/mandos/trunk : revision 729

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

39

import SocketServer as socketserver

43

40

import socket

44

41

import argparse

45

42

import datetime

50

47

import gnutls.library.functions

51

48

import gnutls.library.constants

52

49

import gnutls.library.types

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

50

import ConfigParser as configparser

57

51

import sys

58

52

import re

59

53

import os

68

62

import struct

69

63

import fcntl

70

64

import functools

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

65

import cPickle as pickle

75

66

import multiprocessing

76

67

import types

77

68

import binascii

78

69

import tempfile

79

70

import itertools

80

71

import collections

81

import codecs

82

72

83

73

import dbus

84

74

import dbus.service

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

75

import gobject

89

76

import avahi

90

77

from dbus.mainloop.glib import DBusGMainLoop

91

78

import ctypes

101

88

except ImportError:

102

89

SO_BINDTODEVICE = None

103

90

104

if sys.version_info.major == 2:

105

str = unicode

106

107

version = "1.6.9"

91

version = "1.6.8"

108

92

stored_state_file = "clients.pickle"

109

93

110

94

logger = logging.getLogger()

111

95

syslogger = None

112

96

113

97

try:

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

116

101

except (OSError, AttributeError):

117

118

102

def if_nametoindex(interface):

119

103

"Get an interface index the hard way, i.e. using fcntl()"

120

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

129

113

"""init logger and add loglevel"""

130

114

131

115

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

116

syslogger = (logging.handlers.SysLogHandler

117

(facility =

118

logging.handlers.SysLogHandler.LOG_DAEMON,

119

address = "/dev/log"))

135

120

syslogger.setFormatter(logging.Formatter

136

121

('Mandos [%(process)d]: %(levelname)s:'

137

122

' %(message)s'))

154

139

155

140

class PGPEngine(object):

156

141

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

158

142

def __init__(self):

159

143

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

160

144

self.gnupgargs = ['--batch',

199

183

200

184

def encrypt(self, data, password):

201

185

passphrase = self.password_encode(password)

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

186

with tempfile.NamedTemporaryFile(dir=self.tempdir

187

) as passfile:

204

188

passfile.write(passphrase)

205

189

passfile.flush()

206

190

proc = subprocess.Popen(['gpg', '--symmetric',

217

201

218

202

def decrypt(self, data, password):

219

203

passphrase = self.password_encode(password)

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

204

with tempfile.NamedTemporaryFile(dir = self.tempdir

205

) as passfile:

222

206

passfile.write(passphrase)

223

207

passfile.flush()

224

208

proc = subprocess.Popen(['gpg', '--decrypt',

228

212

stdin = subprocess.PIPE,

229

213

stdout = subprocess.PIPE,

230

214

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

215

decrypted_plaintext, err = proc.communicate(input

216

= data)

232

217

if proc.returncode != 0:

233

218

raise PGPError(err)

234

219

return decrypted_plaintext

240

225

return super(AvahiError, self).__init__(value, *args,

241

226

**kwargs)

242

227

243

244

228

class AvahiServiceError(AvahiError):

245

229

pass

246

230

247

248

231

class AvahiGroupError(AvahiError):

249

232

pass

250

233

270

253

bus: dbus.SystemBus()

271

254

"""

272

255

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

256

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

257

servicetype = None, port = None, TXT = None,

258

domain = "", host = "", max_renames = 32768,

259

protocol = avahi.PROTO_UNSPEC, bus = None):

284

260

self.interface = interface

285

261

self.name = name

286

262

self.type = servicetype

296

272

self.bus = bus

297

273

self.entry_group_state_changed_match = None

298

274

299

def rename(self, remove=True):

275

def rename(self):

300

276

"""Derived from the Avahi example code"""

301

277

if self.rename_count >= self.max_renames:

302

278

logger.critical("No suitable Zeroconf service name found"

303

279

" after %i retries, exiting.",

304

280

self.rename_count)

305

281

raise AvahiServiceError("Too many renames")

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

282

self.name = unicode(self.server

283

.GetAlternativeServiceName(self.name))

309

284

logger.info("Changing Zeroconf service name to %r ...",

310

285

self.name)

311

if remove:

312

self.remove()

286

self.remove()

313

287

try:

314

288

self.add()

315

289

except dbus.exceptions.DBusException as error:

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

290

logger.critical("D-Bus Exception", exc_info=error)

291

self.cleanup()

292

os._exit(1)

293

self.rename_count += 1

324

294

325

295

def remove(self):

326

296

"""Derived from the Avahi example code"""

364

334

self.rename()

365

335

elif state == avahi.ENTRY_GROUP_FAILURE:

366

336

logger.critical("Avahi: Error in group state changed %s",

367

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

337

unicode(error))

338

raise AvahiGroupError("State changed: {!s}"

339

.format(error))

369

340

370

341

def cleanup(self):

371

342

"""Derived from the Avahi example code"""

381

352

def server_state_changed(self, state, error=None):

382

353

"""Derived from the Avahi example code"""

383

354

logger.debug("Avahi server state change: %i", state)

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

355

bad_states = { avahi.SERVER_INVALID:

356

"Zeroconf server invalid",

357

avahi.SERVER_REGISTERING: None,

358

avahi.SERVER_COLLISION:

359

"Zeroconf server name collision",

360

avahi.SERVER_FAILURE:

361

"Zeroconf server failure" }

390

362

if state in bad_states:

391

363

if bad_states[state] is not None:

392

364

if error is None:

395

367

logger.error(bad_states[state] + ": %r", error)

396

368

self.cleanup()

397

369

elif state == avahi.SERVER_RUNNING:

398

try:

399

self.add()

400

except dbus.exceptions.DBusException as error:

401

if (error.get_dbus_name()

402

== "org.freedesktop.Avahi.CollisionError"):

403

logger.info("Local Zeroconf service name"

404

" collision.")

405

return self.rename(remove=False)

406

else:

407

logger.critical("D-Bus Exception", exc_info=error)

408

self.cleanup()

409

os._exit(1)

370

self.add()

410

371

else:

411

372

if error is None:

412

373

logger.debug("Unknown state: %r", state)

422

383

follow_name_owner_changes=True),

423

384

avahi.DBUS_INTERFACE_SERVER)

424

385

self.server.connect_to_signal("StateChanged",

425

self.server_state_changed)

386

self.server_state_changed)

426

387

self.server_state_changed(self.server.GetState())

427

388

428

389

429

390

class AvahiServiceToSyslog(AvahiService):

430

def rename(self, *args, **kwargs):

391

def rename(self):

431

392

"""Add the new name to the syslog messages"""

432

ret = AvahiService.rename(self, *args, **kwargs)

433

syslogger.setFormatter(logging.Formatter(

434

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

435

.format(self.name)))

393

ret = AvahiService.rename(self)

394

syslogger.setFormatter(logging.Formatter

395

('Mandos ({}) [%(process)d]:'

396

' %(levelname)s: %(message)s'

397

.format(self.name)))

436

398

return ret

437

399

438

def call_pipe(connection, # : multiprocessing.Connection

439

func, *args, **kwargs):

440

"""This function is meant to be called by multiprocessing.Process

441

442

This function runs func(*args, **kwargs), and writes the resulting

443

return value on the provided multiprocessing.Connection.

444

"""

445

connection.send(func(*args, **kwargs))

446

connection.close()

447

400

448

401

class Client(object):

449

402

"""A representation of a client host served by this server.

476

429

last_checker_status: integer between 0 and 255 reflecting exit

477

430

status of last checker. -1 reflects crashed

478

431

checker, -2 means no checker completed yet.

479

last_checker_signal: The signal which killed the last checker, if

480

last_checker_status is -1

481

432

last_enabled: datetime.datetime(); (UTC) or None

482

433

name: string; from the config file, used in log messages and

483

434

D-Bus identifiers

496

447

"fingerprint", "host", "interval",

497

448

"last_approval_request", "last_checked_ok",

498

449

"last_enabled", "name", "timeout")

499

client_defaults = {

500

"timeout": "PT5M",

501

"extended_timeout": "PT15M",

502

"interval": "PT2M",

503

"checker": "fping -q -- %%(host)s",

504

"host": "",

505

"approval_delay": "PT0S",

506

"approval_duration": "PT1S",

507

"approved_by_default": "True",

508

"enabled": "True",

509

}

450

client_defaults = { "timeout": "PT5M",

451

"extended_timeout": "PT15M",

452

"interval": "PT2M",

453

"checker": "fping -q -- %%(host)s",

454

"host": "",

455

"approval_delay": "PT0S",

456

"approval_duration": "PT1S",

457

"approved_by_default": "True",

458

"enabled": "True",

459

}

510

460

511

461

@staticmethod

512

462

def config_parser(config):

528

478

client["enabled"] = config.getboolean(client_name,

529

479

"enabled")

530

480

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the

533

# fingerprint() function

534

481

client["fingerprint"] = (section["fingerprint"].upper()

535

482

.replace(" ", ""))

536

483

if "secret" in section:

578

525

self.expires = None

579

526

580

527

logger.debug("Creating client %r", self.name)

528

# Uppercase and remove spaces from fingerprint for later

529

# comparison purposes with return value from the fingerprint()

530

# function

581

531

logger.debug(" Fingerprint: %s", self.fingerprint)

582

532

self.created = settings.get("created",

583

533

datetime.datetime.utcnow())

590

540

self.current_checker_command = None

591

541

self.approved = None

592

542

self.approvals_pending = 0

593

self.changedstate = multiprocessing_manager.Condition(

594

multiprocessing_manager.Lock())

595

self.client_structure = [attr

596

for attr in self.__dict__.iterkeys()

543

self.changedstate = (multiprocessing_manager

544

.Condition(multiprocessing_manager

545

.Lock()))

546

self.client_structure = [attr for attr in

547

self.__dict__.iterkeys()

597

548

if not attr.startswith("_")]

598

549

self.client_structure.append("client_structure")

599

550

600

for name, t in inspect.getmembers(

601

type(self), lambda obj: isinstance(obj, property)):

551

for name, t in inspect.getmembers(type(self),

552

lambda obj:

553

isinstance(obj,

554

property)):

602

555

if not name.startswith("_"):

603

556

self.client_structure.append(name)

604

557

646

599

# and every interval from then on.

647

600

if self.checker_initiator_tag is not None:

648

601

gobject.source_remove(self.checker_initiator_tag)

649

self.checker_initiator_tag = gobject.timeout_add(

650

int(self.interval.total_seconds() * 1000),

651

self.start_checker)

602

self.checker_initiator_tag = (gobject.timeout_add

603

(int(self.interval

604

.total_seconds() * 1000),

605

self.start_checker))

652

606

# Schedule a disable() when 'timeout' has passed

653

607

if self.disable_initiator_tag is not None:

654

608

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = gobject.timeout_add(

656

int(self.timeout.total_seconds() * 1000), self.disable)

609

self.disable_initiator_tag = (gobject.timeout_add

610

(int(self.timeout

611

.total_seconds() * 1000),

612

self.disable))

657

613

# Also start a new checker *right now*.

658

614

self.start_checker()

659

615

660

def checker_callback(self, source, condition, connection,

661

command):

616

def checker_callback(self, pid, condition, command):

662

617

"""The checker has completed, so take appropriate actions."""

663

618

self.checker_callback_tag = None

664

619

self.checker = None

665

# Read return code from connection (see call_pipe)

666

returncode = connection.recv()

667

connection.close()

668

669

if returncode >= 0:

670

self.last_checker_status = returncode

671

self.last_checker_signal = None

620

if os.WIFEXITED(condition):

621

self.last_checker_status = os.WEXITSTATUS(condition)

672

622

if self.last_checker_status == 0:

673

623

logger.info("Checker for %(name)s succeeded",

674

624

vars(self))

675

625

self.checked_ok()

676

626

else:

677

logger.info("Checker for %(name)s failed", vars(self))

627

logger.info("Checker for %(name)s failed",

628

vars(self))

678

629

else:

679

630

self.last_checker_status = -1

680

self.last_checker_signal = -returncode

681

631

logger.warning("Checker for %(name)s crashed?",

682

632

vars(self))

683

return False

684

633

685

634

def checked_ok(self):

686

635

"""Assert that the client has been seen, alive and well."""

687

636

self.last_checked_ok = datetime.datetime.utcnow()

688

637

self.last_checker_status = 0

689

self.last_checker_signal = None

690

638

self.bump_timeout()

691

639

692

640

def bump_timeout(self, timeout=None):

697

645

gobject.source_remove(self.disable_initiator_tag)

698

646

self.disable_initiator_tag = None

699

647

if getattr(self, "enabled", False):

700

self.disable_initiator_tag = gobject.timeout_add(

701

int(timeout.total_seconds() * 1000), self.disable)

648

self.disable_initiator_tag = (gobject.timeout_add

649

(int(timeout.total_seconds()

650

* 1000), self.disable))

702

651

self.expires = datetime.datetime.utcnow() + timeout

703

652

704

653

def need_approval(self):

718

667

# than 'timeout' for the client to be disabled, which is as it

719

668

# should be.

720

669

721

if self.checker is not None and not self.checker.is_alive():

722

logger.warning("Checker was not alive; joining")

723

self.checker.join()

724

self.checker = None

670

# If a checker exists, make sure it is not a zombie

671

try:

672

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

673

except AttributeError:

674

pass

675

except OSError as error:

676

if error.errno != errno.ECHILD:

677

raise

678

else:

679

if pid:

680

logger.warning("Checker was a zombie")

681

gobject.source_remove(self.checker_callback_tag)

682

self.checker_callback(pid, status,

683

self.current_checker_command)

725

684

# Start a new checker if needed

726

685

if self.checker is None:

727

686

# Escape attributes for the shell

728

escaped_attrs = {

729

attr: re.escape(str(getattr(self, attr)))

730

for attr in self.runtime_expansions }

687

escaped_attrs = { attr:

688

re.escape(unicode(getattr(self,

689

attr)))

690

for attr in self.runtime_expansions }

731

691

try:

732

692

command = self.checker_command % escaped_attrs

733

693

except TypeError as error:

734

694

logger.error('Could not format string "%s"',

735

self.checker_command,

695

self.checker_command, exc_info=error)

696

return True # Try again later

697

self.current_checker_command = command

698

try:

699

logger.info("Starting checker %r for %s",

700

command, self.name)

701

# We don't need to redirect stdout and stderr, since

702

# in normal mode, that is already done by daemon(),

703

# and in debug mode we don't want to. (Stdin is

704

# always replaced by /dev/null.)

705

# The exception is when not debugging but nevertheless

706

# running in the foreground; use the previously

707

# created wnull.

708

popen_args = {}

709

if (not self.server_settings["debug"]

710

and self.server_settings["foreground"]):

711

popen_args.update({"stdout": wnull,

712

"stderr": wnull })

713

self.checker = subprocess.Popen(command,

714

close_fds=True,

715

shell=True, cwd="/",

716

**popen_args)

717

except OSError as error:

718

logger.error("Failed to start subprocess",

736

719

exc_info=error)

737

return True # Try again later

738

self.current_checker_command = command

739

logger.info("Starting checker %r for %s", command,

740

self.name)

741

# We don't need to redirect stdout and stderr, since

742

# in normal mode, that is already done by daemon(),

743

# and in debug mode we don't want to. (Stdin is

744

# always replaced by /dev/null.)

745

# The exception is when not debugging but nevertheless

746

# running in the foreground; use the previously

747

# created wnull.

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

751

if (not self.server_settings["debug"]

752

and self.server_settings["foreground"]):

753

popen_args.update({"stdout": wnull,

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

756

self.checker = multiprocessing.Process(

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

760

self.checker.start()

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

763

self.checker_callback, pipe[0], command)

720

return True

721

self.checker_callback_tag = (gobject.child_watch_add

722

(self.checker.pid,

723

self.checker_callback,

724

data=command))

725

# The checker may have completed before the gobject

726

# watch was added. Check for this.

727

try:

728

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

729

except OSError as error:

730

if error.errno == errno.ECHILD:

731

# This should never happen

732

logger.error("Child process vanished",

733

exc_info=error)

734

return True

735

raise

736

if pid:

737

gobject.source_remove(self.checker_callback_tag)

738

self.checker_callback(pid, status, command)

764

739

# Re-run this periodically if run by gobject.timeout_add

765

740

return True

766

741

772

747

if getattr(self, "checker", None) is None:

773

748

return

774

749

logger.debug("Stopping checker for %(name)s", vars(self))

775

self.checker.terminate()

750

try:

751

self.checker.terminate()

752

#time.sleep(0.5)

753

#if self.checker.poll() is None:

754

# self.checker.kill()

755

except OSError as error:

756

if error.errno != errno.ESRCH: # No such process

757

raise

776

758

self.checker = None

777

759

778

760

779

def dbus_service_property(dbus_interface,

780

signature="v",

781

access="readwrite",

782

byte_arrays=False):

761

def dbus_service_property(dbus_interface, signature="v",

762

access="readwrite", byte_arrays=False):

783

763

"""Decorators for marking methods of a DBusObjectWithProperties to

784

764

become properties on the D-Bus.

785

765

795

775

if byte_arrays and signature != "ay":

796

776

raise ValueError("Byte arrays not supported for non-'ay'"

797

777

" signature {!r}".format(signature))

798

799

778

def decorator(func):

800

779

func._dbus_is_property = True

801

780

func._dbus_interface = dbus_interface

806

785

func._dbus_name = func._dbus_name[:-14]

807

786

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

808

787

return func

809

810

788

return decorator

811

789

812

790

821

799

"org.freedesktop.DBus.Property.EmitsChangedSignal":

822

800

"false"}

823

801

"""

824

825

802

def decorator(func):

826

803

func._dbus_is_interface = True

827

804

func._dbus_interface = dbus_interface

828

805

func._dbus_name = dbus_interface

829

806

return func

830

831

807

return decorator

832

808

833

809

835

811

"""Decorator to annotate D-Bus methods, signals or properties

836

812

Usage:

837

813

838

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

841

814

@dbus_service_property("org.example.Interface", signature="b",

842

815

access="r")

816

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

817

"org.freedesktop.DBus.Property."

818

"EmitsChangedSignal": "false"})

843

819

def Property_dbus_property(self):

844

820

return dbus.Boolean(False)

845

846

See also the DBusObjectWithAnnotations class.

847

821

"""

848

849

822

def decorator(func):

850

823

func._dbus_annotations = annotations

851

824

return func

852

853

825

return decorator

854

826

855

827

858

830

"""

859

831

pass

860

832

861

862

833

class DBusPropertyAccessException(DBusPropertyException):

863

834

"""A property's access permissions disallows an operation.

864

835

"""

871

842

pass

872

843

873

844

874

class DBusObjectWithAnnotations(dbus.service.Object):

875

"""A D-Bus object with annotations.

845

class DBusObjectWithProperties(dbus.service.Object):

846

"""A D-Bus object with properties.

876

847

877

Classes inheriting from this can use the dbus_annotations

878

decorator to add annotations to methods or signals.

848

Classes inheriting from this can use the dbus_service_property

849

decorator to expose methods as D-Bus properties. It exposes the

850

standard Get(), Set(), and GetAll() methods on the D-Bus.

879

851

"""

880

852

881

853

@staticmethod

891

863

def _get_all_dbus_things(self, thing):

892

864

"""Returns a generator of (name, attribute) pairs

893

865

"""

894

return ((getattr(athing.__get__(self), "_dbus_name", name),

866

return ((getattr(athing.__get__(self), "_dbus_name",

867

name),

895

868

athing.__get__(self))

896

869

for cls in self.__class__.__mro__

897

870

for name, athing in

898

inspect.getmembers(cls, self._is_dbus_thing(thing)))

899

900

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

901

out_signature = "s",

902

path_keyword = 'object_path',

903

connection_keyword = 'connection')

904

def Introspect(self, object_path, connection):

905

"""Overloading of standard D-Bus method.

906

907

Inserts annotation tags on methods and signals.

908

"""

909

xmlstring = dbus.service.Object.Introspect(self, object_path,

910

connection)

911

try:

912

document = xml.dom.minidom.parseString(xmlstring)

913

914

for if_tag in document.getElementsByTagName("interface"):

915

# Add annotation tags

916

for typ in ("method", "signal"):

917

for tag in if_tag.getElementsByTagName(typ):

918

annots = dict()

919

for name, prop in (self.

920

_get_all_dbus_things(typ)):

921

if (name == tag.getAttribute("name")

922

and prop._dbus_interface

923

== if_tag.getAttribute("name")):

924

annots.update(getattr(

925

prop, "_dbus_annotations", {}))

926

for name, value in annots.items():

927

ann_tag = document.createElement(

928

"annotation")

929

ann_tag.setAttribute("name", name)

930

ann_tag.setAttribute("value", value)

931

tag.appendChild(ann_tag)

932

# Add interface annotation tags

933

for annotation, value in dict(

934

itertools.chain.from_iterable(

935

annotations().items()

936

for name, annotations

937

in self._get_all_dbus_things("interface")

938

if name == if_tag.getAttribute("name")

939

)).items():

940

ann_tag = document.createElement("annotation")

941

ann_tag.setAttribute("name", annotation)

942

ann_tag.setAttribute("value", value)

943

if_tag.appendChild(ann_tag)

944

# Fix argument name for the Introspect method itself

945

if (if_tag.getAttribute("name")

946

== dbus.INTROSPECTABLE_IFACE):

947

for cn in if_tag.getElementsByTagName("method"):

948

if cn.getAttribute("name") == "Introspect":

949

for arg in cn.getElementsByTagName("arg"):

950

if (arg.getAttribute("direction")

951

== "out"):

952

arg.setAttribute("name",

953

"xml_data")

954

xmlstring = document.toxml("utf-8")

955

document.unlink()

956

except (AttributeError, xml.dom.DOMException,

957

xml.parsers.expat.ExpatError) as error:

958

logger.error("Failed to override Introspection method",

959

exc_info=error)

960

return xmlstring

961

962

963

class DBusObjectWithProperties(DBusObjectWithAnnotations):

964

"""A D-Bus object with properties.

965

966

Classes inheriting from this can use the dbus_service_property

967

decorator to expose methods as D-Bus properties. It exposes the

968

standard Get(), Set(), and GetAll() methods on the D-Bus.

969

"""

871

inspect.getmembers(cls,

872

self._is_dbus_thing(thing)))

970

873

971

874

def _get_dbus_property(self, interface_name, property_name):

972

875

"""Returns a bound method if one exists which is a D-Bus

973

876

property with the specified name and interface.

974

877

"""

975

for cls in self.__class__.__mro__:

976

for name, value in inspect.getmembers(

977

cls, self._is_dbus_thing("property")):

878

for cls in self.__class__.__mro__:

879

for name, value in (inspect.getmembers

880

(cls,

881

self._is_dbus_thing("property"))):

978

882

if (value._dbus_name == property_name

979

883

and value._dbus_interface == interface_name):

980

884

return value.__get__(self)

981

885

982

886

# No such property

983

raise DBusPropertyNotFound("{}:{}.{}".format(

984

self.dbus_object_path, interface_name, property_name))

985

986

@classmethod

987

def _get_all_interface_names(cls):

988

"""Get a sequence of all interfaces supported by an object"""

989

return (name for name in set(getattr(getattr(x, attr),

990

"_dbus_interface", None)

991

for x in (inspect.getmro(cls))

992

for attr in dir(x))

993

if name is not None)

994

995

@dbus.service.method(dbus.PROPERTIES_IFACE,

996

in_signature="ss",

887

raise DBusPropertyNotFound(self.dbus_object_path + ":"

888

+ interface_name + "."

889

+ property_name)

890

891

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

997

892

out_signature="v")

998

893

def Get(self, interface_name, property_name):

999

894

"""Standard D-Bus property Get() method, see D-Bus standard.

1024

919

for byte in value))

1025

920

prop(value)

1026

921

1027

@dbus.service.method(dbus.PROPERTIES_IFACE,

1028

in_signature="s",

922

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1029

923

out_signature="a{sv}")

1030

924

def GetAll(self, interface_name):

1031

925

"""Standard D-Bus property GetAll() method, see D-Bus

1046

940

if not hasattr(value, "variant_level"):

1047

941

properties[name] = value

1048

942

continue

1049

properties[name] = type(value)(

1050

value, variant_level = value.variant_level + 1)

943

properties[name] = type(value)(value, variant_level=

944

value.variant_level+1)

1051

945

return dbus.Dictionary(properties, signature="sv")

1052

946

1053

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1054

def PropertiesChanged(self, interface_name, changed_properties,

1055

invalidated_properties):

1056

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1057

standard.

1058

"""

1059

pass

1060

1061

947

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1062

948

out_signature="s",

1063

949

path_keyword='object_path',

1067

953

1068

954

Inserts property tags and interface annotation tags.

1069

955

"""

1070

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1071

object_path,

1072

connection)

956

xmlstring = dbus.service.Object.Introspect(self, object_path,

957

connection)

1073

958

try:

1074

959

document = xml.dom.minidom.parseString(xmlstring)

1075

1076

960

def make_tag(document, name, prop):

1077

961

e = document.createElement("property")

1078

962

e.setAttribute("name", name)

1079

963

e.setAttribute("type", prop._dbus_signature)

1080

964

e.setAttribute("access", prop._dbus_access)

1081

965

return e

1082

1083

966

for if_tag in document.getElementsByTagName("interface"):

1084

967

# Add property tags

1085

968

for tag in (make_tag(document, name, prop)

1088

971

if prop._dbus_interface

1089

972

== if_tag.getAttribute("name")):

1090

973

if_tag.appendChild(tag)

1091

# Add annotation tags for properties

1092

for tag in if_tag.getElementsByTagName("property"):

1093

annots = dict()

1094

for name, prop in self._get_all_dbus_things(

1095

"property"):

1096

if (name == tag.getAttribute("name")

1097

and prop._dbus_interface

1098

== if_tag.getAttribute("name")):

1099

annots.update(getattr(

1100

prop, "_dbus_annotations", {}))

1101

for name, value in annots.items():

1102

ann_tag = document.createElement(

1103

"annotation")

1104

ann_tag.setAttribute("name", name)

1105

ann_tag.setAttribute("value", value)

1106

tag.appendChild(ann_tag)

974

# Add annotation tags

975

for typ in ("method", "signal", "property"):

976

for tag in if_tag.getElementsByTagName(typ):

977

annots = dict()

978

for name, prop in (self.

979

_get_all_dbus_things(typ)):

980

if (name == tag.getAttribute("name")

981

and prop._dbus_interface

982

== if_tag.getAttribute("name")):

983

annots.update(getattr

984

(prop,

985

"_dbus_annotations",

986

{}))

987

for name, value in annots.items():

988

ann_tag = document.createElement(

989

"annotation")

990

ann_tag.setAttribute("name", name)

991

ann_tag.setAttribute("value", value)

992

tag.appendChild(ann_tag)

993

# Add interface annotation tags

994

for annotation, value in dict(

995

itertools.chain.from_iterable(

996

annotations().items()

997

for name, annotations in

998

self._get_all_dbus_things("interface")

999

if name == if_tag.getAttribute("name")

1000

)).items():

1001

ann_tag = document.createElement("annotation")

1002

ann_tag.setAttribute("name", annotation)

1003

ann_tag.setAttribute("value", value)

1004

if_tag.appendChild(ann_tag)

1107

1005

# Add the names to the return values for the

1108

1006

# "org.freedesktop.DBus.Properties" methods

1109

1007

if (if_tag.getAttribute("name")

1127

1025

exc_info=error)

1128

1026

return xmlstring

1129

1027

1130

try:

1131

dbus.OBJECT_MANAGER_IFACE

1132

except AttributeError:

1133

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1134

1135

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1136

"""A D-Bus object with an ObjectManager.

1137

1138

Classes inheriting from this exposes the standard

1139

GetManagedObjects call and the InterfacesAdded and

1140

InterfacesRemoved signals on the standard

1141

"org.freedesktop.DBus.ObjectManager" interface.

1142

1143

Note: No signals are sent automatically; they must be sent

1144

manually.

1145

"""

1146

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1147

out_signature = "a{oa{sa{sv}}}")

1148

def GetManagedObjects(self):

1149

"""This function must be overridden"""

1150

raise NotImplementedError()

1151

1152

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1153

signature = "oa{sa{sv}}")

1154

def InterfacesAdded(self, object_path, interfaces_and_properties):

1155

pass

1156

1157

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1158

signature = "oas")

1159

def InterfacesRemoved(self, object_path, interfaces):

1160

pass

1161

1162

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1163

out_signature = "s",

1164

path_keyword = 'object_path',

1165

connection_keyword = 'connection')

1166

def Introspect(self, object_path, connection):

1167

"""Overloading of standard D-Bus method.

1168

1169

Override return argument name of GetManagedObjects to be

1170

"objpath_interfaces_and_properties"

1171

"""

1172

xmlstring = DBusObjectWithAnnotations(self, object_path,

1173

connection)

1174

try:

1175

document = xml.dom.minidom.parseString(xmlstring)

1176

1177

for if_tag in document.getElementsByTagName("interface"):

1178

# Fix argument name for the GetManagedObjects method

1179

if (if_tag.getAttribute("name")

1180

== dbus.OBJECT_MANAGER_IFACE):

1181

for cn in if_tag.getElementsByTagName("method"):

1182

if (cn.getAttribute("name")

1183

== "GetManagedObjects"):

1184

for arg in cn.getElementsByTagName("arg"):

1185

if (arg.getAttribute("direction")

1186

== "out"):

1187

arg.setAttribute(

1188

"name",

1189

"objpath_interfaces"

1190

"_and_properties")

1191

xmlstring = document.toxml("utf-8")

1192

document.unlink()

1193

except (AttributeError, xml.dom.DOMException,

1194

xml.parsers.expat.ExpatError) as error:

1195

logger.error("Failed to override Introspection method",

1196

exc_info = error)

1197

return xmlstring

1198

1028

1199

1029

def datetime_to_dbus(dt, variant_level=0):

1200

1030

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1201

1031

if dt is None:

1202

1032

return dbus.String("", variant_level = variant_level)

1203

return dbus.String(dt.isoformat(), variant_level=variant_level)

1033

return dbus.String(dt.isoformat(),

1034

variant_level=variant_level)

1204

1035

1205

1036

1206

1037

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1226

1057

(from DBusObjectWithProperties) and interfaces (from the

1227

1058

dbus_interface_annotations decorator).

1228

1059

"""

1229

1230

1060

def wrapper(cls):

1231

1061

for orig_interface_name, alt_interface_name in (

1232

alt_interface_names.items()):

1062

alt_interface_names.items()):

1233

1063

attr = {}

1234

1064

interface_names = set()

1235

1065

# Go though all attributes of the class

1237

1067

# Ignore non-D-Bus attributes, and D-Bus attributes

1238

1068

# with the wrong interface name

1239

1069

if (not hasattr(attribute, "_dbus_interface")

1240

or not attribute._dbus_interface.startswith(

1241

orig_interface_name)):

1070

or not attribute._dbus_interface

1071

.startswith(orig_interface_name)):

1242

1072

continue

1243

1073

# Create an alternate D-Bus interface name based on

1244

1074

# the current name

1245

alt_interface = attribute._dbus_interface.replace(

1246

orig_interface_name, alt_interface_name)

1075

alt_interface = (attribute._dbus_interface

1076

.replace(orig_interface_name,

1077

alt_interface_name))

1247

1078

interface_names.add(alt_interface)

1248

1079

# Is this a D-Bus signal?

1249

1080

if getattr(attribute, "_dbus_is_signal", False):

1250

if sys.version_info.major == 2:

1251

# Extract the original non-method undecorated

1252

# function by black magic

1253

nonmethod_func = (dict(

1081

# Extract the original non-method undecorated

1082

# function by black magic

1083

nonmethod_func = (dict(

1254

1084

zip(attribute.func_code.co_freevars,

1255

attribute.__closure__))

1256

["func"].cell_contents)

1257

else:

1258

nonmethod_func = attribute

1085

attribute.__closure__))["func"]

1086

.cell_contents)

1259

1087

# Create a new, but exactly alike, function

1260

1088

# object, and decorate it to be a new D-Bus signal

1261

1089

# with the alternate D-Bus interface name

1262

if sys.version_info.major == 2:

1263

new_function = types.FunctionType(

1264

nonmethod_func.func_code,

1265

nonmethod_func.func_globals,

1266

nonmethod_func.func_name,

1267

nonmethod_func.func_defaults,

1268

nonmethod_func.func_closure)

1269

else:

1270

new_function = types.FunctionType(

1271

nonmethod_func.__code__,

1272

nonmethod_func.__globals__,

1273

nonmethod_func.__name__,

1274

nonmethod_func.__defaults__,

1275

nonmethod_func.__closure__)

1276

new_function = (dbus.service.signal(

1277

alt_interface,

1278

attribute._dbus_signature)(new_function))

1090

new_function = (dbus.service.signal

1091

(alt_interface,

1092

attribute._dbus_signature)

1093

(types.FunctionType(

1094

nonmethod_func.func_code,

1095

nonmethod_func.func_globals,

1096

nonmethod_func.func_name,

1097

nonmethod_func.func_defaults,

1098

nonmethod_func.func_closure)))

1279

1099

# Copy annotations, if any

1280

1100

try:

1281

new_function._dbus_annotations = dict(

1282

attribute._dbus_annotations)

1101

new_function._dbus_annotations = (

1102

dict(attribute._dbus_annotations))

1283

1103

except AttributeError:

1284

1104

pass

1285

1105

# Define a creator of a function to call both the

1290

1110

"""This function is a scope container to pass

1291

1111

func1 and func2 to the "call_both" function

1292

1112

outside of its arguments"""

1293

1294

1113

def call_both(*args, **kwargs):

1295

1114

"""This function will emit two D-Bus

1296

1115

signals by calling func1 and func2"""

1297

1116

func1(*args, **kwargs)

1298

1117

func2(*args, **kwargs)

1299

1300

1118

return call_both

1301

1119

# Create the "call_both" function and add it to

1302

1120

# the class

1307

1125

# object. Decorate it to be a new D-Bus method

1308

1126

# with the alternate D-Bus interface name. Add it

1309

1127

# to the class.

1310

attr[attrname] = (

1311

dbus.service.method(

1312

alt_interface,

1313

attribute._dbus_in_signature,

1314

attribute._dbus_out_signature)

1315

(types.FunctionType(attribute.func_code,

1316

attribute.func_globals,

1317

attribute.func_name,

1318

attribute.func_defaults,

1319

attribute.func_closure)))

1128

attr[attrname] = (dbus.service.method

1129

(alt_interface,

1130

attribute._dbus_in_signature,

1131

attribute._dbus_out_signature)

1132

(types.FunctionType

1133

(attribute.func_code,

1134

attribute.func_globals,

1135

attribute.func_name,

1136

attribute.func_defaults,

1137

attribute.func_closure)))

1320

1138

# Copy annotations, if any

1321

1139

try:

1322

attr[attrname]._dbus_annotations = dict(

1323

attribute._dbus_annotations)

1140

attr[attrname]._dbus_annotations = (

1141

dict(attribute._dbus_annotations))

1324

1142

except AttributeError:

1325

1143

pass

1326

1144

# Is this a D-Bus property?

1329

1147

# object, and decorate it to be a new D-Bus

1330

1148

# property with the alternate D-Bus interface

1331

1149

# name. Add it to the class.

1332

attr[attrname] = (dbus_service_property(

1333

alt_interface, attribute._dbus_signature,

1334

attribute._dbus_access,

1335

attribute._dbus_get_args_options

1336

["byte_arrays"])

1337

(types.FunctionType(

1338

attribute.func_code,

1339

attribute.func_globals,

1340

attribute.func_name,

1341

attribute.func_defaults,

1342

attribute.func_closure)))

1150

attr[attrname] = (dbus_service_property

1151

(alt_interface,

1152

attribute._dbus_signature,

1153

attribute._dbus_access,

1154

attribute

1155

._dbus_get_args_options

1156

["byte_arrays"])

1157

(types.FunctionType

1158

(attribute.func_code,

1159

attribute.func_globals,

1160

attribute.func_name,

1161

attribute.func_defaults,

1162

attribute.func_closure)))

1343

1163

# Copy annotations, if any

1344

1164

try:

1345

attr[attrname]._dbus_annotations = dict(

1346

attribute._dbus_annotations)

1165

attr[attrname]._dbus_annotations = (

1166

dict(attribute._dbus_annotations))

1347

1167

except AttributeError:

1348

1168

pass

1349

1169

# Is this a D-Bus interface?

1352

1172

# object. Decorate it to be a new D-Bus interface

1353

1173

# with the alternate D-Bus interface name. Add it

1354

1174

# to the class.

1355

attr[attrname] = (

1356

dbus_interface_annotations(alt_interface)

1357

(types.FunctionType(attribute.func_code,

1358

attribute.func_globals,

1359

attribute.func_name,

1360

attribute.func_defaults,

1361

attribute.func_closure)))

1175

attr[attrname] = (dbus_interface_annotations

1176

(alt_interface)

1177

(types.FunctionType

1178

(attribute.func_code,

1179

attribute.func_globals,

1180

attribute.func_name,

1181

attribute.func_defaults,

1182

attribute.func_closure)))

1362

1183

if deprecate:

1363

1184

# Deprecate all alternate interfaces

1364

1185

iname="_AlternateDBusNames_interface_annotation{}"

1365

1186

for interface_name in interface_names:

1366

1367

1187

@dbus_interface_annotations(interface_name)

1368

1188

def func(self):

1369

1189

return { "org.freedesktop.DBus.Deprecated":

1370

"true" }

1190

"true" }

1371

1191

# Find an unused name

1372

1192

for aname in (iname.format(i)

1373

1193

for i in itertools.count()):

1378

1198

# Replace the class with a new subclass of it with

1379

1199

# methods, signals, etc. as created above.

1380

1200

cls = type(b"{}Alternate".format(cls.__name__),

1381

(cls, ), attr)

1201

(cls,), attr)

1382

1202

return cls

1383

1384

1203

return wrapper

1385

1204

1386

1205

1387

1206

@alternate_dbus_interfaces({"se.recompile.Mandos":

1388

"se.bsnet.fukt.Mandos"})

1207

"se.bsnet.fukt.Mandos"})

1389

1208

class ClientDBus(Client, DBusObjectWithProperties):

1390

1209

"""A Client class using D-Bus

1391

1210

1395

1214

"""

1396

1215

1397

1216

runtime_expansions = (Client.runtime_expansions

1398

+ ("dbus_object_path", ))

1399

1400

_interface = "se.recompile.Mandos.Client"

1217

+ ("dbus_object_path",))

1401

1218

1402

1219

# dbus.service.Object doesn't use super(), so we can't either.

1403

1220

1406

1223

Client.__init__(self, *args, **kwargs)

1407

1224

# Only now, when this client is initialized, can it show up on

1408

1225

# the D-Bus

1409

client_object_name = str(self.name).translate(

1226

client_object_name = unicode(self.name).translate(

1410

1227

{ord("."): ord("_"),

1411

1228

ord("-"): ord("_")})

1412

self.dbus_object_path = dbus.ObjectPath(

1413

"/clients/" + client_object_name)

1229

self.dbus_object_path = (dbus.ObjectPath

1230

("/clients/" + client_object_name))

1414

1231

DBusObjectWithProperties.__init__(self, self.bus,

1415

1232

self.dbus_object_path)

1416

1233

1417

def notifychangeproperty(transform_func, dbus_name,

1418

type_func=lambda x: x,

1419

variant_level=1,

1420

invalidate_only=False,

1421

_interface=_interface):

1234

def notifychangeproperty(transform_func,

1235

dbus_name, type_func=lambda x: x,

1236

variant_level=1):

1422

1237

""" Modify a variable so that it's a property which announces

1423

1238

its changes to DBus.

1424

1239

1430

1245

variant_level: D-Bus variant level. Default: 1

1431

1246

"""

1432

1247

attrname = "_{}".format(dbus_name)

1433

1434

1248

def setter(self, value):

1435

1249

if hasattr(self, "dbus_object_path"):

1436

1250

if (not hasattr(self, attrname) or

1437

1251

type_func(getattr(self, attrname, None))

1438

1252

!= type_func(value)):

1439

if invalidate_only:

1440

self.PropertiesChanged(

1441

_interface, dbus.Dictionary(),

1442

dbus.Array((dbus_name, )))

1443

else:

1444

dbus_value = transform_func(

1445

type_func(value),

1446

variant_level = variant_level)

1447

self.PropertyChanged(dbus.String(dbus_name),

1448

dbus_value)

1449

self.PropertiesChanged(

1450

_interface,

1451

dbus.Dictionary({ dbus.String(dbus_name):

1452

dbus_value }),

1453

dbus.Array())

1253

dbus_value = transform_func(type_func(value),

1254

variant_level

1255

=variant_level)

1256

self.PropertyChanged(dbus.String(dbus_name),

1257

dbus_value)

1454

1258

setattr(self, attrname, value)

1455

1259

1456

1260

return property(lambda self: getattr(self, attrname), setter)

1462

1266

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1463

1267

last_enabled = notifychangeproperty(datetime_to_dbus,

1464

1268

"LastEnabled")

1465

checker = notifychangeproperty(

1466

dbus.Boolean, "CheckerRunning",

1467

type_func = lambda checker: checker is not None)

1269

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1270

type_func = lambda checker:

1271

checker is not None)

1468

1272

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1469

1273

"LastCheckedOK")

1470

1274

last_checker_status = notifychangeproperty(dbus.Int16,

1473

1277

datetime_to_dbus, "LastApprovalRequest")

1474

1278

approved_by_default = notifychangeproperty(dbus.Boolean,

1475

1279

"ApprovedByDefault")

1476

approval_delay = notifychangeproperty(

1477

dbus.UInt64, "ApprovalDelay",

1478

type_func = lambda td: td.total_seconds() * 1000)

1280

approval_delay = notifychangeproperty(dbus.UInt64,

1281

"ApprovalDelay",

1282

type_func =

1283

lambda td: td.total_seconds()

1284

* 1000)

1479

1285

approval_duration = notifychangeproperty(

1480

1286

dbus.UInt64, "ApprovalDuration",

1481

1287

type_func = lambda td: td.total_seconds() * 1000)

1482

1288

host = notifychangeproperty(dbus.String, "Host")

1483

timeout = notifychangeproperty(

1484

dbus.UInt64, "Timeout",

1485

type_func = lambda td: td.total_seconds() * 1000)

1289

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1290

type_func = lambda td:

1291

td.total_seconds() * 1000)

1486

1292

extended_timeout = notifychangeproperty(

1487

1293

dbus.UInt64, "ExtendedTimeout",

1488

1294

type_func = lambda td: td.total_seconds() * 1000)

1489

interval = notifychangeproperty(

1490

dbus.UInt64, "Interval",

1491

type_func = lambda td: td.total_seconds() * 1000)

1295

interval = notifychangeproperty(dbus.UInt64,

1296

"Interval",

1297

type_func =

1298

lambda td: td.total_seconds()

1299

* 1000)

1492

1300

checker_command = notifychangeproperty(dbus.String, "Checker")

1493

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1494

invalidate_only=True)

1495

1301

1496

1302

del notifychangeproperty

1497

1303

1504

1310

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1505

1311

Client.__del__(self, *args, **kwargs)

1506

1312

1507

def checker_callback(self, source, condition,

1508

connection, command, *args, **kwargs):

1509

ret = Client.checker_callback(self, source, condition,

1510

connection, command, *args,

1511

**kwargs)

1512

exitstatus = self.last_checker_status

1513

if exitstatus >= 0:

1313

def checker_callback(self, pid, condition, command,

1314

*args, **kwargs):

1315

self.checker_callback_tag = None

1316

self.checker = None

1317

if os.WIFEXITED(condition):

1318

exitstatus = os.WEXITSTATUS(condition)

1514

1319

# Emit D-Bus signal

1515

1320

self.CheckerCompleted(dbus.Int16(exitstatus),

1516

# This is specific to GNU libC

1517

dbus.Int64(exitstatus << 8),

1321

dbus.Int64(condition),

1518

1322

dbus.String(command))

1519

1323

else:

1520

1324

# Emit D-Bus signal

1521

1325

self.CheckerCompleted(dbus.Int16(-1),

1522

dbus.Int64(

1523

# This is specific to GNU libC

1524

(exitstatus << 8)

1525

| self.last_checker_signal),

1326

dbus.Int64(condition),

1526

1327

dbus.String(command))

1527

return ret

1328

1329

return Client.checker_callback(self, pid, condition, command,

1330

*args, **kwargs)

1528

1331

1529

1332

def start_checker(self, *args, **kwargs):

1530

1333

old_checker_pid = getattr(self.checker, "pid", None)

1547

1350

self.send_changedstate()

1548

1351

1549

1352

## D-Bus methods, signals & properties

1353

_interface = "se.recompile.Mandos.Client"

1550

1354

1551

1355

## Interfaces

1552

1356

1357

@dbus_interface_annotations(_interface)

1358

def _foo(self):

1359

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1360

"false"}

1361

1553

1362

## Signals

1554

1363

1555

1364

# CheckerCompleted - signal

1565

1374

pass

1566

1375

1567

1376

# PropertyChanged - signal

1568

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1569

1377

@dbus.service.signal(_interface, signature="sv")

1570

1378

def PropertyChanged(self, property, value):

1571

1379

"D-Bus signal"

1605

1413

self.checked_ok()

1606

1414

1607

1415

# Enable - method

1608

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1609

1416

@dbus.service.method(_interface)

1610

1417

def Enable(self):

1611

1418

"D-Bus method"

1612

1419

self.enable()

1613

1420

1614

1421

# StartChecker - method

1615

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1616

1422

@dbus.service.method(_interface)

1617

1423

def StartChecker(self):

1618

1424

"D-Bus method"

1619

1425

self.start_checker()

1620

1426

1621

1427

# Disable - method

1622

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1623

1428

@dbus.service.method(_interface)

1624

1429

def Disable(self):

1625

1430

"D-Bus method"

1626

1431

self.disable()

1627

1432

1628

1433

# StopChecker - method

1629

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1630

1434

@dbus.service.method(_interface)

1631

1435

def StopChecker(self):

1632

1436

self.stop_checker()

1639

1443

return dbus.Boolean(bool(self.approvals_pending))

1640

1444

1641

1445

# ApprovedByDefault - property

1642

@dbus_service_property(_interface,

1643

signature="b",

1446

@dbus_service_property(_interface, signature="b",

1644

1447

access="readwrite")

1645

1448

def ApprovedByDefault_dbus_property(self, value=None):

1646

1449

if value is None: # get

1648

1451

self.approved_by_default = bool(value)

1649

1452

1650

1453

# ApprovalDelay - property

1651

@dbus_service_property(_interface,

1652

signature="t",

1454

@dbus_service_property(_interface, signature="t",

1653

1455

access="readwrite")

1654

1456

def ApprovalDelay_dbus_property(self, value=None):

1655

1457

if value is None: # get

1658

1460

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1659

1461

1660

1462

# ApprovalDuration - property

1661

@dbus_service_property(_interface,

1662

signature="t",

1463

@dbus_service_property(_interface, signature="t",

1663

1464

access="readwrite")

1664

1465

def ApprovalDuration_dbus_property(self, value=None):

1665

1466

if value is None: # get

1668

1469

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1669

1470

1670

1471

# Name - property

1671

@dbus_annotations(

1672

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1673

1472

@dbus_service_property(_interface, signature="s", access="read")

1674

1473

def Name_dbus_property(self):

1675

1474

return dbus.String(self.name)

1676

1475

1677

1476

# Fingerprint - property

1678

@dbus_annotations(

1679

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1680

1477

@dbus_service_property(_interface, signature="s", access="read")

1681

1478

def Fingerprint_dbus_property(self):

1682

1479

return dbus.String(self.fingerprint)

1683

1480

1684

1481

# Host - property

1685

@dbus_service_property(_interface,

1686

signature="s",

1482

@dbus_service_property(_interface, signature="s",

1687

1483

access="readwrite")

1688

1484

def Host_dbus_property(self, value=None):

1689

1485

if value is None: # get

1690

1486

return dbus.String(self.host)

1691

self.host = str(value)

1487

self.host = unicode(value)

1692

1488

1693

1489

# Created - property

1694

@dbus_annotations(

1695

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1696

1490

@dbus_service_property(_interface, signature="s", access="read")

1697

1491

def Created_dbus_property(self):

1698

1492

return datetime_to_dbus(self.created)

1703

1497

return datetime_to_dbus(self.last_enabled)

1704

1498

1705

1499

# Enabled - property

1706

@dbus_service_property(_interface,

1707

signature="b",

1500

@dbus_service_property(_interface, signature="b",

1708

1501

access="readwrite")

1709

1502

def Enabled_dbus_property(self, value=None):

1710

1503

if value is None: # get

1715

1508

self.disable()

1716

1509

1717

1510

# LastCheckedOK - property

1718

@dbus_service_property(_interface,

1719

signature="s",

1511

@dbus_service_property(_interface, signature="s",

1720

1512

access="readwrite")

1721

1513

def LastCheckedOK_dbus_property(self, value=None):

1722

1514

if value is not None:

1725

1517

return datetime_to_dbus(self.last_checked_ok)

1726

1518

1727

1519

# LastCheckerStatus - property

1728

@dbus_service_property(_interface, signature="n", access="read")

1520

@dbus_service_property(_interface, signature="n",

1521

access="read")

1729

1522

def LastCheckerStatus_dbus_property(self):

1730

1523

return dbus.Int16(self.last_checker_status)

1731

1524

1740

1533

return datetime_to_dbus(self.last_approval_request)

1741

1534

1742

1535

# Timeout - property

1743

@dbus_service_property(_interface,

1744

signature="t",

1536

@dbus_service_property(_interface, signature="t",

1745

1537

access="readwrite")

1746

1538

def Timeout_dbus_property(self, value=None):

1747

1539

if value is None: # get

1760

1552

is None):

1761

1553

return

1762

1554

gobject.source_remove(self.disable_initiator_tag)

1763

self.disable_initiator_tag = gobject.timeout_add(

1764

int((self.expires - now).total_seconds() * 1000),

1765

self.disable)

1555

self.disable_initiator_tag = (

1556

gobject.timeout_add(

1557

int((self.expires - now).total_seconds()

1558

* 1000), self.disable))

1766

1559

1767

1560

# ExtendedTimeout - property

1768

@dbus_service_property(_interface,

1769

signature="t",

1561

@dbus_service_property(_interface, signature="t",

1770

1562

access="readwrite")

1771

1563

def ExtendedTimeout_dbus_property(self, value=None):

1772

1564

if value is None: # get

1775

1567

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1776

1568

1777

1569

# Interval - property

1778

@dbus_service_property(_interface,

1779

signature="t",

1570

@dbus_service_property(_interface, signature="t",

1780

1571

access="readwrite")

1781

1572

def Interval_dbus_property(self, value=None):

1782

1573

if value is None: # get

1787

1578

if self.enabled:

1788

1579

# Reschedule checker run

1789

1580

gobject.source_remove(self.checker_initiator_tag)

1790

self.checker_initiator_tag = gobject.timeout_add(

1791

value, self.start_checker)

1792

self.start_checker() # Start one now, too

1581

self.checker_initiator_tag = (gobject.timeout_add

1582

(value, self.start_checker))

1583

self.start_checker() # Start one now, too

1793

1584

1794

1585

# Checker - property

1795

@dbus_service_property(_interface,

1796

signature="s",

1586

@dbus_service_property(_interface, signature="s",

1797

1587

access="readwrite")

1798

1588

def Checker_dbus_property(self, value=None):

1799

1589

if value is None: # get

1800

1590

return dbus.String(self.checker_command)

1801

self.checker_command = str(value)

1591

self.checker_command = unicode(value)

1802

1592

1803

1593

# CheckerRunning - property

1804

@dbus_service_property(_interface,

1805

signature="b",

1594

@dbus_service_property(_interface, signature="b",

1806

1595

access="readwrite")

1807

1596

def CheckerRunning_dbus_property(self, value=None):

1808

1597

if value is None: # get

1813

1602

self.stop_checker()

1814

1603

1815

1604

# ObjectPath - property

1816

@dbus_annotations(

1817

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

1818

"org.freedesktop.DBus.Deprecated": "true"})

1819

1605

@dbus_service_property(_interface, signature="o", access="read")

1820

1606

def ObjectPath_dbus_property(self):

1821

1607

return self.dbus_object_path # is already a dbus.ObjectPath

1822

1608

1823

1609

# Secret = property

1824

@dbus_annotations(

1825

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

1826

"invalidates"})

1827

@dbus_service_property(_interface,

1828

signature="ay",

1829

access="write",

1830

byte_arrays=True)

1610

@dbus_service_property(_interface, signature="ay",

1611

access="write", byte_arrays=True)

1831

1612

def Secret_dbus_property(self, value):

1832

1613

self.secret = bytes(value)

1833

1614

1839

1620

self._pipe = child_pipe

1840

1621

self._pipe.send(('init', fpr, address))

1841

1622

if not self._pipe.recv():

1842

raise KeyError(fpr)

1623

raise KeyError()

1843

1624

1844

1625

def __getattribute__(self, name):

1845

1626

if name == '_pipe':

1849

1630

if data[0] == 'data':

1850

1631

return data[1]

1851

1632

if data[0] == 'function':

1852

1853

1633

def func(*args, **kwargs):

1854

1634

self._pipe.send(('funcall', name, args, kwargs))

1855

1635

return self._pipe.recv()[1]

1856

1857

1636

return func

1858

1637

1859

1638

def __setattr__(self, name, value):

1871

1650

def handle(self):

1872

1651

with contextlib.closing(self.server.child_pipe) as child_pipe:

1873

1652

logger.info("TCP connection from: %s",

1874

str(self.client_address))

1653

unicode(self.client_address))

1875

1654

logger.debug("Pipe FD: %d",

1876

1655

self.server.child_pipe.fileno())

1877

1656

1878

session = gnutls.connection.ClientSession(

1879

self.request, gnutls.connection .X509Credentials())

1657

session = (gnutls.connection

1658

.ClientSession(self.request,

1659

gnutls.connection

1660

.X509Credentials()))

1880

1661

1881

1662

# Note: gnutls.connection.X509Credentials is really a

1882

1663

# generic GnuTLS certificate credentials object so long as

1891

1672

priority = self.server.gnutls_priority

1892

1673

if priority is None:

1893

1674

priority = "NORMAL"

1894

gnutls.library.functions.gnutls_priority_set_direct(

1895

session._c_object, priority, None)

1675

(gnutls.library.functions

1676

.gnutls_priority_set_direct(session._c_object,

1677

priority, None))

1896

1678

1897

1679

# Start communication using the Mandos protocol

1898

1680

# Get protocol number

1918

1700

approval_required = False

1919

1701

try:

1920

1702

try:

1921

fpr = self.fingerprint(

1922

self.peer_certificate(session))

1703

fpr = self.fingerprint(self.peer_certificate

1704

(session))

1923

1705

except (TypeError,

1924

1706

gnutls.errors.GNUTLSError) as error:

1925

1707

logger.warning("Bad certificate: %s", error)

1940

1722

while True:

1941

1723

if not client.enabled:

1942

1724

logger.info("Client %s is disabled",

1943

client.name)

1725

client.name)

1944

1726

if self.server.use_dbus:

1945

1727

# Emit D-Bus signal

1946

1728

client.Rejected("Disabled")

1993

1775

logger.warning("gnutls send failed",

1994

1776

exc_info=error)

1995

1777

return

1996

logger.debug("Sent: %d, remaining: %d", sent,

1997

len(client.secret) - (sent_size

1998

+ sent))

1778

logger.debug("Sent: %d, remaining: %d",

1779

sent, len(client.secret)

1780

- (sent_size + sent))

1999

1781

sent_size += sent

2000

1782

2001

1783

logger.info("Sending secret to %s", client.name)

2018

1800

def peer_certificate(session):

2019

1801

"Return the peer's OpenPGP certificate as a bytestring"

2020

1802

# If not an OpenPGP certificate...

2021

if (gnutls.library.functions.gnutls_certificate_type_get(

2022

session._c_object)

1803

if (gnutls.library.functions

1804

.gnutls_certificate_type_get(session._c_object)

2023

1805

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

2024

1806

# ...do the normal thing

2025

1807

return session.peer_certificate

2039

1821

def fingerprint(openpgp):

2040

1822

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2041

1823

# New GnuTLS "datum" with the OpenPGP public key

2042

datum = gnutls.library.types.gnutls_datum_t(

2043

ctypes.cast(ctypes.c_char_p(openpgp),

2044

ctypes.POINTER(ctypes.c_ubyte)),

2045

ctypes.c_uint(len(openpgp)))

1824

datum = (gnutls.library.types

1825

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1826

ctypes.POINTER

1827

(ctypes.c_ubyte)),

1828

ctypes.c_uint(len(openpgp))))

2046

1829

# New empty GnuTLS certificate

2047

1830

crt = gnutls.library.types.gnutls_openpgp_crt_t()

2048

gnutls.library.functions.gnutls_openpgp_crt_init(

2049

ctypes.byref(crt))

1831

(gnutls.library.functions

1832

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2050

1833

# Import the OpenPGP public key into the certificate

2051

gnutls.library.functions.gnutls_openpgp_crt_import(

2052

crt, ctypes.byref(datum),

2053

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1834

(gnutls.library.functions

1835

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1836

gnutls.library.constants

1837

.GNUTLS_OPENPGP_FMT_RAW))

2054

1838

# Verify the self signature in the key

2055

1839

crtverify = ctypes.c_uint()

2056

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

2057

crt, 0, ctypes.byref(crtverify))

1840

(gnutls.library.functions

1841

.gnutls_openpgp_crt_verify_self(crt, 0,

1842

ctypes.byref(crtverify)))

2058

1843

if crtverify.value != 0:

2059

1844

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2060

raise gnutls.errors.CertificateSecurityError(

2061

"Verify failed")

1845

raise (gnutls.errors.CertificateSecurityError

1846

("Verify failed"))

2062

1847

# New buffer for the fingerprint

2063

1848

buf = ctypes.create_string_buffer(20)

2064

1849

buf_len = ctypes.c_size_t()

2065

1850

# Get the fingerprint from the certificate into the buffer

2066

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

2067

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1851

(gnutls.library.functions

1852

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1853

ctypes.byref(buf_len)))

2068

1854

# Deinit the certificate

2069

1855

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2070

1856

# Convert the buffer to a Python bytestring

2076

1862

2077

1863

class MultiprocessingMixIn(object):

2078

1864

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2079

2080

1865

def sub_process_main(self, request, address):

2081

1866

try:

2082

1867

self.finish_request(request, address)

2094

1879

2095

1880

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2096

1881

""" adds a pipe to the MixIn """

2097

2098

1882

def process_request(self, request, client_address):

2099

1883

"""Overrides and wraps the original process_request().

2100

1884

2121

1905

interface: None or a network interface name (string)

2122

1906

use_ipv6: Boolean; to use IPv6 or not

2123

1907

"""

2124

2125

1908

def __init__(self, server_address, RequestHandlerClass,

2126

interface=None,

2127

use_ipv6=True,

2128

socketfd=None):

1909

interface=None, use_ipv6=True, socketfd=None):

2129

1910

"""If socketfd is set, use that file descriptor instead of

2130

1911

creating a new one with socket.socket().

2131

1912

"""

2172

1953

self.interface)

2173

1954

else:

2174

1955

try:

2175

self.socket.setsockopt(

2176

socket.SOL_SOCKET, SO_BINDTODEVICE,

2177

(self.interface + "\0").encode("utf-8"))

1956

self.socket.setsockopt(socket.SOL_SOCKET,

1957

SO_BINDTODEVICE,

1958

(self.interface + "\0")

1959

.encode("utf-8"))

2178

1960

except socket.error as error:

2179

1961

if error.errno == errno.EPERM:

2180

1962

logger.error("No permission to bind to"

2198

1980

self.server_address = (any_address,

2199

1981

self.server_address[1])

2200

1982

elif not self.server_address[1]:

2201

self.server_address = (self.server_address[0], 0)

1983

self.server_address = (self.server_address[0],

1984

0)

2202

1985

# if self.interface:

2203

1986

# self.server_address = (self.server_address[0],

2204

1987

# 0, # port

2218

2001

2219

2002

Assumes a gobject.MainLoop event loop.

2220

2003

"""

2221

2222

2004

def __init__(self, server_address, RequestHandlerClass,

2223

interface=None,

2224

use_ipv6=True,

2225

clients=None,

2226

gnutls_priority=None,

2227

use_dbus=True,

2228

socketfd=None):

2005

interface=None, use_ipv6=True, clients=None,

2006

gnutls_priority=None, use_dbus=True, socketfd=None):

2229

2007

self.enabled = False

2230

2008

self.clients = clients

2231

2009

if self.clients is None:

2237

2015

interface = interface,

2238

2016

use_ipv6 = use_ipv6,

2239

2017

socketfd = socketfd)

2240

2241

2018

def server_activate(self):

2242

2019

if self.enabled:

2243

2020

return socketserver.TCPServer.server_activate(self)

2247

2024

2248

2025

def add_pipe(self, parent_pipe, proc):

2249

2026

# Call "handle_ipc" for both data and EOF events

2250

gobject.io_add_watch(

2251

parent_pipe.fileno(),

2252

gobject.IO_IN | gobject.IO_HUP,

2253

functools.partial(self.handle_ipc,

2254

parent_pipe = parent_pipe,

2255

proc = proc))

2027

gobject.io_add_watch(parent_pipe.fileno(),

2028

gobject.IO_IN | gobject.IO_HUP,

2029

functools.partial(self.handle_ipc,

2030

parent_pipe =

2031

parent_pipe,

2032

proc = proc))

2256

2033

2257

def handle_ipc(self, source, condition,

2258

parent_pipe=None,

2259

proc = None,

2260

client_object=None):

2034

def handle_ipc(self, source, condition, parent_pipe=None,

2035

proc = None, client_object=None):

2261

2036

# error, or the other end of multiprocessing.Pipe has closed

2262

2037

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2263

2038

# Wait for other process to exit

2286

2061

parent_pipe.send(False)

2287

2062

return False

2288

2063

2289

gobject.io_add_watch(

2290

parent_pipe.fileno(),

2291

gobject.IO_IN | gobject.IO_HUP,

2292

functools.partial(self.handle_ipc,

2293

parent_pipe = parent_pipe,

2294

proc = proc,

2295

client_object = client))

2064

gobject.io_add_watch(parent_pipe.fileno(),

2065

gobject.IO_IN | gobject.IO_HUP,

2066

functools.partial(self.handle_ipc,

2067

parent_pipe =

2068

parent_pipe,

2069

proc = proc,

2070

client_object =

2071

client))

2296

2072

parent_pipe.send(True)

2297

2073

# remove the old hook in favor of the new above hook on

2298

2074

# same fileno

2304

2080

2305

2081

parent_pipe.send(('data', getattr(client_object,

2306

2082

funcname)(*args,

2307

**kwargs)))

2083

**kwargs)))

2308

2084

2309

2085

if command == 'getattr':

2310

2086

attrname = request[1]

2311

if isinstance(client_object.__getattribute__(attrname),

2312

collections.Callable):

2313

parent_pipe.send(('function', ))

2087

if callable(client_object.__getattribute__(attrname)):

2088

parent_pipe.send(('function',))

2314

2089

else:

2315

parent_pipe.send((

2316

'data', client_object.__getattribute__(attrname)))

2090

parent_pipe.send(('data', client_object

2091

.__getattribute__(attrname)))

2317

2092

2318

2093

if command == 'setattr':

2319

2094

attrname = request[1]

2350

2125

# avoid excessive use of external libraries.

2351

2126

2352

2127

# New type for defining tokens, syntax, and semantics all-in-one

2353

Token = collections.namedtuple("Token", (

2354

"regexp", # To match token; if "value" is not None, must have

2355

# a "group" containing digits

2356

"value", # datetime.timedelta or None

2357

"followers")) # Tokens valid after this token

2128

Token = collections.namedtuple("Token",

2129

("regexp", # To match token; if

2130

# "value" is not None,

2131

# must have a "group"

2132

# containing digits

2133

"value", # datetime.timedelta or

2134

# None

2135

"followers")) # Tokens valid after

2136

# this token

2358

2137

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2359

2138

# the "duration" ABNF definition in RFC 3339, Appendix A.

2360

2139

token_end = Token(re.compile(r"$"), None, frozenset())

2361

2140

token_second = Token(re.compile(r"(\d+)S"),

2362

2141

datetime.timedelta(seconds=1),

2363

frozenset((token_end, )))

2142

frozenset((token_end,)))

2364

2143

token_minute = Token(re.compile(r"(\d+)M"),

2365

2144

datetime.timedelta(minutes=1),

2366

2145

frozenset((token_second, token_end)))

2382

2161

frozenset((token_month, token_end)))

2383

2162

token_week = Token(re.compile(r"(\d+)W"),

2384

2163

datetime.timedelta(weeks=1),

2385

frozenset((token_end, )))

2164

frozenset((token_end,)))

2386

2165

token_duration = Token(re.compile(r"P"), None,

2387

2166

frozenset((token_year, token_month,

2388

2167

token_day, token_time,

2390

2169

# Define starting values

2391

2170

value = datetime.timedelta() # Value so far

2392

2171

found_token = None

2393

followers = frozenset((token_duration, )) # Following valid tokens

2172

followers = frozenset((token_duration,)) # Following valid tokens

2394

2173

s = duration # String left to parse

2395

2174

# Loop until end token is found

2396

2175

while found_token is not token_end:

2413

2192

break

2414

2193

else:

2415

2194

# No currently valid tokens were found

2416

raise ValueError("Invalid RFC 3339 duration: {!r}"

2417

.format(duration))

2195

raise ValueError("Invalid RFC 3339 duration")

2418

2196

# End token found

2419

2197

return value

2420

2198

2457

2235

elif suffix == "w":

2458

2236

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2459

2237

else:

2460

raise ValueError("Unknown suffix {!r}".format(suffix))

2238

raise ValueError("Unknown suffix {!r}"

2239

.format(suffix))

2461

2240

except IndexError as e:

2462

2241

raise ValueError(*(e.args))

2463

2242

timevalue += delta

2479

2258

# Close all standard open file descriptors

2480

2259

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2481

2260

if not stat.S_ISCHR(os.fstat(null).st_mode):

2482

raise OSError(errno.ENODEV,

2483

"{} not a character device"

2261

raise OSError(errno.ENODEV, "{} not a character device"

2484

2262

.format(os.devnull))

2485

2263

os.dup2(null, sys.stdin.fileno())

2486

2264

os.dup2(null, sys.stdout.fileno())

2552

2330

"port": "",

2553

2331

"debug": "False",

2554

2332

"priority":

2555

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2556

":+SIGN-DSA-SHA256",

2333

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2557

2334

"servicename": "Mandos",

2558

2335

"use_dbus": "True",

2559

2336

"use_ipv6": "True",

2563

2340

"statedir": "/var/lib/mandos",

2564

2341

"foreground": "False",

2565

2342

"zeroconf": "True",

2566

}

2343

}

2567

2344

2568

2345

# Parse config file for server-global settings

2569

2346

server_config = configparser.SafeConfigParser(server_defaults)

2570

2347

del server_defaults

2571

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2348

server_config.read(os.path.join(options.configdir,

2349

"mandos.conf"))

2572

2350

# Convert the SafeConfigParser object to a dict

2573

2351

server_settings = server_config.defaults()

2574

2352

# Use the appropriate methods on the non-string config options

2592

2370

# Override the settings from the config file with command line

2593

2371

# options, if set.

2594

2372

for option in ("interface", "address", "port", "debug",

2595

"priority", "servicename", "configdir", "use_dbus",

2596

"use_ipv6", "debuglevel", "restore", "statedir",

2597

"socket", "foreground", "zeroconf"):

2373

"priority", "servicename", "configdir",

2374

"use_dbus", "use_ipv6", "debuglevel", "restore",

2375

"statedir", "socket", "foreground", "zeroconf"):

2598

2376

value = getattr(options, option)

2599

2377

if value is not None:

2600

2378

server_settings[option] = value

2615

2393

2616

2394

##################################################################

2617

2395

2618

if (not server_settings["zeroconf"]

2619

and not (server_settings["port"]

2620

or server_settings["socket"] != "")):

2621

parser.error("Needs port or socket to work without Zeroconf")

2396

if (not server_settings["zeroconf"] and

2397

not (server_settings["port"]

2398

or server_settings["socket"] != "")):

2399

parser.error("Needs port or socket to work without"

2400

" Zeroconf")

2622

2401

2623

2402

# For convenience

2624

2403

debug = server_settings["debug"]

2640

2419

initlogger(debug, level)

2641

2420

2642

2421

if server_settings["servicename"] != "Mandos":

2643

syslogger.setFormatter(

2644

logging.Formatter('Mandos ({}) [%(process)d]:'

2645

' %(levelname)s: %(message)s'.format(

2646

server_settings["servicename"])))

2422

syslogger.setFormatter(logging.Formatter

2423

('Mandos ({}) [%(process)d]:'

2424

' %(levelname)s: %(message)s'

2425

.format(server_settings

2426

["servicename"])))

2647

2427

2648

2428

# Parse config file with clients

2649

2429

client_config = configparser.SafeConfigParser(Client

2657

2437

socketfd = None

2658

2438

if server_settings["socket"] != "":

2659

2439

socketfd = server_settings["socket"]

2660

tcp_server = MandosServer(

2661

(server_settings["address"], server_settings["port"]),

2662

ClientHandler,

2663

interface=(server_settings["interface"] or None),

2664

use_ipv6=use_ipv6,

2665

gnutls_priority=server_settings["priority"],

2666

use_dbus=use_dbus,

2667

socketfd=socketfd)

2440

tcp_server = MandosServer((server_settings["address"],

2441

server_settings["port"]),

2442

ClientHandler,

2443

interface=(server_settings["interface"]

2444

or None),

2445

use_ipv6=use_ipv6,

2446

gnutls_priority=

2447

server_settings["priority"],

2448

use_dbus=use_dbus,

2449

socketfd=socketfd)

2668

2450

if not foreground:

2669

2451

pidfilename = "/run/mandos.pid"

2670

2452

if not os.path.isdir("/run/."):

2671

2453

pidfilename = "/var/run/mandos.pid"

2672

2454

pidfile = None

2673

2455

try:

2674

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2456

pidfile = open(pidfilename, "w")

2675

2457

except IOError as e:

2676

2458

logger.error("Could not open file %r", pidfilename,

2677

2459

exc_info=e)

2704

2486

def debug_gnutls(level, string):

2705

2487

logger.debug("GnuTLS: %s", string[:-1])

2706

2488

2707

gnutls.library.functions.gnutls_global_set_log_function(

2708

debug_gnutls)

2489

(gnutls.library.functions

2490

.gnutls_global_set_log_function(debug_gnutls))

2709

2491

2710

2492

# Redirect stdin so all checkers get /dev/null

2711

2493

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2731

2513

if use_dbus:

2732

2514

try:

2733

2515

bus_name = dbus.service.BusName("se.recompile.Mandos",

2734

bus,

2735

do_not_queue=True)

2736

old_bus_name = dbus.service.BusName(

2737

"se.bsnet.fukt.Mandos", bus,

2738

do_not_queue=True)

2739

except dbus.exceptions.DBusException as e:

2516

bus, do_not_queue=True)

2517

old_bus_name = (dbus.service.BusName

2518

("se.bsnet.fukt.Mandos", bus,

2519

do_not_queue=True))

2520

except dbus.exceptions.NameExistsException as e:

2740

2521

logger.error("Disabling D-Bus:", exc_info=e)

2741

2522

use_dbus = False

2742

2523

server_settings["use_dbus"] = False

2743

2524

tcp_server.use_dbus = False

2744

2525

if zeroconf:

2745

2526

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2746

service = AvahiServiceToSyslog(

2747

name = server_settings["servicename"],

2748

servicetype = "_mandos._tcp",

2749

protocol = protocol,

2750

bus = bus)

2527

service = AvahiServiceToSyslog(name =

2528

server_settings["servicename"],

2529

servicetype = "_mandos._tcp",

2530

protocol = protocol, bus = bus)

2751

2531

if server_settings["interface"]:

2752

service.interface = if_nametoindex(

2753

server_settings["interface"].encode("utf-8"))

2532

service.interface = (if_nametoindex

2533

(server_settings["interface"]

2534

.encode("utf-8")))

2754

2535

2755

2536

global multiprocessing_manager

2756

2537

multiprocessing_manager = multiprocessing.Manager()

2775

2556

if server_settings["restore"]:

2776

2557

try:

2777

2558

with open(stored_state_path, "rb") as stored_state:

2778

clients_data, old_client_settings = pickle.load(

2779

stored_state)

2559

clients_data, old_client_settings = (pickle.load

2560

(stored_state))

2780

2561

os.remove(stored_state_path)

2781

2562

except IOError as e:

2782

2563

if e.errno == errno.ENOENT:

2783

logger.warning("Could not load persistent state:"

2784

" {}".format(os.strerror(e.errno)))

2564

logger.warning("Could not load persistent state: {}"

2565

.format(os.strerror(e.errno)))

2785

2566

else:

2786

2567

logger.critical("Could not load persistent state:",

2787

2568

exc_info=e)

2788

2569

raise

2789

2570

except EOFError as e:

2790

2571

logger.warning("Could not load persistent state: "

2791

"EOFError:",

2792

exc_info=e)

2572

"EOFError:", exc_info=e)

2793

2573

2794

2574

with PGPEngine() as pgp:

2795

2575

for client_name, client in clients_data.items():

2807

2587

# For each value in new config, check if it

2808

2588

# differs from the old config value (Except for

2809

2589

# the "secret" attribute)

2810

if (name != "secret"

2811

and (value !=

2812

old_client_settings[client_name][name])):

2590

if (name != "secret" and

2591

value != old_client_settings[client_name]

2592

[name]):

2813

2593

client[name] = value

2814

2594

except KeyError:

2815

2595

pass

2816

2596

2817

2597

# Clients who has passed its expire date can still be

2818

# enabled if its last checker was successful. A Client

2598

# enabled if its last checker was successful. Clients

2819

2599

# whose checker succeeded before we stored its state is

2820

2600

# assumed to have successfully run all checkers during

2821

2601

# downtime.

2824

2604

if not client["last_checked_ok"]:

2825

2605

logger.warning(

2826

2606

"disabling client {} - Client never "

2827

"performed a successful checker".format(

2828

client_name))

2607

"performed a successful checker"

2608

.format(client_name))

2829

2609

client["enabled"] = False

2830

2610

elif client["last_checker_status"] != 0:

2831

2611

logger.warning(

2832

2612

"disabling client {} - Client last"

2833

" checker failed with error code"

2834

" {}".format(

2835

client_name,

2836

client["last_checker_status"]))

2613

" checker failed with error code {}"

2614

.format(client_name,

2615

client["last_checker_status"]))

2837

2616

client["enabled"] = False

2838

2617

else:

2839

client["expires"] = (

2840

datetime.datetime.utcnow()

2841

+ client["timeout"])

2618

client["expires"] = (datetime.datetime

2619

.utcnow()

2620

+ client["timeout"])

2842

2621

logger.debug("Last checker succeeded,"

2843

" keeping {} enabled".format(

2844

client_name))

2622

" keeping {} enabled"

2623

.format(client_name))

2845

2624

try:

2846

client["secret"] = pgp.decrypt(

2847

client["encrypted_secret"],

2848

client_settings[client_name]["secret"])

2625

client["secret"] = (

2626

pgp.decrypt(client["encrypted_secret"],

2627

client_settings[client_name]

2628

["secret"]))

2849

2629

except PGPError:

2850

2630

# If decryption fails, we use secret from new settings

2851

logger.debug("Failed to decrypt {} old secret".format(

2852

client_name))

2853

client["secret"] = (client_settings[client_name]

2854

["secret"])

2631

logger.debug("Failed to decrypt {} old secret"

2632

.format(client_name))

2633

client["secret"] = (

2634

client_settings[client_name]["secret"])

2855

2635

2856

2636

# Add/remove clients based on new changes made to config

2857

2637

for client_name in (set(old_client_settings)

2864

2644

# Create all client objects

2865

2645

for client_name, client in clients_data.items():

2866

2646

tcp_server.clients[client_name] = client_class(

2867

name = client_name,

2868

settings = client,

2647

name = client_name, settings = client,

2869

2648

server_settings = server_settings)

2870

2649

2871

2650

if not tcp_server.clients:

2873

2652

2874

2653

if not foreground:

2875

2654

if pidfile is not None:

2876

pid = os.getpid()

2877

2655

try:

2878

2656

with pidfile:

2879

print(pid, file=pidfile)

2657

pid = os.getpid()

2658

pidfile.write("{}\n".format(pid).encode("utf-8"))

2880

2659

except IOError:

2881

2660

logger.error("Could not write to file %r with PID %d",

2882

2661

pidfilename, pid)

2887

2666

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2888

2667

2889

2668

if use_dbus:

2890

2891

@alternate_dbus_interfaces(

2892

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2893

class MandosDBusService(DBusObjectWithObjectManager):

2669

@alternate_dbus_interfaces({"se.recompile.Mandos":

2670

"se.bsnet.fukt.Mandos"})

2671

class MandosDBusService(DBusObjectWithProperties):

2894

2672

"""A D-Bus proxy object"""

2895

2896

2673

def __init__(self):

2897

2674

dbus.service.Object.__init__(self, bus, "/")

2898

2899

2675

_interface = "se.recompile.Mandos"

2900

2676

2677

@dbus_interface_annotations(_interface)

2678

def _foo(self):

2679

return { "org.freedesktop.DBus.Property"

2680

".EmitsChangedSignal":

2681

"false"}

2682

2901

2683

@dbus.service.signal(_interface, signature="o")

2902

2684

def ClientAdded(self, objpath):

2903

2685

"D-Bus signal"

2908

2690

"D-Bus signal"

2909

2691

pass

2910

2692

2911

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2912

"true"})

2913

2693

@dbus.service.signal(_interface, signature="os")

2914

2694

def ClientRemoved(self, objpath, name):

2915

2695

"D-Bus signal"

2916

2696

pass

2917

2697

2918

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2919

"true"})

2920

2698

@dbus.service.method(_interface, out_signature="ao")

2921

2699

def GetAllClients(self):

2922

2700

"D-Bus method"

2923

return dbus.Array(c.dbus_object_path for c in

2701

return dbus.Array(c.dbus_object_path

2702

for c in

2924

2703

tcp_server.clients.itervalues())

2925

2704

2926

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2927

"true"})

2928

2705

@dbus.service.method(_interface,

2929

2706

out_signature="a{oa{sv}}")

2930

2707

def GetAllClientsWithProperties(self):

2931

2708

"D-Bus method"

2932

2709

return dbus.Dictionary(

2933

{ c.dbus_object_path: c.GetAll(

2934

"se.recompile.Mandos.Client")

2935

for c in tcp_server.clients.itervalues() },

2710

((c.dbus_object_path, c.GetAll(""))

2711

for c in tcp_server.clients.itervalues()),

2936

2712

signature="oa{sv}")

2937

2713

2938

2714

@dbus.service.method(_interface, in_signature="o")

2942

2718

if c.dbus_object_path == object_path:

2943

2719

del tcp_server.clients[c.name]

2944

2720

c.remove_from_connection()

2945

# Don't signal the disabling

2721

# Don't signal anything except ClientRemoved

2946

2722

c.disable(quiet=True)

2947

# Emit D-Bus signal for removal

2948

self.client_removed_signal(c)

2723

# Emit D-Bus signal

2724

self.ClientRemoved(object_path, c.name)

2949

2725

return

2950

2726

raise KeyError(object_path)

2951

2727

2952

2728

del _interface

2953

2954

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

2955

out_signature = "a{oa{sa{sv}}}")

2956

def GetManagedObjects(self):

2957

"""D-Bus method"""

2958

return dbus.Dictionary(

2959

{ client.dbus_object_path:

2960

dbus.Dictionary(

2961

{ interface: client.GetAll(interface)

2962

for interface in

2963

client._get_all_interface_names()})

2964

for client in tcp_server.clients.values()})

2965

2966

def client_added_signal(self, client):

2967

"""Send the new standard signal and the old signal"""

2968

if use_dbus:

2969

# New standard signal

2970

self.InterfacesAdded(

2971

client.dbus_object_path,

2972

dbus.Dictionary(

2973

{ interface: client.GetAll(interface)

2974

for interface in

2975

client._get_all_interface_names()}))

2976

# Old signal

2977

self.ClientAdded(client.dbus_object_path)

2978

2979

def client_removed_signal(self, client):

2980

"""Send the new standard signal and the old signal"""

2981

if use_dbus:

2982

# New standard signal

2983

self.InterfacesRemoved(

2984

client.dbus_object_path,

2985

client._get_all_interface_names())

2986

# Old signal

2987

self.ClientRemoved(client.dbus_object_path,

2988

client.name)

2989

2729

2990

2730

mandos_dbus_service = MandosDBusService()

2991

2731

3014

2754

# + secret.

3015

2755

exclude = { "bus", "changedstate", "secret",

3016

2756

"checker", "server_settings" }

3017

for name, typ in inspect.getmembers(dbus.service

3018

.Object):

2757

for name, typ in (inspect.getmembers

2758

(dbus.service.Object)):

3019

2759

exclude.add(name)

3020

2760

3021

2761

client_dict["encrypted_secret"] = (client

3028

2768

del client_settings[client.name]["secret"]

3029

2769

3030

2770

try:

3031

with tempfile.NamedTemporaryFile(

3032

mode='wb',

3033

suffix=".pickle",

3034

prefix='clients-',

3035

dir=os.path.dirname(stored_state_path),

3036

delete=False) as stored_state:

2771

with (tempfile.NamedTemporaryFile

2772

(mode='wb', suffix=".pickle", prefix='clients-',

2773

dir=os.path.dirname(stored_state_path),

2774

delete=False)) as stored_state:

3037

2775

pickle.dump((clients, client_settings), stored_state)

3038

tempname = stored_state.name

2776

tempname=stored_state.name

3039

2777

os.rename(tempname, stored_state_path)

3040

2778

except (IOError, OSError) as e:

3041

2779

if not debug:

3056

2794

name, client = tcp_server.clients.popitem()

3057

2795

if use_dbus:

3058

2796

client.remove_from_connection()

3059

# Don't signal the disabling

2797

# Don't signal anything except ClientRemoved

3060

2798

client.disable(quiet=True)

3061

# Emit D-Bus signal for removal

3062

mandos_dbus_service.client_removed_signal(client)

2799

if use_dbus:

2800

# Emit D-Bus signal

2801

mandos_dbus_service.ClientRemoved(client

2802

.dbus_object_path,

2803

client.name)

3063

2804

client_settings.clear()

3064

2805

3065

2806

atexit.register(cleanup)

3066

2807

3067

2808

for client in tcp_server.clients.itervalues():

3068

2809

if use_dbus:

3069

# Emit D-Bus signal for adding

3070

mandos_dbus_service.client_added_signal(client)

2810

# Emit D-Bus signal

2811

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3071

2812

# Need to initiate checking of clients

3072

2813

if client.enabled:

3073

2814

client.init_checker()

3118

2859

# Must run before the D-Bus bus name gets deregistered

3119

2860

cleanup()

3120

2861

3121

3122

2862

if __name__ == '__main__':

3123

2863

main()