/mandos/trunk : revision 518.2.3

1

#!/usr/bin/python2.7

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

37

import SocketServer as socketserver

43

38

import socket

44

39

import argparse

45

40

import datetime

50

45

import gnutls.library.functions

51

46

import gnutls.library.constants

52

47

import gnutls.library.types

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

48

import ConfigParser as configparser

57

49

import sys

58

50

import re

59

51

import os

68

60

import struct

69

61

import fcntl

70

62

import functools

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

63

import cPickle as pickle

75

64

import multiprocessing

76

65

import types

77

66

import binascii

78

67

import tempfile

79

import itertools

80

import collections

81

import codecs

82

68

83

69

import dbus

84

70

import dbus.service

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

71

import gobject

89

72

import avahi

90

73

from dbus.mainloop.glib import DBusGMainLoop

91

74

import ctypes

92

75

import ctypes.util

93

76

import xml.dom.minidom

94

77

import inspect

78

import GnuPGInterface

95

79

96

80

try:

97

81

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

101

85

except ImportError:

102

86

SO_BINDTODEVICE = None

103

87

104

if sys.version_info.major == 2:

105

str = unicode

106

88

107

version = "1.6.9"

89

version = "1.4.1"

108

90

stored_state_file = "clients.pickle"

109

91

110

92

logger = logging.getLogger()

111

syslogger = None

93

syslogger = (logging.handlers.SysLogHandler

94

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

95

address = str("/dev/log")))

112

96

113

97

try:

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

116

101

except (OSError, AttributeError):

117

118

102

def if_nametoindex(interface):

119

103

"Get an interface index the hard way, i.e. using fcntl()"

120

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

121

105

with contextlib.closing(socket.socket()) as s:

122

106

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

123

struct.pack(b"16s16x", interface))

124

interface_index = struct.unpack("I", ifreq[16:20])[0]

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

125

111

return interface_index

126

112

127

113

128

def initlogger(debug, level=logging.WARNING):

114

def initlogger(level=logging.WARNING):

129

115

"""init logger and add loglevel"""

130

116

131

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

135

117

syslogger.setFormatter(logging.Formatter

136

118

('Mandos [%(process)d]: %(levelname)s:'

137

119

' %(message)s'))

138

120

logger.addHandler(syslogger)

139

121

140

if debug:

141

console = logging.StreamHandler()

142

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

143

' [%(process)d]:'

144

' %(levelname)s:'

145

' %(message)s'))

146

logger.addHandler(console)

122

console = logging.StreamHandler()

123

console.setFormatter(logging.Formatter('%(asctime)s %(name)s'

124

' [%(process)d]:'

125

' %(levelname)s:'

126

' %(message)s'))

127

logger.addHandler(console)

147

128

logger.setLevel(level)

148

129

149

130

150

class PGPError(Exception):

151

"""Exception if encryption/decryption fails"""

131

class CryptoError(Exception):

152

132

pass

153

133

154

134

155

class PGPEngine(object):

135

class Crypto(object):

156

136

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

158

137

def __init__(self):

138

self.gnupg = GnuPGInterface.GnuPG()

159

139

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

160

self.gnupgargs = ['--batch',

161

'--home', self.tempdir,

162

'--force-mdc',

163

'--quiet',

164

'--no-use-agent']

140

self.gnupg = GnuPGInterface.GnuPG()

141

self.gnupg.options.meta_interactive = False

142

self.gnupg.options.homedir = self.tempdir

143

self.gnupg.options.extra_args.extend(['--force-mdc',

144

'--quiet'])

165

145

166

146

def __enter__(self):

167

147

return self

168

148

169

def __exit__(self, exc_type, exc_value, traceback):

149

def __exit__ (self, exc_type, exc_value, traceback):

170

150

self._cleanup()

171

151

return False

172

152

189

169

def password_encode(self, password):

190

170

# Passphrase can not be empty and can not contain newlines or

191

171

# NUL bytes. So we prefix it and hex encode it.

192

encoded = b"mandos" + binascii.hexlify(password)

193

if len(encoded) > 2048:

194

# GnuPG can't handle long passwords, so encode differently

195

encoded = (b"mandos" + password.replace(b"\\", b"\\\\")

196

.replace(b"\n", b"\\n")

197

.replace(b"\0", b"\\x00"))

198

return encoded

172

return b"mandos" + binascii.hexlify(password)

199

173

200

174

def encrypt(self, data, password):

201

passphrase = self.password_encode(password)

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

204

passfile.write(passphrase)

205

passfile.flush()

206

proc = subprocess.Popen(['gpg', '--symmetric',

207

'--passphrase-file',

208

passfile.name]

209

+ self.gnupgargs,

210

stdin = subprocess.PIPE,

211

stdout = subprocess.PIPE,

212

stderr = subprocess.PIPE)

213

ciphertext, err = proc.communicate(input = data)

214

if proc.returncode != 0:

215

raise PGPError(err)

175

self.gnupg.passphrase = self.password_encode(password)

176

with open(os.devnull) as devnull:

177

try:

178

proc = self.gnupg.run(['--symmetric'],

179

create_fhs=['stdin', 'stdout'],

180

attach_fhs={'stderr': devnull})

181

with contextlib.closing(proc.handles['stdin']) as f:

182

f.write(data)

183

with contextlib.closing(proc.handles['stdout']) as f:

184

ciphertext = f.read()

185

proc.wait()

186

except IOError as e:

187

raise CryptoError(e)

188

self.gnupg.passphrase = None

216

189

return ciphertext

217

190

218

191

def decrypt(self, data, password):

219

passphrase = self.password_encode(password)

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

222

passfile.write(passphrase)

223

passfile.flush()

224

proc = subprocess.Popen(['gpg', '--decrypt',

225

'--passphrase-file',

226

passfile.name]

227

+ self.gnupgargs,

228

stdin = subprocess.PIPE,

229

stdout = subprocess.PIPE,

230

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

232

if proc.returncode != 0:

233

raise PGPError(err)

192

self.gnupg.passphrase = self.password_encode(password)

193

with open(os.devnull) as devnull:

194

try:

195

proc = self.gnupg.run(['--decrypt'],

196

create_fhs=['stdin', 'stdout'],

197

attach_fhs={'stderr': devnull})

198

with contextlib.closing(proc.handles['stdin'] ) as f:

199

f.write(data)

200

with contextlib.closing(proc.handles['stdout']) as f:

201

decrypted_plaintext = f.read()

202

proc.wait()

203

except IOError as e:

204

raise CryptoError(e)

205

self.gnupg.passphrase = None

234

206

return decrypted_plaintext

235

207

236

208

209

237

210

class AvahiError(Exception):

238

211

def __init__(self, value, *args, **kwargs):

239

212

self.value = value

240

return super(AvahiError, self).__init__(value, *args,

241

**kwargs)

242

213

super(AvahiError, self).__init__(value, *args, **kwargs)

214

def __unicode__(self):

215

return unicode(repr(self.value))

243

216

244

217

class AvahiServiceError(AvahiError):

245

218

pass

246

219

247

248

220

class AvahiGroupError(AvahiError):

249

221

pass

250

222

257

229

Used to optionally bind to the specified interface.

258

230

name: string; Example: 'Mandos'

259

231

type: string; Example: '_mandos._tcp'.

260

See <https://www.iana.org/assignments/service-names-port-numbers>

232

See <http://www.dns-sd.org/ServiceTypes.html>

261

233

port: integer; what port to announce

262

234

TXT: list of strings; TXT record for the service

263

235

domain: string; Domain to publish on, default to .local if empty.

269

241

server: D-Bus Server

270

242

bus: dbus.SystemBus()

271

243

"""

272

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

244

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

245

servicetype = None, port = None, TXT = None,

246

domain = "", host = "", max_renames = 32768,

247

protocol = avahi.PROTO_UNSPEC, bus = None):

284

248

self.interface = interface

285

249

self.name = name

286

250

self.type = servicetype

295

259

self.server = None

296

260

self.bus = bus

297

261

self.entry_group_state_changed_match = None

298

299

def rename(self, remove=True):

262

def rename(self):

300

263

"""Derived from the Avahi example code"""

301

264

if self.rename_count >= self.max_renames:

302

265

logger.critical("No suitable Zeroconf service name found"

303

266

" after %i retries, exiting.",

304

267

self.rename_count)

305

268

raise AvahiServiceError("Too many renames")

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

269

self.name = unicode(self.server

270

.GetAlternativeServiceName(self.name))

309

271

logger.info("Changing Zeroconf service name to %r ...",

310

272

self.name)

311

if remove:

312

self.remove()

273

self.remove()

313

274

try:

314

275

self.add()

315

276

except dbus.exceptions.DBusException as error:

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

324

277

logger.critical("DBusException: %s", error)

278

self.cleanup()

279

os._exit(1)

280

self.rename_count += 1

325

281

def remove(self):

326

282

"""Derived from the Avahi example code"""

327

283

if self.entry_group_state_changed_match is not None:

329

285

self.entry_group_state_changed_match = None

330

286

if self.group is not None:

331

287

self.group.Reset()

332

333

288

def add(self):

334

289

"""Derived from the Avahi example code"""

335

290

self.remove()

352

307

dbus.UInt16(self.port),

353

308

avahi.string_array_to_txt_array(self.TXT))

354

309

self.group.Commit()

355

356

310

def entry_group_state_changed(self, state, error):

357

311

"""Derived from the Avahi example code"""

358

312

logger.debug("Avahi entry group state change: %i", state)

364

318

self.rename()

365

319

elif state == avahi.ENTRY_GROUP_FAILURE:

366

320

logger.critical("Avahi: Error in group state changed %s",

367

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

369

321

unicode(error))

322

raise AvahiGroupError("State changed: %s"

323

% unicode(error))

370

324

def cleanup(self):

371

325

"""Derived from the Avahi example code"""

372

326

if self.group is not None:

377

331

pass

378

332

self.group = None

379

333

self.remove()

380

381

334

def server_state_changed(self, state, error=None):

382

335

"""Derived from the Avahi example code"""

383

336

logger.debug("Avahi server state change: %i", state)

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

337

bad_states = { avahi.SERVER_INVALID:

338

"Zeroconf server invalid",

339

avahi.SERVER_REGISTERING: None,

340

avahi.SERVER_COLLISION:

341

"Zeroconf server name collision",

342

avahi.SERVER_FAILURE:

343

"Zeroconf server failure" }

390

344

if state in bad_states:

391

345

if bad_states[state] is not None:

392

346

if error is None:

395

349

logger.error(bad_states[state] + ": %r", error)

396

350

self.cleanup()

397

351

elif state == avahi.SERVER_RUNNING:

398

try:

399

self.add()

400

except dbus.exceptions.DBusException as error:

401

if (error.get_dbus_name()

402

== "org.freedesktop.Avahi.CollisionError"):

403

logger.info("Local Zeroconf service name"

404

" collision.")

405

return self.rename(remove=False)

406

else:

407

logger.critical("D-Bus Exception", exc_info=error)

408

self.cleanup()

409

os._exit(1)

352

self.add()

410

353

else:

411

354

if error is None:

412

355

logger.debug("Unknown state: %r", state)

413

356

else:

414

357

logger.debug("Unknown state: %r: %r", state, error)

415

416

358

def activate(self):

417

359

"""Derived from the Avahi example code"""

418

360

if self.server is None:

422

364

follow_name_owner_changes=True),

423

365

avahi.DBUS_INTERFACE_SERVER)

424

366

self.server.connect_to_signal("StateChanged",

425

self.server_state_changed)

367

self.server_state_changed)

426

368

self.server_state_changed(self.server.GetState())

427

369

428

429

370

class AvahiServiceToSyslog(AvahiService):

430

def rename(self, *args, **kwargs):

371

def rename(self):

431

372

"""Add the new name to the syslog messages"""

432

ret = AvahiService.rename(self, *args, **kwargs)

433

syslogger.setFormatter(logging.Formatter(

434

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

435

.format(self.name)))

373

ret = AvahiService.rename(self)

374

syslogger.setFormatter(logging.Formatter

375

('Mandos (%s) [%%(process)d]:'

376

' %%(levelname)s: %%(message)s'

377

% self.name))

436

378

return ret

437

379

438

def call_pipe(connection, # : multiprocessing.Connection

439

func, *args, **kwargs):

440

"""This function is meant to be called by multiprocessing.Process

441

442

This function runs func(*args, **kwargs), and writes the resulting

443

return value on the provided multiprocessing.Connection.

444

"""

445

connection.send(func(*args, **kwargs))

446

connection.close()

447

380

def _timedelta_to_milliseconds(td):

381

"Convert a datetime.timedelta() to milliseconds"

382

return ((td.days * 24 * 60 * 60 * 1000)

383

+ (td.seconds * 1000)

384

+ (td.microseconds // 1000))

385

448

386

class Client(object):

449

387

"""A representation of a client host served by this server.

450

388

451

389

Attributes:

452

approved: bool(); 'None' if not yet approved/disapproved

390

_approved: bool(); 'None' if not yet approved/disapproved

453

391

approval_delay: datetime.timedelta(); Time to wait for approval

454

392

approval_duration: datetime.timedelta(); Duration of one approval

455

393

checker: subprocess.Popen(); a running checker process used

473

411

interval: datetime.timedelta(); How often to start a new checker

474

412

last_approval_request: datetime.datetime(); (UTC) or None

475

413

last_checked_ok: datetime.datetime(); (UTC) or None

414

476

415

last_checker_status: integer between 0 and 255 reflecting exit

477

416

status of last checker. -1 reflects crashed

478

checker, -2 means no checker completed yet.

479

last_checker_signal: The signal which killed the last checker, if

480

last_checker_status is -1

417

checker, or None.

481

418

last_enabled: datetime.datetime(); (UTC) or None

482

419

name: string; from the config file, used in log messages and

483

420

D-Bus identifiers

484

421

secret: bytestring; sent verbatim (over TLS) to client

485

422

timeout: datetime.timedelta(); How long from last_checked_ok

486

423

until this client is disabled

487

extended_timeout: extra long timeout when secret has been sent

424

extended_timeout: extra long timeout when password has been sent

488

425

runtime_expansions: Allowed attributes for runtime expansion.

489

426

expires: datetime.datetime(); time (UTC) when a client will be

490

427

disabled, or None

491

server_settings: The server_settings dict from main()

492

428

"""

493

429

494

430

runtime_expansions = ("approval_delay", "approval_duration",

495

"created", "enabled", "expires",

496

"fingerprint", "host", "interval",

497

"last_approval_request", "last_checked_ok",

431

"created", "enabled", "fingerprint",

432

"host", "interval", "last_checked_ok",

498

433

"last_enabled", "name", "timeout")

499

client_defaults = {

500

"timeout": "PT5M",

501

"extended_timeout": "PT15M",

502

"interval": "PT2M",

503

"checker": "fping -q -- %%(host)s",

504

"host": "",

505

"approval_delay": "PT0S",

506

"approval_duration": "PT1S",

507

"approved_by_default": "True",

508

"enabled": "True",

509

}

510

511

@staticmethod

512

def config_parser(config):

513

"""Construct a new dict of client settings of this form:

514

{ client_name: {setting_name: value, ...}, ...}

515

with exceptions for any special settings as defined above.

516

NOTE: Must be a pure function. Must return the same result

517

value given the same arguments.

518

"""

519

settings = {}

520

for client_name in config.sections():

521

section = dict(config.items(client_name))

522

client = settings[client_name] = {}

523

524

client["host"] = section["host"]

525

# Reformat values from string types to Python types

526

client["approved_by_default"] = config.getboolean(

527

client_name, "approved_by_default")

528

client["enabled"] = config.getboolean(client_name,

529

"enabled")

530

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the

533

# fingerprint() function

534

client["fingerprint"] = (section["fingerprint"].upper()

535

.replace(" ", ""))

536

if "secret" in section:

537

client["secret"] = section["secret"].decode("base64")

538

elif "secfile" in section:

539

with open(os.path.expanduser(os.path.expandvars

540

(section["secfile"])),

541

"rb") as secfile:

542

client["secret"] = secfile.read()

543

else:

544

raise TypeError("No secret or secfile for section {}"

545

.format(section))

546

client["timeout"] = string_to_delta(section["timeout"])

547

client["extended_timeout"] = string_to_delta(

548

section["extended_timeout"])

549

client["interval"] = string_to_delta(section["interval"])

550

client["approval_delay"] = string_to_delta(

551

section["approval_delay"])

552

client["approval_duration"] = string_to_delta(

553

section["approval_duration"])

554

client["checker_command"] = section["checker"]

555

client["last_approval_request"] = None

556

client["last_checked_ok"] = None

557

client["last_checker_status"] = -2

558

559

return settings

560

561

def __init__(self, settings, name = None, server_settings=None):

434

435

def timeout_milliseconds(self):

436

"Return the 'timeout' attribute in milliseconds"

437

return _timedelta_to_milliseconds(self.timeout)

438

439

def extended_timeout_milliseconds(self):

440

"Return the 'extended_timeout' attribute in milliseconds"

441

return _timedelta_to_milliseconds(self.extended_timeout)

442

443

def interval_milliseconds(self):

444

"Return the 'interval' attribute in milliseconds"

445

return _timedelta_to_milliseconds(self.interval)

446

447

def approval_delay_milliseconds(self):

448

return _timedelta_to_milliseconds(self.approval_delay)

449

450

def __init__(self, name = None, config=None):

451

"""Note: the 'checker' key in 'config' sets the

452

'checker_command' attribute and *not* the 'checker'

453

attribute."""

562

454

self.name = name

563

if server_settings is None:

564

server_settings = {}

565

self.server_settings = server_settings

566

# adding all client settings

567

for setting, value in settings.items():

568

setattr(self, setting, value)

569

570

if self.enabled:

571

if not hasattr(self, "last_enabled"):

572

self.last_enabled = datetime.datetime.utcnow()

573

if not hasattr(self, "expires"):

574

self.expires = (datetime.datetime.utcnow()

575

+ self.timeout)

576

else:

577

self.last_enabled = None

578

self.expires = None

579

455

if config is None:

456

config = {}

580

457

logger.debug("Creating client %r", self.name)

458

# Uppercase and remove spaces from fingerprint for later

459

# comparison purposes with return value from the fingerprint()

460

# function

461

self.fingerprint = (config["fingerprint"].upper()

462

.replace(" ", ""))

581

463

logger.debug(" Fingerprint: %s", self.fingerprint)

582

self.created = settings.get("created",

583

datetime.datetime.utcnow())

584

585

# attributes specific for this server instance

464

if "secret" in config:

465

self.secret = config["secret"].decode("base64")

466

elif "secfile" in config:

467

with open(os.path.expanduser(os.path.expandvars

468

(config["secfile"])),

469

"rb") as secfile:

470

self.secret = secfile.read()

471

else:

472

raise TypeError("No secret or secfile for client %s"

473

% self.name)

474

self.host = config.get("host", "")

475

self.created = datetime.datetime.utcnow()

476

self.enabled = config.get("enabled", True)

477

self.last_approval_request = None

478

if self.enabled:

479

self.last_enabled = datetime.datetime.utcnow()

480

else:

481

self.last_enabled = None

482

self.last_checked_ok = None

483

self.last_checker_status = None

484

self.timeout = string_to_delta(config["timeout"])

485

self.extended_timeout = string_to_delta(config

486

["extended_timeout"])

487

self.interval = string_to_delta(config["interval"])

586

488

self.checker = None

587

489

self.checker_initiator_tag = None

588

490

self.disable_initiator_tag = None

491

if self.enabled:

492

self.expires = datetime.datetime.utcnow() + self.timeout

493

else:

494

self.expires = None

589

495

self.checker_callback_tag = None

496

self.checker_command = config["checker"]

590

497

self.current_checker_command = None

591

self.approved = None

498

self._approved = None

499

self.approved_by_default = config.get("approved_by_default",

500

True)

592

501

self.approvals_pending = 0

593

self.changedstate = multiprocessing_manager.Condition(

594

multiprocessing_manager.Lock())

595

self.client_structure = [attr

596

for attr in self.__dict__.iterkeys()

502

self.approval_delay = string_to_delta(

503

config["approval_delay"])

504

self.approval_duration = string_to_delta(

505

config["approval_duration"])

506

self.changedstate = (multiprocessing_manager

507

.Condition(multiprocessing_manager

508

.Lock()))

509

self.client_structure = [attr for attr in

510

self.__dict__.iterkeys()

597

511

if not attr.startswith("_")]

598

512

self.client_structure.append("client_structure")

599

513

600

for name, t in inspect.getmembers(

601

type(self), lambda obj: isinstance(obj, property)):

514

for name, t in inspect.getmembers(type(self),

515

lambda obj:

516

isinstance(obj,

517

property)):

602

518

if not name.startswith("_"):

603

519

self.client_structure.append(name)

604

520

612

528

if getattr(self, "enabled", False):

613

529

# Already enabled

614

530

return

531

self.send_changedstate()

615

532

self.expires = datetime.datetime.utcnow() + self.timeout

616

533

self.enabled = True

617

534

self.last_enabled = datetime.datetime.utcnow()

618

535

self.init_checker()

619

self.send_changedstate()

620

536

621

537

def disable(self, quiet=True):

622

538

"""Disable this client."""

623

539

if not getattr(self, "enabled", False):

624

540

return False

625

541

if not quiet:

542

self.send_changedstate()

543

if not quiet:

626

544

logger.info("Disabling client %s", self.name)

627

if getattr(self, "disable_initiator_tag", None) is not None:

545

if getattr(self, "disable_initiator_tag", False):

628

546

gobject.source_remove(self.disable_initiator_tag)

629

547

self.disable_initiator_tag = None

630

548

self.expires = None

631

if getattr(self, "checker_initiator_tag", None) is not None:

549

if getattr(self, "checker_initiator_tag", False):

632

550

gobject.source_remove(self.checker_initiator_tag)

633

551

self.checker_initiator_tag = None

634

552

self.stop_checker()

635

553

self.enabled = False

636

if not quiet:

637

self.send_changedstate()

638

554

# Do not run this again if called by a gobject.timeout_add

639

555

return False

640

556

644

560

def init_checker(self):

645

561

# Schedule a new checker to be started an 'interval' from now,

646

562

# and every interval from then on.

647

if self.checker_initiator_tag is not None:

648

gobject.source_remove(self.checker_initiator_tag)

649

self.checker_initiator_tag = gobject.timeout_add(

650

int(self.interval.total_seconds() * 1000),

651

self.start_checker)

563

self.checker_initiator_tag = (gobject.timeout_add

564

(self.interval_milliseconds(),

565

self.start_checker))

652

566

# Schedule a disable() when 'timeout' has passed

653

if self.disable_initiator_tag is not None:

654

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = gobject.timeout_add(

656

int(self.timeout.total_seconds() * 1000), self.disable)

567

self.disable_initiator_tag = (gobject.timeout_add

568

(self.timeout_milliseconds(),

569

self.disable))

657

570

# Also start a new checker *right now*.

658

571

self.start_checker()

659

572

660

def checker_callback(self, source, condition, connection,

661

command):

573

def checker_callback(self, pid, condition, command):

662

574

"""The checker has completed, so take appropriate actions."""

663

575

self.checker_callback_tag = None

664

576

self.checker = None

665

# Read return code from connection (see call_pipe)

666

returncode = connection.recv()

667

connection.close()

668

669

if returncode >= 0:

670

self.last_checker_status = returncode

671

self.last_checker_signal = None

577

if os.WIFEXITED(condition):

578

self.last_checker_status = os.WEXITSTATUS(condition)

672

579

if self.last_checker_status == 0:

673

580

logger.info("Checker for %(name)s succeeded",

674

581

vars(self))

675

582

self.checked_ok()

676

583

else:

677

logger.info("Checker for %(name)s failed", vars(self))

584

logger.info("Checker for %(name)s failed",

585

vars(self))

678

586

else:

679

587

self.last_checker_status = -1

680

self.last_checker_signal = -returncode

681

588

logger.warning("Checker for %(name)s crashed?",

682

589

vars(self))

683

return False

684

685

def checked_ok(self):

686

"""Assert that the client has been seen, alive and well."""

687

self.last_checked_ok = datetime.datetime.utcnow()

688

self.last_checker_status = 0

689

self.last_checker_signal = None

690

self.bump_timeout()

691

692

def bump_timeout(self, timeout=None):

693

"""Bump up the timeout for this client."""

590

591

def checked_ok(self, timeout=None):

592

"""Bump up the timeout for this client.

593

594

This should only be called when the client has been seen,

595

alive and well.

596

"""

694

597

if timeout is None:

695

598

timeout = self.timeout

599

self.last_checked_ok = datetime.datetime.utcnow()

696

600

if self.disable_initiator_tag is not None:

697

601

gobject.source_remove(self.disable_initiator_tag)

698

self.disable_initiator_tag = None

699

602

if getattr(self, "enabled", False):

700

self.disable_initiator_tag = gobject.timeout_add(

701

int(timeout.total_seconds() * 1000), self.disable)

603

self.disable_initiator_tag = (gobject.timeout_add

604

(_timedelta_to_milliseconds

605

(timeout), self.disable))

702

606

self.expires = datetime.datetime.utcnow() + timeout

703

607

704

608

def need_approval(self):

710

614

If a checker already exists, leave it running and do

711

615

nothing."""

712

616

# The reason for not killing a running checker is that if we

713

# did that, and if a checker (for some reason) started running

714

# slowly and taking more than 'interval' time, then the client

715

# would inevitably timeout, since no checker would get a

716

# chance to run to completion. If we instead leave running

617

# did that, then if a checker (for some reason) started

618

# running slowly and taking more than 'interval' time, the

619

# client would inevitably timeout, since no checker would get

620

# a chance to run to completion. If we instead leave running

717

621

# checkers alone, the checker would have to take more time

718

622

# than 'timeout' for the client to be disabled, which is as it

719

623

# should be.

720

624

721

if self.checker is not None and not self.checker.is_alive():

722

logger.warning("Checker was not alive; joining")

723

self.checker.join()

724

self.checker = None

625

# If a checker exists, make sure it is not a zombie

626

try:

627

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

628

except (AttributeError, OSError) as error:

629

if (isinstance(error, OSError)

630

and error.errno != errno.ECHILD):

631

raise error

632

else:

633

if pid:

634

logger.warning("Checker was a zombie")

635

gobject.source_remove(self.checker_callback_tag)

636

self.checker_callback(pid, status,

637

self.current_checker_command)

725

638

# Start a new checker if needed

726

639

if self.checker is None:

727

# Escape attributes for the shell

728

escaped_attrs = {

729

attr: re.escape(str(getattr(self, attr)))

730

for attr in self.runtime_expansions }

731

640

try:

732

command = self.checker_command % escaped_attrs

733

except TypeError as error:

734

logger.error('Could not format string "%s"',

735

self.checker_command,

736

exc_info=error)

737

return True # Try again later

641

# In case checker_command has exactly one % operator

642

command = self.checker_command % self.host

643

except TypeError:

644

# Escape attributes for the shell

645

escaped_attrs = dict(

646

(attr,

647

re.escape(unicode(str(getattr(self, attr, "")),

648

errors=

649

'replace')))

650

for attr in

651

self.runtime_expansions)

652

653

try:

654

command = self.checker_command % escaped_attrs

655

except TypeError as error:

656

logger.error('Could not format string "%s":'

657

' %s', self.checker_command, error)

658

return True # Try again later

738

659

self.current_checker_command = command

739

logger.info("Starting checker %r for %s", command,

740

self.name)

741

# We don't need to redirect stdout and stderr, since

742

# in normal mode, that is already done by daemon(),

743

# and in debug mode we don't want to. (Stdin is

744

# always replaced by /dev/null.)

745

# The exception is when not debugging but nevertheless

746

# running in the foreground; use the previously

747

# created wnull.

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

751

if (not self.server_settings["debug"]

752

and self.server_settings["foreground"]):

753

popen_args.update({"stdout": wnull,

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

756

self.checker = multiprocessing.Process(

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

760

self.checker.start()

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

763

self.checker_callback, pipe[0], command)

660

try:

661

logger.info("Starting checker %r for %s",

662

command, self.name)

663

# We don't need to redirect stdout and stderr, since

664

# in normal mode, that is already done by daemon(),

665

# and in debug mode we don't want to. (Stdin is

666

# always replaced by /dev/null.)

667

self.checker = subprocess.Popen(command,

668

close_fds=True,

669

shell=True, cwd="/")

670

self.checker_callback_tag = (gobject.child_watch_add

671

(self.checker.pid,

672

self.checker_callback,

673

data=command))

674

# The checker may have completed before the gobject

675

# watch was added. Check for this.

676

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

677

if pid:

678

gobject.source_remove(self.checker_callback_tag)

679

self.checker_callback(pid, status, command)

680

except OSError as error:

681

logger.error("Failed to start subprocess: %s",

682

error)

764

683

# Re-run this periodically if run by gobject.timeout_add

765

684

return True

766

685

772

691

if getattr(self, "checker", None) is None:

773

692

return

774

693

logger.debug("Stopping checker for %(name)s", vars(self))

775

self.checker.terminate()

694

try:

695

os.kill(self.checker.pid, signal.SIGTERM)

696

#time.sleep(0.5)

697

#if self.checker.poll() is None:

698

# os.kill(self.checker.pid, signal.SIGKILL)

699

except OSError as error:

700

if error.errno != errno.ESRCH: # No such process

701

raise

776

702

self.checker = None

777

703

778

704

779

def dbus_service_property(dbus_interface,

780

signature="v",

781

access="readwrite",

782

byte_arrays=False):

705

def dbus_service_property(dbus_interface, signature="v",

706

access="readwrite", byte_arrays=False):

783

707

"""Decorators for marking methods of a DBusObjectWithProperties to

784

708

become properties on the D-Bus.

785

709

794

718

# "Set" method, so we fail early here:

795

719

if byte_arrays and signature != "ay":

796

720

raise ValueError("Byte arrays not supported for non-'ay'"

797

" signature {!r}".format(signature))

798

721

" signature %r" % signature)

799

722

def decorator(func):

800

723

func._dbus_is_property = True

801

724

func._dbus_interface = dbus_interface

806

729

func._dbus_name = func._dbus_name[:-14]

807

730

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

808

731

return func

809

810

return decorator

811

812

813

def dbus_interface_annotations(dbus_interface):

814

"""Decorator for marking functions returning interface annotations

815

816

Usage:

817

818

@dbus_interface_annotations("org.example.Interface")

819

def _foo(self): # Function name does not matter

820

return {"org.freedesktop.DBus.Deprecated": "true",

821

"org.freedesktop.DBus.Property.EmitsChangedSignal":

822

"false"}

823

"""

824

825

def decorator(func):

826

func._dbus_is_interface = True

827

func._dbus_interface = dbus_interface

828

func._dbus_name = dbus_interface

829

return func

830

831

return decorator

832

833

834

def dbus_annotations(annotations):

835

"""Decorator to annotate D-Bus methods, signals or properties

836

Usage:

837

838

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

841

@dbus_service_property("org.example.Interface", signature="b",

842

access="r")

843

def Property_dbus_property(self):

844

return dbus.Boolean(False)

845

846

See also the DBusObjectWithAnnotations class.

847

"""

848

849

def decorator(func):

850

func._dbus_annotations = annotations

851

return func

852

853

732

return decorator

854

733

855

734

856

735

class DBusPropertyException(dbus.exceptions.DBusException):

857

736

"""A base class for D-Bus property-related exceptions

858

737

"""

859

pass

738

def __unicode__(self):

739

return unicode(str(self))

860

740

861

741

862

742

class DBusPropertyAccessException(DBusPropertyException):

871

751

pass

872

752

873

753

874

class DBusObjectWithAnnotations(dbus.service.Object):

875

"""A D-Bus object with annotations.

876

877

Classes inheriting from this can use the dbus_annotations

878

decorator to add annotations to methods or signals.

879

"""

880

881

@staticmethod

882

def _is_dbus_thing(thing):

883

"""Returns a function testing if an attribute is a D-Bus thing

884

885

If called like _is_dbus_thing("method") it returns a function

886

suitable for use as predicate to inspect.getmembers().

887

"""

888

return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),

889

False)

890

891

def _get_all_dbus_things(self, thing):

892

"""Returns a generator of (name, attribute) pairs

893

"""

894

return ((getattr(athing.__get__(self), "_dbus_name", name),

895

athing.__get__(self))

896

for cls in self.__class__.__mro__

897

for name, athing in

898

inspect.getmembers(cls, self._is_dbus_thing(thing)))

899

900

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

901

out_signature = "s",

902

path_keyword = 'object_path',

903

connection_keyword = 'connection')

904

def Introspect(self, object_path, connection):

905

"""Overloading of standard D-Bus method.

906

907

Inserts annotation tags on methods and signals.

908

"""

909

xmlstring = dbus.service.Object.Introspect(self, object_path,

910

connection)

911

try:

912

document = xml.dom.minidom.parseString(xmlstring)

913

914

for if_tag in document.getElementsByTagName("interface"):

915

# Add annotation tags

916

for typ in ("method", "signal"):

917

for tag in if_tag.getElementsByTagName(typ):

918

annots = dict()

919

for name, prop in (self.

920

_get_all_dbus_things(typ)):

921

if (name == tag.getAttribute("name")

922

and prop._dbus_interface

923

== if_tag.getAttribute("name")):

924

annots.update(getattr(

925

prop, "_dbus_annotations", {}))

926

for name, value in annots.items():

927

ann_tag = document.createElement(

928

"annotation")

929

ann_tag.setAttribute("name", name)

930

ann_tag.setAttribute("value", value)

931

tag.appendChild(ann_tag)

932

# Add interface annotation tags

933

for annotation, value in dict(

934

itertools.chain.from_iterable(

935

annotations().items()

936

for name, annotations

937

in self._get_all_dbus_things("interface")

938

if name == if_tag.getAttribute("name")

939

)).items():

940

ann_tag = document.createElement("annotation")

941

ann_tag.setAttribute("name", annotation)

942

ann_tag.setAttribute("value", value)

943

if_tag.appendChild(ann_tag)

944

# Fix argument name for the Introspect method itself

945

if (if_tag.getAttribute("name")

946

== dbus.INTROSPECTABLE_IFACE):

947

for cn in if_tag.getElementsByTagName("method"):

948

if cn.getAttribute("name") == "Introspect":

949

for arg in cn.getElementsByTagName("arg"):

950

if (arg.getAttribute("direction")

951

== "out"):

952

arg.setAttribute("name",

953

"xml_data")

954

xmlstring = document.toxml("utf-8")

955

document.unlink()

956

except (AttributeError, xml.dom.DOMException,

957

xml.parsers.expat.ExpatError) as error:

958

logger.error("Failed to override Introspection method",

959

exc_info=error)

960

return xmlstring

961

962

963

class DBusObjectWithProperties(DBusObjectWithAnnotations):

754

class DBusObjectWithProperties(dbus.service.Object):

964

755

"""A D-Bus object with properties.

965

756

966

757

Classes inheriting from this can use the dbus_service_property

968

759

standard Get(), Set(), and GetAll() methods on the D-Bus.

969

760

"""

970

761

762

@staticmethod

763

def _is_dbus_property(obj):

764

return getattr(obj, "_dbus_is_property", False)

765

766

def _get_all_dbus_properties(self):

767

"""Returns a generator of (name, attribute) pairs

768

"""

769

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

770

for cls in self.__class__.__mro__

771

for name, prop in

772

inspect.getmembers(cls, self._is_dbus_property))

773

971

774

def _get_dbus_property(self, interface_name, property_name):

972

775

"""Returns a bound method if one exists which is a D-Bus

973

776

property with the specified name and interface.

974

777

"""

975

for cls in self.__class__.__mro__:

976

for name, value in inspect.getmembers(

977

cls, self._is_dbus_thing("property")):

778

for cls in self.__class__.__mro__:

779

for name, value in (inspect.getmembers

780

(cls, self._is_dbus_property)):

978

781

if (value._dbus_name == property_name

979

782

and value._dbus_interface == interface_name):

980

783

return value.__get__(self)

981

784

982

785

# No such property

983

raise DBusPropertyNotFound("{}:{}.{}".format(

984

self.dbus_object_path, interface_name, property_name))

786

raise DBusPropertyNotFound(self.dbus_object_path + ":"

787

+ interface_name + "."

788

+ property_name)

985

789

986

@dbus.service.method(dbus.PROPERTIES_IFACE,

987

in_signature="ss",

790

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

988

791

out_signature="v")

989

792

def Get(self, interface_name, property_name):

990

793

"""Standard D-Bus property Get() method, see D-Bus standard.

1008

811

# The byte_arrays option is not supported yet on

1009

812

# signatures other than "ay".

1010

813

if prop._dbus_signature != "ay":

1011

raise ValueError("Byte arrays not supported for non-"

1012

"'ay' signature {!r}"

1013

.format(prop._dbus_signature))

1014

value = dbus.ByteArray(b''.join(chr(byte)

1015

for byte in value))

814

raise ValueError

815

value = dbus.ByteArray(''.join(unichr(byte)

816

for byte in value))

1016

817

prop(value)

1017

818

1018

@dbus.service.method(dbus.PROPERTIES_IFACE,

1019

in_signature="s",

819

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1020

820

out_signature="a{sv}")

1021

821

def GetAll(self, interface_name):

1022

822

"""Standard D-Bus property GetAll() method, see D-Bus

1025

825

Note: Will not include properties with access="write".

1026

826

"""

1027

827

properties = {}

1028

for name, prop in self._get_all_dbus_things("property"):

828

for name, prop in self._get_all_dbus_properties():

1029

829

if (interface_name

1030

830

and interface_name != prop._dbus_interface):

1031

831

# Interface non-empty but did not match

1037

837

if not hasattr(value, "variant_level"):

1038

838

properties[name] = value

1039

839

continue

1040

properties[name] = type(value)(

1041

value, variant_level = value.variant_level + 1)

840

properties[name] = type(value)(value, variant_level=

841

value.variant_level+1)

1042

842

return dbus.Dictionary(properties, signature="sv")

1043

843

1044

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1045

def PropertiesChanged(self, interface_name, changed_properties,

1046

invalidated_properties):

1047

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1048

standard.

1049

"""

1050

pass

1051

1052

844

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1053

845

out_signature="s",

1054

846

path_keyword='object_path',

1055

847

connection_keyword='connection')

1056

848

def Introspect(self, object_path, connection):

1057

"""Overloading of standard D-Bus method.

1058

1059

Inserts property tags and interface annotation tags.

849

"""Standard D-Bus method, overloaded to insert property tags.

1060

850

"""

1061

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1062

object_path,

1063

connection)

851

xmlstring = dbus.service.Object.Introspect(self, object_path,

852

connection)

1064

853

try:

1065

854

document = xml.dom.minidom.parseString(xmlstring)

1066

1067

855

def make_tag(document, name, prop):

1068

856

e = document.createElement("property")

1069

857

e.setAttribute("name", name)

1070

858

e.setAttribute("type", prop._dbus_signature)

1071

859

e.setAttribute("access", prop._dbus_access)

1072

860

return e

1073

1074

861

for if_tag in document.getElementsByTagName("interface"):

1075

# Add property tags

1076

862

for tag in (make_tag(document, name, prop)

1077

863

for name, prop

1078

in self._get_all_dbus_things("property")

864

in self._get_all_dbus_properties()

1079

865

if prop._dbus_interface

1080

866

== if_tag.getAttribute("name")):

1081

867

if_tag.appendChild(tag)

1082

# Add annotation tags for properties

1083

for tag in if_tag.getElementsByTagName("property"):

1084

annots = dict()

1085

for name, prop in self._get_all_dbus_things(

1086

"property"):

1087

if (name == tag.getAttribute("name")

1088

and prop._dbus_interface

1089

== if_tag.getAttribute("name")):

1090

annots.update(getattr(

1091

prop, "_dbus_annotations", {}))

1092

for name, value in annots.items():

1093

ann_tag = document.createElement(

1094

"annotation")

1095

ann_tag.setAttribute("name", name)

1096

ann_tag.setAttribute("value", value)

1097

tag.appendChild(ann_tag)

1098

868

# Add the names to the return values for the

1099

869

# "org.freedesktop.DBus.Properties" methods

1100

870

if (if_tag.getAttribute("name")

1115

885

except (AttributeError, xml.dom.DOMException,

1116

886

xml.parsers.expat.ExpatError) as error:

1117

887

logger.error("Failed to override Introspection method",

1118

exc_info=error)

888

error)

1119

889

return xmlstring

1120

890

1121

891

1122

def datetime_to_dbus(dt, variant_level=0):

892

def datetime_to_dbus (dt, variant_level=0):

1123

893

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1124

894

if dt is None:

1125

895

return dbus.String("", variant_level = variant_level)

1126

return dbus.String(dt.isoformat(), variant_level=variant_level)

1127

1128

1129

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1130

"""A class decorator; applied to a subclass of

1131

dbus.service.Object, it will add alternate D-Bus attributes with

1132

interface names according to the "alt_interface_names" mapping.

1133

Usage:

1134

1135

@alternate_dbus_interfaces({"org.example.Interface":

1136

"net.example.AlternateInterface"})

1137

class SampleDBusObject(dbus.service.Object):

1138

@dbus.service.method("org.example.Interface")

1139

def SampleDBusMethod():

1140

pass

1141

1142

The above "SampleDBusMethod" on "SampleDBusObject" will be

1143

reachable via two interfaces: "org.example.Interface" and

1144

"net.example.AlternateInterface", the latter of which will have

1145

its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to

1146

"true", unless "deprecate" is passed with a False value.

1147

1148

This works for methods and signals, and also for D-Bus properties

1149

(from DBusObjectWithProperties) and interfaces (from the

1150

dbus_interface_annotations decorator).

896

return dbus.String(dt.isoformat(),

897

variant_level=variant_level)

898

899

900

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

901

.__metaclass__):

902

"""Applied to an empty subclass of a D-Bus object, this metaclass

903

will add additional D-Bus attributes matching a certain pattern.

1151

904

"""

1152

1153

def wrapper(cls):

1154

for orig_interface_name, alt_interface_name in (

1155

alt_interface_names.items()):

1156

attr = {}

1157

interface_names = set()

1158

# Go though all attributes of the class

1159

for attrname, attribute in inspect.getmembers(cls):

905

def __new__(mcs, name, bases, attr):

906

# Go through all the base classes which could have D-Bus

907

# methods, signals, or properties in them

908

for base in (b for b in bases

909

if issubclass(b, dbus.service.Object)):

910

# Go though all attributes of the base class

911

for attrname, attribute in inspect.getmembers(base):

1160

912

# Ignore non-D-Bus attributes, and D-Bus attributes

1161

913

# with the wrong interface name

1162

914

if (not hasattr(attribute, "_dbus_interface")

1163

or not attribute._dbus_interface.startswith(

1164

orig_interface_name)):

915

or not attribute._dbus_interface

916

.startswith("se.recompile.Mandos")):

1165

917

continue

1166

918

# Create an alternate D-Bus interface name based on

1167

919

# the current name

1168

alt_interface = attribute._dbus_interface.replace(

1169

orig_interface_name, alt_interface_name)

1170

interface_names.add(alt_interface)

920

alt_interface = (attribute._dbus_interface

921

.replace("se.recompile.Mandos",

922

"se.bsnet.fukt.Mandos"))

1171

923

# Is this a D-Bus signal?

1172

924

if getattr(attribute, "_dbus_is_signal", False):

1173

if sys.version_info.major == 2:

1174

# Extract the original non-method undecorated

1175

# function by black magic

1176

nonmethod_func = (dict(

925

# Extract the original non-method function by

926

# black magic

927

nonmethod_func = (dict(

1177

928

zip(attribute.func_code.co_freevars,

1178

attribute.__closure__))

1179

["func"].cell_contents)

1180

else:

1181

nonmethod_func = attribute

929

attribute.__closure__))["func"]

930

.cell_contents)

1182

931

# Create a new, but exactly alike, function

1183

932

# object, and decorate it to be a new D-Bus signal

1184

933

# with the alternate D-Bus interface name

1185

if sys.version_info.major == 2:

1186

new_function = types.FunctionType(

1187

nonmethod_func.func_code,

1188

nonmethod_func.func_globals,

1189

nonmethod_func.func_name,

1190

nonmethod_func.func_defaults,

1191

nonmethod_func.func_closure)

1192

else:

1193

new_function = types.FunctionType(

1194

nonmethod_func.__code__,

1195

nonmethod_func.__globals__,

1196

nonmethod_func.__name__,

1197

nonmethod_func.__defaults__,

1198

nonmethod_func.__closure__)

1199

new_function = (dbus.service.signal(

1200

alt_interface,

1201

attribute._dbus_signature)(new_function))

1202

# Copy annotations, if any

1203

try:

1204

new_function._dbus_annotations = dict(

1205

attribute._dbus_annotations)

1206

except AttributeError:

1207

pass

934

new_function = (dbus.service.signal

935

(alt_interface,

936

attribute._dbus_signature)

937

(types.FunctionType(

938

nonmethod_func.func_code,

939

nonmethod_func.func_globals,

940

nonmethod_func.func_name,

941

nonmethod_func.func_defaults,

942

nonmethod_func.func_closure)))

1208

943

# Define a creator of a function to call both the

1209

# original and alternate functions, so both the

1210

# original and alternate signals gets sent when

1211

# the function is called

944

# old and new functions, so both the old and new

945

# signals gets sent when the function is called

1212

946

def fixscope(func1, func2):

1213

947

"""This function is a scope container to pass

1214

948

func1 and func2 to the "call_both" function

1215

949

outside of its arguments"""

1216

1217

950

def call_both(*args, **kwargs):

1218

951

"""This function will emit two D-Bus

1219

952

signals by calling func1 and func2"""

1220

953

func1(*args, **kwargs)

1221

954

func2(*args, **kwargs)

1222

1223

955

return call_both

1224

956

# Create the "call_both" function and add it to

1225

957

# the class

1226

attr[attrname] = fixscope(attribute, new_function)

958

attr[attrname] = fixscope(attribute,

959

new_function)

1227

960

# Is this a D-Bus method?

1228

961

elif getattr(attribute, "_dbus_is_method", False):

1229

962

# Create a new, but exactly alike, function

1230

963

# object. Decorate it to be a new D-Bus method

1231

964

# with the alternate D-Bus interface name. Add it

1232

965

# to the class.

1233

attr[attrname] = (

1234

dbus.service.method(

1235

alt_interface,

1236

attribute._dbus_in_signature,

1237

attribute._dbus_out_signature)

1238

(types.FunctionType(attribute.func_code,

1239

attribute.func_globals,

1240

attribute.func_name,

1241

attribute.func_defaults,

1242

attribute.func_closure)))

1243

# Copy annotations, if any

1244

try:

1245

attr[attrname]._dbus_annotations = dict(

1246

attribute._dbus_annotations)

1247

except AttributeError:

1248

pass

966

attr[attrname] = (dbus.service.method

967

(alt_interface,

968

attribute._dbus_in_signature,

969

attribute._dbus_out_signature)

970

(types.FunctionType

971

(attribute.func_code,

972

attribute.func_globals,

973

attribute.func_name,

974

attribute.func_defaults,

975

attribute.func_closure)))

1249

976

# Is this a D-Bus property?

1250

977

elif getattr(attribute, "_dbus_is_property", False):

1251

978

# Create a new, but exactly alike, function

1252

979

# object, and decorate it to be a new D-Bus

1253

980

# property with the alternate D-Bus interface

1254

981

# name. Add it to the class.

1255

attr[attrname] = (dbus_service_property(

1256

alt_interface, attribute._dbus_signature,

1257

attribute._dbus_access,

1258

attribute._dbus_get_args_options

1259

["byte_arrays"])

1260

(types.FunctionType(

1261

attribute.func_code,

1262

attribute.func_globals,

1263

attribute.func_name,

1264

attribute.func_defaults,

1265

attribute.func_closure)))

1266

# Copy annotations, if any

1267

try:

1268

attr[attrname]._dbus_annotations = dict(

1269

attribute._dbus_annotations)

1270

except AttributeError:

1271

pass

1272

# Is this a D-Bus interface?

1273

elif getattr(attribute, "_dbus_is_interface", False):

1274

# Create a new, but exactly alike, function

1275

# object. Decorate it to be a new D-Bus interface

1276

# with the alternate D-Bus interface name. Add it

1277

# to the class.

1278

attr[attrname] = (

1279

dbus_interface_annotations(alt_interface)

1280

(types.FunctionType(attribute.func_code,

1281

attribute.func_globals,

1282

attribute.func_name,

1283

attribute.func_defaults,

1284

attribute.func_closure)))

1285

if deprecate:

1286

# Deprecate all alternate interfaces

1287

iname="_AlternateDBusNames_interface_annotation{}"

1288

for interface_name in interface_names:

1289

1290

@dbus_interface_annotations(interface_name)

1291

def func(self):

1292

return { "org.freedesktop.DBus.Deprecated":

1293

"true" }

1294

# Find an unused name

1295

for aname in (iname.format(i)

1296

for i in itertools.count()):

1297

if aname not in attr:

1298

attr[aname] = func

1299

break

1300

if interface_names:

1301

# Replace the class with a new subclass of it with

1302

# methods, signals, etc. as created above.

1303

cls = type(b"{}Alternate".format(cls.__name__),

1304

(cls, ), attr)

1305

return cls

1306

1307

return wrapper

1308

1309

1310

@alternate_dbus_interfaces({"se.recompile.Mandos":

1311

"se.bsnet.fukt.Mandos"})

982

attr[attrname] = (dbus_service_property

983

(alt_interface,

984

attribute._dbus_signature,

985

attribute._dbus_access,

986

attribute

987

._dbus_get_args_options

988

["byte_arrays"])

989

(types.FunctionType

990

(attribute.func_code,

991

attribute.func_globals,

992

attribute.func_name,

993

attribute.func_defaults,

994

attribute.func_closure)))

995

return type.__new__(mcs, name, bases, attr)

996

997

1312

998

class ClientDBus(Client, DBusObjectWithProperties):

1313

999

"""A Client class using D-Bus

1314

1000

1318

1004

"""

1319

1005

1320

1006

runtime_expansions = (Client.runtime_expansions

1321

+ ("dbus_object_path", ))

1322

1323

_interface = "se.recompile.Mandos.Client"

1007

+ ("dbus_object_path",))

1324

1008

1325

1009

# dbus.service.Object doesn't use super(), so we can't either.

1326

1010

1327

1011

def __init__(self, bus = None, *args, **kwargs):

1328

1012

self.bus = bus

1329

1013

Client.__init__(self, *args, **kwargs)

1014

1015

self._approvals_pending = 0

1330

1016

# Only now, when this client is initialized, can it show up on

1331

1017

# the D-Bus

1332

client_object_name = str(self.name).translate(

1018

client_object_name = unicode(self.name).translate(

1333

1019

{ord("."): ord("_"),

1334

1020

ord("-"): ord("_")})

1335

self.dbus_object_path = dbus.ObjectPath(

1336

"/clients/" + client_object_name)

1021

self.dbus_object_path = (dbus.ObjectPath

1022

("/clients/" + client_object_name))

1337

1023

DBusObjectWithProperties.__init__(self, self.bus,

1338

1024

self.dbus_object_path)

1339

1340

def notifychangeproperty(transform_func, dbus_name,

1341

type_func=lambda x: x,

1342

variant_level=1,

1343

invalidate_only=False,

1344

_interface=_interface):

1025

1026

def notifychangeproperty(transform_func,

1027

dbus_name, type_func=lambda x: x,

1028

variant_level=1):

1345

1029

""" Modify a variable so that it's a property which announces

1346

1030

its changes to DBus.

1347

1031

1352

1036

to the D-Bus. Default: no transform

1353

1037

variant_level: D-Bus variant level. Default: 1

1354

1038

"""

1355

attrname = "_{}".format(dbus_name)

1356

1039

attrname = "_{0}".format(dbus_name)

1357

1040

def setter(self, value):

1358

1041

if hasattr(self, "dbus_object_path"):

1359

1042

if (not hasattr(self, attrname) or

1360

1043

type_func(getattr(self, attrname, None))

1361

1044

!= type_func(value)):

1362

if invalidate_only:

1363

self.PropertiesChanged(

1364

_interface, dbus.Dictionary(),

1365

dbus.Array((dbus_name, )))

1366

else:

1367

dbus_value = transform_func(

1368

type_func(value),

1369

variant_level = variant_level)

1370

self.PropertyChanged(dbus.String(dbus_name),

1371

dbus_value)

1372

self.PropertiesChanged(

1373

_interface,

1374

dbus.Dictionary({ dbus.String(dbus_name):

1375

dbus_value }),

1376

dbus.Array())

1045

dbus_value = transform_func(type_func(value),

1046

variant_level

1047

=variant_level)

1048

self.PropertyChanged(dbus.String(dbus_name),

1049

dbus_value)

1377

1050

setattr(self, attrname, value)

1378

1051

1379

1052

return property(lambda self: getattr(self, attrname), setter)

1380

1053

1054

1381

1055

expires = notifychangeproperty(datetime_to_dbus, "Expires")

1382

1056

approvals_pending = notifychangeproperty(dbus.Boolean,

1383

1057

"ApprovalPending",

1385

1059

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1386

1060

last_enabled = notifychangeproperty(datetime_to_dbus,

1387

1061

"LastEnabled")

1388

checker = notifychangeproperty(

1389

dbus.Boolean, "CheckerRunning",

1390

type_func = lambda checker: checker is not None)

1062

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1063

type_func = lambda checker:

1064

checker is not None)

1391

1065

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1392

1066

"LastCheckedOK")

1393

last_checker_status = notifychangeproperty(dbus.Int16,

1394

"LastCheckerStatus")

1395

1067

last_approval_request = notifychangeproperty(

1396

1068

datetime_to_dbus, "LastApprovalRequest")

1397

1069

approved_by_default = notifychangeproperty(dbus.Boolean,

1398

1070

"ApprovedByDefault")

1399

approval_delay = notifychangeproperty(

1400

dbus.UInt64, "ApprovalDelay",

1401

type_func = lambda td: td.total_seconds() * 1000)

1071

approval_delay = notifychangeproperty(dbus.UInt16,

1072

"ApprovalDelay",

1073

type_func =

1074

_timedelta_to_milliseconds)

1402

1075

approval_duration = notifychangeproperty(

1403

dbus.UInt64, "ApprovalDuration",

1404

type_func = lambda td: td.total_seconds() * 1000)

1076

dbus.UInt16, "ApprovalDuration",

1077

type_func = _timedelta_to_milliseconds)

1405

1078

host = notifychangeproperty(dbus.String, "Host")

1406

timeout = notifychangeproperty(

1407

dbus.UInt64, "Timeout",

1408

type_func = lambda td: td.total_seconds() * 1000)

1079

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

1080

type_func =

1081

_timedelta_to_milliseconds)

1409

1082

extended_timeout = notifychangeproperty(

1410

dbus.UInt64, "ExtendedTimeout",

1411

type_func = lambda td: td.total_seconds() * 1000)

1412

interval = notifychangeproperty(

1413

dbus.UInt64, "Interval",

1414

type_func = lambda td: td.total_seconds() * 1000)

1083

dbus.UInt16, "ExtendedTimeout",

1084

type_func = _timedelta_to_milliseconds)

1085

interval = notifychangeproperty(dbus.UInt16,

1086

"Interval",

1087

type_func =

1088

_timedelta_to_milliseconds)

1415

1089

checker_command = notifychangeproperty(dbus.String, "Checker")

1416

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1417

invalidate_only=True)

1418

1090

1419

1091

del notifychangeproperty

1420

1092

1427

1099

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1428

1100

Client.__del__(self, *args, **kwargs)

1429

1101

1430

def checker_callback(self, source, condition,

1431

connection, command, *args, **kwargs):

1432

ret = Client.checker_callback(self, source, condition,

1433

connection, command, *args,

1434

**kwargs)

1435

exitstatus = self.last_checker_status

1436

if exitstatus >= 0:

1102

def checker_callback(self, pid, condition, command,

1103

*args, **kwargs):

1104

self.checker_callback_tag = None

1105

self.checker = None

1106

if os.WIFEXITED(condition):

1107

exitstatus = os.WEXITSTATUS(condition)

1437

1108

# Emit D-Bus signal

1438

1109

self.CheckerCompleted(dbus.Int16(exitstatus),

1439

# This is specific to GNU libC

1440

dbus.Int64(exitstatus << 8),

1110

dbus.Int64(condition),

1441

1111

dbus.String(command))

1442

1112

else:

1443

1113

# Emit D-Bus signal

1444

1114

self.CheckerCompleted(dbus.Int16(-1),

1445

dbus.Int64(

1446

# This is specific to GNU libC

1447

(exitstatus << 8)

1448

| self.last_checker_signal),

1115

dbus.Int64(condition),

1449

1116

dbus.String(command))

1450

return ret

1117

1118

return Client.checker_callback(self, pid, condition, command,

1119

*args, **kwargs)

1451

1120

1452

1121

def start_checker(self, *args, **kwargs):

1453

old_checker_pid = getattr(self.checker, "pid", None)

1122

old_checker = self.checker

1123

if self.checker is not None:

1124

old_checker_pid = self.checker.pid

1125

else:

1126

old_checker_pid = None

1454

1127

r = Client.start_checker(self, *args, **kwargs)

1455

1128

# Only if new checker process was started

1456

1129

if (self.checker is not None

1460

1133

return r

1461

1134

1462

1135

def _reset_approved(self):

1463

self.approved = None

1136

self._approved = None

1464

1137

return False

1465

1138

1466

1139

def approve(self, value=True):

1467

self.approved = value

1468

gobject.timeout_add(int(self.approval_duration.total_seconds()

1469

* 1000), self._reset_approved)

1470

1140

self.send_changedstate()

1141

self._approved = value

1142

gobject.timeout_add(_timedelta_to_milliseconds

1143

(self.approval_duration),

1144

self._reset_approved)

1145

1471

1146

1472

1147

## D-Bus methods, signals & properties

1473

1474

## Interfaces

1148

_interface = "se.recompile.Mandos.Client"

1475

1149

1476

1150

## Signals

1477

1151

1488

1162

pass

1489

1163

1490

1164

# PropertyChanged - signal

1491

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1492

1165

@dbus.service.signal(_interface, signature="sv")

1493

1166

def PropertyChanged(self, property, value):

1494

1167

"D-Bus signal"

1515

1188

"D-Bus signal"

1516

1189

return self.need_approval()

1517

1190

1191

# NeRwequest - signal

1192

@dbus.service.signal(_interface, signature="s")

1193

def NewRequest(self, ip):

1194

"""D-Bus signal

1195

Is sent after a client request a password.

1196

"""

1197

pass

1198

1518

1199

## Methods

1519

1200

1520

1201

# Approve - method

1528

1209

self.checked_ok()

1529

1210

1530

1211

# Enable - method

1531

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1532

1212

@dbus.service.method(_interface)

1533

1213

def Enable(self):

1534

1214

"D-Bus method"

1535

1215

self.enable()

1536

1216

1537

1217

# StartChecker - method

1538

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1539

1218

@dbus.service.method(_interface)

1540

1219

def StartChecker(self):

1541

1220

"D-Bus method"

1542

1221

self.start_checker()

1543

1222

1544

1223

# Disable - method

1545

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1546

1224

@dbus.service.method(_interface)

1547

1225

def Disable(self):

1548

1226

"D-Bus method"

1549

1227

self.disable()

1550

1228

1551

1229

# StopChecker - method

1552

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1553

1230

@dbus.service.method(_interface)

1554

1231

def StopChecker(self):

1555

1232

self.stop_checker()

1562

1239

return dbus.Boolean(bool(self.approvals_pending))

1563

1240

1564

1241

# ApprovedByDefault - property

1565

@dbus_service_property(_interface,

1566

signature="b",

1242

@dbus_service_property(_interface, signature="b",

1567

1243

access="readwrite")

1568

1244

def ApprovedByDefault_dbus_property(self, value=None):

1569

1245

if value is None: # get

1571

1247

self.approved_by_default = bool(value)

1572

1248

1573

1249

# ApprovalDelay - property

1574

@dbus_service_property(_interface,

1575

signature="t",

1250

@dbus_service_property(_interface, signature="t",

1576

1251

access="readwrite")

1577

1252

def ApprovalDelay_dbus_property(self, value=None):

1578

1253

if value is None: # get

1579

return dbus.UInt64(self.approval_delay.total_seconds()

1580

* 1000)

1254

return dbus.UInt64(self.approval_delay_milliseconds())

1581

1255

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1582

1256

1583

1257

# ApprovalDuration - property

1584

@dbus_service_property(_interface,

1585

signature="t",

1258

@dbus_service_property(_interface, signature="t",

1586

1259

access="readwrite")

1587

1260

def ApprovalDuration_dbus_property(self, value=None):

1588

1261

if value is None: # get

1589

return dbus.UInt64(self.approval_duration.total_seconds()

1590

* 1000)

1262

return dbus.UInt64(_timedelta_to_milliseconds(

1263

self.approval_duration))

1591

1264

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1592

1265

1593

1266

# Name - property

1594

@dbus_annotations(

1595

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1596

1267

@dbus_service_property(_interface, signature="s", access="read")

1597

1268

def Name_dbus_property(self):

1598

1269

return dbus.String(self.name)

1599

1270

1600

1271

# Fingerprint - property

1601

@dbus_annotations(

1602

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1603

1272

@dbus_service_property(_interface, signature="s", access="read")

1604

1273

def Fingerprint_dbus_property(self):

1605

1274

return dbus.String(self.fingerprint)

1606

1275

1607

1276

# Host - property

1608

@dbus_service_property(_interface,

1609

signature="s",

1277

@dbus_service_property(_interface, signature="s",

1610

1278

access="readwrite")

1611

1279

def Host_dbus_property(self, value=None):

1612

1280

if value is None: # get

1613

1281

return dbus.String(self.host)

1614

self.host = str(value)

1282

self.host = value

1615

1283

1616

1284

# Created - property

1617

@dbus_annotations(

1618

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1619

1285

@dbus_service_property(_interface, signature="s", access="read")

1620

1286

def Created_dbus_property(self):

1621

1287

return datetime_to_dbus(self.created)

1626

1292

return datetime_to_dbus(self.last_enabled)

1627

1293

1628

1294

# Enabled - property

1629

@dbus_service_property(_interface,

1630

signature="b",

1295

@dbus_service_property(_interface, signature="b",

1631

1296

access="readwrite")

1632

1297

def Enabled_dbus_property(self, value=None):

1633

1298

if value is None: # get

1638

1303

self.disable()

1639

1304

1640

1305

# LastCheckedOK - property

1641

@dbus_service_property(_interface,

1642

signature="s",

1306

@dbus_service_property(_interface, signature="s",

1643

1307

access="readwrite")

1644

1308

def LastCheckedOK_dbus_property(self, value=None):

1645

1309

if value is not None:

1647

1311

return

1648

1312

return datetime_to_dbus(self.last_checked_ok)

1649

1313

1650

# LastCheckerStatus - property

1651

@dbus_service_property(_interface, signature="n", access="read")

1652

def LastCheckerStatus_dbus_property(self):

1653

return dbus.Int16(self.last_checker_status)

1654

1655

1314

# Expires - property

1656

1315

@dbus_service_property(_interface, signature="s", access="read")

1657

1316

def Expires_dbus_property(self):

1663

1322

return datetime_to_dbus(self.last_approval_request)

1664

1323

1665

1324

# Timeout - property

1666

@dbus_service_property(_interface,

1667

signature="t",

1325

@dbus_service_property(_interface, signature="t",

1668

1326

access="readwrite")

1669

1327

def Timeout_dbus_property(self, value=None):

1670

1328

if value is None: # get

1671

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1672

old_timeout = self.timeout

1329

return dbus.UInt64(self.timeout_milliseconds())

1673

1330

self.timeout = datetime.timedelta(0, 0, 0, value)

1674

# Reschedule disabling

1675

if self.enabled:

1676

now = datetime.datetime.utcnow()

1677

self.expires += self.timeout - old_timeout

1678

if self.expires <= now:

1679

# The timeout has passed

1680

self.disable()

1681

else:

1682

if (getattr(self, "disable_initiator_tag", None)

1683

is None):

1684

return

1685

gobject.source_remove(self.disable_initiator_tag)

1686

self.disable_initiator_tag = gobject.timeout_add(

1687

int((self.expires - now).total_seconds() * 1000),

1688

self.disable)

1331

if getattr(self, "disable_initiator_tag", None) is None:

1332

return

1333

# Reschedule timeout

1334

gobject.source_remove(self.disable_initiator_tag)

1335

self.disable_initiator_tag = None

1336

self.expires = None

1337

time_to_die = _timedelta_to_milliseconds((self

1338

.last_checked_ok

1339

+ self.timeout)

1340

- datetime.datetime

1341

.utcnow())

1342

if time_to_die <= 0:

1343

# The timeout has passed

1344

self.disable()

1345

else:

1346

self.expires = (datetime.datetime.utcnow()

1347

+ datetime.timedelta(milliseconds =

1348

time_to_die))

1349

self.disable_initiator_tag = (gobject.timeout_add

1350

(time_to_die, self.disable))

1689

1351

1690

1352

# ExtendedTimeout - property

1691

@dbus_service_property(_interface,

1692

signature="t",

1353

@dbus_service_property(_interface, signature="t",

1693

1354

access="readwrite")

1694

1355

def ExtendedTimeout_dbus_property(self, value=None):

1695

1356

if value is None: # get

1696

return dbus.UInt64(self.extended_timeout.total_seconds()

1697

* 1000)

1357

return dbus.UInt64(self.extended_timeout_milliseconds())

1698

1358

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1699

1359

1700

1360

# Interval - property

1701

@dbus_service_property(_interface,

1702

signature="t",

1361

@dbus_service_property(_interface, signature="t",

1703

1362

access="readwrite")

1704

1363

def Interval_dbus_property(self, value=None):

1705

1364

if value is None: # get

1706

return dbus.UInt64(self.interval.total_seconds() * 1000)

1365

return dbus.UInt64(self.interval_milliseconds())

1707

1366

self.interval = datetime.timedelta(0, 0, 0, value)

1708

1367

if getattr(self, "checker_initiator_tag", None) is None:

1709

1368

return

1710

1369

if self.enabled:

1711

1370

# Reschedule checker run

1712

1371

gobject.source_remove(self.checker_initiator_tag)

1713

self.checker_initiator_tag = gobject.timeout_add(

1714

value, self.start_checker)

1715

self.start_checker() # Start one now, too

1372

self.checker_initiator_tag = (gobject.timeout_add

1373

(value, self.start_checker))

1374

self.start_checker() # Start one now, too

1716

1375

1717

1376

# Checker - property

1718

@dbus_service_property(_interface,

1719

signature="s",

1377

@dbus_service_property(_interface, signature="s",

1720

1378

access="readwrite")

1721

1379

def Checker_dbus_property(self, value=None):

1722

1380

if value is None: # get

1723

1381

return dbus.String(self.checker_command)

1724

self.checker_command = str(value)

1382

self.checker_command = value

1725

1383

1726

1384

# CheckerRunning - property

1727

@dbus_service_property(_interface,

1728

signature="b",

1385

@dbus_service_property(_interface, signature="b",

1729

1386

access="readwrite")

1730

1387

def CheckerRunning_dbus_property(self, value=None):

1731

1388

if value is None: # get

1736

1393

self.stop_checker()

1737

1394

1738

1395

# ObjectPath - property

1739

@dbus_annotations(

1740

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

1741

"org.freedesktop.DBus.Deprecated": "true"})

1742

1396

@dbus_service_property(_interface, signature="o", access="read")

1743

1397

def ObjectPath_dbus_property(self):

1744

1398

return self.dbus_object_path # is already a dbus.ObjectPath

1745

1399

1746

1400

# Secret = property

1747

@dbus_annotations(

1748

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

1749

"invalidates"})

1750

@dbus_service_property(_interface,

1751

signature="ay",

1752

access="write",

1753

byte_arrays=True)

1401

@dbus_service_property(_interface, signature="ay",

1402

access="write", byte_arrays=True)

1754

1403

def Secret_dbus_property(self, value):

1755

self.secret = bytes(value)

1404

self.secret = str(value)

1756

1405

1757

1406

del _interface

1758

1407

1762

1411

self._pipe = child_pipe

1763

1412

self._pipe.send(('init', fpr, address))

1764

1413

if not self._pipe.recv():

1765

raise KeyError(fpr)

1414

raise KeyError()

1766

1415

1767

1416

def __getattribute__(self, name):

1768

if name == '_pipe':

1417

if(name == '_pipe'):

1769

1418

return super(ProxyClient, self).__getattribute__(name)

1770

1419

self._pipe.send(('getattr', name))

1771

1420

data = self._pipe.recv()

1772

1421

if data[0] == 'data':

1773

1422

return data[1]

1774

1423

if data[0] == 'function':

1775

1776

1424

def func(*args, **kwargs):

1777

1425

self._pipe.send(('funcall', name, args, kwargs))

1778

1426

return self._pipe.recv()[1]

1779

1780

1427

return func

1781

1428

1782

1429

def __setattr__(self, name, value):

1783

if name == '_pipe':

1430

if(name == '_pipe'):

1784

1431

return super(ProxyClient, self).__setattr__(name, value)

1785

1432

self._pipe.send(('setattr', name, value))

1786

1433

1787

1434

1435

class ClientDBusTransitional(ClientDBus):

1436

__metaclass__ = AlternateDBusNamesMetaclass

1437

1438

1788

1439

class ClientHandler(socketserver.BaseRequestHandler, object):

1789

1440

"""A class to handle client connections.

1790

1441

1794

1445

def handle(self):

1795

1446

with contextlib.closing(self.server.child_pipe) as child_pipe:

1796

1447

logger.info("TCP connection from: %s",

1797

str(self.client_address))

1448

unicode(self.client_address))

1798

1449

logger.debug("Pipe FD: %d",

1799

1450

self.server.child_pipe.fileno())

1800

1451

1801

session = gnutls.connection.ClientSession(

1802

self.request, gnutls.connection .X509Credentials())

1452

session = (gnutls.connection

1453

.ClientSession(self.request,

1454

gnutls.connection

1455

.X509Credentials()))

1803

1456

1804

1457

# Note: gnutls.connection.X509Credentials is really a

1805

1458

# generic GnuTLS certificate credentials object so long as

1814

1467

priority = self.server.gnutls_priority

1815

1468

if priority is None:

1816

1469

priority = "NORMAL"

1817

gnutls.library.functions.gnutls_priority_set_direct(

1818

session._c_object, priority, None)

1470

(gnutls.library.functions

1471

.gnutls_priority_set_direct(session._c_object,

1472

priority, None))

1819

1473

1820

1474

# Start communication using the Mandos protocol

1821

1475

# Get protocol number

1823

1477

logger.debug("Protocol version: %r", line)

1824

1478

try:

1825

1479

if int(line.strip().split()[0]) > 1:

1826

raise RuntimeError(line)

1480

raise RuntimeError

1827

1481

except (ValueError, IndexError, RuntimeError) as error:

1828

1482

logger.error("Unknown protocol version: %s", error)

1829

1483

return

1841

1495

approval_required = False

1842

1496

try:

1843

1497

try:

1844

fpr = self.fingerprint(

1845

self.peer_certificate(session))

1498

fpr = self.fingerprint(self.peer_certificate

1499

(session))

1846

1500

except (TypeError,

1847

1501

gnutls.errors.GNUTLSError) as error:

1848

1502

logger.warning("Bad certificate: %s", error)

1849

1503

return

1850

1504

logger.debug("Fingerprint: %s", fpr)

1505

if self.server.use_dbus:

1506

# Emit D-Bus signal

1507

client.NewRequest(str(self.client_address))

1851

1508

1852

1509

try:

1853

1510

client = ProxyClient(child_pipe, fpr,

1863

1520

while True:

1864

1521

if not client.enabled:

1865

1522

logger.info("Client %s is disabled",

1866

client.name)

1523

client.name)

1867

1524

if self.server.use_dbus:

1868

1525

# Emit D-Bus signal

1869

1526

client.Rejected("Disabled")

1870

1527

return

1871

1528

1872

if client.approved or not client.approval_delay:

1529

if client._approved or not client.approval_delay:

1873

1530

#We are approved or approval is disabled

1874

1531

break

1875

elif client.approved is None:

1532

elif client._approved is None:

1876

1533

logger.info("Client %s needs approval",

1877

1534

client.name)

1878

1535

if self.server.use_dbus:

1879

1536

# Emit D-Bus signal

1880

1537

client.NeedApproval(

1881

client.approval_delay.total_seconds()

1882

* 1000, client.approved_by_default)

1538

client.approval_delay_milliseconds(),

1539

client.approved_by_default)

1883

1540

else:

1884

1541

logger.warning("Client %s was not approved",

1885

1542

client.name)

1891

1548

#wait until timeout or approved

1892

1549

time = datetime.datetime.now()

1893

1550

client.changedstate.acquire()

1894

client.changedstate.wait(delay.total_seconds())

1551

(client.changedstate.wait

1552

(float(client._timedelta_to_milliseconds(delay)

1553

/ 1000)))

1895

1554

client.changedstate.release()

1896

1555

time2 = datetime.datetime.now()

1897

1556

if (time2 - time) >= delay:

1913

1572

try:

1914

1573

sent = session.send(client.secret[sent_size:])

1915

1574

except gnutls.errors.GNUTLSError as error:

1916

logger.warning("gnutls send failed",

1917

exc_info=error)

1575

logger.warning("gnutls send failed")

1918

1576

return

1919

logger.debug("Sent: %d, remaining: %d", sent,

1920

len(client.secret) - (sent_size

1921

+ sent))

1577

logger.debug("Sent: %d, remaining: %d",

1578

sent, len(client.secret)

1579

- (sent_size + sent))

1922

1580

sent_size += sent

1923

1581

1924

1582

logger.info("Sending secret to %s", client.name)

1925

1583

# bump the timeout using extended_timeout

1926

client.bump_timeout(client.extended_timeout)

1584

client.checked_ok(client.extended_timeout)

1927

1585

if self.server.use_dbus:

1928

1586

# Emit D-Bus signal

1929

1587

client.GotSecret()

1934

1592

try:

1935

1593

session.bye()

1936

1594

except gnutls.errors.GNUTLSError as error:

1937

logger.warning("GnuTLS bye failed",

1938

exc_info=error)

1595

logger.warning("GnuTLS bye failed")

1939

1596

1940

1597

@staticmethod

1941

1598

def peer_certificate(session):

1942

1599

"Return the peer's OpenPGP certificate as a bytestring"

1943

1600

# If not an OpenPGP certificate...

1944

if (gnutls.library.functions.gnutls_certificate_type_get(

1945

session._c_object)

1601

if (gnutls.library.functions

1602

.gnutls_certificate_type_get(session._c_object)

1946

1603

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1947

1604

# ...do the normal thing

1948

1605

return session.peer_certificate

1962

1619

def fingerprint(openpgp):

1963

1620

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1964

1621

# New GnuTLS "datum" with the OpenPGP public key

1965

datum = gnutls.library.types.gnutls_datum_t(

1966

ctypes.cast(ctypes.c_char_p(openpgp),

1967

ctypes.POINTER(ctypes.c_ubyte)),

1968

ctypes.c_uint(len(openpgp)))

1622

datum = (gnutls.library.types

1623

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1624

ctypes.POINTER

1625

(ctypes.c_ubyte)),

1626

ctypes.c_uint(len(openpgp))))

1969

1627

# New empty GnuTLS certificate

1970

1628

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1971

gnutls.library.functions.gnutls_openpgp_crt_init(

1972

ctypes.byref(crt))

1629

(gnutls.library.functions

1630

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1973

1631

# Import the OpenPGP public key into the certificate

1974

gnutls.library.functions.gnutls_openpgp_crt_import(

1975

crt, ctypes.byref(datum),

1976

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1632

(gnutls.library.functions

1633

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1634

gnutls.library.constants

1635

.GNUTLS_OPENPGP_FMT_RAW))

1977

1636

# Verify the self signature in the key

1978

1637

crtverify = ctypes.c_uint()

1979

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1980

crt, 0, ctypes.byref(crtverify))

1638

(gnutls.library.functions

1639

.gnutls_openpgp_crt_verify_self(crt, 0,

1640

ctypes.byref(crtverify)))

1981

1641

if crtverify.value != 0:

1982

1642

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1983

raise gnutls.errors.CertificateSecurityError(

1984

"Verify failed")

1643

raise (gnutls.errors.CertificateSecurityError

1644

("Verify failed"))

1985

1645

# New buffer for the fingerprint

1986

1646

buf = ctypes.create_string_buffer(20)

1987

1647

buf_len = ctypes.c_size_t()

1988

1648

# Get the fingerprint from the certificate into the buffer

1989

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1990

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1649

(gnutls.library.functions

1650

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1651

ctypes.byref(buf_len)))

1991

1652

# Deinit the certificate

1992

1653

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1993

1654

# Convert the buffer to a Python bytestring

1999

1660

2000

1661

class MultiprocessingMixIn(object):

2001

1662

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2002

2003

1663

def sub_process_main(self, request, address):

2004

1664

try:

2005

1665

self.finish_request(request, address)

2006

except Exception:

1666

except:

2007

1667

self.handle_error(request, address)

2008

1668

self.close_request(request)

2009

1669

2010

1670

def process_request(self, request, address):

2011

1671

"""Start a new process to process the request."""

2012

1672

proc = multiprocessing.Process(target = self.sub_process_main,

2013

args = (request, address))

1673

args = (request,

1674

address))

2014

1675

proc.start()

2015

1676

return proc

2016

1677

2017

1678

2018

1679

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2019

1680

""" adds a pipe to the MixIn """

2020

2021

1681

def process_request(self, request, client_address):

2022

1682

"""Overrides and wraps the original process_request().

2023

1683

2032

1692

2033

1693

def add_pipe(self, parent_pipe, proc):

2034

1694

"""Dummy function; override as necessary"""

2035

raise NotImplementedError()

1695

raise NotImplementedError

2036

1696

2037

1697

2038

1698

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

2044

1704

interface: None or a network interface name (string)

2045

1705

use_ipv6: Boolean; to use IPv6 or not

2046

1706

"""

2047

2048

1707

def __init__(self, server_address, RequestHandlerClass,

2049

interface=None,

2050

use_ipv6=True,

2051

socketfd=None):

2052

"""If socketfd is set, use that file descriptor instead of

2053

creating a new one with socket.socket().

2054

"""

1708

interface=None, use_ipv6=True):

2055

1709

self.interface = interface

2056

1710

if use_ipv6:

2057

1711

self.address_family = socket.AF_INET6

2058

if socketfd is not None:

2059

# Save the file descriptor

2060

self.socketfd = socketfd

2061

# Save the original socket.socket() function

2062

self.socket_socket = socket.socket

2063

# To implement --socket, we monkey patch socket.socket.

2064

#

2065

# (When socketserver.TCPServer is a new-style class, we

2066

# could make self.socket into a property instead of monkey

2067

# patching socket.socket.)

2068

#

2069

# Create a one-time-only replacement for socket.socket()

2070

@functools.wraps(socket.socket)

2071

def socket_wrapper(*args, **kwargs):

2072

# Restore original function so subsequent calls are

2073

# not affected.

2074

socket.socket = self.socket_socket

2075

del self.socket_socket

2076

# This time only, return a new socket object from the

2077

# saved file descriptor.

2078

return socket.fromfd(self.socketfd, *args, **kwargs)

2079

# Replace socket.socket() function with wrapper

2080

socket.socket = socket_wrapper

2081

# The socketserver.TCPServer.__init__ will call

2082

# socket.socket(), which might be our replacement,

2083

# socket_wrapper(), if socketfd was set.

2084

1712

socketserver.TCPServer.__init__(self, server_address,

2085

1713

RequestHandlerClass)

2086

2087

1714

def server_bind(self):

2088

1715

"""This overrides the normal server_bind() function

2089

1716

to bind to an interface if one was specified, and also NOT to

2095

1722

self.interface)

2096

1723

else:

2097

1724

try:

2098

self.socket.setsockopt(

2099

socket.SOL_SOCKET, SO_BINDTODEVICE,

2100

(self.interface + "\0").encode("utf-8"))

1725

self.socket.setsockopt(socket.SOL_SOCKET,

1726

SO_BINDTODEVICE,

1727

str(self.interface

1728

+ '\0'))

2101

1729

except socket.error as error:

2102

if error.errno == errno.EPERM:

2103

logger.error("No permission to bind to"

2104

" interface %s", self.interface)

2105

elif error.errno == errno.ENOPROTOOPT:

1730

if error[0] == errno.EPERM:

1731

logger.error("No permission to"

1732

" bind to interface %s",

1733

self.interface)

1734

elif error[0] == errno.ENOPROTOOPT:

2106

1735

logger.error("SO_BINDTODEVICE not available;"

2107

1736

" cannot bind to interface %s",

2108

1737

self.interface)

2109

elif error.errno == errno.ENODEV:

2110

logger.error("Interface %s does not exist,"

2111

" cannot bind", self.interface)

2112

1738

else:

2113

1739

raise

2114

1740

# Only bind(2) the socket if we really need to.

2117

1743

if self.address_family == socket.AF_INET6:

2118

1744

any_address = "::" # in6addr_any

2119

1745

else:

2120

any_address = "0.0.0.0" # INADDR_ANY

1746

any_address = socket.INADDR_ANY

2121

1747

self.server_address = (any_address,

2122

1748

self.server_address[1])

2123

1749

elif not self.server_address[1]:

2124

self.server_address = (self.server_address[0], 0)

1750

self.server_address = (self.server_address[0],

1751

0)

2125

1752

# if self.interface:

2126

1753

# self.server_address = (self.server_address[0],

2127

1754

# 0, # port

2141

1768

2142

1769

Assumes a gobject.MainLoop event loop.

2143

1770

"""

2144

2145

1771

def __init__(self, server_address, RequestHandlerClass,

2146

interface=None,

2147

use_ipv6=True,

2148

clients=None,

2149

gnutls_priority=None,

2150

use_dbus=True,

2151

socketfd=None):

1772

interface=None, use_ipv6=True, clients=None,

1773

gnutls_priority=None, use_dbus=True):

2152

1774

self.enabled = False

2153

1775

self.clients = clients

2154

1776

if self.clients is None:

2158

1780

IPv6_TCPServer.__init__(self, server_address,

2159

1781

RequestHandlerClass,

2160

1782

interface = interface,

2161

use_ipv6 = use_ipv6,

2162

socketfd = socketfd)

2163

1783

use_ipv6 = use_ipv6)

2164

1784

def server_activate(self):

2165

1785

if self.enabled:

2166

1786

return socketserver.TCPServer.server_activate(self)

2170

1790

2171

1791

def add_pipe(self, parent_pipe, proc):

2172

1792

# Call "handle_ipc" for both data and EOF events

2173

gobject.io_add_watch(

2174

parent_pipe.fileno(),

2175

gobject.IO_IN | gobject.IO_HUP,

2176

functools.partial(self.handle_ipc,

2177

parent_pipe = parent_pipe,

2178

proc = proc))

1793

gobject.io_add_watch(parent_pipe.fileno(),

1794

gobject.IO_IN | gobject.IO_HUP,

1795

functools.partial(self.handle_ipc,

1796

parent_pipe =

1797

parent_pipe,

1798

proc = proc))

2179

1799

2180

def handle_ipc(self, source, condition,

2181

parent_pipe=None,

2182

proc = None,

2183

client_object=None):

1800

def handle_ipc(self, source, condition, parent_pipe=None,

1801

proc = None, client_object=None):

1802

condition_names = {

1803

gobject.IO_IN: "IN", # There is data to read.

1804

gobject.IO_OUT: "OUT", # Data can be written (without

1805

# blocking).

1806

gobject.IO_PRI: "PRI", # There is urgent data to read.

1807

gobject.IO_ERR: "ERR", # Error condition.

1808

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1809

# broken, usually for pipes and

1810

# sockets).

1811

}

1812

conditions_string = ' | '.join(name

1813

for cond, name in

1814

condition_names.iteritems()

1815

if cond & condition)

2184

1816

# error, or the other end of multiprocessing.Pipe has closed

2185

if condition & (gobject.IO_ERR | gobject.IO_HUP):

1817

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

2186

1818

# Wait for other process to exit

2187

1819

proc.join()

2188

1820

return False

2209

1841

parent_pipe.send(False)

2210

1842

return False

2211

1843

2212

gobject.io_add_watch(

2213

parent_pipe.fileno(),

2214

gobject.IO_IN | gobject.IO_HUP,

2215

functools.partial(self.handle_ipc,

2216

parent_pipe = parent_pipe,

2217

proc = proc,

2218

client_object = client))

1844

gobject.io_add_watch(parent_pipe.fileno(),

1845

gobject.IO_IN | gobject.IO_HUP,

1846

functools.partial(self.handle_ipc,

1847

parent_pipe =

1848

parent_pipe,

1849

proc = proc,

1850

client_object =

1851

client))

2219

1852

parent_pipe.send(True)

2220

1853

# remove the old hook in favor of the new above hook on

2221

1854

# same fileno

2227

1860

2228

1861

parent_pipe.send(('data', getattr(client_object,

2229

1862

funcname)(*args,

2230

**kwargs)))

1863

**kwargs)))

2231

1864

2232

1865

if command == 'getattr':

2233

1866

attrname = request[1]

2234

if isinstance(client_object.__getattribute__(attrname),

2235

collections.Callable):

2236

parent_pipe.send(('function', ))

1867

if callable(client_object.__getattribute__(attrname)):

1868

parent_pipe.send(('function',))

2237

1869

else:

2238

parent_pipe.send((

2239

'data', client_object.__getattribute__(attrname)))

1870

parent_pipe.send(('data', client_object

1871

.__getattribute__(attrname)))

2240

1872

2241

1873

if command == 'setattr':

2242

1874

attrname = request[1]

2246

1878

return True

2247

1879

2248

1880

2249

def rfc3339_duration_to_delta(duration):

2250

"""Parse an RFC 3339 "duration" and return a datetime.timedelta

2251

2252

>>> rfc3339_duration_to_delta("P7D")

2253

datetime.timedelta(7)

2254

>>> rfc3339_duration_to_delta("PT60S")

2255

datetime.timedelta(0, 60)

2256

>>> rfc3339_duration_to_delta("PT60M")

2257

datetime.timedelta(0, 3600)

2258

>>> rfc3339_duration_to_delta("PT24H")

2259

datetime.timedelta(1)

2260

>>> rfc3339_duration_to_delta("P1W")

2261

datetime.timedelta(7)

2262

>>> rfc3339_duration_to_delta("PT5M30S")

2263

datetime.timedelta(0, 330)

2264

>>> rfc3339_duration_to_delta("P1DT3M20S")

2265

datetime.timedelta(1, 200)

2266

"""

2267

2268

# Parsing an RFC 3339 duration with regular expressions is not

2269

# possible - there would have to be multiple places for the same

2270

# values, like seconds. The current code, while more esoteric, is

2271

# cleaner without depending on a parsing library. If Python had a

2272

# built-in library for parsing we would use it, but we'd like to

2273

# avoid excessive use of external libraries.

2274

2275

# New type for defining tokens, syntax, and semantics all-in-one

2276

Token = collections.namedtuple("Token", (

2277

"regexp", # To match token; if "value" is not None, must have

2278

# a "group" containing digits

2279

"value", # datetime.timedelta or None

2280

"followers")) # Tokens valid after this token

2281

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2282

# the "duration" ABNF definition in RFC 3339, Appendix A.

2283

token_end = Token(re.compile(r"$"), None, frozenset())

2284

token_second = Token(re.compile(r"(\d+)S"),

2285

datetime.timedelta(seconds=1),

2286

frozenset((token_end, )))

2287

token_minute = Token(re.compile(r"(\d+)M"),

2288

datetime.timedelta(minutes=1),

2289

frozenset((token_second, token_end)))

2290

token_hour = Token(re.compile(r"(\d+)H"),

2291

datetime.timedelta(hours=1),

2292

frozenset((token_minute, token_end)))

2293

token_time = Token(re.compile(r"T"),

2294

None,

2295

frozenset((token_hour, token_minute,

2296

token_second)))

2297

token_day = Token(re.compile(r"(\d+)D"),

2298

datetime.timedelta(days=1),

2299

frozenset((token_time, token_end)))

2300

token_month = Token(re.compile(r"(\d+)M"),

2301

datetime.timedelta(weeks=4),

2302

frozenset((token_day, token_end)))

2303

token_year = Token(re.compile(r"(\d+)Y"),

2304

datetime.timedelta(weeks=52),

2305

frozenset((token_month, token_end)))

2306

token_week = Token(re.compile(r"(\d+)W"),

2307

datetime.timedelta(weeks=1),

2308

frozenset((token_end, )))

2309

token_duration = Token(re.compile(r"P"), None,

2310

frozenset((token_year, token_month,

2311

token_day, token_time,

2312

token_week)))

2313

# Define starting values

2314

value = datetime.timedelta() # Value so far

2315

found_token = None

2316

followers = frozenset((token_duration, )) # Following valid tokens

2317

s = duration # String left to parse

2318

# Loop until end token is found

2319

while found_token is not token_end:

2320

# Search for any currently valid tokens

2321

for token in followers:

2322

match = token.regexp.match(s)

2323

if match is not None:

2324

# Token found

2325

if token.value is not None:

2326

# Value found, parse digits

2327

factor = int(match.group(1), 10)

2328

# Add to value so far

2329

value += factor * token.value

2330

# Strip token from string

2331

s = token.regexp.sub("", s, 1)

2332

# Go to found token

2333

found_token = token

2334

# Set valid next tokens

2335

followers = found_token.followers

2336

break

2337

else:

2338

# No currently valid tokens were found

2339

raise ValueError("Invalid RFC 3339 duration: {!r}"

2340

.format(duration))

2341

# End token found

2342

return value

2343

2344

2345

1881

def string_to_delta(interval):

2346

1882

"""Parse a string and return a datetime.timedelta

2347

1883

2358

1894

>>> string_to_delta('5m 30s')

2359

1895

datetime.timedelta(0, 330)

2360

1896

"""

2361

2362

try:

2363

return rfc3339_duration_to_delta(interval)

2364

except ValueError:

2365

pass

2366

2367

1897

timevalue = datetime.timedelta(0)

2368

1898

for s in interval.split():

2369

1899

try:

2370

suffix = s[-1]

1900

suffix = unicode(s[-1])

2371

1901

value = int(s[:-1])

2372

1902

if suffix == "d":

2373

1903

delta = datetime.timedelta(value)

2380

1910

elif suffix == "w":

2381

1911

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2382

1912

else:

2383

raise ValueError("Unknown suffix {!r}".format(suffix))

2384

except IndexError as e:

1913

raise ValueError("Unknown suffix %r" % suffix)

1914

except (ValueError, IndexError) as e:

2385

1915

raise ValueError(*(e.args))

2386

1916

timevalue += delta

2387

1917

return timevalue

2400

1930

sys.exit()

2401

1931

if not noclose:

2402

1932

# Close all standard open file descriptors

2403

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

1933

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2404

1934

if not stat.S_ISCHR(os.fstat(null).st_mode):

2405

1935

raise OSError(errno.ENODEV,

2406

"{} not a character device"

2407

.format(os.devnull))

1936

"%s not a character device"

1937

% os.path.devnull)

2408

1938

os.dup2(null, sys.stdin.fileno())

2409

1939

os.dup2(null, sys.stdout.fileno())

2410

1940

os.dup2(null, sys.stderr.fileno())

2419

1949

2420

1950

parser = argparse.ArgumentParser()

2421

1951

parser.add_argument("-v", "--version", action="version",

2422

version = "%(prog)s {}".format(version),

1952

version = "%%(prog)s %s" % version,

2423

1953

help="show version number and exit")

2424

1954

parser.add_argument("-i", "--interface", metavar="IF",

2425

1955

help="Bind to interface IF")

2431

1961

help="Run self-test")

2432

1962

parser.add_argument("--debug", action="store_true",

2433

1963

help="Debug mode; run in foreground and log"

2434

" to terminal", default=None)

1964

" to terminal")

2435

1965

parser.add_argument("--debuglevel", metavar="LEVEL",

2436

1966

help="Debug level for stdout output")

2437

1967

parser.add_argument("--priority", help="GnuTLS"

2444

1974

" files")

2445

1975

parser.add_argument("--no-dbus", action="store_false",

2446

1976

dest="use_dbus", help="Do not provide D-Bus"

2447

" system bus interface", default=None)

1977

" system bus interface")

2448

1978

parser.add_argument("--no-ipv6", action="store_false",

2449

dest="use_ipv6", help="Do not use IPv6",

2450

default=None)

1979

dest="use_ipv6", help="Do not use IPv6")

2451

1980

parser.add_argument("--no-restore", action="store_false",

2452

1981

dest="restore", help="Do not restore stored"

2453

" state", default=None)

2454

parser.add_argument("--socket", type=int,

2455

help="Specify a file descriptor to a network"

2456

" socket to use instead of creating one")

1982

" state")

2457

1983

parser.add_argument("--statedir", metavar="DIR",

2458

1984

help="Directory to save/restore state in")

2459

parser.add_argument("--foreground", action="store_true",

2460

help="Run in foreground", default=None)

2461

parser.add_argument("--no-zeroconf", action="store_false",

2462

dest="zeroconf", help="Do not use Zeroconf",

2463

default=None)

2464

1985

2465

1986

options = parser.parse_args()

2466

1987

2467

1988

if options.check:

2468

1989

import doctest

2469

fail_count, test_count = doctest.testmod()

2470

sys.exit(os.EX_OK if fail_count == 0 else 1)

1990

doctest.testmod()

1991

sys.exit()

2471

1992

2472

1993

# Default values for config file for server-global settings

2473

1994

server_defaults = { "interface": "",

2475

1996

"port": "",

2476

1997

"debug": "False",

2477

1998

"priority":

2478

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2479

":+SIGN-DSA-SHA256",

1999

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

2480

2000

"servicename": "Mandos",

2481

2001

"use_dbus": "True",

2482

2002

"use_ipv6": "True",

2483

2003

"debuglevel": "",

2484

2004

"restore": "True",

2485

"socket": "",

2486

"statedir": "/var/lib/mandos",

2487

"foreground": "False",

2488

"zeroconf": "True",

2489

}

2005

"statedir": "/var/lib/mandos"

2006

}

2490

2007

2491

2008

# Parse config file for server-global settings

2492

2009

server_config = configparser.SafeConfigParser(server_defaults)

2493

2010

del server_defaults

2494

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2011

server_config.read(os.path.join(options.configdir,

2012

"mandos.conf"))

2495

2013

# Convert the SafeConfigParser object to a dict

2496

2014

server_settings = server_config.defaults()

2497

2015

# Use the appropriate methods on the non-string config options

2498

for option in ("debug", "use_dbus", "use_ipv6", "foreground"):

2016

for option in ("debug", "use_dbus", "use_ipv6"):

2499

2017

server_settings[option] = server_config.getboolean("DEFAULT",

2500

2018

option)

2501

2019

if server_settings["port"]:

2502

2020

server_settings["port"] = server_config.getint("DEFAULT",

2503

2021

"port")

2504

if server_settings["socket"]:

2505

server_settings["socket"] = server_config.getint("DEFAULT",

2506

"socket")

2507

# Later, stdin will, and stdout and stderr might, be dup'ed

2508

# over with an opened os.devnull. But we don't want this to

2509

# happen with a supplied network socket.

2510

if 0 <= server_settings["socket"] <= 2:

2511

server_settings["socket"] = os.dup(server_settings

2512

["socket"])

2513

2022

del server_config

2514

2023

2515

2024

# Override the settings from the config file with command line

2516

2025

# options, if set.

2517

2026

for option in ("interface", "address", "port", "debug",

2518

"priority", "servicename", "configdir", "use_dbus",

2519

"use_ipv6", "debuglevel", "restore", "statedir",

2520

"socket", "foreground", "zeroconf"):

2027

"priority", "servicename", "configdir",

2028

"use_dbus", "use_ipv6", "debuglevel", "restore",

2029

"statedir"):

2521

2030

value = getattr(options, option)

2522

2031

if value is not None:

2523

2032

server_settings[option] = value

2524

2033

del options

2525

2034

# Force all strings to be unicode

2526

2035

for option in server_settings.keys():

2527

if isinstance(server_settings[option], bytes):

2528

server_settings[option] = (server_settings[option]

2529

.decode("utf-8"))

2530

# Force all boolean options to be boolean

2531

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2532

"foreground", "zeroconf"):

2533

server_settings[option] = bool(server_settings[option])

2534

# Debug implies foreground

2535

if server_settings["debug"]:

2536

server_settings["foreground"] = True

2036

if type(server_settings[option]) is str:

2037

server_settings[option] = unicode(server_settings[option])

2537

2038

# Now we have our good server settings in "server_settings"

2538

2039

2539

2040

##################################################################

2540

2041

2541

if (not server_settings["zeroconf"]

2542

and not (server_settings["port"]

2543

or server_settings["socket"] != "")):

2544

parser.error("Needs port or socket to work without Zeroconf")

2545

2546

2042

# For convenience

2547

2043

debug = server_settings["debug"]

2548

2044

debuglevel = server_settings["debuglevel"]

2550

2046

use_ipv6 = server_settings["use_ipv6"]

2551

2047

stored_state_path = os.path.join(server_settings["statedir"],

2552

2048

stored_state_file)

2553

foreground = server_settings["foreground"]

2554

zeroconf = server_settings["zeroconf"]

2555

2049

2556

2050

if debug:

2557

initlogger(debug, logging.DEBUG)

2051

initlogger(logging.DEBUG)

2558

2052

else:

2559

2053

if not debuglevel:

2560

initlogger(debug)

2054

initlogger()

2561

2055

else:

2562

2056

level = getattr(logging, debuglevel.upper())

2563

initlogger(debug, level)

2057

initlogger(level)

2564

2058

2565

2059

if server_settings["servicename"] != "Mandos":

2566

syslogger.setFormatter(

2567

logging.Formatter('Mandos ({}) [%(process)d]:'

2568

' %(levelname)s: %(message)s'.format(

2569

server_settings["servicename"])))

2060

syslogger.setFormatter(logging.Formatter

2061

('Mandos (%s) [%%(process)d]:'

2062

' %%(levelname)s: %%(message)s'

2063

% server_settings["servicename"]))

2570

2064

2571

2065

# Parse config file with clients

2572

client_config = configparser.SafeConfigParser(Client

2573

.client_defaults)

2066

client_defaults = { "timeout": "5m",

2067

"extended_timeout": "15m",

2068

"interval": "2m",

2069

"checker": "fping -q -- %%(host)s",

2070

"host": "",

2071

"approval_delay": "0s",

2072

"approval_duration": "1s",

2073

}

2074

client_config = configparser.SafeConfigParser(client_defaults)

2574

2075

client_config.read(os.path.join(server_settings["configdir"],

2575

2076

"clients.conf"))

2576

2077

2577

2078

global mandos_dbus_service

2578

2079

mandos_dbus_service = None

2579

2080

2580

socketfd = None

2581

if server_settings["socket"] != "":

2582

socketfd = server_settings["socket"]

2583

tcp_server = MandosServer(

2584

(server_settings["address"], server_settings["port"]),

2585

ClientHandler,

2586

interface=(server_settings["interface"] or None),

2587

use_ipv6=use_ipv6,

2588

gnutls_priority=server_settings["priority"],

2589

use_dbus=use_dbus,

2590

socketfd=socketfd)

2591

if not foreground:

2592

pidfilename = "/run/mandos.pid"

2593

if not os.path.isdir("/run/."):

2594

pidfilename = "/var/run/mandos.pid"

2595

pidfile = None

2081

tcp_server = MandosServer((server_settings["address"],

2082

server_settings["port"]),

2083

ClientHandler,

2084

interface=(server_settings["interface"]

2085

or None),

2086

use_ipv6=use_ipv6,

2087

gnutls_priority=

2088

server_settings["priority"],

2089

use_dbus=use_dbus)

2090

if not debug:

2091

pidfilename = "/var/run/mandos.pid"

2596

2092

try:

2597

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2598

except IOError as e:

2599

logger.error("Could not open file %r", pidfilename,

2600

exc_info=e)

2093

pidfile = open(pidfilename, "w")

2094

except IOError:

2095

logger.error("Could not open file %r", pidfilename)

2601

2096

2602

for name in ("_mandos", "mandos", "nobody"):

2097

try:

2098

uid = pwd.getpwnam("_mandos").pw_uid

2099

gid = pwd.getpwnam("_mandos").pw_gid

2100

except KeyError:

2603

2101

try:

2604

uid = pwd.getpwnam(name).pw_uid

2605

gid = pwd.getpwnam(name).pw_gid

2606

break

2102

uid = pwd.getpwnam("mandos").pw_uid

2103

gid = pwd.getpwnam("mandos").pw_gid

2607

2104

except KeyError:

2608

continue

2609

else:

2610

uid = 65534

2611

gid = 65534

2105

try:

2106

uid = pwd.getpwnam("nobody").pw_uid

2107

gid = pwd.getpwnam("nobody").pw_gid

2108

except KeyError:

2109

uid = 65534

2110

gid = 65534

2612

2111

try:

2613

2112

os.setgid(gid)

2614

2113

os.setuid(uid)

2615

2114

except OSError as error:

2616

if error.errno != errno.EPERM:

2617

raise

2115

if error[0] != errno.EPERM:

2116

raise error

2618

2117

2619

2118

if debug:

2620

2119

# Enable all possible GnuTLS debugging

2627

2126

def debug_gnutls(level, string):

2628

2127

logger.debug("GnuTLS: %s", string[:-1])

2629

2128

2630

gnutls.library.functions.gnutls_global_set_log_function(

2631

debug_gnutls)

2129

(gnutls.library.functions

2130

.gnutls_global_set_log_function(debug_gnutls))

2632

2131

2633

2132

# Redirect stdin so all checkers get /dev/null

2634

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2133

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

2635

2134

os.dup2(null, sys.stdin.fileno())

2636

2135

if null > 2:

2637

2136

os.close(null)

2137

else:

2138

# No console logging

2139

logger.removeHandler(console)

2638

2140

2639

2141

# Need to fork before connecting to D-Bus

2640

if not foreground:

2142

if not debug:

2641

2143

# Close all input and output, do double fork, etc.

2642

2144

daemon()

2643

2145

2644

# multiprocessing will use threads, so before we use gobject we

2645

# need to inform gobject that threads will be used.

2646

gobject.threads_init()

2647

2648

2146

global main_loop

2649

2147

# From the Avahi example code

2650

DBusGMainLoop(set_as_default=True)

2148

DBusGMainLoop(set_as_default=True )

2651

2149

main_loop = gobject.MainLoop()

2652

2150

bus = dbus.SystemBus()

2653

2151

# End of Avahi example code

2654

2152

if use_dbus:

2655

2153

try:

2656

2154

bus_name = dbus.service.BusName("se.recompile.Mandos",

2657

bus,

2658

do_not_queue=True)

2659

old_bus_name = dbus.service.BusName(

2660

"se.bsnet.fukt.Mandos", bus,

2661

do_not_queue=True)

2662

except dbus.exceptions.DBusException as e:

2663

logger.error("Disabling D-Bus:", exc_info=e)

2155

bus, do_not_queue=True)

2156

old_bus_name = (dbus.service.BusName

2157

("se.bsnet.fukt.Mandos", bus,

2158

do_not_queue=True))

2159

except dbus.exceptions.NameExistsException as e:

2160

logger.error(unicode(e) + ", disabling D-Bus")

2664

2161

use_dbus = False

2665

2162

server_settings["use_dbus"] = False

2666

2163

tcp_server.use_dbus = False

2667

if zeroconf:

2668

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2669

service = AvahiServiceToSyslog(

2670

name = server_settings["servicename"],

2671

servicetype = "_mandos._tcp",

2672

protocol = protocol,

2673

bus = bus)

2674

if server_settings["interface"]:

2675

service.interface = if_nametoindex(

2676

server_settings["interface"].encode("utf-8"))

2164

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2165

service = AvahiServiceToSyslog(name =

2166

server_settings["servicename"],

2167

servicetype = "_mandos._tcp",

2168

protocol = protocol, bus = bus)

2169

if server_settings["interface"]:

2170

service.interface = (if_nametoindex

2171

(str(server_settings["interface"])))

2677

2172

2678

2173

global multiprocessing_manager

2679

2174

multiprocessing_manager = multiprocessing.Manager()

2680

2175

2681

2176

client_class = Client

2682

2177

if use_dbus:

2683

client_class = functools.partial(ClientDBus, bus = bus)

2684

2685

client_settings = Client.config_parser(client_config)

2178

client_class = functools.partial(ClientDBusTransitional,

2179

bus = bus)

2180

2181

special_settings = {

2182

# Some settings need to be accessd by special methods;

2183

# booleans need .getboolean(), etc. Here is a list of them:

2184

"approved_by_default":

2185

lambda section:

2186

client_config.getboolean(section, "approved_by_default"),

2187

"enabled":

2188

lambda section:

2189

client_config.getboolean(section, "enabled"),

2190

}

2191

# Construct a new dict of client settings of this form:

2192

# { client_name: {setting_name: value, ...}, ...}

2193

# with exceptions for any special settings as defined above

2194

client_settings = dict((clientname,

2195

dict((setting,

2196

(value

2197

if setting not in special_settings

2198

else special_settings[setting]

2199

(clientname)))

2200

for setting, value in

2201

client_config.items(clientname)))

2202

for clientname in client_config.sections())

2203

2686

2204

old_client_settings = {}

2687

clients_data = {}

2688

2689

# This is used to redirect stdout and stderr for checker processes

2690

global wnull

2691

wnull = open(os.devnull, "w") # A writable /dev/null

2692

# Only used if server is running in foreground but not in debug

2693

# mode

2694

if debug or not foreground:

2695

wnull.close()

2205

clients_data = []

2696

2206

2697

2207

# Get client data and settings from last running state.

2698

2208

if server_settings["restore"]:

2699

2209

try:

2700

2210

with open(stored_state_path, "rb") as stored_state:

2701

clients_data, old_client_settings = pickle.load(

2702

stored_state)

2211

clients_data, old_client_settings = (pickle.load

2212

(stored_state))

2703

2213

os.remove(stored_state_path)

2704

2214

except IOError as e:

2705

if e.errno == errno.ENOENT:

2706

logger.warning("Could not load persistent state:"

2707

" {}".format(os.strerror(e.errno)))

2708

else:

2709

logger.critical("Could not load persistent state:",

2710

exc_info=e)

2215

logger.warning("Could not load persistent state: {0}"

2216

.format(e))

2217

if e.errno != errno.ENOENT:

2711

2218

raise

2712

except EOFError as e:

2713

logger.warning("Could not load persistent state: "

2714

"EOFError:",

2715

exc_info=e)

2716

2219

2717

with PGPEngine() as pgp:

2718

for client_name, client in clients_data.items():

2719

# Skip removed clients

2720

if client_name not in client_settings:

2721

continue

2220

with Crypto() as crypt:

2221

for client in clients_data:

2222

client_name = client["name"]

2722

2223

2723

2224

# Decide which value to use after restoring saved state.

2724

2225

# We have three different values: Old config file,

2730

2231

# For each value in new config, check if it

2731

2232

# differs from the old config value (Except for

2732

2233

# the "secret" attribute)

2733

if (name != "secret"

2734

and (value !=

2735

old_client_settings[client_name][name])):

2736

client[name] = value

2234

if (name != "secret" and

2235

value != old_client_settings[client_name]

2236

[name]):

2237

setattr(client, name, value)

2737

2238

except KeyError:

2738

2239

pass

2739

2240

2740

2241

# Clients who has passed its expire date can still be

2741

# enabled if its last checker was successful. A Client

2742

# whose checker succeeded before we stored its state is

2743

# assumed to have successfully run all checkers during

2744

# downtime.

2745

if client["enabled"]:

2746

if datetime.datetime.utcnow() >= client["expires"]:

2747

if not client["last_checked_ok"]:

2748

logger.warning(

2749

"disabling client {} - Client never "

2750

"performed a successful checker".format(

2751

client_name))

2752

client["enabled"] = False

2753

elif client["last_checker_status"] != 0:

2754

logger.warning(

2755

"disabling client {} - Client last"

2756

" checker failed with error code"

2757

" {}".format(

2758

client_name,

2759

client["last_checker_status"]))

2242

# enabled if its last checker was sucessful. Clients

2243

# whose checker failed before we stored its state is

2244

# assumed to have failed all checkers during downtime.

2245

if client["enabled"] and client["last_checked_ok"]:

2246

if ((datetime.datetime.utcnow()

2247

- client["last_checked_ok"])

2248

> client["interval"]):

2249

if client["last_checker_status"] != 0:

2760

2250

client["enabled"] = False

2761

2251

else:

2762

client["expires"] = (

2763

datetime.datetime.utcnow()

2764

+ client["timeout"])

2765

logger.debug("Last checker succeeded,"

2766

" keeping {} enabled".format(

2767

client_name))

2252

client["expires"] = (datetime.datetime

2253

.utcnow()

2254

+ client["timeout"])

2255

2256

client["changedstate"] = (multiprocessing_manager

2257

.Condition

2258

(multiprocessing_manager

2259

.Lock()))

2260

if use_dbus:

2261

new_client = (ClientDBusTransitional.__new__

2262

(ClientDBusTransitional))

2263

tcp_server.clients[client_name] = new_client

2264

new_client.bus = bus

2265

for name, value in client.iteritems():

2266

setattr(new_client, name, value)

2267

client_object_name = unicode(client_name).translate(

2268

{ord("."): ord("_"),

2269

ord("-"): ord("_")})

2270

new_client.dbus_object_path = (dbus.ObjectPath

2271

("/clients/"

2272

+ client_object_name))

2273

DBusObjectWithProperties.__init__(new_client,

2274

new_client.bus,

2275

new_client

2276

.dbus_object_path)

2277

else:

2278

tcp_server.clients[client_name] = (Client.__new__

2279

(Client))

2280

for name, value in client.iteritems():

2281

setattr(tcp_server.clients[client_name],

2282

name, value)

2283

2768

2284

try:

2769

client["secret"] = pgp.decrypt(

2770

client["encrypted_secret"],

2285

tcp_server.clients[client_name].secret = (

2286

crypt.decrypt(tcp_server.clients[client_name]

2287

.encrypted_secret,

2288

client_settings[client_name]

2289

["secret"]))

2290

except CryptoError:

2291

# If decryption fails, we use secret from new settings

2292

tcp_server.clients[client_name].secret = (

2771

2293

client_settings[client_name]["secret"])

2772

except PGPError:

2773

# If decryption fails, we use secret from new settings

2774

logger.debug("Failed to decrypt {} old secret".format(

2775

client_name))

2776

client["secret"] = (client_settings[client_name]

2777

["secret"])

2778

2779

# Add/remove clients based on new changes made to config

2780

for client_name in (set(old_client_settings)

2781

- set(client_settings)):

2782

del clients_data[client_name]

2783

for client_name in (set(client_settings)

2784

- set(old_client_settings)):

2785

clients_data[client_name] = client_settings[client_name]

2786

2787

# Create all client objects

2788

for client_name, client in clients_data.items():

2789

tcp_server.clients[client_name] = client_class(

2790

name = client_name,

2791

settings = client,

2792

server_settings = server_settings)

2294

2295

# Create/remove clients based on new changes made to config

2296

for clientname in set(old_client_settings) - set(client_settings):

2297

del tcp_server.clients[clientname]

2298

for clientname in set(client_settings) - set(old_client_settings):

2299

tcp_server.clients[clientname] = (client_class(name

2300

= clientname,

2301

config =

2302

client_settings

2303

[clientname]))

2793

2304

2794

2305

if not tcp_server.clients:

2795

2306

logger.warning("No clients defined")

2796

2797

if not foreground:

2798

if pidfile is not None:

2799

pid = os.getpid()

2800

try:

2801

with pidfile:

2802

print(pid, file=pidfile)

2803

except IOError:

2804

logger.error("Could not write to file %r with PID %d",

2805

pidfilename, pid)

2806

del pidfile

2307

2308

if not debug:

2309

try:

2310

with pidfile:

2311

pid = os.getpid()

2312

pidfile.write(str(pid) + "\n".encode("utf-8"))

2313

del pidfile

2314

except IOError:

2315

logger.error("Could not write to file %r with PID %d",

2316

pidfilename, pid)

2317

except NameError:

2318

# "pidfile" was never created

2319

pass

2807

2320

del pidfilename

2321

2322

signal.signal(signal.SIGINT, signal.SIG_IGN)

2808

2323

2809

2324

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2810

2325

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2811

2326

2812

2327

if use_dbus:

2813

2814

@alternate_dbus_interfaces(

2815

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2816

class MandosDBusService(DBusObjectWithAnnotations):

2328

class MandosDBusService(dbus.service.Object):

2817

2329

"""A D-Bus proxy object"""

2818

2819

2330

def __init__(self):

2820

2331

dbus.service.Object.__init__(self, bus, "/")

2821

2822

2332

_interface = "se.recompile.Mandos"

2823

2333

2824

2334

@dbus.service.signal(_interface, signature="o")

2839

2349

@dbus.service.method(_interface, out_signature="ao")

2840

2350

def GetAllClients(self):

2841

2351

"D-Bus method"

2842

return dbus.Array(c.dbus_object_path for c in

2352

return dbus.Array(c.dbus_object_path

2353

for c in

2843

2354

tcp_server.clients.itervalues())

2844

2355

2845

2356

@dbus.service.method(_interface,

2847

2358

def GetAllClientsWithProperties(self):

2848

2359

"D-Bus method"

2849

2360

return dbus.Dictionary(

2850

{ c.dbus_object_path: c.GetAll("")

2851

for c in tcp_server.clients.itervalues() },

2361

((c.dbus_object_path, c.GetAll(""))

2362

for c in tcp_server.clients.itervalues()),

2852

2363

signature="oa{sv}")

2853

2364

2854

2365

@dbus.service.method(_interface, in_signature="o")

2867

2378

2868

2379

del _interface

2869

2380

2870

mandos_dbus_service = MandosDBusService()

2381

class MandosDBusServiceTransitional(MandosDBusService):

2382

__metaclass__ = AlternateDBusNamesMetaclass

2383

mandos_dbus_service = MandosDBusServiceTransitional()

2871

2384

2872

2385

def cleanup():

2873

2386

"Cleanup function; run on exit"

2874

if zeroconf:

2875

service.cleanup()

2387

service.cleanup()

2876

2388

2877

2389

multiprocessing.active_children()

2878

wnull.close()

2879

2390

if not (tcp_server.clients or client_settings):

2880

2391

return

2881

2392

2882

2393

# Store client before exiting. Secrets are encrypted with key

2883

2394

# based on what config file has. If config file is

2884

2395

# removed/edited, old secret will thus be unrecovable.

2885

clients = {}

2886

with PGPEngine() as pgp:

2396

clients = []

2397

with Crypto() as crypt:

2887

2398

for client in tcp_server.clients.itervalues():

2888

2399

key = client_settings[client.name]["secret"]

2889

client.encrypted_secret = pgp.encrypt(client.secret,

2890

key)

2400

client.encrypted_secret = crypt.encrypt(client.secret,

2401

key)

2891

2402

client_dict = {}

2892

2403

2893

# A list of attributes that can not be pickled

2894

# + secret.

2895

exclude = { "bus", "changedstate", "secret",

2896

"checker", "server_settings" }

2897

for name, typ in inspect.getmembers(dbus.service

2898

.Object):

2404

# A list of attributes that will not be stored when

2405

# shutting down.

2406

exclude = set(("bus", "changedstate", "secret"))

2407

for name, typ in (inspect.getmembers

2408

(dbus.service.Object)):

2899

2409

exclude.add(name)

2900

2410

2901

2411

client_dict["encrypted_secret"] = (client

2904

2414

if attr not in exclude:

2905

2415

client_dict[attr] = getattr(client, attr)

2906

2416

2907

clients[client.name] = client_dict

2417

clients.append(client_dict)

2908

2418

del client_settings[client.name]["secret"]

2909

2419

2910

2420

try:

2911

with tempfile.NamedTemporaryFile(

2912

mode='wb',

2913

suffix=".pickle",

2914

prefix='clients-',

2915

dir=os.path.dirname(stored_state_path),

2916

delete=False) as stored_state:

2421

with os.fdopen(os.open(stored_state_path,

2422

os.O_CREAT|os.O_WRONLY|os.O_TRUNC,

2423

0600), "wb") as stored_state:

2917

2424

pickle.dump((clients, client_settings), stored_state)

2918

tempname = stored_state.name

2919

os.rename(tempname, stored_state_path)

2920

2425

except (IOError, OSError) as e:

2921

if not debug:

2922

try:

2923

os.remove(tempname)

2924

except NameError:

2925

pass

2926

if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):

2927

logger.warning("Could not save persistent state: {}"

2928

.format(os.strerror(e.errno)))

2929

else:

2930

logger.warning("Could not save persistent state:",

2931

exc_info=e)

2426

logger.warning("Could not save persistent state: {0}"

2427

.format(e))

2428

if e.errno not in (errno.ENOENT, errno.EACCES):

2932

2429

raise

2933

2430

2934

2431

# Delete all clients, and settings from config

2940

2437

client.disable(quiet=True)

2941

2438

if use_dbus:

2942

2439

# Emit D-Bus signal

2943

mandos_dbus_service.ClientRemoved(

2944

client.dbus_object_path, client.name)

2440

mandos_dbus_service.ClientRemoved(client

2441

.dbus_object_path,

2442

client.name)

2945

2443

client_settings.clear()

2946

2444

2947

2445

atexit.register(cleanup)

2958

2456

tcp_server.server_activate()

2959

2457

2960

2458

# Find out what port we got

2961

if zeroconf:

2962

service.port = tcp_server.socket.getsockname()[1]

2459

service.port = tcp_server.socket.getsockname()[1]

2963

2460

if use_ipv6:

2964

2461

logger.info("Now listening on address %r, port %d,"

2965

" flowinfo %d, scope_id %d",

2966

*tcp_server.socket.getsockname())

2462

" flowinfo %d, scope_id %d"

2463

% tcp_server.socket.getsockname())

2967

2464

else: # IPv4

2968

logger.info("Now listening on address %r, port %d",

2969

*tcp_server.socket.getsockname())

2465

logger.info("Now listening on address %r, port %d"

2466

% tcp_server.socket.getsockname())

2970

2467

2971

2468

#service.interface = tcp_server.socket.getsockname()[3]

2972

2469

2973

2470

try:

2974

if zeroconf:

2975

# From the Avahi example code

2976

try:

2977

service.activate()

2978

except dbus.exceptions.DBusException as error:

2979

logger.critical("D-Bus Exception", exc_info=error)

2980

cleanup()

2981

sys.exit(1)

2982

# End of Avahi example code

2471

# From the Avahi example code

2472

try:

2473

service.activate()

2474

except dbus.exceptions.DBusException as error:

2475

logger.critical("DBusException: %s", error)

2476

cleanup()

2477

sys.exit(1)

2478

# End of Avahi example code

2983

2479

2984

2480

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2985

2481

lambda *args, **kwargs:

2989

2485

logger.debug("Starting main loop")

2990

2486

main_loop.run()

2991

2487

except AvahiError as error:

2992

logger.critical("Avahi Error", exc_info=error)

2488

logger.critical("AvahiError: %s", error)

2993

2489

cleanup()

2994

2490

sys.exit(1)

2995

2491

except KeyboardInterrupt: