70
import cPickle as pickle
65
import cPickle as pickle
73
66
import multiprocessing
85
74
import dbus.service
87
from gi.repository import GLib
88
77
from dbus.mainloop.glib import DBusGMainLoop
91
80
import xml.dom.minidom
94
if sys.version_info.major == 2:
98
# Add collections.abc.Callable if it does not exist
100
collections.abc.Callable
101
except AttributeError:
103
Callable = collections.Callable
104
collections.abc = abc
107
# Add shlex.quote if it does not exist
110
except AttributeError:
111
shlex.quote = re.escape
113
# Show warnings by default
114
if not sys.warnoptions:
116
warnings.simplefilter("default")
118
# Try to find the value of SO_BINDTODEVICE:
120
# This is where SO_BINDTODEVICE is in Python 3.3 (or 3.4?) and
121
# newer, and it is also the most natural place for it:
122
84
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
123
85
except AttributeError:
125
# This is where SO_BINDTODEVICE was up to and including Python
127
87
from IN import SO_BINDTODEVICE
128
88
except ImportError:
129
# In Python 2.7 it seems to have been removed entirely.
130
# Try running the C preprocessor:
132
cc = subprocess.Popen(["cc", "--language=c", "-E",
134
stdin=subprocess.PIPE,
135
stdout=subprocess.PIPE)
136
stdout = cc.communicate(
137
"#include <sys/socket.h>\nSO_BINDTODEVICE\n")[0]
138
SO_BINDTODEVICE = int(stdout.splitlines()[-1])
139
except (OSError, ValueError, IndexError):
141
SO_BINDTODEVICE = None
143
if sys.version_info < (3, 2):
144
configparser.Configparser = configparser.SafeConfigParser
89
SO_BINDTODEVICE = None
147
92
stored_state_file = "clients.pickle"
149
94
logger = logging.getLogger()
150
logging.captureWarnings(True) # Show warnings via the logging system
95
syslogger = (logging.handlers.SysLogHandler
96
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
154
if_nametoindex = ctypes.cdll.LoadLibrary(
155
ctypes.util.find_library("c")).if_nametoindex
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
156
103
except (OSError, AttributeError):
158
104
def if_nametoindex(interface):
159
105
"Get an interface index the hard way, i.e. using fcntl()"
160
106
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
161
107
with contextlib.closing(socket.socket()) as s:
162
108
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
163
struct.pack(b"16s16x", interface))
164
interface_index = struct.unpack("I", ifreq[16:20])[0]
109
struct.pack(str("16s16x"),
111
interface_index = struct.unpack(str("I"),
165
113
return interface_index
168
def copy_function(func):
169
"""Make a copy of a function"""
170
if sys.version_info.major == 2:
171
return types.FunctionType(func.func_code,
177
return types.FunctionType(func.__code__,
184
116
def initlogger(debug, level=logging.WARNING):
185
117
"""init logger and add loglevel"""
188
syslogger = (logging.handlers.SysLogHandler(
189
facility=logging.handlers.SysLogHandler.LOG_DAEMON,
191
119
syslogger.setFormatter(logging.Formatter
192
120
('Mandos [%(process)d]: %(levelname)s:'
194
122
logger.addHandler(syslogger)
197
125
console = logging.StreamHandler()
198
126
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
265
179
.replace(b"\n", b"\\n")
266
180
.replace(b"\0", b"\\x00"))
269
183
def encrypt(self, data, password):
270
184
passphrase = self.password_encode(password)
271
with tempfile.NamedTemporaryFile(
272
dir=self.tempdir) as passfile:
185
with tempfile.NamedTemporaryFile(dir=self.tempdir
273
187
passfile.write(passphrase)
275
proc = subprocess.Popen([self.gpg, '--symmetric',
189
proc = subprocess.Popen(['gpg', '--symmetric',
276
190
'--passphrase-file',
278
192
+ self.gnupgargs,
279
stdin=subprocess.PIPE,
280
stdout=subprocess.PIPE,
281
stderr=subprocess.PIPE)
282
ciphertext, err = proc.communicate(input=data)
193
stdin = subprocess.PIPE,
194
stdout = subprocess.PIPE,
195
stderr = subprocess.PIPE)
196
ciphertext, err = proc.communicate(input = data)
283
197
if proc.returncode != 0:
284
198
raise PGPError(err)
285
199
return ciphertext
287
201
def decrypt(self, data, password):
288
202
passphrase = self.password_encode(password)
289
with tempfile.NamedTemporaryFile(
290
dir=self.tempdir) as passfile:
203
with tempfile.NamedTemporaryFile(dir = self.tempdir
291
205
passfile.write(passphrase)
293
proc = subprocess.Popen([self.gpg, '--decrypt',
207
proc = subprocess.Popen(['gpg', '--decrypt',
294
208
'--passphrase-file',
296
210
+ self.gnupgargs,
297
stdin=subprocess.PIPE,
298
stdout=subprocess.PIPE,
299
stderr=subprocess.PIPE)
300
decrypted_plaintext, err = proc.communicate(input=data)
211
stdin = subprocess.PIPE,
212
stdout = subprocess.PIPE,
213
stderr = subprocess.PIPE)
214
decrypted_plaintext, err = proc.communicate(input
301
216
if proc.returncode != 0:
302
217
raise PGPError(err)
303
218
return decrypted_plaintext
306
# Pretend that we have an Avahi module
308
"""This isn't so much a class as it is a module-like namespace."""
309
IF_UNSPEC = -1 # avahi-common/address.h
310
PROTO_UNSPEC = -1 # avahi-common/address.h
311
PROTO_INET = 0 # avahi-common/address.h
312
PROTO_INET6 = 1 # avahi-common/address.h
313
DBUS_NAME = "org.freedesktop.Avahi"
314
DBUS_INTERFACE_ENTRY_GROUP = DBUS_NAME + ".EntryGroup"
315
DBUS_INTERFACE_SERVER = DBUS_NAME + ".Server"
316
DBUS_PATH_SERVER = "/"
319
def string_array_to_txt_array(t):
320
return dbus.Array((dbus.ByteArray(s.encode("utf-8"))
321
for s in t), signature="ay")
322
ENTRY_GROUP_ESTABLISHED = 2 # avahi-common/defs.h
323
ENTRY_GROUP_COLLISION = 3 # avahi-common/defs.h
324
ENTRY_GROUP_FAILURE = 4 # avahi-common/defs.h
325
SERVER_INVALID = 0 # avahi-common/defs.h
326
SERVER_REGISTERING = 1 # avahi-common/defs.h
327
SERVER_RUNNING = 2 # avahi-common/defs.h
328
SERVER_COLLISION = 3 # avahi-common/defs.h
329
SERVER_FAILURE = 4 # avahi-common/defs.h
332
221
class AvahiError(Exception):
333
222
def __init__(self, value, *args, **kwargs):
334
223
self.value = value
335
return super(AvahiError, self).__init__(value, *args,
224
super(AvahiError, self).__init__(value, *args, **kwargs)
225
def __unicode__(self):
226
return unicode(repr(self.value))
339
228
class AvahiServiceError(AvahiError):
343
231
class AvahiGroupError(AvahiError):
235
class AvahiService(object):
348
236
"""An Avahi (Zeroconf) service.
351
239
interface: integer; avahi.IF_UNSPEC or an interface index.
352
240
Used to optionally bind to the specified interface.
517
383
follow_name_owner_changes=True),
518
384
avahi.DBUS_INTERFACE_SERVER)
519
385
self.server.connect_to_signal("StateChanged",
520
self.server_state_changed)
386
self.server_state_changed)
521
387
self.server_state_changed(self.server.GetState())
524
390
class AvahiServiceToSyslog(AvahiService):
525
def rename(self, *args, **kwargs):
526
392
"""Add the new name to the syslog messages"""
527
ret = super(AvahiServiceToSyslog, self).rename(*args,
529
syslogger.setFormatter(logging.Formatter(
530
'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'
393
ret = AvahiService.rename(self)
394
syslogger.setFormatter(logging.Formatter
395
('Mandos ({0}) [%(process)d]:'
396
' %(levelname)s: %(message)s'
535
# Pretend that we have a GnuTLS module
537
"""This isn't so much a class as it is a module-like namespace."""
539
library = ctypes.util.find_library("gnutls")
541
library = ctypes.util.find_library("gnutls-deb0")
542
_library = ctypes.cdll.LoadLibrary(library)
545
# Unless otherwise indicated, the constants and types below are
546
# all from the gnutls/gnutls.h C header file.
557
E_NO_CERTIFICATE_FOUND = -49
562
KEYID_USE_SHA256 = 1 # gnutls/x509.h
563
OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h
566
class _session_int(ctypes.Structure):
568
session_t = ctypes.POINTER(_session_int)
570
class certificate_credentials_st(ctypes.Structure):
572
certificate_credentials_t = ctypes.POINTER(
573
certificate_credentials_st)
574
certificate_type_t = ctypes.c_int
576
class datum_t(ctypes.Structure):
577
_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),
578
('size', ctypes.c_uint)]
580
class _openpgp_crt_int(ctypes.Structure):
582
openpgp_crt_t = ctypes.POINTER(_openpgp_crt_int)
583
openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h
584
log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)
585
credentials_type_t = ctypes.c_int
586
transport_ptr_t = ctypes.c_void_p
587
close_request_t = ctypes.c_int
590
class Error(Exception):
591
def __init__(self, message=None, code=None, args=()):
592
# Default usage is by a message string, but if a return
593
# code is passed, convert it to a string with
596
if message is None and code is not None:
597
message = gnutls.strerror(code).decode(
598
"utf-8", errors="replace")
599
return super(gnutls.Error, self).__init__(
602
class CertificateSecurityError(Error):
606
def __init__(self, cls):
609
def from_param(self, obj):
610
if not isinstance(obj, self.cls):
611
raise TypeError("Not of type {}: {!r}"
612
.format(self.cls.__name__, obj))
613
return ctypes.byref(obj.from_param(obj))
615
class CastToVoidPointer:
616
def __init__(self, cls):
619
def from_param(self, obj):
620
if not isinstance(obj, self.cls):
621
raise TypeError("Not of type {}: {!r}"
622
.format(self.cls.__name__, obj))
623
return ctypes.cast(obj.from_param(obj), ctypes.c_void_p)
625
class With_from_param:
627
def from_param(cls, obj):
628
return obj._as_parameter_
631
class Credentials(With_from_param):
633
self._as_parameter_ = gnutls.certificate_credentials_t()
634
gnutls.certificate_allocate_credentials(self)
635
self.type = gnutls.CRD_CERTIFICATE
638
gnutls.certificate_free_credentials(self)
640
class ClientSession(With_from_param):
641
def __init__(self, socket, credentials=None):
642
self._as_parameter_ = gnutls.session_t()
643
gnutls_flags = gnutls.CLIENT
644
if gnutls.check_version(b"3.5.6"):
645
gnutls_flags |= gnutls.NO_TICKETS
647
gnutls_flags |= gnutls.ENABLE_RAWPK
648
gnutls.init(self, gnutls_flags)
650
gnutls.set_default_priority(self)
651
gnutls.transport_set_ptr(self, socket.fileno())
652
gnutls.handshake_set_private_extensions(self, True)
654
if credentials is None:
655
credentials = gnutls.Credentials()
656
gnutls.credentials_set(self, credentials.type,
658
self.credentials = credentials
664
return gnutls.handshake(self)
666
def send(self, data):
670
data_len -= gnutls.record_send(self, data[-data_len:],
674
return gnutls.bye(self, gnutls.SHUT_RDWR)
676
# Error handling functions
677
def _error_code(result):
678
"""A function to raise exceptions on errors, suitable
679
for the 'restype' attribute on ctypes functions"""
680
if result >= gnutls.E_SUCCESS:
682
if result == gnutls.E_NO_CERTIFICATE_FOUND:
683
raise gnutls.CertificateSecurityError(code=result)
684
raise gnutls.Error(code=result)
686
def _retry_on_error(result, func, arguments,
687
_error_code=_error_code):
688
"""A function to retry on some errors, suitable
689
for the 'errcheck' attribute on ctypes functions"""
690
while result < gnutls.E_SUCCESS:
691
if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):
692
return _error_code(result)
693
result = func(*arguments)
696
# Unless otherwise indicated, the function declarations below are
697
# all from the gnutls/gnutls.h C header file.
700
priority_set_direct = _library.gnutls_priority_set_direct
701
priority_set_direct.argtypes = [ClientSession, ctypes.c_char_p,
702
ctypes.POINTER(ctypes.c_char_p)]
703
priority_set_direct.restype = _error_code
705
init = _library.gnutls_init
706
init.argtypes = [PointerTo(ClientSession), ctypes.c_int]
707
init.restype = _error_code
709
set_default_priority = _library.gnutls_set_default_priority
710
set_default_priority.argtypes = [ClientSession]
711
set_default_priority.restype = _error_code
713
record_send = _library.gnutls_record_send
714
record_send.argtypes = [ClientSession, ctypes.c_void_p,
716
record_send.restype = ctypes.c_ssize_t
717
record_send.errcheck = _retry_on_error
719
certificate_allocate_credentials = (
720
_library.gnutls_certificate_allocate_credentials)
721
certificate_allocate_credentials.argtypes = [
722
PointerTo(Credentials)]
723
certificate_allocate_credentials.restype = _error_code
725
certificate_free_credentials = (
726
_library.gnutls_certificate_free_credentials)
727
certificate_free_credentials.argtypes = [Credentials]
728
certificate_free_credentials.restype = None
730
handshake_set_private_extensions = (
731
_library.gnutls_handshake_set_private_extensions)
732
handshake_set_private_extensions.argtypes = [ClientSession,
734
handshake_set_private_extensions.restype = None
736
credentials_set = _library.gnutls_credentials_set
737
credentials_set.argtypes = [ClientSession, credentials_type_t,
738
CastToVoidPointer(Credentials)]
739
credentials_set.restype = _error_code
741
strerror = _library.gnutls_strerror
742
strerror.argtypes = [ctypes.c_int]
743
strerror.restype = ctypes.c_char_p
745
certificate_type_get = _library.gnutls_certificate_type_get
746
certificate_type_get.argtypes = [ClientSession]
747
certificate_type_get.restype = _error_code
749
certificate_get_peers = _library.gnutls_certificate_get_peers
750
certificate_get_peers.argtypes = [ClientSession,
751
ctypes.POINTER(ctypes.c_uint)]
752
certificate_get_peers.restype = ctypes.POINTER(datum_t)
754
global_set_log_level = _library.gnutls_global_set_log_level
755
global_set_log_level.argtypes = [ctypes.c_int]
756
global_set_log_level.restype = None
758
global_set_log_function = _library.gnutls_global_set_log_function
759
global_set_log_function.argtypes = [log_func]
760
global_set_log_function.restype = None
762
deinit = _library.gnutls_deinit
763
deinit.argtypes = [ClientSession]
764
deinit.restype = None
766
handshake = _library.gnutls_handshake
767
handshake.argtypes = [ClientSession]
768
handshake.restype = ctypes.c_int
769
handshake.errcheck = _retry_on_error
771
transport_set_ptr = _library.gnutls_transport_set_ptr
772
transport_set_ptr.argtypes = [ClientSession, transport_ptr_t]
773
transport_set_ptr.restype = None
775
bye = _library.gnutls_bye
776
bye.argtypes = [ClientSession, close_request_t]
777
bye.restype = ctypes.c_int
778
bye.errcheck = _retry_on_error
780
check_version = _library.gnutls_check_version
781
check_version.argtypes = [ctypes.c_char_p]
782
check_version.restype = ctypes.c_char_p
784
_need_version = b"3.3.0"
785
if check_version(_need_version) is None:
786
raise self.Error("Needs GnuTLS {} or later"
787
.format(_need_version))
789
_tls_rawpk_version = b"3.6.6"
790
has_rawpk = bool(check_version(_tls_rawpk_version))
794
class pubkey_st(ctypes.Structure):
796
pubkey_t = ctypes.POINTER(pubkey_st)
798
x509_crt_fmt_t = ctypes.c_int
800
# All the function declarations below are from
802
pubkey_init = _library.gnutls_pubkey_init
803
pubkey_init.argtypes = [ctypes.POINTER(pubkey_t)]
804
pubkey_init.restype = _error_code
806
pubkey_import = _library.gnutls_pubkey_import
807
pubkey_import.argtypes = [pubkey_t, ctypes.POINTER(datum_t),
809
pubkey_import.restype = _error_code
811
pubkey_get_key_id = _library.gnutls_pubkey_get_key_id
812
pubkey_get_key_id.argtypes = [pubkey_t, ctypes.c_int,
813
ctypes.POINTER(ctypes.c_ubyte),
814
ctypes.POINTER(ctypes.c_size_t)]
815
pubkey_get_key_id.restype = _error_code
817
pubkey_deinit = _library.gnutls_pubkey_deinit
818
pubkey_deinit.argtypes = [pubkey_t]
819
pubkey_deinit.restype = None
821
# All the function declarations below are from
824
openpgp_crt_init = _library.gnutls_openpgp_crt_init
825
openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]
826
openpgp_crt_init.restype = _error_code
828
openpgp_crt_import = _library.gnutls_openpgp_crt_import
829
openpgp_crt_import.argtypes = [openpgp_crt_t,
830
ctypes.POINTER(datum_t),
832
openpgp_crt_import.restype = _error_code
834
openpgp_crt_verify_self = \
835
_library.gnutls_openpgp_crt_verify_self
836
openpgp_crt_verify_self.argtypes = [
839
ctypes.POINTER(ctypes.c_uint),
841
openpgp_crt_verify_self.restype = _error_code
843
openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit
844
openpgp_crt_deinit.argtypes = [openpgp_crt_t]
845
openpgp_crt_deinit.restype = None
847
openpgp_crt_get_fingerprint = (
848
_library.gnutls_openpgp_crt_get_fingerprint)
849
openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,
853
openpgp_crt_get_fingerprint.restype = _error_code
855
if check_version(b"3.6.4"):
856
certificate_type_get2 = _library.gnutls_certificate_type_get2
857
certificate_type_get2.argtypes = [ClientSession, ctypes.c_int]
858
certificate_type_get2.restype = _error_code
860
# Remove non-public functions
861
del _error_code, _retry_on_error
864
def call_pipe(connection, # : multiprocessing.Connection
865
func, *args, **kwargs):
866
"""This function is meant to be called by multiprocessing.Process
868
This function runs func(*args, **kwargs), and writes the resulting
869
return value on the provided multiprocessing.Connection.
871
connection.send(func(*args, **kwargs))
401
def timedelta_to_milliseconds(td):
402
"Convert a datetime.timedelta() to milliseconds"
403
return ((td.days * 24 * 60 * 60 * 1000)
404
+ (td.seconds * 1000)
405
+ (td.microseconds // 1000))
408
class Client(object):
876
409
"""A representation of a client host served by this server.
879
412
approved: bool(); 'None' if not yet approved/disapproved
880
413
approval_delay: datetime.timedelta(); Time to wait for approval
881
414
approval_duration: datetime.timedelta(); Duration of one approval
882
checker: multiprocessing.Process(); a running checker process used
883
to see if the client lives. 'None' if no process is
885
checker_callback_tag: a GLib event source tag, or None
415
checker: subprocess.Popen(); a running checker process used
416
to see if the client lives.
417
'None' if no process is running.
418
checker_callback_tag: a gobject event source tag, or None
886
419
checker_command: string; External command which is run to check
887
420
if client lives. %() expansions are done at
888
421
runtime with vars(self) as dict, so that for
889
422
instance %(name)s can be used in the command.
890
checker_initiator_tag: a GLib event source tag, or None
423
checker_initiator_tag: a gobject event source tag, or None
891
424
created: datetime.datetime(); (UTC) object creation
892
425
client_structure: Object describing what attributes a client has
893
426
and is used for storing the client at exit
894
427
current_checker_command: string; current running checker_command
895
disable_initiator_tag: a GLib event source tag, or None
428
disable_initiator_tag: a gobject event source tag, or None
897
430
fingerprint: string (40 or 32 hexadecimal digits); used to
898
uniquely identify an OpenPGP client
899
key_id: string (64 hexadecimal digits); used to uniquely identify
900
a client using raw public keys
431
uniquely identify the client
901
432
host: string; available for use by the checker command
902
433
interval: datetime.timedelta(); How often to start a new checker
903
434
last_approval_request: datetime.datetime(); (UTC) or None
1060
601
logger.info("Disabling client %s", self.name)
1061
602
if getattr(self, "disable_initiator_tag", None) is not None:
1062
GLib.source_remove(self.disable_initiator_tag)
603
gobject.source_remove(self.disable_initiator_tag)
1063
604
self.disable_initiator_tag = None
1064
605
self.expires = None
1065
606
if getattr(self, "checker_initiator_tag", None) is not None:
1066
GLib.source_remove(self.checker_initiator_tag)
607
gobject.source_remove(self.checker_initiator_tag)
1067
608
self.checker_initiator_tag = None
1068
609
self.stop_checker()
1069
610
self.enabled = False
1071
612
self.send_changedstate()
1072
# Do not run this again if called by a GLib.timeout_add
613
# Do not run this again if called by a gobject.timeout_add
1075
616
def __del__(self):
1078
619
def init_checker(self):
1079
620
# Schedule a new checker to be started an 'interval' from now,
1080
621
# and every interval from then on.
1081
622
if self.checker_initiator_tag is not None:
1082
GLib.source_remove(self.checker_initiator_tag)
1083
self.checker_initiator_tag = GLib.timeout_add(
1084
random.randrange(int(self.interval.total_seconds() * 1000
623
gobject.source_remove(self.checker_initiator_tag)
624
self.checker_initiator_tag = (gobject.timeout_add
625
(self.interval_milliseconds(),
1087
627
# Schedule a disable() when 'timeout' has passed
1088
628
if self.disable_initiator_tag is not None:
1089
GLib.source_remove(self.disable_initiator_tag)
1090
self.disable_initiator_tag = GLib.timeout_add(
1091
int(self.timeout.total_seconds() * 1000), self.disable)
629
gobject.source_remove(self.disable_initiator_tag)
630
self.disable_initiator_tag = (gobject.timeout_add
631
(self.timeout_milliseconds(),
1092
633
# Also start a new checker *right now*.
1093
634
self.start_checker()
1095
def checker_callback(self, source, condition, connection,
636
def checker_callback(self, pid, condition, command):
1097
637
"""The checker has completed, so take appropriate actions."""
1098
# Read return code from connection (see call_pipe)
1099
returncode = connection.recv()
1101
if self.checker is not None:
1103
638
self.checker_callback_tag = None
1104
639
self.checker = None
1107
self.last_checker_status = returncode
1108
self.last_checker_signal = None
640
if os.WIFEXITED(condition):
641
self.last_checker_status = os.WEXITSTATUS(condition)
1109
642
if self.last_checker_status == 0:
1110
643
logger.info("Checker for %(name)s succeeded",
1112
645
self.checked_ok()
1114
logger.info("Checker for %(name)s failed", vars(self))
647
logger.info("Checker for %(name)s failed",
1116
650
self.last_checker_status = -1
1117
self.last_checker_signal = -returncode
1118
651
logger.warning("Checker for %(name)s crashed?",
1122
654
def checked_ok(self):
1123
655
"""Assert that the client has been seen, alive and well."""
1124
656
self.last_checked_ok = datetime.datetime.utcnow()
1125
657
self.last_checker_status = 0
1126
self.last_checker_signal = None
1127
658
self.bump_timeout()
1129
660
def bump_timeout(self, timeout=None):
1130
661
"""Bump up the timeout for this client."""
1131
662
if timeout is None:
1132
663
timeout = self.timeout
1133
664
if self.disable_initiator_tag is not None:
1134
GLib.source_remove(self.disable_initiator_tag)
665
gobject.source_remove(self.disable_initiator_tag)
1135
666
self.disable_initiator_tag = None
1136
667
if getattr(self, "enabled", False):
1137
self.disable_initiator_tag = GLib.timeout_add(
1138
int(timeout.total_seconds() * 1000), self.disable)
668
self.disable_initiator_tag = (gobject.timeout_add
669
(timedelta_to_milliseconds
670
(timeout), self.disable))
1139
671
self.expires = datetime.datetime.utcnow() + timeout
1141
673
def need_approval(self):
1142
674
self.last_approval_request = datetime.datetime.utcnow()
1144
676
def start_checker(self):
1145
677
"""Start a new checker subprocess if one is not running.
1147
679
If a checker already exists, leave it running and do
1149
681
# The reason for not killing a running checker is that if we
1154
686
# checkers alone, the checker would have to take more time
1155
687
# than 'timeout' for the client to be disabled, which is as it
1158
if self.checker is not None and not self.checker.is_alive():
1159
logger.warning("Checker was not alive; joining")
690
# If a checker exists, make sure it is not a zombie
692
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
693
except (AttributeError, OSError) as error:
694
if (isinstance(error, OSError)
695
and error.errno != errno.ECHILD):
699
logger.warning("Checker was a zombie")
700
gobject.source_remove(self.checker_callback_tag)
701
self.checker_callback(pid, status,
702
self.current_checker_command)
1162
703
# Start a new checker if needed
1163
704
if self.checker is None:
1164
705
# Escape attributes for the shell
1166
attr: shlex.quote(str(getattr(self, attr)))
1167
for attr in self.runtime_expansions}
706
escaped_attrs = dict(
707
(attr, re.escape(unicode(getattr(self, attr))))
709
self.runtime_expansions)
1169
711
command = self.checker_command % escaped_attrs
1170
712
except TypeError as error:
1171
713
logger.error('Could not format string "%s"',
1172
self.checker_command,
714
self.checker_command, exc_info=error)
715
return True # Try again later
716
self.current_checker_command = command
718
logger.info("Starting checker %r for %s",
720
# We don't need to redirect stdout and stderr, since
721
# in normal mode, that is already done by daemon(),
722
# and in debug mode we don't want to. (Stdin is
723
# always replaced by /dev/null.)
724
# The exception is when not debugging but nevertheless
725
# running in the foreground; use the previously
728
if (not self.server_settings["debug"]
729
and self.server_settings["foreground"]):
730
popen_args.update({"stdout": wnull,
732
self.checker = subprocess.Popen(command,
736
except OSError as error:
737
logger.error("Failed to start subprocess",
1174
return True # Try again later
1175
self.current_checker_command = command
1176
logger.info("Starting checker %r for %s", command,
1178
# We don't need to redirect stdout and stderr, since
1179
# in normal mode, that is already done by daemon(),
1180
# and in debug mode we don't want to. (Stdin is
1181
# always replaced by /dev/null.)
1182
# The exception is when not debugging but nevertheless
1183
# running in the foreground; use the previously
1185
popen_args = {"close_fds": True,
1188
if (not self.server_settings["debug"]
1189
and self.server_settings["foreground"]):
1190
popen_args.update({"stdout": wnull,
1192
pipe = multiprocessing.Pipe(duplex=False)
1193
self.checker = multiprocessing.Process(
1195
args=(pipe[1], subprocess.call, command),
1197
self.checker.start()
1198
self.checker_callback_tag = GLib.io_add_watch(
1199
GLib.IOChannel.unix_new(pipe[0].fileno()),
1200
GLib.PRIORITY_DEFAULT, GLib.IO_IN,
1201
self.checker_callback, pipe[0], command)
1202
# Re-run this periodically if run by GLib.timeout_add
740
self.checker_callback_tag = (gobject.child_watch_add
742
self.checker_callback,
744
# The checker may have completed before the gobject
745
# watch was added. Check for this.
747
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
748
except OSError as error:
749
if error.errno == errno.ECHILD:
750
# This should never happen
751
logger.error("Child process vanished",
756
gobject.source_remove(self.checker_callback_tag)
757
self.checker_callback(pid, status, command)
758
# Re-run this periodically if run by gobject.timeout_add
1205
761
def stop_checker(self):
1206
762
"""Force the checker process, if any, to stop."""
1207
763
if self.checker_callback_tag:
1208
GLib.source_remove(self.checker_callback_tag)
764
gobject.source_remove(self.checker_callback_tag)
1209
765
self.checker_callback_tag = None
1210
766
if getattr(self, "checker", None) is None:
1212
768
logger.debug("Stopping checker for %(name)s", vars(self))
1213
self.checker.terminate()
770
self.checker.terminate()
772
#if self.checker.poll() is None:
773
# self.checker.kill()
774
except OSError as error:
775
if error.errno != errno.ESRCH: # No such process
1214
777
self.checker = None
1217
def dbus_service_property(dbus_interface,
780
def dbus_service_property(dbus_interface, signature="v",
781
access="readwrite", byte_arrays=False):
1221
782
"""Decorators for marking methods of a DBusObjectWithProperties to
1222
783
become properties on the D-Bus.
1224
785
The decorated method will be called with no arguments by "Get"
1225
786
and with one argument by "Set".
1227
788
The parameters, where they are supported, are the same as
1228
789
dbus.service.method, except there is only "signature", since the
1229
790
type from Get() and the type sent to Set() is the same.
1312
class DBusObjectWithAnnotations(dbus.service.Object):
1313
"""A D-Bus object with annotations.
1315
Classes inheriting from this can use the dbus_annotations
1316
decorator to add annotations to methods or signals.
866
class DBusObjectWithProperties(dbus.service.Object):
867
"""A D-Bus object with properties.
869
Classes inheriting from this can use the dbus_service_property
870
decorator to expose methods as D-Bus properties. It exposes the
871
standard Get(), Set(), and GetAll() methods on the D-Bus.
1320
875
def _is_dbus_thing(thing):
1321
876
"""Returns a function testing if an attribute is a D-Bus thing
1323
878
If called like _is_dbus_thing("method") it returns a function
1324
879
suitable for use as predicate to inspect.getmembers().
1326
return lambda obj: getattr(obj, "_dbus_is_{}".format(thing),
881
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
1329
884
def _get_all_dbus_things(self, thing):
1330
885
"""Returns a generator of (name, attribute) pairs
1332
return ((getattr(athing.__get__(self), "_dbus_name", name),
887
return ((getattr(athing.__get__(self), "_dbus_name",
1333
889
athing.__get__(self))
1334
890
for cls in self.__class__.__mro__
1335
891
for name, athing in
1336
inspect.getmembers(cls, self._is_dbus_thing(thing)))
1338
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1340
path_keyword='object_path',
1341
connection_keyword='connection')
1342
def Introspect(self, object_path, connection):
1343
"""Overloading of standard D-Bus method.
1345
Inserts annotation tags on methods and signals.
1347
xmlstring = dbus.service.Object.Introspect(self, object_path,
1350
document = xml.dom.minidom.parseString(xmlstring)
1352
for if_tag in document.getElementsByTagName("interface"):
1353
# Add annotation tags
1354
for typ in ("method", "signal"):
1355
for tag in if_tag.getElementsByTagName(typ):
1357
for name, prop in (self.
1358
_get_all_dbus_things(typ)):
1359
if (name == tag.getAttribute("name")
1360
and prop._dbus_interface
1361
== if_tag.getAttribute("name")):
1362
annots.update(getattr(
1363
prop, "_dbus_annotations", {}))
1364
for name, value in annots.items():
1365
ann_tag = document.createElement(
1367
ann_tag.setAttribute("name", name)
1368
ann_tag.setAttribute("value", value)
1369
tag.appendChild(ann_tag)
1370
# Add interface annotation tags
1371
for annotation, value in dict(
1372
itertools.chain.from_iterable(
1373
annotations().items()
1374
for name, annotations
1375
in self._get_all_dbus_things("interface")
1376
if name == if_tag.getAttribute("name")
1378
ann_tag = document.createElement("annotation")
1379
ann_tag.setAttribute("name", annotation)
1380
ann_tag.setAttribute("value", value)
1381
if_tag.appendChild(ann_tag)
1382
# Fix argument name for the Introspect method itself
1383
if (if_tag.getAttribute("name")
1384
== dbus.INTROSPECTABLE_IFACE):
1385
for cn in if_tag.getElementsByTagName("method"):
1386
if cn.getAttribute("name") == "Introspect":
1387
for arg in cn.getElementsByTagName("arg"):
1388
if (arg.getAttribute("direction")
1390
arg.setAttribute("name",
1392
xmlstring = document.toxml("utf-8")
1394
except (AttributeError, xml.dom.DOMException,
1395
xml.parsers.expat.ExpatError) as error:
1396
logger.error("Failed to override Introspection method",
1401
class DBusObjectWithProperties(DBusObjectWithAnnotations):
1402
"""A D-Bus object with properties.
1404
Classes inheriting from this can use the dbus_service_property
1405
decorator to expose methods as D-Bus properties. It exposes the
1406
standard Get(), Set(), and GetAll() methods on the D-Bus.
892
inspect.getmembers(cls,
893
self._is_dbus_thing(thing)))
1409
895
def _get_dbus_property(self, interface_name, property_name):
1410
896
"""Returns a bound method if one exists which is a D-Bus
1411
897
property with the specified name and interface.
1413
for cls in self.__class__.__mro__:
1414
for name, value in inspect.getmembers(
1415
cls, self._is_dbus_thing("property")):
899
for cls in self.__class__.__mro__:
900
for name, value in (inspect.getmembers
902
self._is_dbus_thing("property"))):
1416
903
if (value._dbus_name == property_name
1417
904
and value._dbus_interface == interface_name):
1418
905
return value.__get__(self)
1420
907
# No such property
1421
raise DBusPropertyNotFound("{}:{}.{}".format(
1422
self.dbus_object_path, interface_name, property_name))
1425
def _get_all_interface_names(cls):
1426
"""Get a sequence of all interfaces supported by an object"""
1427
return (name for name in set(getattr(getattr(x, attr),
1428
"_dbus_interface", None)
1429
for x in (inspect.getmro(cls))
1431
if name is not None)
1433
@dbus.service.method(dbus.PROPERTIES_IFACE,
908
raise DBusPropertyNotFound(self.dbus_object_path + ":"
909
+ interface_name + "."
912
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
1435
913
out_signature="v")
1436
914
def Get(self, interface_name, property_name):
1437
915
"""Standard D-Bus property Get() method, see D-Bus standard.
1565
1045
return xmlstring
1569
dbus.OBJECT_MANAGER_IFACE
1570
except AttributeError:
1571
dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"
1574
class DBusObjectWithObjectManager(DBusObjectWithAnnotations):
1575
"""A D-Bus object with an ObjectManager.
1577
Classes inheriting from this exposes the standard
1578
GetManagedObjects call and the InterfacesAdded and
1579
InterfacesRemoved signals on the standard
1580
"org.freedesktop.DBus.ObjectManager" interface.
1582
Note: No signals are sent automatically; they must be sent
1585
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
1586
out_signature="a{oa{sa{sv}}}")
1587
def GetManagedObjects(self):
1588
"""This function must be overridden"""
1589
raise NotImplementedError()
1591
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,
1592
signature="oa{sa{sv}}")
1593
def InterfacesAdded(self, object_path, interfaces_and_properties):
1596
@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature="oas")
1597
def InterfacesRemoved(self, object_path, interfaces):
1600
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
1602
path_keyword='object_path',
1603
connection_keyword='connection')
1604
def Introspect(self, object_path, connection):
1605
"""Overloading of standard D-Bus method.
1607
Override return argument name of GetManagedObjects to be
1608
"objpath_interfaces_and_properties"
1610
xmlstring = DBusObjectWithAnnotations.Introspect(self,
1614
document = xml.dom.minidom.parseString(xmlstring)
1616
for if_tag in document.getElementsByTagName("interface"):
1617
# Fix argument name for the GetManagedObjects method
1618
if (if_tag.getAttribute("name")
1619
== dbus.OBJECT_MANAGER_IFACE):
1620
for cn in if_tag.getElementsByTagName("method"):
1621
if (cn.getAttribute("name")
1622
== "GetManagedObjects"):
1623
for arg in cn.getElementsByTagName("arg"):
1624
if (arg.getAttribute("direction")
1628
"objpath_interfaces"
1630
xmlstring = document.toxml("utf-8")
1632
except (AttributeError, xml.dom.DOMException,
1633
xml.parsers.expat.ExpatError) as error:
1634
logger.error("Failed to override Introspection method",
1639
1048
def datetime_to_dbus(dt, variant_level=0):
1640
1049
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1642
return dbus.String("", variant_level=variant_level)
1643
return dbus.String(dt.isoformat(), variant_level=variant_level)
1051
return dbus.String("", variant_level = variant_level)
1052
return dbus.String(dt.isoformat(),
1053
variant_level=variant_level)
1646
1056
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
2007
1409
server to mandos-client
2011
1413
# Rejected - signal
2012
1414
@dbus.service.signal(_interface, signature="s")
2013
1415
def Rejected(self, reason):
2017
1419
# NeedApproval - signal
2018
1420
@dbus.service.signal(_interface, signature="tb")
2019
1421
def NeedApproval(self, timeout, default):
2021
1423
return self.need_approval()
2025
1427
# Approve - method
2026
1428
@dbus.service.method(_interface, in_signature="b")
2027
1429
def Approve(self, value):
2028
1430
self.approve(value)
2030
1432
# CheckedOK - method
2031
1433
@dbus.service.method(_interface)
2032
1434
def CheckedOK(self):
2033
1435
self.checked_ok()
2035
1437
# Enable - method
2036
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2037
1438
@dbus.service.method(_interface)
2038
1439
def Enable(self):
2042
1443
# StartChecker - method
2043
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2044
1444
@dbus.service.method(_interface)
2045
1445
def StartChecker(self):
2047
1447
self.start_checker()
2049
1449
# Disable - method
2050
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2051
1450
@dbus.service.method(_interface)
2052
1451
def Disable(self):
2056
1455
# StopChecker - method
2057
@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})
2058
1456
@dbus.service.method(_interface)
2059
1457
def StopChecker(self):
2060
1458
self.stop_checker()
2064
1462
# ApprovalPending - property
2065
1463
@dbus_service_property(_interface, signature="b", access="read")
2066
1464
def ApprovalPending_dbus_property(self):
2067
1465
return dbus.Boolean(bool(self.approvals_pending))
2069
1467
# ApprovedByDefault - property
2070
@dbus_service_property(_interface,
1468
@dbus_service_property(_interface, signature="b",
2072
1469
access="readwrite")
2073
1470
def ApprovedByDefault_dbus_property(self, value=None):
2074
1471
if value is None: # get
2075
1472
return dbus.Boolean(self.approved_by_default)
2076
1473
self.approved_by_default = bool(value)
2078
1475
# ApprovalDelay - property
2079
@dbus_service_property(_interface,
1476
@dbus_service_property(_interface, signature="t",
2081
1477
access="readwrite")
2082
1478
def ApprovalDelay_dbus_property(self, value=None):
2083
1479
if value is None: # get
2084
return dbus.UInt64(self.approval_delay.total_seconds()
1480
return dbus.UInt64(self.approval_delay_milliseconds())
2086
1481
self.approval_delay = datetime.timedelta(0, 0, 0, value)
2088
1483
# ApprovalDuration - property
2089
@dbus_service_property(_interface,
1484
@dbus_service_property(_interface, signature="t",
2091
1485
access="readwrite")
2092
1486
def ApprovalDuration_dbus_property(self, value=None):
2093
1487
if value is None: # get
2094
return dbus.UInt64(self.approval_duration.total_seconds()
1488
return dbus.UInt64(timedelta_to_milliseconds(
1489
self.approval_duration))
2096
1490
self.approval_duration = datetime.timedelta(0, 0, 0, value)
2098
1492
# Name - property
2100
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2101
1493
@dbus_service_property(_interface, signature="s", access="read")
2102
1494
def Name_dbus_property(self):
2103
1495
return dbus.String(self.name)
2107
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2108
@dbus_service_property(_interface, signature="s", access="read")
2109
def KeyID_dbus_property(self):
2110
return dbus.String(self.key_id)
2112
1497
# Fingerprint - property
2114
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2115
1498
@dbus_service_property(_interface, signature="s", access="read")
2116
1499
def Fingerprint_dbus_property(self):
2117
1500
return dbus.String(self.fingerprint)
2119
1502
# Host - property
2120
@dbus_service_property(_interface,
1503
@dbus_service_property(_interface, signature="s",
2122
1504
access="readwrite")
2123
1505
def Host_dbus_property(self, value=None):
2124
1506
if value is None: # get
2125
1507
return dbus.String(self.host)
2126
self.host = str(value)
1508
self.host = unicode(value)
2128
1510
# Created - property
2130
{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})
2131
1511
@dbus_service_property(_interface, signature="s", access="read")
2132
1512
def Created_dbus_property(self):
2133
1513
return datetime_to_dbus(self.created)
2135
1515
# LastEnabled - property
2136
1516
@dbus_service_property(_interface, signature="s", access="read")
2137
1517
def LastEnabled_dbus_property(self):
2138
1518
return datetime_to_dbus(self.last_enabled)
2140
1520
# Enabled - property
2141
@dbus_service_property(_interface,
1521
@dbus_service_property(_interface, signature="b",
2143
1522
access="readwrite")
2144
1523
def Enabled_dbus_property(self, value=None):
2145
1524
if value is None: # get
2300
1664
class ClientHandler(socketserver.BaseRequestHandler, object):
2301
1665
"""A class to handle client connections.
2303
1667
Instantiated once for each connection to handle it.
2304
1668
Note: This will run in its own forked process."""
2306
1670
def handle(self):
2307
1671
with contextlib.closing(self.server.child_pipe) as child_pipe:
2308
1672
logger.info("TCP connection from: %s",
2309
str(self.client_address))
1673
unicode(self.client_address))
2310
1674
logger.debug("Pipe FD: %d",
2311
1675
self.server.child_pipe.fileno())
2313
session = gnutls.ClientSession(self.request)
2315
# priority = ':'.join(("NONE", "+VERS-TLS1.1",
2316
# "+AES-256-CBC", "+SHA1",
2317
# "+COMP-NULL", "+CTYPE-OPENPGP",
1677
session = (gnutls.connection
1678
.ClientSession(self.request,
1680
.X509Credentials()))
1682
# Note: gnutls.connection.X509Credentials is really a
1683
# generic GnuTLS certificate credentials object so long as
1684
# no X.509 keys are added to it. Therefore, we can use it
1685
# here despite using OpenPGP certificates.
1687
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1688
# "+AES-256-CBC", "+SHA1",
1689
# "+COMP-NULL", "+CTYPE-OPENPGP",
2319
1691
# Use a fallback default, since this MUST be set.
2320
1692
priority = self.server.gnutls_priority
2321
1693
if priority is None:
2322
1694
priority = "NORMAL"
2323
gnutls.priority_set_direct(session,
2324
priority.encode("utf-8"), None)
1695
(gnutls.library.functions
1696
.gnutls_priority_set_direct(session._c_object,
2326
1699
# Start communication using the Mandos protocol
2327
1700
# Get protocol number
2328
1701
line = self.request.makefile().readline()
2329
1702
logger.debug("Protocol version: %r", line)
2331
1704
if int(line.strip().split()[0]) > 1:
2332
raise RuntimeError(line)
2333
1706
except (ValueError, IndexError, RuntimeError) as error:
2334
1707
logger.error("Unknown protocol version: %s", error)
2337
1710
# Start GnuTLS connection
2339
1712
session.handshake()
2340
except gnutls.Error as error:
1713
except gnutls.errors.GNUTLSError as error:
2341
1714
logger.warning("Handshake failed: %s", error)
2342
1715
# Do not run session.bye() here: the session is not
2343
1716
# established. Just abandon the request.
2345
1718
logger.debug("Handshake succeeded")
2347
1720
approval_required = False
2349
if gnutls.has_rawpk:
2352
key_id = self.key_id(
2353
self.peer_certificate(session))
2354
except (TypeError, gnutls.Error) as error:
2355
logger.warning("Bad certificate: %s", error)
2357
logger.debug("Key ID: %s",
2358
key_id.decode("utf-8",
2364
fpr = self.fingerprint(
2365
self.peer_certificate(session))
2366
except (TypeError, gnutls.Error) as error:
2367
logger.warning("Bad certificate: %s", error)
2369
logger.debug("Fingerprint: %s", fpr)
2372
client = ProxyClient(child_pipe, key_id, fpr,
1723
fpr = self.fingerprint(self.peer_certificate
1726
gnutls.errors.GNUTLSError) as error:
1727
logger.warning("Bad certificate: %s", error)
1729
logger.debug("Fingerprint: %s", fpr)
1732
client = ProxyClient(child_pipe, fpr,
2373
1733
self.client_address)
2374
1734
except KeyError:
2377
1737
if client.approval_delay:
2378
1738
delay = client.approval_delay
2379
1739
client.approvals_pending += 1
2380
1740
approval_required = True
2383
1743
if not client.enabled:
2384
1744
logger.info("Client %s is disabled",
2386
1746
if self.server.use_dbus:
2387
1747
# Emit D-Bus signal
2388
1748
client.Rejected("Disabled")
2391
1751
if client.approved or not client.approval_delay:
2392
# We are approved or approval is disabled
1752
#We are approved or approval is disabled
2394
1754
elif client.approved is None:
2395
1755
logger.info("Client %s needs approval",
2428
1790
delay -= time2 - time
2431
session.send(client.secret)
2432
except gnutls.Error as error:
2433
logger.warning("gnutls send failed",
1793
while sent_size < len(client.secret):
1795
sent = session.send(client.secret[sent_size:])
1796
except gnutls.errors.GNUTLSError as error:
1797
logger.warning("gnutls send failed",
1800
logger.debug("Sent: %d, remaining: %d",
1801
sent, len(client.secret)
1802
- (sent_size + sent))
2437
1805
logger.info("Sending secret to %s", client.name)
2438
1806
# bump the timeout using extended_timeout
2439
1807
client.bump_timeout(client.extended_timeout)
2440
1808
if self.server.use_dbus:
2441
1809
# Emit D-Bus signal
2442
1810
client.GotSecret()
2445
1813
if approval_required:
2446
1814
client.approvals_pending -= 1
2449
except gnutls.Error as error:
1817
except gnutls.errors.GNUTLSError as error:
2450
1818
logger.warning("GnuTLS bye failed",
2451
1819
exc_info=error)
2454
1822
def peer_certificate(session):
2455
"Return the peer's certificate as a bytestring"
2457
cert_type = gnutls.certificate_type_get2(
2458
session, gnutls.CTYPE_PEERS)
2459
except AttributeError:
2460
cert_type = gnutls.certificate_type_get(session)
2461
if gnutls.has_rawpk:
2462
valid_cert_types = frozenset((gnutls.CRT_RAWPK,))
2464
valid_cert_types = frozenset((gnutls.CRT_OPENPGP,))
2465
# If not a valid certificate type...
2466
if cert_type not in valid_cert_types:
2467
logger.info("Cert type %r not in %r", cert_type,
2469
# ...return invalid data
1823
"Return the peer's OpenPGP certificate as a bytestring"
1824
# If not an OpenPGP certificate...
1825
if (gnutls.library.functions
1826
.gnutls_certificate_type_get(session._c_object)
1827
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1828
# ...do the normal thing
1829
return session.peer_certificate
2471
1830
list_size = ctypes.c_uint(1)
2472
cert_list = (gnutls.certificate_get_peers
2473
(session, ctypes.byref(list_size)))
1831
cert_list = (gnutls.library.functions
1832
.gnutls_certificate_get_peers
1833
(session._c_object, ctypes.byref(list_size)))
2474
1834
if not bool(cert_list) and list_size.value != 0:
2475
raise gnutls.Error("error getting peer certificate")
1835
raise gnutls.errors.GNUTLSError("error getting peer"
2476
1837
if list_size.value == 0:
2478
1839
cert = cert_list[0]
2479
1840
return ctypes.string_at(cert.data, cert.size)
2482
def key_id(certificate):
2483
"Convert a certificate bytestring to a hexdigit key ID"
2484
# New GnuTLS "datum" with the public key
2485
datum = gnutls.datum_t(
2486
ctypes.cast(ctypes.c_char_p(certificate),
2487
ctypes.POINTER(ctypes.c_ubyte)),
2488
ctypes.c_uint(len(certificate)))
2489
# XXX all these need to be created in the gnutls "module"
2490
# New empty GnuTLS certificate
2491
pubkey = gnutls.pubkey_t()
2492
gnutls.pubkey_init(ctypes.byref(pubkey))
2493
# Import the raw public key into the certificate
2494
gnutls.pubkey_import(pubkey,
2495
ctypes.byref(datum),
2496
gnutls.X509_FMT_DER)
2497
# New buffer for the key ID
2498
buf = ctypes.create_string_buffer(32)
2499
buf_len = ctypes.c_size_t(len(buf))
2500
# Get the key ID from the raw public key into the buffer
2501
gnutls.pubkey_get_key_id(
2503
gnutls.KEYID_USE_SHA256,
2504
ctypes.cast(ctypes.byref(buf),
2505
ctypes.POINTER(ctypes.c_ubyte)),
2506
ctypes.byref(buf_len))
2507
# Deinit the certificate
2508
gnutls.pubkey_deinit(pubkey)
2510
# Convert the buffer to a Python bytestring
2511
key_id = ctypes.string_at(buf, buf_len.value)
2512
# Convert the bytestring to hexadecimal notation
2513
hex_key_id = binascii.hexlify(key_id).upper()
2517
1843
def fingerprint(openpgp):
2518
1844
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
2519
1845
# New GnuTLS "datum" with the OpenPGP public key
2520
datum = gnutls.datum_t(
2521
ctypes.cast(ctypes.c_char_p(openpgp),
2522
ctypes.POINTER(ctypes.c_ubyte)),
2523
ctypes.c_uint(len(openpgp)))
1846
datum = (gnutls.library.types
1847
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1850
ctypes.c_uint(len(openpgp))))
2524
1851
# New empty GnuTLS certificate
2525
crt = gnutls.openpgp_crt_t()
2526
gnutls.openpgp_crt_init(ctypes.byref(crt))
1852
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1853
(gnutls.library.functions
1854
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
2527
1855
# Import the OpenPGP public key into the certificate
2528
gnutls.openpgp_crt_import(crt, ctypes.byref(datum),
2529
gnutls.OPENPGP_FMT_RAW)
1856
(gnutls.library.functions
1857
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1858
gnutls.library.constants
1859
.GNUTLS_OPENPGP_FMT_RAW))
2530
1860
# Verify the self signature in the key
2531
1861
crtverify = ctypes.c_uint()
2532
gnutls.openpgp_crt_verify_self(crt, 0,
2533
ctypes.byref(crtverify))
1862
(gnutls.library.functions
1863
.gnutls_openpgp_crt_verify_self(crt, 0,
1864
ctypes.byref(crtverify)))
2534
1865
if crtverify.value != 0:
2535
gnutls.openpgp_crt_deinit(crt)
2536
raise gnutls.CertificateSecurityError(code
1866
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1867
raise (gnutls.errors.CertificateSecurityError
2538
1869
# New buffer for the fingerprint
2539
1870
buf = ctypes.create_string_buffer(20)
2540
1871
buf_len = ctypes.c_size_t()
2541
1872
# Get the fingerprint from the certificate into the buffer
2542
gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
2543
ctypes.byref(buf_len))
1873
(gnutls.library.functions
1874
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1875
ctypes.byref(buf_len)))
2544
1876
# Deinit the certificate
2545
gnutls.openpgp_crt_deinit(crt)
1877
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
2546
1878
# Convert the buffer to a Python bytestring
2547
1879
fpr = ctypes.string_at(buf, buf_len.value)
2548
1880
# Convert the bytestring to hexadecimal notation
2637
1963
# socket_wrapper(), if socketfd was set.
2638
1964
socketserver.TCPServer.__init__(self, server_address,
2639
1965
RequestHandlerClass)
2641
1967
def server_bind(self):
2642
1968
"""This overrides the normal server_bind() function
2643
1969
to bind to an interface if one was specified, and also NOT to
2644
1970
bind to an address or port if they were not specified."""
2645
global SO_BINDTODEVICE
2646
1971
if self.interface is not None:
2647
1972
if SO_BINDTODEVICE is None:
2648
# Fall back to a hard-coded value which seems to be
2650
logger.warning("SO_BINDTODEVICE not found, trying 25")
2651
SO_BINDTODEVICE = 25
2653
self.socket.setsockopt(
2654
socket.SOL_SOCKET, SO_BINDTODEVICE,
2655
(self.interface + "\0").encode("utf-8"))
2656
except socket.error as error:
2657
if error.errno == errno.EPERM:
2658
logger.error("No permission to bind to"
2659
" interface %s", self.interface)
2660
elif error.errno == errno.ENOPROTOOPT:
2661
logger.error("SO_BINDTODEVICE not available;"
2662
" cannot bind to interface %s",
2664
elif error.errno == errno.ENODEV:
2665
logger.error("Interface %s does not exist,"
2666
" cannot bind", self.interface)
1973
logger.error("SO_BINDTODEVICE does not exist;"
1974
" cannot bind to interface %s",
1978
self.socket.setsockopt(socket.SOL_SOCKET,
1980
str(self.interface + '\0'))
1981
except socket.error as error:
1982
if error.errno == errno.EPERM:
1983
logger.error("No permission to bind to"
1984
" interface %s", self.interface)
1985
elif error.errno == errno.ENOPROTOOPT:
1986
logger.error("SO_BINDTODEVICE not available;"
1987
" cannot bind to interface %s",
1989
elif error.errno == errno.ENODEV:
1990
logger.error("Interface %s does not exist,"
1991
" cannot bind", self.interface)
2669
1994
# Only bind(2) the socket if we really need to.
2670
1995
if self.server_address[0] or self.server_address[1]:
2671
if self.server_address[1]:
2672
self.allow_reuse_address = True
2673
1996
if not self.server_address[0]:
2674
1997
if self.address_family == socket.AF_INET6:
2675
any_address = "::" # in6addr_any
1998
any_address = "::" # in6addr_any
2677
any_address = "0.0.0.0" # INADDR_ANY
2000
any_address = "0.0.0.0" # INADDR_ANY
2678
2001
self.server_address = (any_address,
2679
2002
self.server_address[1])
2680
2003
elif not self.server_address[1]:
2681
self.server_address = (self.server_address[0], 0)
2004
self.server_address = (self.server_address[0],
2682
2006
# if self.interface:
2683
2007
# self.server_address = (self.server_address[0],
2714
2033
self.gnutls_priority = gnutls_priority
2715
2034
IPv6_TCPServer.__init__(self, server_address,
2716
2035
RequestHandlerClass,
2717
interface=interface,
2036
interface = interface,
2037
use_ipv6 = use_ipv6,
2038
socketfd = socketfd)
2721
2039
def server_activate(self):
2722
2040
if self.enabled:
2723
2041
return socketserver.TCPServer.server_activate(self)
2725
2043
def enable(self):
2726
2044
self.enabled = True
2728
2046
def add_pipe(self, parent_pipe, proc):
2729
2047
# Call "handle_ipc" for both data and EOF events
2731
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2732
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2733
functools.partial(self.handle_ipc,
2734
parent_pipe=parent_pipe,
2737
def handle_ipc(self, source, condition,
2740
client_object=None):
2048
gobject.io_add_watch(parent_pipe.fileno(),
2049
gobject.IO_IN | gobject.IO_HUP,
2050
functools.partial(self.handle_ipc,
2055
def handle_ipc(self, source, condition, parent_pipe=None,
2056
proc = None, client_object=None):
2741
2057
# error, or the other end of multiprocessing.Pipe has closed
2742
if condition & (GLib.IO_ERR | GLib.IO_HUP):
2058
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2743
2059
# Wait for other process to exit
2747
2063
# Read a request from the child
2748
2064
request = parent_pipe.recv()
2749
2065
command = request[0]
2751
2067
if command == 'init':
2752
key_id = request[1].decode("ascii")
2753
fpr = request[2].decode("ascii")
2754
address = request[3]
2756
for c in self.clients.values():
2757
if key_id == ("E3B0C44298FC1C149AFBF4C8996FB924"
2758
"27AE41E4649B934CA495991B7852B855"):
2760
if key_id and c.key_id == key_id:
2763
if fpr and c.fingerprint == fpr:
2069
address = request[2]
2071
for c in self.clients.itervalues():
2072
if c.fingerprint == fpr:
2767
logger.info("Client not found for key ID: %s, address"
2768
": %s", key_id or fpr, address)
2076
logger.info("Client not found for fingerprint: %s, ad"
2077
"dress: %s", fpr, address)
2769
2078
if self.use_dbus:
2770
2079
# Emit D-Bus signal
2771
mandos_dbus_service.ClientNotFound(key_id or fpr,
2080
mandos_dbus_service.ClientNotFound(fpr,
2773
2082
parent_pipe.send(False)
2777
GLib.IOChannel.unix_new(parent_pipe.fileno()),
2778
GLib.PRIORITY_DEFAULT, GLib.IO_IN | GLib.IO_HUP,
2779
functools.partial(self.handle_ipc,
2780
parent_pipe=parent_pipe,
2782
client_object=client))
2085
gobject.io_add_watch(parent_pipe.fileno(),
2086
gobject.IO_IN | gobject.IO_HUP,
2087
functools.partial(self.handle_ipc,
2783
2093
parent_pipe.send(True)
2784
2094
# remove the old hook in favor of the new above hook on
2788
2098
funcname = request[1]
2789
2099
args = request[2]
2790
2100
kwargs = request[3]
2792
2102
parent_pipe.send(('data', getattr(client_object,
2793
2103
funcname)(*args,
2796
2106
if command == 'getattr':
2797
2107
attrname = request[1]
2798
if isinstance(client_object.__getattribute__(attrname),
2799
collections.abc.Callable):
2800
parent_pipe.send(('function', ))
2108
if callable(client_object.__getattribute__(attrname)):
2109
parent_pipe.send(('function',))
2803
'data', client_object.__getattribute__(attrname)))
2111
parent_pipe.send(('data', client_object
2112
.__getattribute__(attrname)))
2805
2114
if command == 'setattr':
2806
2115
attrname = request[1]
2807
2116
value = request[2]
2808
2117
setattr(client_object, attrname, value)
2813
2122
def rfc3339_duration_to_delta(duration):
2814
2123
"""Parse an RFC 3339 "duration" and return a datetime.timedelta
2816
>>> timedelta = datetime.timedelta
2817
>>> rfc3339_duration_to_delta("P7D") == timedelta(7)
2819
>>> rfc3339_duration_to_delta("PT60S") == timedelta(0, 60)
2821
>>> rfc3339_duration_to_delta("PT60M") == timedelta(0, 3600)
2823
>>> rfc3339_duration_to_delta("PT24H") == timedelta(1)
2825
>>> rfc3339_duration_to_delta("P1W") == timedelta(7)
2827
>>> rfc3339_duration_to_delta("PT5M30S") == timedelta(0, 330)
2829
>>> rfc3339_duration_to_delta("P1DT3M20S") == timedelta(1, 200)
2125
>>> rfc3339_duration_to_delta("P7D")
2126
datetime.timedelta(7)
2127
>>> rfc3339_duration_to_delta("PT60S")
2128
datetime.timedelta(0, 60)
2129
>>> rfc3339_duration_to_delta("PT60M")
2130
datetime.timedelta(0, 3600)
2131
>>> rfc3339_duration_to_delta("PT24H")
2132
datetime.timedelta(1)
2133
>>> rfc3339_duration_to_delta("P1W")
2134
datetime.timedelta(7)
2135
>>> rfc3339_duration_to_delta("PT5M30S")
2136
datetime.timedelta(0, 330)
2137
>>> rfc3339_duration_to_delta("P1DT3M20S")
2138
datetime.timedelta(1, 200)
2834
2141
# Parsing an RFC 3339 duration with regular expressions is not
2835
2142
# possible - there would have to be multiple places for the same
2836
2143
# values, like seconds. The current code, while more esoteric, is
2837
2144
# cleaner without depending on a parsing library. If Python had a
2838
2145
# built-in library for parsing we would use it, but we'd like to
2839
2146
# avoid excessive use of external libraries.
2841
2148
# New type for defining tokens, syntax, and semantics all-in-one
2842
Token = collections.namedtuple("Token", (
2843
"regexp", # To match token; if "value" is not None, must have
2844
# a "group" containing digits
2845
"value", # datetime.timedelta or None
2846
"followers")) # Tokens valid after this token
2149
Token = collections.namedtuple("Token",
2150
("regexp", # To match token; if
2151
# "value" is not None,
2152
# must have a "group"
2154
"value", # datetime.timedelta or
2156
"followers")) # Tokens valid after
2847
2158
# RFC 3339 "duration" tokens, syntax, and semantics; taken from
2848
2159
# the "duration" ABNF definition in RFC 3339, Appendix A.
2849
2160
token_end = Token(re.compile(r"$"), None, frozenset())
2850
2161
token_second = Token(re.compile(r"(\d+)S"),
2851
2162
datetime.timedelta(seconds=1),
2852
frozenset((token_end, )))
2163
frozenset((token_end,)))
2853
2164
token_minute = Token(re.compile(r"(\d+)M"),
2854
2165
datetime.timedelta(minutes=1),
2855
2166
frozenset((token_second, token_end)))
3187
logger.debug("Did setuid/setgid to {}:{}".format(uid,
3189
2480
except OSError as error:
3190
logger.warning("Failed to setuid/setgid to {}:{}: {}"
3191
.format(uid, gid, os.strerror(error.errno)))
3192
2481
if error.errno != errno.EPERM:
3196
2485
# Enable all possible GnuTLS debugging
3198
2487
# "Use a log level over 10 to enable all debugging options."
3199
2488
# - GnuTLS manual
3200
gnutls.global_set_log_level(11)
2489
gnutls.library.functions.gnutls_global_set_log_level(11)
2491
@gnutls.library.types.gnutls_log_func
3203
2492
def debug_gnutls(level, string):
3204
logger.debug("GnuTLS: %s",
3205
string[:-1].decode("utf-8",
3208
gnutls.global_set_log_function(debug_gnutls)
2493
logger.debug("GnuTLS: %s", string[:-1])
2495
(gnutls.library.functions
2496
.gnutls_global_set_log_function(debug_gnutls))
3210
2498
# Redirect stdin so all checkers get /dev/null
3211
2499
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
3212
2500
os.dup2(null, sys.stdin.fileno())
3216
2504
# Need to fork before connecting to D-Bus
3217
2505
if not foreground:
3218
2506
# Close all input and output, do double fork, etc.
3221
if gi.version_info < (3, 10, 2):
3222
# multiprocessing will use threads, so before we use GLib we
3223
# need to inform GLib that threads will be used.
2509
# multiprocessing will use threads, so before we use gobject we
2510
# need to inform gobject that threads will be used.
2511
gobject.threads_init()
3226
2513
global main_loop
3227
2514
# From the Avahi example code
3228
2515
DBusGMainLoop(set_as_default=True)
3229
main_loop = GLib.MainLoop()
2516
main_loop = gobject.MainLoop()
3230
2517
bus = dbus.SystemBus()
3231
2518
# End of Avahi example code
3234
2521
bus_name = dbus.service.BusName("se.recompile.Mandos",
3237
old_bus_name = dbus.service.BusName(
3238
"se.bsnet.fukt.Mandos", bus,
3240
except dbus.exceptions.DBusException as e:
2522
bus, do_not_queue=True)
2523
old_bus_name = (dbus.service.BusName
2524
("se.bsnet.fukt.Mandos", bus,
2526
except dbus.exceptions.NameExistsException as e:
3241
2527
logger.error("Disabling D-Bus:", exc_info=e)
3242
2528
use_dbus = False
3243
2529
server_settings["use_dbus"] = False
3244
2530
tcp_server.use_dbus = False
3246
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
3247
service = AvahiServiceToSyslog(
3248
name=server_settings["servicename"],
3249
servicetype="_mandos._tcp",
3252
if server_settings["interface"]:
3253
service.interface = if_nametoindex(
3254
server_settings["interface"].encode("utf-8"))
2531
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2532
service = AvahiServiceToSyslog(name =
2533
server_settings["servicename"],
2534
servicetype = "_mandos._tcp",
2535
protocol = protocol, bus = bus)
2536
if server_settings["interface"]:
2537
service.interface = (if_nametoindex
2538
(str(server_settings["interface"])))
3256
2540
global multiprocessing_manager
3257
2541
multiprocessing_manager = multiprocessing.Manager()
3259
2543
client_class = Client
3261
client_class = functools.partial(ClientDBus, bus=bus)
2545
client_class = functools.partial(ClientDBus, bus = bus)
3263
2547
client_settings = Client.config_parser(client_config)
3264
2548
old_client_settings = {}
3265
2549
clients_data = {}
3267
2551
# This is used to redirect stdout and stderr for checker processes
3269
wnull = open(os.devnull, "w") # A writable /dev/null
2553
wnull = open(os.devnull, "w") # A writable /dev/null
3270
2554
# Only used if server is running in foreground but not in debug
3272
2556
if debug or not foreground:
3275
2559
# Get client data and settings from last running state.
3276
2560
if server_settings["restore"]:
3278
2562
with open(stored_state_path, "rb") as stored_state:
3279
if sys.version_info.major == 2:
3280
clients_data, old_client_settings = pickle.load(
3283
bytes_clients_data, bytes_old_client_settings = (
3284
pickle.load(stored_state, encoding="bytes"))
3285
# Fix bytes to strings
3288
clients_data = {(key.decode("utf-8")
3289
if isinstance(key, bytes)
3292
bytes_clients_data.items()}
3293
del bytes_clients_data
3294
for key in clients_data:
3295
value = {(k.decode("utf-8")
3296
if isinstance(k, bytes) else k): v
3298
clients_data[key].items()}
3299
clients_data[key] = value
3301
value["client_structure"] = [
3303
if isinstance(s, bytes)
3305
value["client_structure"]]
3306
# .name, .host, and .checker_command
3307
for k in ("name", "host", "checker_command"):
3308
if isinstance(value[k], bytes):
3309
value[k] = value[k].decode("utf-8")
3310
if "key_id" not in value:
3311
value["key_id"] = ""
3312
elif "fingerprint" not in value:
3313
value["fingerprint"] = ""
3314
# old_client_settings
3316
old_client_settings = {
3317
(key.decode("utf-8")
3318
if isinstance(key, bytes)
3321
bytes_old_client_settings.items()}
3322
del bytes_old_client_settings
3323
# .host and .checker_command
3324
for value in old_client_settings.values():
3325
for attribute in ("host", "checker_command"):
3326
if isinstance(value[attribute], bytes):
3327
value[attribute] = (value[attribute]
2563
clients_data, old_client_settings = (pickle.load
3329
2565
os.remove(stored_state_path)
3330
2566
except IOError as e:
3331
2567
if e.errno == errno.ENOENT:
3332
logger.warning("Could not load persistent state:"
3333
" {}".format(os.strerror(e.errno)))
2568
logger.warning("Could not load persistent state: {0}"
2569
.format(os.strerror(e.errno)))
3335
2571
logger.critical("Could not load persistent state:",
3338
2574
except EOFError as e:
3339
2575
logger.warning("Could not load persistent state: "
2576
"EOFError:", exc_info=e)
3343
2578
with PGPEngine() as pgp:
3344
for client_name, client in clients_data.items():
2579
for client_name, client in clients_data.iteritems():
3345
2580
# Skip removed clients
3346
2581
if client_name not in client_settings:
3349
2584
# Decide which value to use after restoring saved state.
3350
2585
# We have three different values: Old config file,
3351
2586
# new config file, and saved state.
3409
2644
for client_name in (set(client_settings)
3410
2645
- set(old_client_settings)):
3411
2646
clients_data[client_name] = client_settings[client_name]
3413
2648
# Create all client objects
3414
for client_name, client in clients_data.items():
2649
for client_name, client in clients_data.iteritems():
3415
2650
tcp_server.clients[client_name] = client_class(
3418
server_settings=server_settings)
2651
name = client_name, settings = client,
2652
server_settings = server_settings)
3420
2654
if not tcp_server.clients:
3421
2655
logger.warning("No clients defined")
3423
2657
if not foreground:
3424
2658
if pidfile is not None:
3428
print(pid, file=pidfile)
2662
pidfile.write(str(pid) + "\n".encode("utf-8"))
3429
2663
except IOError:
3430
2664
logger.error("Could not write to file %r with PID %d",
3431
2665
pidfilename, pid)
3433
2667
del pidfilename
3435
for termsig in (signal.SIGHUP, signal.SIGTERM):
3436
GLib.unix_signal_add(GLib.PRIORITY_HIGH, termsig,
3437
lambda: main_loop.quit() and False)
2669
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2670
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
3441
@alternate_dbus_interfaces(
3442
{"se.recompile.Mandos": "se.bsnet.fukt.Mandos"})
3443
class MandosDBusService(DBusObjectWithObjectManager):
2673
@alternate_dbus_interfaces({"se.recompile.Mandos":
2674
"se.bsnet.fukt.Mandos"})
2675
class MandosDBusService(DBusObjectWithProperties):
3444
2676
"""A D-Bus proxy object"""
3446
2677
def __init__(self):
3447
2678
dbus.service.Object.__init__(self, bus, "/")
3449
2679
_interface = "se.recompile.Mandos"
2681
@dbus_interface_annotations(_interface)
2683
return { "org.freedesktop.DBus.Property"
2684
".EmitsChangedSignal":
3451
2687
@dbus.service.signal(_interface, signature="o")
3452
2688
def ClientAdded(self, objpath):
3456
2692
@dbus.service.signal(_interface, signature="ss")
3457
def ClientNotFound(self, key_id, address):
2693
def ClientNotFound(self, fingerprint, address):
3461
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3463
2697
@dbus.service.signal(_interface, signature="os")
3464
2698
def ClientRemoved(self, objpath, name):
3468
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
3470
2702
@dbus.service.method(_interface, out_signature="ao")
3471
2703
def GetAllClients(self):
3473
return dbus.Array(c.dbus_object_path for c in
3474
tcp_server.clients.values())
3476
@dbus_annotations({"org.freedesktop.DBus.Deprecated":
2705
return dbus.Array(c.dbus_object_path
2707
tcp_server.clients.itervalues())
3478
2709
@dbus.service.method(_interface,
3479
2710
out_signature="a{oa{sv}}")
3480
2711
def GetAllClientsWithProperties(self):
3482
2713
return dbus.Dictionary(
3483
{c.dbus_object_path: c.GetAll(
3484
"se.recompile.Mandos.Client")
3485
for c in tcp_server.clients.values()},
2714
((c.dbus_object_path, c.GetAll(""))
2715
for c in tcp_server.clients.itervalues()),
3486
2716
signature="oa{sv}")
3488
2718
@dbus.service.method(_interface, in_signature="o")
3489
2719
def RemoveClient(self, object_path):
3491
for c in tcp_server.clients.values():
2721
for c in tcp_server.clients.itervalues():
3492
2722
if c.dbus_object_path == object_path:
3493
2723
del tcp_server.clients[c.name]
3494
2724
c.remove_from_connection()
3495
# Don't signal the disabling
2725
# Don't signal anything except ClientRemoved
3496
2726
c.disable(quiet=True)
3497
# Emit D-Bus signal for removal
3498
self.client_removed_signal(c)
2728
self.ClientRemoved(object_path, c.name)
3500
2730
raise KeyError(object_path)
3504
@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,
3505
out_signature="a{oa{sa{sv}}}")
3506
def GetManagedObjects(self):
3508
return dbus.Dictionary(
3509
{client.dbus_object_path:
3511
{interface: client.GetAll(interface)
3513
client._get_all_interface_names()})
3514
for client in tcp_server.clients.values()})
3516
def client_added_signal(self, client):
3517
"""Send the new standard signal and the old signal"""
3519
# New standard signal
3520
self.InterfacesAdded(
3521
client.dbus_object_path,
3523
{interface: client.GetAll(interface)
3525
client._get_all_interface_names()}))
3527
self.ClientAdded(client.dbus_object_path)
3529
def client_removed_signal(self, client):
3530
"""Send the new standard signal and the old signal"""
3532
# New standard signal
3533
self.InterfacesRemoved(
3534
client.dbus_object_path,
3535
client._get_all_interface_names())
3537
self.ClientRemoved(client.dbus_object_path,
3540
2734
mandos_dbus_service = MandosDBusService()
3542
# Save modules to variables to exempt the modules from being
3543
# unloaded before the function registered with atexit() is run.
3544
mp = multiprocessing
3548
2737
"Cleanup function; run on exit"
3552
mp.active_children()
2740
multiprocessing.active_children()
3554
2742
if not (tcp_server.clients or client_settings):
3557
2745
# Store client before exiting. Secrets are encrypted with key
3558
2746
# based on what config file has. If config file is
3559
2747
# removed/edited, old secret will thus be unrecovable.
3561
2749
with PGPEngine() as pgp:
3562
for client in tcp_server.clients.values():
2750
for client in tcp_server.clients.itervalues():
3563
2751
key = client_settings[client.name]["secret"]
3564
2752
client.encrypted_secret = pgp.encrypt(client.secret,
3566
2754
client_dict = {}
3568
2756
# A list of attributes that can not be pickled
3570
exclude = {"bus", "changedstate", "secret",
3571
"checker", "server_settings"}
3572
for name, typ in inspect.getmembers(dbus.service
2758
exclude = set(("bus", "changedstate", "secret",
2759
"checker", "server_settings"))
2760
for name, typ in (inspect.getmembers
2761
(dbus.service.Object)):
3574
2762
exclude.add(name)
3576
2764
client_dict["encrypted_secret"] = (client
3577
2765
.encrypted_secret)
3578
2766
for attr in client.client_structure:
3579
2767
if attr not in exclude:
3580
2768
client_dict[attr] = getattr(client, attr)
3582
2770
clients[client.name] = client_dict
3583
2771
del client_settings[client.name]["secret"]
3586
with tempfile.NamedTemporaryFile(
3590
dir=os.path.dirname(stored_state_path),
3591
delete=False) as stored_state:
3592
pickle.dump((clients, client_settings), stored_state,
3594
tempname = stored_state.name
2774
with (tempfile.NamedTemporaryFile
2775
(mode='wb', suffix=".pickle", prefix='clients-',
2776
dir=os.path.dirname(stored_state_path),
2777
delete=False)) as stored_state:
2778
pickle.dump((clients, client_settings), stored_state)
2779
tempname=stored_state.name
3595
2780
os.rename(tempname, stored_state_path)
3596
2781
except (IOError, OSError) as e: