipv6)

2512

1579

def server_activate(self):

2513

1580

if self.enabled:

2514

1581

return socketserver.TCPServer.server_activate(self)

2515

2516

1582

def enable(self):

2517

1583

self.enabled = True

2518

2519

def add_pipe(self, parent_pipe, proc):

1584

def add_pipe(self, parent_pipe):

2520

1585

# Call "handle_ipc" for both data and EOF events

2521

GObject.io_add_watch(

2522

parent_pipe.fileno(),

2523

GObject.IO_IN | GObject.IO_HUP,

2524

functools.partial(self.handle_ipc,

2525

parent_pipe = parent_pipe,

2526

proc = proc))

2527

2528

def handle_ipc(self, source, condition,

2529

parent_pipe=None,

2530

proc = None,

1586

gobject.io_add_watch(parent_pipe.fileno(),

1587

gobject.IO_IN | gobject.IO_HUP,

1588

functools.partial(self.handle_ipc,

1589

parent_pipe = parent_pipe))

1590

1591

def handle_ipc(self, source, condition, parent_pipe=None,

2531

1592

client_object=None):

2532

# error, or the other end of multiprocessing.Pipe has closed

2533

if condition & (GObject.IO_ERR | GObject.IO_HUP):

2534

# Wait for other process to exit

2535

proc.join()

1593

condition_names = {

1594

gobject.IO_IN: "IN", # There is data to read.

1595

gobject.IO_OUT: "OUT", # Data can be written (without

1596

# blocking).

1597

gobject.IO_PRI: "PRI", # There is urgent data to read.

1598

gobject.IO_ERR: "ERR", # Error condition.

1599

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1600

# broken, usually for pipes and

1601

# sockets).

1602

}

1603

conditions_string = ' | '.join(name

1604

for cond, name in

1605

condition_names.iteritems()

1606

if cond & condition)

1607

# error or the other end of multiprocessing.Pipe has closed

1608

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2536

1609

return False

2537

1610

2538

1611

# Read a request from the child

2543

1616

fpr = request[1]

2544

1617

address = request[2]

2545

1618

2546

for c in self.clients.values():

1619

for c in self.clients:

2547

1620

if c.fingerprint == fpr:

2548

1621

client = c

2549

1622

break

2552

1625

"dress: %s", fpr, address)

2553

1626

if self.use_dbus:

2554

1627

# Emit D-Bus signal

2555

mandos_dbus_service.ClientNotFound(fpr,

2556

address[0])

1628

mandos_dbus_service.ClientNotFound(fpr, address[0])

2557

1629

parent_pipe.send(False)

2558

1630

return False

2559

1631

2560

GObject.io_add_watch(

2561

parent_pipe.fileno(),

2562

GObject.IO_IN | GObject.IO_HUP,

2563

functools.partial(self.handle_ipc,

2564

parent_pipe = parent_pipe,

2565

proc = proc,

2566

client_object = client))

1632

gobject.io_add_watch(parent_pipe.fileno(),

1633

gobject.IO_IN | gobject.IO_HUP,

1634

functools.partial(self.handle_ipc,

1635

parent_pipe = parent_pipe,

1636

client_object = client))

2567

1637

parent_pipe.send(True)

2568

# remove the old hook in favor of the new above hook on

2569

# same fileno

1638

# remove the old hook in favor of the new above hook on same fileno

2570

1639

return False

2571

1640

if command == 'funcall':

2572

1641

funcname = request[1]

2573

1642

args = request[2]

2574

1643

kwargs = request[3]

2575

1644

2576

parent_pipe.send(('data', getattr(client_object,

2577

funcname)(*args,

2578

**kwargs)))

2579

1645

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1646

2580

1647

if command == 'getattr':

2581

1648

attrname = request[1]

2582

if isinstance(client_object.__getattribute__(attrname),

2583

collections.Callable):

2584

parent_pipe.send(('function', ))

1649

if callable(client_object.__getattribute__(attrname)):

1650

parent_pipe.send(('function',))

2585

1651

else:

2586

parent_pipe.send((

2587

'data', client_object.__getattribute__(attrname)))

1652

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

2588

1653

2589

1654

if command == 'setattr':

2590

1655

attrname = request[1]

2591

1656

value = request[2]

2592

1657

setattr(client_object, attrname, value)

2593

1658

2594

1659

return True

2595

1660

2596

1661

2597

def rfc3339_duration_to_delta(duration):

2598

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2599

2600

>>> rfc3339_duration_to_delta("P7D")

2601

datetime.timedelta(7)

2602

>>> rfc3339_duration_to_delta("PT60S")

2603

datetime.timedelta(0, 60)

2604

>>> rfc3339_duration_to_delta("PT60M")

2605

datetime.timedelta(0, 3600)

2606

>>> rfc3339_duration_to_delta("PT24H")

2607

datetime.timedelta(1)

2608

>>> rfc3339_duration_to_delta("P1W")

2609

datetime.timedelta(7)

2610

>>> rfc3339_duration_to_delta("PT5M30S")

2611

datetime.timedelta(0, 330)

2612

>>> rfc3339_duration_to_delta("P1DT3M20S")

2613

datetime.timedelta(1, 200)

2614

"""

2615

2616

# Parsing an RFC 3339 duration with regular expressions is not

2617

# possible - there would have to be multiple places for the same

2618

# values, like seconds. The current code, while more esoteric, is

2619

# cleaner without depending on a parsing library. If Python had a

2620

# built-in library for parsing we would use it, but we'd like to

2621

# avoid excessive use of external libraries.

2622

2623

# New type for defining tokens, syntax, and semantics all-in-one

2624

Token = collections.namedtuple("Token", (

2625

"regexp", # To match token; if "value" is not None, must have

2626

# a "group" containing digits

2627

"value", # datetime.timedelta or None

2628

"followers")) # Tokens valid after this token

2629

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2630

# the "duration" ABNF definition in RFC 3339, Appendix A.

2631

token_end = Token(re.compile(r"$"), None, frozenset())

2632

token_second = Token(re.compile(r"(\d+)S"),

2633

datetime.timedelta(seconds=1),

2634

frozenset((token_end, )))

2635

token_minute = Token(re.compile(r"(\d+)M"),

2636

datetime.timedelta(minutes=1),

2637

frozenset((token_second, token_end)))

2638

token_hour = Token(re.compile(r"(\d+)H"),

2639

datetime.timedelta(hours=1),

2640

frozenset((token_minute, token_end)))

2641

token_time = Token(re.compile(r"T"),

2642

None,

2643

frozenset((token_hour, token_minute,

2644

token_second)))

2645

token_day = Token(re.compile(r"(\d+)D"),

2646

datetime.timedelta(days=1),

2647

frozenset((token_time, token_end)))

2648

token_month = Token(re.compile(r"(\d+)M"),

2649

datetime.timedelta(weeks=4),

2650

frozenset((token_day, token_end)))

2651

token_year = Token(re.compile(r"(\d+)Y"),

2652

datetime.timedelta(weeks=52),

2653

frozenset((token_month, token_end)))

2654

token_week = Token(re.compile(r"(\d+)W"),

2655

datetime.timedelta(weeks=1),

2656

frozenset((token_end, )))

2657

token_duration = Token(re.compile(r"P"), None,

2658

frozenset((token_year, token_month,

2659

token_day, token_time,

2660

token_week)))

2661

# Define starting values

2662

value = datetime.timedelta() # Value so far

2663

found_token = None

2664

followers = frozenset((token_duration, )) # Following valid tokens

2665

s = duration # String left to parse

2666

# Loop until end token is found

2667

while found_token is not token_end:

2668

# Search for any currently valid tokens

2669

for token in followers:

2670

match = token.regexp.match(s)

2671

if match is not None:

2672

# Token found

2673

if token.value is not None:

2674

# Value found, parse digits

2675

factor = int(match.group(1), 10)

2676

# Add to value so far

2677

value += factor * token.value

2678

# Strip token from string

2679

s = token.regexp.sub("", s, 1)

2680

# Go to found token

2681

found_token = token

2682

# Set valid next tokens

2683

followers = found_token.followers

2684

break

2685

else:

2686

# No currently valid tokens were found

2687

raise ValueError("Invalid RFC 3339 duration: {!r}"

2688

.format(duration))

2689

# End token found

2690

return value

2691

2692

2693

1662

def string_to_delta(interval):

2694

1663

"""Parse a string and return a datetime.timedelta

2695

1664

2706

1675

>>> string_to_delta('5m 30s')

2707

1676

datetime.timedelta(0, 330)

2708

1677

"""

2709

2710

try:

2711

return rfc3339_duration_to_delta(interval)

2712

except ValueError:

2713

pass

2714

2715

1678

timevalue = datetime.timedelta(0)

2716

1679

for s in interval.split():

2717

1680

try:

2718

suffix = s[-1]

1681

suffix = unicode(s[-1])

2719

1682

value = int(s[:-1])

2720

1683

if suffix == "d":

2721

1684

delta = datetime.timedelta(value)

2728

1691

elif suffix == "w":

2729

1692

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2730

1693

else:

2731

raise ValueError("Unknown suffix {!r}".format(suffix))

2732

except IndexError as e:

1694

raise ValueError("Unknown suffix %r" % suffix)

1695

except (ValueError, IndexError) as e:

2733

1696

raise ValueError(*(e.args))

2734

1697

timevalue += delta

2735

1698

return timevalue

2736

1699

2737

1700

1701

def if_nametoindex(interface):

1702

"""Call the C function if_nametoindex(), or equivalent

1703

1704

Note: This function cannot accept a unicode string."""

1705

global if_nametoindex

1706

try:

1707

if_nametoindex = (ctypes.cdll.LoadLibrary

1708

(ctypes.util.find_library("c"))

1709

.if_nametoindex)

1710

except (OSError, AttributeError):

1711

logger.warning("Doing if_nametoindex the hard way")

1712

def if_nametoindex(interface):

1713

"Get an interface index the hard way, i.e. using fcntl()"

1714

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1715

with contextlib.closing(socket.socket()) as s:

1716

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1717

struct.pack(str("16s16x"),

1718

interface))

1719

interface_index = struct.unpack(str("I"),

1720

ifreq[16:20])[0]

1721

return interface_index

1722

return if_nametoindex(interface)

1723

1724

2738

1725

def daemon(nochdir = False, noclose = False):

2739

1726

"""See daemon(3). Standard BSD Unix function.

2740

1727

2748

1735

sys.exit()

2749

1736

if not noclose:

2750

1737

# Close all standard open file descriptors

2751

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1738

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2752

1739

if not stat.S_ISCHR(os.fstat(null).st_mode):

2753

1740

raise OSError(errno.ENODEV,

2754

"{} not a character device"

2755

.format(os.devnull))

1741

"%s not a character device"

1742

% os.path.devnull)

2756

1743

os.dup2(null, sys.stdin.fileno())

2757

1744

os.dup2(null, sys.stdout.fileno())

2758

1745

os.dup2(null, sys.stderr.fileno())

2767

1754

2768

1755

parser = argparse.ArgumentParser()

2769

1756

parser.add_argument("-v", "--version", action="version",

2770

version = "%(prog)s {}".format(version),

1757

version = "%%(prog)s %s" % version,

2771

1758

help="show version number and exit")

2772

1759

parser.add_argument("-i", "--interface", metavar="IF",

2773

1760

help="Bind to interface IF")

2779

1766

help="Run self-test")

2780

1767

parser.add_argument("--debug", action="store_true",

2781

1768

help="Debug mode; run in foreground and log"

2782

" to terminal", default=None)

1769

" to terminal")

2783

1770

parser.add_argument("--debuglevel", metavar="LEVEL",

2784

1771

help="Debug level for stdout output")

2785

1772

parser.add_argument("--priority", help="GnuTLS"

2792

1779

" files")

2793

1780

parser.add_argument("--no-dbus", action="store_false",

2794

1781

dest="use_dbus", help="Do not provide D-Bus"

2795

" system bus interface", default=None)

1782

" system bus interface")

2796

1783

parser.add_argument("--no-ipv6", action="store_false",

2797

dest="use_ipv6", help="Do not use IPv6",

2798

default=None)

2799

parser.add_argument("--no-restore", action="store_false",

2800

dest="restore", help="Do not restore stored"

2801

" state", default=None)

2802

parser.add_argument("--socket", type=int,

2803

help="Specify a file descriptor to a network"

2804

" socket to use instead of creating one")

2805

parser.add_argument("--statedir", metavar="DIR",

2806

help="Directory to save/restore state in")

2807

parser.add_argument("--foreground", action="store_true",

2808

help="Run in foreground", default=None)

2809

parser.add_argument("--no-zeroconf", action="store_false",

2810

dest="zeroconf", help="Do not use Zeroconf",

2811

default=None)

2812

1784

dest="use_ipv6", help="Do not use IPv6")

2813

1785

options = parser.parse_args()

2814

1786

2815

1787

if options.check:

2816

1788

import doctest

2817

fail_count, test_count = doctest.testmod()

2818

sys.exit(os.EX_OK if fail_count == 0 else 1)

1789

doctest.testmod()

1790

sys.exit()

2819

1791

2820

1792

# Default values for config file for server-global settings

2821

1793

server_defaults = { "interface": "",

2823

1795

"port": "",

2824

1796

"debug": "False",

2825

1797

"priority":

2826

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2827

":+SIGN-DSA-SHA256",

1798

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2828

1799

"servicename": "Mandos",

2829

1800

"use_dbus": "True",

2830

1801

"use_ipv6": "True",

2831

1802

"debuglevel": "",

2832

"restore": "True",

2833

"socket": "",

2834

"statedir": "/var/lib/mandos",

2835

"foreground": "False",

2836

"zeroconf": "True",

2837

}

1803

}

2838

1804

2839

1805

# Parse config file for server-global settings

2840

1806

server_config = configparser.SafeConfigParser(server_defaults)

2841

1807

del server_defaults

2842

server_config.read(os.path.join(options.configdir, "mandos.conf"))

1808

server_config.read(os.path.join(options.configdir,

1809

"mandos.conf"))

2843

1810

# Convert the SafeConfigParser object to a dict

2844

1811

server_settings = server_config.defaults()

2845

1812

# Use the appropriate methods on the non-string config options

2846

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

1813

for option in ("debug", "use_dbus", "use_ipv6"):

2847

1814

server_settings[option] = server_config.getboolean("DEFAULT",

2848

1815

option)

2849

1816

if server_settings["port"]:

2850

1817

server_settings["port"] = server_config.getint("DEFAULT",

2851

1818

"port")

2852

if server_settings["socket"]:

2853

server_settings["socket"] = server_config.getint("DEFAULT",

2854

"socket")

2855

# Later, stdin will, and stdout and stderr might, be dup'ed

2856

# over with an opened os.devnull. But we don't want this to

2857

# happen with a supplied network socket.

2858

if 0 <= server_settings["socket"] <= 2:

2859

server_settings["socket"] = os.dup(server_settings

2860

["socket"])

2861

1819

del server_config

2862

1820

2863

1821

# Override the settings from the config file with command line

2864

1822

# options, if set.

2865

1823

for option in ("interface", "address", "port", "debug",

2866

"priority", "servicename", "configdir", "use_dbus",

2867

"use_ipv6", "debuglevel", "restore", "statedir",

2868

"socket", "foreground", "zeroconf"):

1824

"priority", "servicename", "configdir",

1825

"use_dbus", "use_ipv6", "debuglevel"):

2869

1826

value = getattr(options, option)

2870

1827

if value is not None:

2871

1828

server_settings[option] = value

2872

1829

del options

2873

1830

# Force all strings to be unicode

2874

1831

for option in server_settings.keys():

2875

if isinstance(server_settings[option], bytes):

2876

server_settings[option] = (server_settings[option]

2877

.decode("utf-8"))

2878

# Force all boolean options to be boolean

2879

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2880

"foreground", "zeroconf"):

2881

server_settings[option] = bool(server_settings[option])

2882

# Debug implies foreground

2883

if server_settings["debug"]:

2884

server_settings["foreground"] = True

1832

if type(server_settings[option]) is str:

1833

server_settings[option] = unicode(server_settings[option])

2885

1834

# Now we have our good server settings in "server_settings"

2886

1835

2887

1836

##################################################################

2888

1837

2889

if (not server_settings["zeroconf"]

2890

and not (server_settings["port"]

2891

or server_settings["socket"] != "")):

2892

parser.error("Needs port or socket to work without Zeroconf")

2893

2894

1838

# For convenience

2895

1839

debug = server_settings["debug"]

2896

1840

debuglevel = server_settings["debuglevel"]

2897

1841

use_dbus = server_settings["use_dbus"]

2898

1842

use_ipv6 = server_settings["use_ipv6"]

2899

stored_state_path = os.path.join(server_settings["statedir"],

2900

stored_state_file)

2901

foreground = server_settings["foreground"]

2902

zeroconf = server_settings["zeroconf"]

2903

2904

if debug:

2905

initlogger(debug, logging.DEBUG)

2906

else:

2907

if not debuglevel:

2908

initlogger(debug)

2909

else:

2910

level = getattr(logging, debuglevel.upper())

2911

initlogger(debug, level)

2912

1843

2913

1844

if server_settings["servicename"] != "Mandos":

2914

syslogger.setFormatter(

2915

logging.Formatter('Mandos ({}) [%(process)d]:'

2916

' %(levelname)s: %(message)s'.format(

2917

server_settings["servicename"])))

1845

syslogger.setFormatter(logging.Formatter

1846

('Mandos (%s) [%%(process)d]:'

1847

' %%(levelname)s: %%(message)s'

1848

% server_settings["servicename"]))

2918

1849

2919

1850

# Parse config file with clients

2920

client_config = configparser.SafeConfigParser(Client

2921

.client_defaults)

1851

client_defaults = { "timeout": "5m",

1852

"extended_timeout": "15m",

1853

"interval": "2m",

1854

"checker": "fping -q -- %%(host)s",

1855

"host": "",

1856

"approval_delay": "0s",

1857

"approval_duration": "1s",

1858

}

1859

client_config = configparser.SafeConfigParser(client_defaults)

2922

1860

client_config.read(os.path.join(server_settings["configdir"],

2923

1861

"clients.conf"))

2924

1862

2925

1863

global mandos_dbus_service

2926

1864

mandos_dbus_service = None

2927

1865

2928

socketfd = None

2929

if server_settings["socket"] != "":

2930

socketfd = server_settings["socket"]

2931

tcp_server = MandosServer(

2932

(server_settings["address"], server_settings["port"]),

2933

ClientHandler,

2934

interface=(server_settings["interface"] or None),

2935

use_ipv6=use_ipv6,

2936

gnutls_priority=server_settings["priority"],

2937

use_dbus=use_dbus,

2938

socketfd=socketfd)

2939

if not foreground:

2940

pidfilename = "/run/mandos.pid"

2941

if not os.path.isdir("/run/."):

2942

pidfilename = "/var/run/mandos.pid"

2943

pidfile = None

1866

tcp_server = MandosServer((server_settings["address"],

1867

server_settings["port"]),

1868

ClientHandler,

1869

interface=(server_settings["interface"]

1870

or None),

1871

use_ipv6=use_ipv6,

1872

gnutls_priority=

1873

server_settings["priority"],

1874

use_dbus=use_dbus)

1875

if not debug:

1876

pidfilename = "/var/run/mandos.pid"

2944

1877

try:

2945

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2946

except IOError as e:

2947

logger.error("Could not open file %r", pidfilename,

2948

exc_info=e)

1878

pidfile = open(pidfilename, "w")

1879

except IOError:

1880

logger.error("Could not open file %r", pidfilename)

2949

1881

2950

for name, group in (("_mandos", "_mandos"),

2951

("mandos", "mandos"),

2952

("nobody", "nogroup")):

1882

try:

1883

uid = pwd.getpwnam("_mandos").pw_uid

1884

gid = pwd.getpwnam("_mandos").pw_gid

1885

except KeyError:

2953

1886

try:

2954

uid = pwd.getpwnam(name).pw_uid

2955

gid = pwd.getpwnam(group).pw_gid

2956

break

1887

uid = pwd.getpwnam("mandos").pw_uid

1888

gid = pwd.getpwnam("mandos").pw_gid

2957

1889

except KeyError:

2958

continue

2959

else:

2960

uid = 65534

2961

gid = 65534

1890

try:

1891

uid = pwd.getpwnam("nobody").pw_uid

1892

gid = pwd.getpwnam("nobody").pw_gid

1893

except KeyError:

1894

uid = 65534

1895

gid = 65534

2962

1896

try:

2963

1897

os.setgid(gid)

2964

1898

os.setuid(uid)

2965

if debug:

2966

logger.debug("Did setuid/setgid to {}:{}".format(uid,

2967

gid))

2968

1899

except OSError as error:

2969

logger.warning("Failed to setuid/setgid to {}:{}: {}"

2970

.format(uid, gid, os.strerror(error.errno)))

2971

if error.errno != errno.EPERM:

2972

raise

1900

if error[0] != errno.EPERM:

1901

raise error

2973

1902

1903

if not debug and not debuglevel:

1904

syslogger.setLevel(logging.WARNING)

1905

console.setLevel(logging.WARNING)

1906

if debuglevel:

1907

level = getattr(logging, debuglevel.upper())

1908

syslogger.setLevel(level)

1909

console.setLevel(level)

1910

2974

1911

if debug:

2975

1912

# Enable all possible GnuTLS debugging

2976

1913

2977

1914

# "Use a log level over 10 to enable all debugging options."

2978

1915

# - GnuTLS manual

2979

gnutls.global_set_log_level(11)

1916

gnutls.library.functions.gnutls_global_set_log_level(11)

2980

1917

2981

@gnutls.log_func

1918

@gnutls.library.types.gnutls_log_func

2982

1919

def debug_gnutls(level, string):

2983

1920

logger.debug("GnuTLS: %s", string[:-1])

2984

1921

2985

gnutls.global_set_log_function(debug_gnutls)

1922

(gnutls.library.functions

1923

.gnutls_global_set_log_function(debug_gnutls))

2986

1924

2987

1925

# Redirect stdin so all checkers get /dev/null

2988

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1926

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2989

1927

os.dup2(null, sys.stdin.fileno())

2990

1928

if null > 2:

2991

1929

os.close(null)

1930

else:

1931

# No console logging

1932

logger.removeHandler(console)

2992

1933

2993

1934

# Need to fork before connecting to D-Bus

2994

if not foreground:

1935

if not debug:

2995

1936

# Close all input and output, do double fork, etc.

2996

1937

daemon()

2997

1938

2998

# multiprocessing will use threads, so before we use GObject we

2999

# need to inform GObject that threads will be used.

3000

GObject.threads_init()

3001

3002

1939

global main_loop

3003

1940

# From the Avahi example code

3004

DBusGMainLoop(set_as_default=True)

3005

main_loop = GObject.MainLoop()

1941

DBusGMainLoop(set_as_default=True )

1942

main_loop = gobject.MainLoop()

3006

1943

bus = dbus.SystemBus()

3007

1944

# End of Avahi example code

3008

1945

if use_dbus:

3009

1946

try:

3010

bus_name = dbus.service.BusName("se.recompile.Mandos",

3011

bus,

3012

do_not_queue=True)

3013

old_bus_name = dbus.service.BusName(

3014

"se.bsnet.fukt.Mandos", bus,

3015

do_not_queue=True)

3016

except dbus.exceptions.DBusException as e:

3017

logger.error("Disabling D-Bus:", exc_info=e)

1947

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1948

bus, do_not_queue=True)

1949

except dbus.exceptions.NameExistsException as e:

1950

logger.error(unicode(e) + ", disabling D-Bus")

3018

1951

use_dbus = False

3019

1952

server_settings["use_dbus"] = False

3020

1953

tcp_server.use_dbus = False

3021

if zeroconf:

3022

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

3023

service = AvahiServiceToSyslog(

3024

name = server_settings["servicename"],

3025

servicetype = "_mandos._tcp",

3026

protocol = protocol,

3027

bus = bus)

3028

if server_settings["interface"]:

3029

service.interface = if_nametoindex(

3030

server_settings["interface"].encode("utf-8"))

1954

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1955

service = AvahiService(name = server_settings["servicename"],

1956

servicetype = "_mandos._tcp",

1957

protocol = protocol, bus = bus)

1958

if server_settings["interface"]:

1959

service.interface = (if_nametoindex

1960

(str(server_settings["interface"])))

3031

1961

3032

1962

global multiprocessing_manager

3033

1963

multiprocessing_manager = multiprocessing.Manager()

3035

1965

client_class = Client

3036

1966

if use_dbus:

3037

1967

client_class = functools.partial(ClientDBus, bus = bus)

3038

3039

client_settings = Client.config_parser(client_config)

3040

old_client_settings = {}

3041

clients_data = {}

3042

3043

# This is used to redirect stdout and stderr for checker processes

3044

global wnull

3045

wnull = open(os.devnull, "w") # A writable /dev/null

3046

# Only used if server is running in foreground but not in debug

3047

# mode

3048

if debug or not foreground:

3049

wnull.close()

3050

3051

# Get client data and settings from last running state.

3052

if server_settings["restore"]:

3053

try:

3054

with open(stored_state_path, "rb") as stored_state:

3055

if sys.version_info.major == 2:

3056

clients_data, old_client_settings = pickle.load(

3057

stored_state)

3058

else:

3059

bytes_clients_data, bytes_old_client_settings = (

3060

pickle.load(stored_state, encoding = "bytes"))

3061

### Fix bytes to strings

3062

## clients_data

3063

# .keys()

3064

clients_data = { (key.decode("utf-8")

3065

if isinstance(key, bytes)

3066

else key): value

3067

for key, value in

3068

bytes_clients_data.items() }

3069

del bytes_clients_data

3070

for key in clients_data:

3071

value = { (k.decode("utf-8")

3072

if isinstance(k, bytes) else k): v

3073

for k, v in

3074

clients_data[key].items() }

3075

clients_data[key] = value

3076

# .client_structure

3077

value["client_structure"] = [

3078

(s.decode("utf-8")

3079

if isinstance(s, bytes)

3080

else s) for s in

3081

value["client_structure"] ]

3082

# .name & .host

3083

for k in ("name", "host"):

3084

if isinstance(value[k], bytes):

3085

value[k] = value[k].decode("utf-8")

3086

## old_client_settings

3087

# .keys()

3088

old_client_settings = {

3089

(key.decode("utf-8")

3090

if isinstance(key, bytes)

3091

else key): value

3092

for key, value in

3093

bytes_old_client_settings.items() }

3094

del bytes_old_client_settings

3095

# .host

3096

for value in old_client_settings.values():

3097

if isinstance(value["host"], bytes):

3098

value["host"] = (value["host"]

3099

.decode("utf-8"))

3100

os.remove(stored_state_path)

3101

except IOError as e:

3102

if e.errno == errno.ENOENT:

3103

logger.warning("Could not load persistent state:"

3104

" {}".format(os.strerror(e.errno)))

3105

else:

3106

logger.critical("Could not load persistent state:",

3107

exc_info=e)

3108

raise

3109

except EOFError as e:

3110

logger.warning("Could not load persistent state: "

3111

"EOFError:",

3112

exc_info=e)

3113

3114

with PGPEngine() as pgp:

3115

for client_name, client in clients_data.items():

3116

# Skip removed clients

3117

if client_name not in client_settings:

3118

continue

3119

3120

# Decide which value to use after restoring saved state.

3121

# We have three different values: Old config file,

3122

# new config file, and saved state.

3123

# New config value takes precedence if it differs from old

3124

# config value, otherwise use saved state.

3125

for name, value in client_settings[client_name].items():

3126

try:

3127

# For each value in new config, check if it

3128

# differs from the old config value (Except for

3129

# the "secret" attribute)

3130

if (name != "secret"

3131

and (value !=

3132

old_client_settings[client_name][name])):

3133

client[name] = value

3134

except KeyError:

3135

pass

3136

3137

# Clients who has passed its expire date can still be

3138

# enabled if its last checker was successful. A Client

3139

# whose checker succeeded before we stored its state is

3140

# assumed to have successfully run all checkers during

3141

# downtime.

3142

if client["enabled"]:

3143

if datetime.datetime.utcnow() >= client["expires"]:

3144

if not client["last_checked_ok"]:

3145

logger.warning(

3146

"disabling client {} - Client never "

3147

"performed a successful checker".format(

3148

client_name))

3149

client["enabled"] = False

3150

elif client["last_checker_status"] != 0:

3151

logger.warning(

3152

"disabling client {} - Client last"

3153

" checker failed with error code"

3154

" {}".format(

3155

client_name,

3156

client["last_checker_status"]))

3157

client["enabled"] = False

3158

else:

3159

client["expires"] = (

3160

datetime.datetime.utcnow()

3161

+ client["timeout"])

3162

logger.debug("Last checker succeeded,"

3163

" keeping {} enabled".format(

3164

client_name))

1968

def client_config_items(config, section):

1969

special_settings = {

1970

"approved_by_default":

1971

lambda: config.getboolean(section,

1972

"approved_by_default"),

1973

}

1974

for name, value in config.items(section):

3165

1975

try:

3166

client["secret"] = pgp.decrypt(

3167

client["encrypted_secret"],

3168

client_settings[client_name]["secret"])

3169

except PGPError:

3170

# If decryption fails, we use secret from new settings

3171

logger.debug("Failed to decrypt {} old secret".format(

3172

client_name))

3173

client["secret"] = (client_settings[client_name]

3174

["secret"])

3175

3176

# Add/remove clients based on new changes made to config

3177

for client_name in (set(old_client_settings)

3178

- set(client_settings)):

3179

del clients_data[client_name]

3180

for client_name in (set(client_settings)

3181

- set(old_client_settings)):

3182

clients_data[client_name] = client_settings[client_name]

3183

3184

# Create all client objects

3185

for client_name, client in clients_data.items():

3186

tcp_server.clients[client_name] = client_class(

3187

name = client_name,

3188

settings = client,

3189

server_settings = server_settings)

3190

1976

yield (name, special_settings[name]())

1977

except KeyError:

1978

yield (name, value)

1979

1980

tcp_server.clients.update(set(

1981

client_class(name = section,

1982

config= dict(client_config_items(

1983

client_config, section)))

1984

for section in client_config.sections()))

3191

1985

if not tcp_server.clients:

3192

1986

logger.warning("No clients defined")

3193

3194

if not foreground:

3195

if pidfile is not None:

3196

pid = os.getpid()

3197

try:

3198

with pidfile:

3199

print(pid, file=pidfile)

3200

except IOError:

3201

logger.error("Could not write to file %r with PID %d",

3202

pidfilename, pid)

3203

del pidfile

1987

1988

if not debug:

1989

try:

1990

with pidfile:

1991

pid = os.getpid()

1992

pidfile.write(str(pid) + "\n".encode("utf-8"))

1993

del pidfile

1994

except IOError:

1995

logger.error("Could not write to file %r with PID %d",

1996

pidfilename, pid)

1997

except NameError:

1998

# "pidfile" was never created

1999

pass

3204

2000

del pidfilename

3205

2001

2002

signal.signal(signal.SIGINT, signal.SIG_IGN)

2003

3206

2004

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

3207

2005

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

3208

2006

3209

2007

if use_dbus:

3210

3211

@alternate_dbus_interfaces(

3212

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3213

class MandosDBusService(DBusObjectWithObjectManager):

2008

class MandosDBusService(dbus.service.Object):

3214

2009

"""A D-Bus proxy object"""

3215

3216

2010

def __init__(self):

3217

2011

dbus.service.Object.__init__(self, bus, "/")

3218

3219

_interface = "se.recompile.Mandos"

2012

_interface = "se.bsnet.fukt.Mandos"

3220

2013

3221

2014

@dbus.service.signal(_interface, signature="o")

3222

2015

def ClientAdded(self, objpath):

3228

2021

"D-Bus signal"

3229

2022

pass

3230

2023

3231

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3232

"true"})

3233

2024

@dbus.service.signal(_interface, signature="os")

3234

2025

def ClientRemoved(self, objpath, name):

3235

2026

"D-Bus signal"

3236

2027

pass

3237

2028

3238

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3239

"true"})

3240

2029

@dbus.service.method(_interface, out_signature="ao")

3241

2030

def GetAllClients(self):

3242

2031

"D-Bus method"

3243

return dbus.Array(c.dbus_object_path for c in

3244

tcp_server.clients.values())

2032

return dbus.Array(c.dbus_object_path

2033

for c in tcp_server.clients)

3245

2034

3246

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3247

"true"})

3248

2035

@dbus.service.method(_interface,

3249

2036

out_signature="a{oa{sv}}")

3250

2037

def GetAllClientsWithProperties(self):

3251

2038

"D-Bus method"

3252

2039

return dbus.Dictionary(

3253

{ c.dbus_object_path: c.GetAll(

3254

"se.recompile.Mandos.Client")

3255

for c in tcp_server.clients.values() },

2040

((c.dbus_object_path, c.GetAll(""))

2041

for c in tcp_server.clients),

3256

2042

signature="oa{sv}")

3257

2043

3258

2044

@dbus.service.method(_interface, in_signature="o")

3259

2045

def RemoveClient(self, object_path):

3260

2046

"D-Bus method"

3261

for c in tcp_server.clients.values():

2047

for c in tcp_server.clients:

3262

2048

if c.dbus_object_path == object_path:

3263

del tcp_server.clients[c.name]

2049

tcp_server.clients.remove(c)

3264

2050

c.remove_from_connection()

3265

# Don't signal the disabling

2051

# Don't signal anything except ClientRemoved

3266

2052

c.disable(quiet=True)

3267

# Emit D-Bus signal for removal

3268

self.client_removed_signal(c)

2053

# Emit D-Bus signal

2054

self.ClientRemoved(object_path, c.name)

3269

2055

return

3270

2056

raise KeyError(object_path)

3271

2057

3272

2058

del _interface

3273

3274

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3275

out_signature = "a{oa{sa{sv}}}")

3276

def GetManagedObjects(self):

3277

"""D-Bus method"""

3278

return dbus.Dictionary(

3279

{ client.dbus_object_path:

3280

dbus.Dictionary(

3281

{ interface: client.GetAll(interface)

3282

for interface in

3283

client._get_all_interface_names()})

3284

for client in tcp_server.clients.values()})

3285

3286

def client_added_signal(self, client):

3287

"""Send the new standard signal and the old signal"""

3288

if use_dbus:

3289

# New standard signal

3290

self.InterfacesAdded(

3291

client.dbus_object_path,

3292

dbus.Dictionary(

3293

{ interface: client.GetAll(interface)

3294

for interface in

3295

client._get_all_interface_names()}))

3296

# Old signal

3297

self.ClientAdded(client.dbus_object_path)

3298

3299

def client_removed_signal(self, client):

3300

"""Send the new standard signal and the old signal"""

3301

if use_dbus:

3302

# New standard signal

3303

self.InterfacesRemoved(

3304

client.dbus_object_path,

3305

client._get_all_interface_names())

3306

# Old signal

3307

self.ClientRemoved(client.dbus_object_path,

3308

client.name)

3309

2059

3310

2060

mandos_dbus_service = MandosDBusService()

3311

2061

3312

2062

def cleanup():

3313

2063

"Cleanup function; run on exit"

3314

if zeroconf:

3315

service.cleanup()

3316

3317

multiprocessing.active_children()

3318

wnull.close()

3319

if not (tcp_server.clients or client_settings):

3320

return

3321

3322

# Store client before exiting. Secrets are encrypted with key

3323

# based on what config file has. If config file is

3324

# removed/edited, old secret will thus be unrecovable.

3325

clients = {}

3326

with PGPEngine() as pgp:

3327

for client in tcp_server.clients.values():

3328

key = client_settings[client.name]["secret"]

3329

client.encrypted_secret = pgp.encrypt(client.secret,

3330

key)

3331

client_dict = {}

3332

3333

# A list of attributes that can not be pickled

3334

# + secret.

3335

exclude = { "bus", "changedstate", "secret",

3336

"checker", "server_settings" }

3337

for name, typ in inspect.getmembers(dbus.service

3338

.Object):

3339

exclude.add(name)

3340

3341

client_dict["encrypted_secret"] = (client

3342

.encrypted_secret)

3343

for attr in client.client_structure:

3344

if attr not in exclude:

3345

client_dict[attr] = getattr(client, attr)

3346

3347

clients[client.name] = client_dict

3348

del client_settings[client.name]["secret"]

3349

3350

try:

3351

with tempfile.NamedTemporaryFile(

3352

mode='wb',

3353

suffix=".pickle",

3354

prefix='clients-',

3355

dir=os.path.dirname(stored_state_path),

3356

delete=False) as stored_state:

3357

pickle.dump((clients, client_settings), stored_state,

3358

protocol = 2)

3359

tempname = stored_state.name

3360

os.rename(tempname, stored_state_path)

3361

except (IOError, OSError) as e:

3362

if not debug:

3363

try:

3364

os.remove(tempname)

3365

except NameError:

3366

pass

3367

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

3368

logger.warning("Could not save persistent state: {}"

3369

.format(os.strerror(e.errno)))

3370

else:

3371

logger.warning("Could not save persistent state:",

3372

exc_info=e)

3373

raise

3374

3375

# Delete all clients, and settings from config

2064

service.cleanup()

2065

3376

2066

while tcp_server.clients:

3377

name, client = tcp_server.clients.popitem()

2067

client = tcp_server.clients.pop()

3378

2068

if use_dbus:

3379

2069

client.remove_from_connection()

3380

# Don't signal the disabling

2070

client.disable_hook = None

2071

# Don't signal anything except ClientRemoved

3381

2072

client.disable(quiet=True)

3382

# Emit D-Bus signal for removal

3383

2073

if use_dbus:

3384

mandos_dbus_service.client_removed_signal(client)

3385

client_settings.clear()

2074

# Emit D-Bus signal

2075

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2076

client.name)

3386

2077

3387

2078

atexit.register(cleanup)

3388

2079

3389

for client in tcp_server.clients.values():

2080

for client in tcp_server.clients:

3390

2081

if use_dbus:

3391

# Emit D-Bus signal for adding

3392

mandos_dbus_service.client_added_signal(client)

3393

# Need to initiate checking of clients

3394

if client.enabled:

3395

client.init_checker()

2082

# Emit D-Bus signal

2083

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2084

client.enable()

3396

2085

3397

2086

tcp_server.enable()

3398

2087

tcp_server.server_activate()

3399

2088

3400

2089

# Find out what port we got

3401

if zeroconf:

3402

service.port = tcp_server.socket.getsockname()[1]

2090

service.port = tcp_server.socket.getsockname()[1]

3403

2091

if use_ipv6:

3404

2092

logger.info("Now listening on address %r, port %d,"

3405

" flowinfo %d, scope_id %d",

3406

*tcp_server.socket.getsockname())

2093

" flowinfo %d, scope_id %d"

2094

% tcp_server.socket.getsockname())

3407

2095

else: # IPv4

3408

logger.info("Now listening on address %r, port %d",

3409

*tcp_server.socket.getsockname())

2096

logger.info("Now listening on address %r, port %d"

2097

% tcp_server.socket.getsockname())

3410

2098

3411

2099

#service.interface = tcp_server.socket.getsockname()[3]

3412

2100

3413

2101

try:

3414

if zeroconf:

3415

# From the Avahi example code

3416

try:

3417

service.activate()

3418

except dbus.exceptions.DBusException as error:

3419

logger.critical("D-Bus Exception", exc_info=error)

3420

cleanup()

3421

sys.exit(1)

3422

# End of Avahi example code

2102

# From the Avahi example code

2103

try:

2104

service.activate()

2105

except dbus.exceptions.DBusException as error:

2106

logger.critical("DBusException: %s", error)

2107

cleanup()

2108

sys.exit(1)

2109

# End of Avahi example code

3423

2110

3424

GObject.io_add_watch(tcp_server.fileno(), GObject.IO_IN,

2111

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

3425

2112

lambda *args, **kwargs:

3426

2113

(tcp_server.handle_request

3427

2114

(*args[2:], **kwargs) or True))

3429

2116

logger.debug("Starting main loop")

3430

2117

main_loop.run()

3431

2118

except AvahiError as error:

3432

logger.critical("Avahi Error", exc_info=error)

2119

logger.critical("AvahiError: %s", error)

3433

2120

cleanup()

3434

2121

sys.exit(1)

3435

2122

except KeyboardInterrupt:

3440

2127

# Must run before the D-Bus bus name gets deregistered

3441

2128

cleanup()

3442

2129

3443

3444

2130

if __name__ == '__main__':

3445

2131

main()