177
176
def encrypt(self, data, password):
178
177
self.gnupg.passphrase = self.password_encode(password)
179
with open(os.devnull, "w") as devnull:
178
with open(os.devnull) as devnull:
181
180
proc = self.gnupg.run(['--symmetric'],
182
181
create_fhs=['stdin', 'stdout'],
194
193
def decrypt(self, data, password):
195
194
self.gnupg.passphrase = self.password_encode(password)
196
with open(os.devnull, "w") as devnull:
195
with open(os.devnull) as devnull:
198
197
proc = self.gnupg.run(['--decrypt'],
199
198
create_fhs=['stdin', 'stdout'],
200
199
attach_fhs={'stderr': devnull})
201
with contextlib.closing(proc.handles['stdin']) as f:
200
with contextlib.closing(proc.handles['stdin'] ) as f:
203
202
with contextlib.closing(proc.handles['stdout']) as f:
204
203
decrypted_plaintext = f.read()
416
415
last_checked_ok: datetime.datetime(); (UTC) or None
417
416
last_checker_status: integer between 0 and 255 reflecting exit
418
417
status of last checker. -1 reflects crashed
419
checker, -2 means no checker completed yet.
420
419
last_enabled: datetime.datetime(); (UTC) or None
421
420
name: string; from the config file, used in log messages and
422
421
D-Bus identifiers
423
422
secret: bytestring; sent verbatim (over TLS) to client
424
423
timeout: datetime.timedelta(); How long from last_checked_ok
425
424
until this client is disabled
426
extended_timeout: extra long timeout when secret has been sent
425
extended_timeout: extra long timeout when password has been sent
427
426
runtime_expansions: Allowed attributes for runtime expansion.
428
427
expires: datetime.datetime(); time (UTC) when a client will be
429
428
disabled, or None
502
501
client["checker_command"] = section["checker"]
503
502
client["last_approval_request"] = None
504
503
client["last_checked_ok"] = None
505
client["last_checker_status"] = -2
504
client["last_checker_status"] = None
627
626
logger.warning("Checker for %(name)s crashed?",
630
def checked_ok(self):
631
"""Assert that the client has been seen, alive and well."""
632
self.last_checked_ok = datetime.datetime.utcnow()
633
self.last_checker_status = 0
636
def bump_timeout(self, timeout=None):
637
"""Bump up the timeout for this client."""
629
def checked_ok(self, timeout=None):
630
"""Bump up the timeout for this client.
632
This should only be called when the client has been seen,
638
635
if timeout is None:
639
636
timeout = self.timeout
637
self.last_checked_ok = datetime.datetime.utcnow()
640
638
if self.disable_initiator_tag is not None:
641
639
gobject.source_remove(self.disable_initiator_tag)
642
640
if getattr(self, "enabled", False):
694
692
command = self.checker_command % escaped_attrs
695
693
except TypeError as error:
696
logger.error('Could not format string "%s"',
697
self.checker_command, exc_info=error)
694
logger.error('Could not format string "%s":'
695
' %s', self.checker_command, error)
698
696
return True # Try again later
699
697
self.current_checker_command = command
718
716
gobject.source_remove(self.checker_callback_tag)
719
717
self.checker_callback(pid, status, command)
720
718
except OSError as error:
721
logger.error("Failed to start subprocess",
719
logger.error("Failed to start subprocess: %s",
723
721
# Re-run this periodically if run by gobject.timeout_add
733
731
logger.debug("Stopping checker for %(name)s", vars(self))
735
self.checker.terminate()
733
os.kill(self.checker.pid, signal.SIGTERM)
737
735
#if self.checker.poll() is None:
738
# self.checker.kill()
736
# os.kill(self.checker.pid, signal.SIGKILL)
739
737
except OSError as error:
740
738
if error.errno != errno.ESRCH: # No such process
775
def dbus_interface_annotations(dbus_interface):
776
"""Decorator for marking functions returning interface annotations.
780
@dbus_interface_annotations("org.example.Interface")
781
def _foo(self): # Function name does not matter
782
return {"org.freedesktop.DBus.Deprecated": "true",
783
"org.freedesktop.DBus.Property.EmitsChangedSignal":
787
func._dbus_is_interface = True
788
func._dbus_interface = dbus_interface
789
func._dbus_name = dbus_interface
794
def dbus_annotations(annotations):
795
"""Decorator to annotate D-Bus methods, signals or properties
798
@dbus_service_property("org.example.Interface", signature="b",
800
@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
801
"org.freedesktop.DBus.Property."
802
"EmitsChangedSignal": "false"})
803
def Property_dbus_property(self):
804
return dbus.Boolean(False)
807
func._dbus_annotations = annotations
812
773
class DBusPropertyException(dbus.exceptions.DBusException):
813
774
"""A base class for D-Bus property-related exceptions
840
def _is_dbus_thing(thing):
841
"""Returns a function testing if an attribute is a D-Bus thing
843
If called like _is_dbus_thing("method") it returns a function
844
suitable for use as predicate to inspect.getmembers().
846
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
801
def _is_dbus_property(obj):
802
return getattr(obj, "_dbus_is_property", False)
849
def _get_all_dbus_things(self, thing):
804
def _get_all_dbus_properties(self):
850
805
"""Returns a generator of (name, attribute) pairs
852
return ((getattr(athing.__get__(self), "_dbus_name",
854
athing.__get__(self))
807
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
855
808
for cls in self.__class__.__mro__
857
inspect.getmembers(cls,
858
self._is_dbus_thing(thing)))
810
inspect.getmembers(cls, self._is_dbus_property))
860
812
def _get_dbus_property(self, interface_name, property_name):
861
813
"""Returns a bound method if one exists which is a D-Bus
864
816
for cls in self.__class__.__mro__:
865
817
for name, value in (inspect.getmembers
867
self._is_dbus_thing("property"))):
818
(cls, self._is_dbus_property)):
868
819
if (value._dbus_name == property_name
869
820
and value._dbus_interface == interface_name):
870
821
return value.__get__(self)
912
863
Note: Will not include properties with access="write".
915
for name, prop in self._get_all_dbus_things("property"):
866
for name, prop in self._get_all_dbus_properties():
916
867
if (interface_name
917
868
and interface_name != prop._dbus_interface):
918
869
# Interface non-empty but did not match
933
884
path_keyword='object_path',
934
885
connection_keyword='connection')
935
886
def Introspect(self, object_path, connection):
936
"""Overloading of standard D-Bus method.
938
Inserts property tags and interface annotation tags.
887
"""Standard D-Bus method, overloaded to insert property tags.
940
889
xmlstring = dbus.service.Object.Introspect(self, object_path,
948
897
e.setAttribute("access", prop._dbus_access)
950
899
for if_tag in document.getElementsByTagName("interface"):
952
900
for tag in (make_tag(document, name, prop)
954
in self._get_all_dbus_things("property")
902
in self._get_all_dbus_properties()
955
903
if prop._dbus_interface
956
904
== if_tag.getAttribute("name")):
957
905
if_tag.appendChild(tag)
958
# Add annotation tags
959
for typ in ("method", "signal", "property"):
960
for tag in if_tag.getElementsByTagName(typ):
962
for name, prop in (self.
963
_get_all_dbus_things(typ)):
964
if (name == tag.getAttribute("name")
965
and prop._dbus_interface
966
== if_tag.getAttribute("name")):
967
annots.update(getattr
971
for name, value in annots.iteritems():
972
ann_tag = document.createElement(
974
ann_tag.setAttribute("name", name)
975
ann_tag.setAttribute("value", value)
976
tag.appendChild(ann_tag)
977
# Add interface annotation tags
978
for annotation, value in dict(
980
*(annotations().iteritems()
981
for name, annotations in
982
self._get_all_dbus_things("interface")
983
if name == if_tag.getAttribute("name")
985
ann_tag = document.createElement("annotation")
986
ann_tag.setAttribute("name", annotation)
987
ann_tag.setAttribute("value", value)
988
if_tag.appendChild(ann_tag)
989
906
# Add the names to the return values for the
990
907
# "org.freedesktop.DBus.Properties" methods
991
908
if (if_tag.getAttribute("name")
1006
923
except (AttributeError, xml.dom.DOMException,
1007
924
xml.parsers.expat.ExpatError) as error:
1008
925
logger.error("Failed to override Introspection method",
1010
927
return xmlstring
1026
943
def __new__(mcs, name, bases, attr):
1027
944
# Go through all the base classes which could have D-Bus
1028
945
# methods, signals, or properties in them
1029
old_interface_names = []
1030
946
for base in (b for b in bases
1031
947
if issubclass(b, dbus.service.Object)):
1032
948
# Go though all attributes of the base class
1042
958
alt_interface = (attribute._dbus_interface
1043
959
.replace("se.recompile.Mandos",
1044
960
"se.bsnet.fukt.Mandos"))
1045
if alt_interface != attribute._dbus_interface:
1046
old_interface_names.append(alt_interface)
1047
961
# Is this a D-Bus signal?
1048
962
if getattr(attribute, "_dbus_is_signal", False):
1049
963
# Extract the original non-method function by
1064
978
nonmethod_func.func_name,
1065
979
nonmethod_func.func_defaults,
1066
980
nonmethod_func.func_closure)))
1067
# Copy annotations, if any
1069
new_function._dbus_annotations = (
1070
dict(attribute._dbus_annotations))
1071
except AttributeError:
1073
981
# Define a creator of a function to call both the
1074
982
# old and new functions, so both the old and new
1075
983
# signals gets sent when the function is called
1103
1011
attribute.func_name,
1104
1012
attribute.func_defaults,
1105
1013
attribute.func_closure)))
1106
# Copy annotations, if any
1108
attr[attrname]._dbus_annotations = (
1109
dict(attribute._dbus_annotations))
1110
except AttributeError:
1112
1014
# Is this a D-Bus property?
1113
1015
elif getattr(attribute, "_dbus_is_property", False):
1114
1016
# Create a new, but exactly alike, function
1128
1030
attribute.func_name,
1129
1031
attribute.func_defaults,
1130
1032
attribute.func_closure)))
1131
# Copy annotations, if any
1133
attr[attrname]._dbus_annotations = (
1134
dict(attribute._dbus_annotations))
1135
except AttributeError:
1137
# Is this a D-Bus interface?
1138
elif getattr(attribute, "_dbus_is_interface", False):
1139
# Create a new, but exactly alike, function
1140
# object. Decorate it to be a new D-Bus interface
1141
# with the alternate D-Bus interface name. Add it
1143
attr[attrname] = (dbus_interface_annotations
1146
(attribute.func_code,
1147
attribute.func_globals,
1148
attribute.func_name,
1149
attribute.func_defaults,
1150
attribute.func_closure)))
1151
# Deprecate all old interfaces
1152
basename="_AlternateDBusNamesMetaclass_interface_annotation{0}"
1153
for old_interface_name in old_interface_names:
1154
@dbus_interface_annotations(old_interface_name)
1156
return { "org.freedesktop.DBus.Deprecated": "true" }
1157
# Find an unused name
1158
for aname in (basename.format(i) for i in
1160
if aname not in attr:
1163
1033
return type.__new__(mcs, name, bases, attr)
1179
1049
def __init__(self, bus = None, *args, **kwargs):
1181
1051
Client.__init__(self, *args, **kwargs)
1052
self._approvals_pending = 0
1054
self._approvals_pending = 0
1182
1055
# Only now, when this client is initialized, can it show up on
1184
1057
client_object_name = unicode(self.name).translate(
1230
1103
checker is not None)
1231
1104
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1232
1105
"LastCheckedOK")
1233
last_checker_status = notifychangeproperty(dbus.Int16,
1234
"LastCheckerStatus")
1235
1106
last_approval_request = notifychangeproperty(
1236
1107
datetime_to_dbus, "LastApprovalRequest")
1237
1108
approved_by_default = notifychangeproperty(dbus.Boolean,
1315
1186
## D-Bus methods, signals & properties
1316
1187
_interface = "se.recompile.Mandos.Client"
1320
@dbus_interface_annotations(_interface)
1322
return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1327
1191
# CheckerCompleted - signal
1364
1228
return self.need_approval()
1230
# NeRwequest - signal
1231
@dbus.service.signal(_interface, signature="s")
1232
def NewRequest(self, ip):
1234
Is sent after a client request a password.
1368
1240
# Approve - method
1479
1351
return datetime_to_dbus(self.last_checked_ok)
1481
# LastCheckerStatus - property
1482
@dbus_service_property(_interface, signature="n",
1484
def LastCheckerStatus_dbus_property(self):
1485
return dbus.Int16(self.last_checker_status)
1487
1353
# Expires - property
1488
1354
@dbus_service_property(_interface, signature="s", access="read")
1489
1355
def Expires_dbus_property(self):
1751
1621
logger.info("Sending secret to %s", client.name)
1752
1622
# bump the timeout using extended_timeout
1753
client.bump_timeout(client.extended_timeout)
1623
client.checked_ok(client.extended_timeout)
1754
1624
if self.server.use_dbus:
1755
1625
# Emit D-Bus signal
1756
1626
client.GotSecret()
2100
1970
if not noclose:
2101
1971
# Close all standard open file descriptors
2102
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
1972
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2103
1973
if not stat.S_ISCHR(os.fstat(null).st_mode):
2104
1974
raise OSError(errno.ENODEV,
2105
1975
"%s not a character device"
2107
1977
os.dup2(null, sys.stdin.fileno())
2108
1978
os.dup2(null, sys.stdout.fileno())
2109
1979
os.dup2(null, sys.stderr.fileno())
2292
2162
.gnutls_global_set_log_function(debug_gnutls))
2294
2164
# Redirect stdin so all checkers get /dev/null
2295
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2165
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2296
2166
os.dup2(null, sys.stdin.fileno())
2307
2177
global main_loop
2308
2178
# From the Avahi example code
2309
DBusGMainLoop(set_as_default=True)
2179
DBusGMainLoop(set_as_default=True )
2310
2180
main_loop = gobject.MainLoop()
2311
2181
bus = dbus.SystemBus()
2312
2182
# End of Avahi example code
2381
2251
# Clients who has passed its expire date can still be
2382
2252
# enabled if its last checker was successful. Clients
2383
# whose checker succeeded before we stored its state is
2384
# assumed to have successfully run all checkers during
2253
# whose checker failed before we stored its state is
2254
# assumed to have failed all checkers during downtime.
2386
2255
if client["enabled"]:
2387
2256
if datetime.datetime.utcnow() >= client["expires"]:
2388
2257
if not client["last_checked_ok"]:
2389
2258
logger.warning(
2390
2259
"disabling client {0} - Client never "
2391
"performed a successful checker"
2392
.format(client_name))
2260
"performed a successfull checker"
2261
.format(client["name"]))
2393
2262
client["enabled"] = False
2394
2263
elif client["last_checker_status"] != 0:
2395
2264
logger.warning(
2396
2265
"disabling client {0} - Client "
2397
2266
"last checker failed with error code {1}"
2398
.format(client_name,
2267
.format(client["name"],
2399
2268
client["last_checker_status"]))
2400
2269
client["enabled"] = False
2426
2295
- set(old_client_settings)):
2427
2296
clients_data[client_name] = client_settings[client_name]
2429
# Create all client objects
2298
# Create clients all clients
2430
2299
for client_name, client in clients_data.iteritems():
2431
2300
tcp_server.clients[client_name] = client_class(
2432
2301
name = client_name, settings = client)
2453
2322
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2456
class MandosDBusService(DBusObjectWithProperties):
2325
class MandosDBusService(dbus.service.Object):
2457
2326
"""A D-Bus proxy object"""
2458
2327
def __init__(self):
2459
2328
dbus.service.Object.__init__(self, bus, "/")
2460
2329
_interface = "se.recompile.Mandos"
2462
@dbus_interface_annotations(_interface)
2464
return { "org.freedesktop.DBus.Property"
2465
".EmitsChangedSignal":
2468
2331
@dbus.service.signal(_interface, signature="o")
2469
2332
def ClientAdded(self, objpath):
2617
2480
service.activate()
2618
2481
except dbus.exceptions.DBusException as error:
2619
logger.critical("D-Bus Exception", exc_info=error)
2482
logger.critical("DBusException: %s", error)
2622
2485
# End of Avahi example code
2629
2492
logger.debug("Starting main loop")
2630
2493
main_loop.run()
2631
2494
except AvahiError as error:
2632
logger.critical("Avahi Error", exc_info=error)
2495
logger.critical("AvahiError: %s", error)
2635
2498
except KeyboardInterrupt: