/mandos/trunk : revision 729

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

39

import SocketServer as socketserver

43

40

import socket

44

41

import argparse

45

42

import datetime

50

47

import gnutls.library.functions

51

48

import gnutls.library.constants

52

49

import gnutls.library.types

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

50

import ConfigParser as configparser

57

51

import sys

58

52

import re

59

53

import os

68

62

import struct

69

63

import fcntl

70

64

import functools

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

65

import cPickle as pickle

75

66

import multiprocessing

76

67

import types

77

68

import binascii

78

69

import tempfile

79

70

import itertools

80

71

import collections

81

import codecs

82

72

83

73

import dbus

84

74

import dbus.service

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

75

import gobject

89

76

import avahi

90

77

from dbus.mainloop.glib import DBusGMainLoop

91

78

import ctypes

101

88

except ImportError:

102

89

SO_BINDTODEVICE = None

103

90

104

if sys.version_info.major == 2:

105

str = unicode

106

107

version = "1.7.0"

91

version = "1.6.8"

108

92

stored_state_file = "clients.pickle"

109

93

110

94

logger = logging.getLogger()

111

95

syslogger = None

112

96

113

97

try:

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

116

101

except (OSError, AttributeError):

117

118

102

def if_nametoindex(interface):

119

103

"Get an interface index the hard way, i.e. using fcntl()"

120

104

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

129

113

"""init logger and add loglevel"""

130

114

131

115

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

116

syslogger = (logging.handlers.SysLogHandler

117

(facility =

118

logging.handlers.SysLogHandler.LOG_DAEMON,

119

address = "/dev/log"))

135

120

syslogger.setFormatter(logging.Formatter

136

121

('Mandos [%(process)d]: %(levelname)s:'

137

122

' %(message)s'))

154

139

155

140

class PGPEngine(object):

156

141

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

158

142

def __init__(self):

159

143

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

160

144

self.gnupgargs = ['--batch',

199

183

200

184

def encrypt(self, data, password):

201

185

passphrase = self.password_encode(password)

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

186

with tempfile.NamedTemporaryFile(dir=self.tempdir

187

) as passfile:

204

188

passfile.write(passphrase)

205

189

passfile.flush()

206

190

proc = subprocess.Popen(['gpg', '--symmetric',

217

201

218

202

def decrypt(self, data, password):

219

203

passphrase = self.password_encode(password)

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

204

with tempfile.NamedTemporaryFile(dir = self.tempdir

205

) as passfile:

222

206

passfile.write(passphrase)

223

207

passfile.flush()

224

208

proc = subprocess.Popen(['gpg', '--decrypt',

228

212

stdin = subprocess.PIPE,

229

213

stdout = subprocess.PIPE,

230

214

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

215

decrypted_plaintext, err = proc.communicate(input

216

= data)

232

217

if proc.returncode != 0:

233

218

raise PGPError(err)

234

219

return decrypted_plaintext

240

225

return super(AvahiError, self).__init__(value, *args,

241

226

**kwargs)

242

227

243

244

228

class AvahiServiceError(AvahiError):

245

229

pass

246

230

247

248

231

class AvahiGroupError(AvahiError):

249

232

pass

250

233

270

253

bus: dbus.SystemBus()

271

254

"""

272

255

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

256

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

257

servicetype = None, port = None, TXT = None,

258

domain = "", host = "", max_renames = 32768,

259

protocol = avahi.PROTO_UNSPEC, bus = None):

284

260

self.interface = interface

285

261

self.name = name

286

262

self.type = servicetype

296

272

self.bus = bus

297

273

self.entry_group_state_changed_match = None

298

274

299

def rename(self, remove=True):

275

def rename(self):

300

276

"""Derived from the Avahi example code"""

301

277

if self.rename_count >= self.max_renames:

302

278

logger.critical("No suitable Zeroconf service name found"

303

279

" after %i retries, exiting.",

304

280

self.rename_count)

305

281

raise AvahiServiceError("Too many renames")

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

282

self.name = unicode(self.server

283

.GetAlternativeServiceName(self.name))

309

284

logger.info("Changing Zeroconf service name to %r ...",

310

285

self.name)

311

if remove:

312

self.remove()

286

self.remove()

313

287

try:

314

288

self.add()

315

289

except dbus.exceptions.DBusException as error:

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

290

logger.critical("D-Bus Exception", exc_info=error)

291

self.cleanup()

292

os._exit(1)

293

self.rename_count += 1

324

294

325

295

def remove(self):

326

296

"""Derived from the Avahi example code"""

364

334

self.rename()

365

335

elif state == avahi.ENTRY_GROUP_FAILURE:

366

336

logger.critical("Avahi: Error in group state changed %s",

367

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

337

unicode(error))

338

raise AvahiGroupError("State changed: {!s}"

339

.format(error))

369

340

370

341

def cleanup(self):

371

342

"""Derived from the Avahi example code"""

381

352

def server_state_changed(self, state, error=None):

382

353

"""Derived from the Avahi example code"""

383

354

logger.debug("Avahi server state change: %i", state)

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

355

bad_states = { avahi.SERVER_INVALID:

356

"Zeroconf server invalid",

357

avahi.SERVER_REGISTERING: None,

358

avahi.SERVER_COLLISION:

359

"Zeroconf server name collision",

360

avahi.SERVER_FAILURE:

361

"Zeroconf server failure" }

390

362

if state in bad_states:

391

363

if bad_states[state] is not None:

392

364

if error is None:

395

367

logger.error(bad_states[state] + ": %r", error)

396

368

self.cleanup()

397

369

elif state == avahi.SERVER_RUNNING:

398

try:

399

self.add()

400

except dbus.exceptions.DBusException as error:

401

if (error.get_dbus_name()

402

== "org.freedesktop.Avahi.CollisionError"):

403

logger.info("Local Zeroconf service name"

404

" collision.")

405

return self.rename(remove=False)

406

else:

407

logger.critical("D-Bus Exception", exc_info=error)

408

self.cleanup()

409

os._exit(1)

370

self.add()

410

371

else:

411

372

if error is None:

412

373

logger.debug("Unknown state: %r", state)

422

383

follow_name_owner_changes=True),

423

384

avahi.DBUS_INTERFACE_SERVER)

424

385

self.server.connect_to_signal("StateChanged",

425

self.server_state_changed)

386

self.server_state_changed)

426

387

self.server_state_changed(self.server.GetState())

427

388

428

389

429

390

class AvahiServiceToSyslog(AvahiService):

430

def rename(self, *args, **kwargs):

391

def rename(self):

431

392

"""Add the new name to the syslog messages"""

432

ret = AvahiService.rename(self, *args, **kwargs)

433

syslogger.setFormatter(logging.Formatter(

434

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

435

.format(self.name)))

393

ret = AvahiService.rename(self)

394

syslogger.setFormatter(logging.Formatter

395

('Mandos ({}) [%(process)d]:'

396

' %(levelname)s: %(message)s'

397

.format(self.name)))

436

398

return ret

437

399

438

def call_pipe(connection, # : multiprocessing.Connection

439

func, *args, **kwargs):

440

"""This function is meant to be called by multiprocessing.Process

441

442

This function runs func(*args, **kwargs), and writes the resulting

443

return value on the provided multiprocessing.Connection.

444

"""

445

connection.send(func(*args, **kwargs))

446

connection.close()

447

400

448

401

class Client(object):

449

402

"""A representation of a client host served by this server.

476

429

last_checker_status: integer between 0 and 255 reflecting exit

477

430

status of last checker. -1 reflects crashed

478

431

checker, -2 means no checker completed yet.

479

last_checker_signal: The signal which killed the last checker, if

480

last_checker_status is -1

481

432

last_enabled: datetime.datetime(); (UTC) or None

482

433

name: string; from the config file, used in log messages and

483

434

D-Bus identifiers

496

447

"fingerprint", "host", "interval",

497

448

"last_approval_request", "last_checked_ok",

498

449

"last_enabled", "name", "timeout")

499

client_defaults = {

500

"timeout": "PT5M",

501

"extended_timeout": "PT15M",

502

"interval": "PT2M",

503

"checker": "fping -q -- %%(host)s",

504

"host": "",

505

"approval_delay": "PT0S",

506

"approval_duration": "PT1S",

507

"approved_by_default": "True",

508

"enabled": "True",

509

}

450

client_defaults = { "timeout": "PT5M",

451

"extended_timeout": "PT15M",

452

"interval": "PT2M",

453

"checker": "fping -q -- %%(host)s",

454

"host": "",

455

"approval_delay": "PT0S",

456

"approval_duration": "PT1S",

457

"approved_by_default": "True",

458

"enabled": "True",

459

}

510

460

511

461

@staticmethod

512

462

def config_parser(config):

528

478

client["enabled"] = config.getboolean(client_name,

529

479

"enabled")

530

480

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the

533

# fingerprint() function

534

481

client["fingerprint"] = (section["fingerprint"].upper()

535

482

.replace(" ", ""))

536

483

if "secret" in section:

578

525

self.expires = None

579

526

580

527

logger.debug("Creating client %r", self.name)

528

# Uppercase and remove spaces from fingerprint for later

529

# comparison purposes with return value from the fingerprint()

530

# function

581

531

logger.debug(" Fingerprint: %s", self.fingerprint)

582

532

self.created = settings.get("created",

583

533

datetime.datetime.utcnow())

590

540

self.current_checker_command = None

591

541

self.approved = None

592

542

self.approvals_pending = 0

593

self.changedstate = multiprocessing_manager.Condition(

594

multiprocessing_manager.Lock())

595

self.client_structure = [attr

596

for attr in self.__dict__.iterkeys()

543

self.changedstate = (multiprocessing_manager

544

.Condition(multiprocessing_manager

545

.Lock()))

546

self.client_structure = [attr for attr in

547

self.__dict__.iterkeys()

597

548

if not attr.startswith("_")]

598

549

self.client_structure.append("client_structure")

599

550

600

for name, t in inspect.getmembers(

601

type(self), lambda obj: isinstance(obj, property)):

551

for name, t in inspect.getmembers(type(self),

552

lambda obj:

553

isinstance(obj,

554

property)):

602

555

if not name.startswith("_"):

603

556

self.client_structure.append(name)

604

557

646

599

# and every interval from then on.

647

600

if self.checker_initiator_tag is not None:

648

601

gobject.source_remove(self.checker_initiator_tag)

649

self.checker_initiator_tag = gobject.timeout_add(

650

int(self.interval.total_seconds() * 1000),

651

self.start_checker)

602

self.checker_initiator_tag = (gobject.timeout_add

603

(int(self.interval

604

.total_seconds() * 1000),

605

self.start_checker))

652

606

# Schedule a disable() when 'timeout' has passed

653

607

if self.disable_initiator_tag is not None:

654

608

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = gobject.timeout_add(

656

int(self.timeout.total_seconds() * 1000), self.disable)

609

self.disable_initiator_tag = (gobject.timeout_add

610

(int(self.timeout

611

.total_seconds() * 1000),

612

self.disable))

657

613

# Also start a new checker *right now*.

658

614

self.start_checker()

659

615

660

def checker_callback(self, source, condition, connection,

661

command):

616

def checker_callback(self, pid, condition, command):

662

617

"""The checker has completed, so take appropriate actions."""

663

618

self.checker_callback_tag = None

664

619

self.checker = None

665

# Read return code from connection (see call_pipe)

666

returncode = connection.recv()

667

connection.close()

668

669

if returncode >= 0:

670

self.last_checker_status = returncode

671

self.last_checker_signal = None

620

if os.WIFEXITED(condition):

621

self.last_checker_status = os.WEXITSTATUS(condition)

672

622

if self.last_checker_status == 0:

673

623

logger.info("Checker for %(name)s succeeded",

674

624

vars(self))

675

625

self.checked_ok()

676

626

else:

677

logger.info("Checker for %(name)s failed", vars(self))

627

logger.info("Checker for %(name)s failed",

628

vars(self))

678

629

else:

679

630

self.last_checker_status = -1

680

self.last_checker_signal = -returncode

681

631

logger.warning("Checker for %(name)s crashed?",

682

632

vars(self))

683

return False

684

633

685

634

def checked_ok(self):

686

635

"""Assert that the client has been seen, alive and well."""

687

636

self.last_checked_ok = datetime.datetime.utcnow()

688

637

self.last_checker_status = 0

689

self.last_checker_signal = None

690

638

self.bump_timeout()

691

639

692

640

def bump_timeout(self, timeout=None):

697

645

gobject.source_remove(self.disable_initiator_tag)

698

646

self.disable_initiator_tag = None

699

647

if getattr(self, "enabled", False):

700

self.disable_initiator_tag = gobject.timeout_add(

701

int(timeout.total_seconds() * 1000), self.disable)

648

self.disable_initiator_tag = (gobject.timeout_add

649

(int(timeout.total_seconds()

650

* 1000), self.disable))

702

651

self.expires = datetime.datetime.utcnow() + timeout

703

652

704

653

def need_approval(self):

718

667

# than 'timeout' for the client to be disabled, which is as it

719

668

# should be.

720

669

721

if self.checker is not None and not self.checker.is_alive():

722

logger.warning("Checker was not alive; joining")

723

self.checker.join()

724

self.checker = None

670

# If a checker exists, make sure it is not a zombie

671

try:

672

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

673

except AttributeError:

674

pass

675

except OSError as error:

676

if error.errno != errno.ECHILD:

677

raise

678

else:

679

if pid:

680

logger.warning("Checker was a zombie")

681

gobject.source_remove(self.checker_callback_tag)

682

self.checker_callback(pid, status,

683

self.current_checker_command)

725

684

# Start a new checker if needed

726

685

if self.checker is None:

727

686

# Escape attributes for the shell

728

escaped_attrs = {

729

attr: re.escape(str(getattr(self, attr)))

730

for attr in self.runtime_expansions }

687

escaped_attrs = { attr:

688

re.escape(unicode(getattr(self,

689

attr)))

690

for attr in self.runtime_expansions }

731

691

try:

732

692

command = self.checker_command % escaped_attrs

733

693

except TypeError as error:

734

694

logger.error('Could not format string "%s"',

735

self.checker_command,

695

self.checker_command, exc_info=error)

696

return True # Try again later

697

self.current_checker_command = command

698

try:

699

logger.info("Starting checker %r for %s",

700

command, self.name)

701

# We don't need to redirect stdout and stderr, since

702

# in normal mode, that is already done by daemon(),

703

# and in debug mode we don't want to. (Stdin is

704

# always replaced by /dev/null.)

705

# The exception is when not debugging but nevertheless

706

# running in the foreground; use the previously

707

# created wnull.

708

popen_args = {}

709

if (not self.server_settings["debug"]

710

and self.server_settings["foreground"]):

711

popen_args.update({"stdout": wnull,

712

"stderr": wnull })

713

self.checker = subprocess.Popen(command,

714

close_fds=True,

715

shell=True, cwd="/",

716

**popen_args)

717

except OSError as error:

718

logger.error("Failed to start subprocess",

736

719

exc_info=error)

737

return True # Try again later

738

self.current_checker_command = command

739

logger.info("Starting checker %r for %s", command,

740

self.name)

741

# We don't need to redirect stdout and stderr, since

742

# in normal mode, that is already done by daemon(),

743

# and in debug mode we don't want to. (Stdin is

744

# always replaced by /dev/null.)

745

# The exception is when not debugging but nevertheless

746

# running in the foreground; use the previously

747

# created wnull.

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

751

if (not self.server_settings["debug"]

752

and self.server_settings["foreground"]):

753

popen_args.update({"stdout": wnull,

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

756

self.checker = multiprocessing.Process(

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

760

self.checker.start()

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

763

self.checker_callback, pipe[0], command)

720

return True

721

self.checker_callback_tag = (gobject.child_watch_add

722

(self.checker.pid,

723

self.checker_callback,

724

data=command))

725

# The checker may have completed before the gobject

726

# watch was added. Check for this.

727

try:

728

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

729

except OSError as error:

730

if error.errno == errno.ECHILD:

731

# This should never happen

732

logger.error("Child process vanished",

733

exc_info=error)

734

return True

735

raise

736

if pid:

737

gobject.source_remove(self.checker_callback_tag)

738

self.checker_callback(pid, status, command)

764

739

# Re-run this periodically if run by gobject.timeout_add

765

740

return True

766

741

772

747

if getattr(self, "checker", None) is None:

773

748

return

774

749

logger.debug("Stopping checker for %(name)s", vars(self))

775

self.checker.terminate()

750

try:

751

self.checker.terminate()

752

#time.sleep(0.5)

753

#if self.checker.poll() is None:

754

# self.checker.kill()

755

except OSError as error:

756

if error.errno != errno.ESRCH: # No such process

757

raise

776

758

self.checker = None

777

759

778

760

779

def dbus_service_property(dbus_interface,

780

signature="v",

781

access="readwrite",

782

byte_arrays=False):

761

def dbus_service_property(dbus_interface, signature="v",

762

access="readwrite", byte_arrays=False):

783

763

"""Decorators for marking methods of a DBusObjectWithProperties to

784

764

become properties on the D-Bus.

785

765

795

775

if byte_arrays and signature != "ay":

796

776

raise ValueError("Byte arrays not supported for non-'ay'"

797

777

" signature {!r}".format(signature))

798

799

778

def decorator(func):

800

779

func._dbus_is_property = True

801

780

func._dbus_interface = dbus_interface

806

785

func._dbus_name = func._dbus_name[:-14]

807

786

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

808

787

return func

809

810

788

return decorator

811

789

812

790

821

799

"org.freedesktop.DBus.Property.EmitsChangedSignal":

822

800

"false"}

823

801

"""

824

825

802

def decorator(func):

826

803

func._dbus_is_interface = True

827

804

func._dbus_interface = dbus_interface

828

805

func._dbus_name = dbus_interface

829

806

return func

830

831

807

return decorator

832

808

833

809

835

811

"""Decorator to annotate D-Bus methods, signals or properties

836

812

Usage:

837

813

838

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

841

814

@dbus_service_property("org.example.Interface", signature="b",

842

815

access="r")

816

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

817

"org.freedesktop.DBus.Property."

818

"EmitsChangedSignal": "false"})

843

819

def Property_dbus_property(self):

844

820

return dbus.Boolean(False)

845

846

See also the DBusObjectWithAnnotations class.

847

821

"""

848

849

822

def decorator(func):

850

823

func._dbus_annotations = annotations

851

824

return func

852

853

825

return decorator

854

826

855

827

858

830

"""

859

831

pass

860

832

861

862

833

class DBusPropertyAccessException(DBusPropertyException):

863

834

"""A property's access permissions disallows an operation.

864

835

"""

871

842

pass

872

843

873

844

874

class DBusObjectWithAnnotations(dbus.service.Object):

875

"""A D-Bus object with annotations.

845

class DBusObjectWithProperties(dbus.service.Object):

846

"""A D-Bus object with properties.

876

847

877

Classes inheriting from this can use the dbus_annotations

878

decorator to add annotations to methods or signals.

848

Classes inheriting from this can use the dbus_service_property

849

decorator to expose methods as D-Bus properties. It exposes the

850

standard Get(), Set(), and GetAll() methods on the D-Bus.

879

851

"""

880

852

881

853

@staticmethod

891

863

def _get_all_dbus_things(self, thing):

892

864

"""Returns a generator of (name, attribute) pairs

893

865

"""

894

return ((getattr(athing.__get__(self), "_dbus_name", name),

866

return ((getattr(athing.__get__(self), "_dbus_name",

867

name),

895

868

athing.__get__(self))

896

869

for cls in self.__class__.__mro__

897

870

for name, athing in

898

inspect.getmembers(cls, self._is_dbus_thing(thing)))

899

900

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

901

out_signature = "s",

902

path_keyword = 'object_path',

903

connection_keyword = 'connection')

904

def Introspect(self, object_path, connection):

905

"""Overloading of standard D-Bus method.

906

907

Inserts annotation tags on methods and signals.

908

"""

909

xmlstring = dbus.service.Object.Introspect(self, object_path,

910

connection)

911

try:

912

document = xml.dom.minidom.parseString(xmlstring)

913

914

for if_tag in document.getElementsByTagName("interface"):

915

# Add annotation tags

916

for typ in ("method", "signal"):

917

for tag in if_tag.getElementsByTagName(typ):

918

annots = dict()

919

for name, prop in (self.

920

_get_all_dbus_things(typ)):

921

if (name == tag.getAttribute("name")

922

and prop._dbus_interface

923

== if_tag.getAttribute("name")):

924

annots.update(getattr(

925

prop, "_dbus_annotations", {}))

926

for name, value in annots.items():

927

ann_tag = document.createElement(

928

"annotation")

929

ann_tag.setAttribute("name", name)

930

ann_tag.setAttribute("value", value)

931

tag.appendChild(ann_tag)

932

# Add interface annotation tags

933

for annotation, value in dict(

934

itertools.chain.from_iterable(

935

annotations().items()

936

for name, annotations

937

in self._get_all_dbus_things("interface")

938

if name == if_tag.getAttribute("name")

939

)).items():

940

ann_tag = document.createElement("annotation")

941

ann_tag.setAttribute("name", annotation)

942

ann_tag.setAttribute("value", value)

943

if_tag.appendChild(ann_tag)

944

# Fix argument name for the Introspect method itself

945

if (if_tag.getAttribute("name")

946

== dbus.INTROSPECTABLE_IFACE):

947

for cn in if_tag.getElementsByTagName("method"):

948

if cn.getAttribute("name") == "Introspect":

949

for arg in cn.getElementsByTagName("arg"):

950

if (arg.getAttribute("direction")

951

== "out"):

952

arg.setAttribute("name",

953

"xml_data")

954

xmlstring = document.toxml("utf-8")

955

document.unlink()

956

except (AttributeError, xml.dom.DOMException,

957

xml.parsers.expat.ExpatError) as error:

958

logger.error("Failed to override Introspection method",

959

exc_info=error)

960

return xmlstring

961

962

963

class DBusObjectWithProperties(DBusObjectWithAnnotations):

964

"""A D-Bus object with properties.

965

966

Classes inheriting from this can use the dbus_service_property

967

decorator to expose methods as D-Bus properties. It exposes the

968

standard Get(), Set(), and GetAll() methods on the D-Bus.

969

"""

871

inspect.getmembers(cls,

872

self._is_dbus_thing(thing)))

970

873

971

874

def _get_dbus_property(self, interface_name, property_name):

972

875

"""Returns a bound method if one exists which is a D-Bus

973

876

property with the specified name and interface.

974

877

"""

975

for cls in self.__class__.__mro__:

976

for name, value in inspect.getmembers(

977

cls, self._is_dbus_thing("property")):

878

for cls in self.__class__.__mro__:

879

for name, value in (inspect.getmembers

880

(cls,

881

self._is_dbus_thing("property"))):

978

882

if (value._dbus_name == property_name

979

883

and value._dbus_interface == interface_name):

980

884

return value.__get__(self)

981

885

982

886

# No such property

983

raise DBusPropertyNotFound("{}:{}.{}".format(

984

self.dbus_object_path, interface_name, property_name))

985

986

@classmethod

987

def _get_all_interface_names(cls):

988

"""Get a sequence of all interfaces supported by an object"""

989

return (name for name in set(getattr(getattr(x, attr),

990

"_dbus_interface", None)

991

for x in (inspect.getmro(cls))

992

for attr in dir(x))

993

if name is not None)

994

995

@dbus.service.method(dbus.PROPERTIES_IFACE,

996

in_signature="ss",

887

raise DBusPropertyNotFound(self.dbus_object_path + ":"

888

+ interface_name + "."

889

+ property_name)

890

891

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

997

892

out_signature="v")

998

893

def Get(self, interface_name, property_name):

999

894

"""Standard D-Bus property Get() method, see D-Bus standard.

1024

919

for byte in value))

1025

920

prop(value)

1026

921

1027

@dbus.service.method(dbus.PROPERTIES_IFACE,

1028

in_signature="s",

922

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1029

923

out_signature="a{sv}")

1030

924

def GetAll(self, interface_name):

1031

925

"""Standard D-Bus property GetAll() method, see D-Bus

1046

940

if not hasattr(value, "variant_level"):

1047

941

properties[name] = value

1048

942

continue

1049

properties[name] = type(value)(

1050

value, variant_level = value.variant_level + 1)

943

properties[name] = type(value)(value, variant_level=

944

value.variant_level+1)

1051

945

return dbus.Dictionary(properties, signature="sv")

1052

946

1053

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1054

def PropertiesChanged(self, interface_name, changed_properties,

1055

invalidated_properties):

1056

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

1057

standard.

1058

"""

1059

pass

1060

1061

947

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1062

948

out_signature="s",

1063

949

path_keyword='object_path',

1067

953

1068

954

Inserts property tags and interface annotation tags.

1069

955

"""

1070

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1071

object_path,

1072

connection)

956

xmlstring = dbus.service.Object.Introspect(self, object_path,

957

connection)

1073

958

try:

1074

959

document = xml.dom.minidom.parseString(xmlstring)

1075

1076

960

def make_tag(document, name, prop):

1077

961

e = document.createElement("property")

1078

962

e.setAttribute("name", name)

1079

963

e.setAttribute("type", prop._dbus_signature)

1080

964

e.setAttribute("access", prop._dbus_access)

1081

965

return e

1082

1083

966

for if_tag in document.getElementsByTagName("interface"):

1084

967

# Add property tags

1085

968

for tag in (make_tag(document, name, prop)

1088

971

if prop._dbus_interface

1089

972

== if_tag.getAttribute("name")):

1090

973

if_tag.appendChild(tag)

1091

# Add annotation tags for properties

1092

for tag in if_tag.getElementsByTagName("property"):

1093

annots = dict()

1094

for name, prop in self._get_all_dbus_things(

1095

"property"):

1096

if (name == tag.getAttribute("name")

1097

and prop._dbus_interface

1098

== if_tag.getAttribute("name")):

1099

annots.update(getattr(

1100

prop, "_dbus_annotations", {}))

1101

for name, value in annots.items():

1102

ann_tag = document.createElement(

1103

"annotation")

1104

ann_tag.setAttribute("name", name)

1105

ann_tag.setAttribute("value", value)

1106

tag.appendChild(ann_tag)

974

# Add annotation tags

975

for typ in ("method", "signal", "property"):

976

for tag in if_tag.getElementsByTagName(typ):

977

annots = dict()

978

for name, prop in (self.

979

_get_all_dbus_things(typ)):

980

if (name == tag.getAttribute("name")

981

and prop._dbus_interface

982

== if_tag.getAttribute("name")):

983

annots.update(getattr

984

(prop,

985

"_dbus_annotations",

986

{}))

987

for name, value in annots.items():

988

ann_tag = document.createElement(

989

"annotation")

990

ann_tag.setAttribute("name", name)

991

ann_tag.setAttribute("value", value)

992

tag.appendChild(ann_tag)

993

# Add interface annotation tags

994

for annotation, value in dict(

995

itertools.chain.from_iterable(

996

annotations().items()

997

for name, annotations in

998

self._get_all_dbus_things("interface")

999

if name == if_tag.getAttribute("name")

1000

)).items():

1001

ann_tag = document.createElement("annotation")

1002

ann_tag.setAttribute("name", annotation)

1003

ann_tag.setAttribute("value", value)

1004

if_tag.appendChild(ann_tag)

1107

1005

# Add the names to the return values for the

1108

1006

# "org.freedesktop.DBus.Properties" methods

1109

1007

if (if_tag.getAttribute("name")

1127

1025

exc_info=error)

1128

1026

return xmlstring

1129

1027

1130

try:

1131

dbus.OBJECT_MANAGER_IFACE

1132

except AttributeError:

1133

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1134

1135

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1136

"""A D-Bus object with an ObjectManager.

1137

1138

Classes inheriting from this exposes the standard

1139

GetManagedObjects call and the InterfacesAdded and

1140

InterfacesRemoved signals on the standard

1141

"org.freedesktop.DBus.ObjectManager" interface.

1142

1143

Note: No signals are sent automatically; they must be sent

1144

manually.

1145

"""

1146

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1147

out_signature = "a{oa{sa{sv}}}")

1148

def GetManagedObjects(self):

1149

"""This function must be overridden"""

1150

raise NotImplementedError()

1151

1152

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1153

signature = "oa{sa{sv}}")

1154

def InterfacesAdded(self, object_path, interfaces_and_properties):

1155

pass

1156

1157

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1158

def InterfacesRemoved(self, object_path, interfaces):

1159

pass

1160

1161

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1162

out_signature = "s",

1163

path_keyword = 'object_path',

1164

connection_keyword = 'connection')

1165

def Introspect(self, object_path, connection):

1166

"""Overloading of standard D-Bus method.

1167

1168

Override return argument name of GetManagedObjects to be

1169

"objpath_interfaces_and_properties"

1170

"""

1171

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1172

object_path,

1173

connection)

1174

try:

1175

document = xml.dom.minidom.parseString(xmlstring)

1176

1177

for if_tag in document.getElementsByTagName("interface"):

1178

# Fix argument name for the GetManagedObjects method

1179

if (if_tag.getAttribute("name")

1180

== dbus.OBJECT_MANAGER_IFACE):

1181

for cn in if_tag.getElementsByTagName("method"):

1182

if (cn.getAttribute("name")

1183

== "GetManagedObjects"):

1184

for arg in cn.getElementsByTagName("arg"):

1185

if (arg.getAttribute("direction")

1186

== "out"):

1187

arg.setAttribute(

1188

"name",

1189

"objpath_interfaces"

1190

"_and_properties")

1191

xmlstring = document.toxml("utf-8")

1192

document.unlink()

1193

except (AttributeError, xml.dom.DOMException,

1194

xml.parsers.expat.ExpatError) as error:

1195

logger.error("Failed to override Introspection method",

1196

exc_info = error)

1197

return xmlstring

1198

1028

1199

1029

def datetime_to_dbus(dt, variant_level=0):

1200

1030

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1201

1031

if dt is None:

1202

1032

return dbus.String("", variant_level = variant_level)

1203

return dbus.String(dt.isoformat(), variant_level=variant_level)

1033

return dbus.String(dt.isoformat(),

1034

variant_level=variant_level)

1204

1035

1205

1036

1206

1037

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1226

1057

(from DBusObjectWithProperties) and interfaces (from the

1227

1058

dbus_interface_annotations decorator).

1228

1059

"""

1229

1230

1060

def wrapper(cls):

1231

1061

for orig_interface_name, alt_interface_name in (

1232

alt_interface_names.items()):

1062

alt_interface_names.items()):

1233

1063

attr = {}

1234

1064

interface_names = set()

1235

1065

# Go though all attributes of the class

1237

1067

# Ignore non-D-Bus attributes, and D-Bus attributes

1238

1068

# with the wrong interface name

1239

1069

if (not hasattr(attribute, "_dbus_interface")

1240

or not attribute._dbus_interface.startswith(

1241

orig_interface_name)):

1070

or not attribute._dbus_interface

1071

.startswith(orig_interface_name)):

1242

1072

continue

1243

1073

# Create an alternate D-Bus interface name based on

1244

1074

# the current name

1245

alt_interface = attribute._dbus_interface.replace(

1246

orig_interface_name, alt_interface_name)

1075

alt_interface = (attribute._dbus_interface

1076

.replace(orig_interface_name,

1077

alt_interface_name))

1247

1078

interface_names.add(alt_interface)

1248

1079

# Is this a D-Bus signal?

1249

1080

if getattr(attribute, "_dbus_is_signal", False):

1250

if sys.version_info.major == 2:

1251

# Extract the original non-method undecorated

1252

# function by black magic

1253

nonmethod_func = (dict(

1081

# Extract the original non-method undecorated

1082

# function by black magic

1083

nonmethod_func = (dict(

1254

1084

zip(attribute.func_code.co_freevars,

1255

attribute.__closure__))

1256

["func"].cell_contents)

1257

else:

1258

nonmethod_func = attribute

1085

attribute.__closure__))["func"]

1086

.cell_contents)

1259

1087

# Create a new, but exactly alike, function

1260

1088

# object, and decorate it to be a new D-Bus signal

1261

1089

# with the alternate D-Bus interface name

1262

if sys.version_info.major == 2:

1263

new_function = types.FunctionType(

1264

nonmethod_func.func_code,

1265

nonmethod_func.func_globals,

1266

nonmethod_func.func_name,

1267

nonmethod_func.func_defaults,

1268

nonmethod_func.func_closure)

1269

else:

1270

new_function = types.FunctionType(

1271

nonmethod_func.__code__,

1272

nonmethod_func.__globals__,

1273

nonmethod_func.__name__,

1274

nonmethod_func.__defaults__,

1275

nonmethod_func.__closure__)

1276

new_function = (dbus.service.signal(

1277

alt_interface,

1278

attribute._dbus_signature)(new_function))

1090

new_function = (dbus.service.signal

1091

(alt_interface,

1092

attribute._dbus_signature)

1093

(types.FunctionType(

1094

nonmethod_func.func_code,

1095

nonmethod_func.func_globals,

1096

nonmethod_func.func_name,

1097

nonmethod_func.func_defaults,

1098

nonmethod_func.func_closure)))

1279

1099

# Copy annotations, if any

1280

1100

try:

1281

new_function._dbus_annotations = dict(

1282

attribute._dbus_annotations)

1101

new_function._dbus_annotations = (

1102

dict(attribute._dbus_annotations))

1283

1103

except AttributeError:

1284

1104

pass

1285

1105

# Define a creator of a function to call both the

1290

1110

"""This function is a scope container to pass

1291

1111

func1 and func2 to the "call_both" function

1292

1112

outside of its arguments"""

1293

1294

@functools.wraps(func2)

1295

1113

def call_both(*args, **kwargs):

1296

1114

"""This function will emit two D-Bus

1297

1115

signals by calling func1 and func2"""

1298

1116

func1(*args, **kwargs)

1299

1117

func2(*args, **kwargs)

1300

# Make wrapper function look like a D-Bus signal

1301

for name, attr in inspect.getmembers(func2):

1302

if name.startswith("_dbus_"):

1303

setattr(call_both, name, attr)

1304

1305

1118

return call_both

1306

1119

# Create the "call_both" function and add it to

1307

1120

# the class

1312

1125

# object. Decorate it to be a new D-Bus method

1313

1126

# with the alternate D-Bus interface name. Add it

1314

1127

# to the class.

1315

attr[attrname] = (

1316

dbus.service.method(

1317

alt_interface,

1318

attribute._dbus_in_signature,

1319

attribute._dbus_out_signature)

1320

(types.FunctionType(attribute.func_code,

1321

attribute.func_globals,

1322

attribute.func_name,

1323

attribute.func_defaults,

1324

attribute.func_closure)))

1128

attr[attrname] = (dbus.service.method

1129

(alt_interface,

1130

attribute._dbus_in_signature,

1131

attribute._dbus_out_signature)

1132

(types.FunctionType

1133

(attribute.func_code,

1134

attribute.func_globals,

1135

attribute.func_name,

1136

attribute.func_defaults,

1137

attribute.func_closure)))

1325

1138

# Copy annotations, if any

1326

1139

try:

1327

attr[attrname]._dbus_annotations = dict(

1328

attribute._dbus_annotations)

1140

attr[attrname]._dbus_annotations = (

1141

dict(attribute._dbus_annotations))

1329

1142

except AttributeError:

1330

1143

pass

1331

1144

# Is this a D-Bus property?

1334

1147

# object, and decorate it to be a new D-Bus

1335

1148

# property with the alternate D-Bus interface

1336

1149

# name. Add it to the class.

1337

attr[attrname] = (dbus_service_property(

1338

alt_interface, attribute._dbus_signature,

1339

attribute._dbus_access,

1340

attribute._dbus_get_args_options

1341

["byte_arrays"])

1342

(types.FunctionType(

1343

attribute.func_code,

1344

attribute.func_globals,

1345

attribute.func_name,

1346

attribute.func_defaults,

1347

attribute.func_closure)))

1150

attr[attrname] = (dbus_service_property

1151

(alt_interface,

1152

attribute._dbus_signature,

1153

attribute._dbus_access,

1154

attribute

1155

._dbus_get_args_options

1156

["byte_arrays"])

1157

(types.FunctionType

1158

(attribute.func_code,

1159

attribute.func_globals,

1160

attribute.func_name,

1161

attribute.func_defaults,

1162

attribute.func_closure)))

1348

1163

# Copy annotations, if any

1349

1164

try:

1350

attr[attrname]._dbus_annotations = dict(

1351

attribute._dbus_annotations)

1165

attr[attrname]._dbus_annotations = (

1166

dict(attribute._dbus_annotations))

1352

1167

except AttributeError:

1353

1168

pass

1354

1169

# Is this a D-Bus interface?

1357

1172

# object. Decorate it to be a new D-Bus interface

1358

1173

# with the alternate D-Bus interface name. Add it

1359

1174

# to the class.

1360

attr[attrname] = (

1361

dbus_interface_annotations(alt_interface)

1362

(types.FunctionType(attribute.func_code,

1363

attribute.func_globals,

1364

attribute.func_name,

1365

attribute.func_defaults,

1366

attribute.func_closure)))

1175

attr[attrname] = (dbus_interface_annotations

1176

(alt_interface)

1177

(types.FunctionType

1178

(attribute.func_code,

1179

attribute.func_globals,

1180

attribute.func_name,

1181

attribute.func_defaults,

1182

attribute.func_closure)))

1367

1183

if deprecate:

1368

1184

# Deprecate all alternate interfaces

1369

1185

iname="_AlternateDBusNames_interface_annotation{}"

1370

1186

for interface_name in interface_names:

1371

1372

1187

@dbus_interface_annotations(interface_name)

1373

1188

def func(self):

1374

1189

return { "org.freedesktop.DBus.Deprecated":

1375

"true" }

1190

"true" }

1376

1191

# Find an unused name

1377

1192

for aname in (iname.format(i)

1378

1193

for i in itertools.count()):

1383

1198

# Replace the class with a new subclass of it with

1384

1199

# methods, signals, etc. as created above.

1385

1200

cls = type(b"{}Alternate".format(cls.__name__),

1386

(cls, ), attr)

1201

(cls,), attr)

1387

1202

return cls

1388

1389

1203

return wrapper

1390

1204

1391

1205

1392

1206

@alternate_dbus_interfaces({"se.recompile.Mandos":

1393

"se.bsnet.fukt.Mandos"})

1207

"se.bsnet.fukt.Mandos"})

1394

1208

class ClientDBus(Client, DBusObjectWithProperties):

1395

1209

"""A Client class using D-Bus

1396

1210

1400

1214

"""

1401

1215

1402

1216

runtime_expansions = (Client.runtime_expansions

1403

+ ("dbus_object_path", ))

1404

1405

_interface = "se.recompile.Mandos.Client"

1217

+ ("dbus_object_path",))

1406

1218

1407

1219

# dbus.service.Object doesn't use super(), so we can't either.

1408

1220

1411

1223

Client.__init__(self, *args, **kwargs)

1412

1224

# Only now, when this client is initialized, can it show up on

1413

1225

# the D-Bus

1414

client_object_name = str(self.name).translate(

1226

client_object_name = unicode(self.name).translate(

1415

1227

{ord("."): ord("_"),

1416

1228

ord("-"): ord("_")})

1417

self.dbus_object_path = dbus.ObjectPath(

1418

"/clients/" + client_object_name)

1229

self.dbus_object_path = (dbus.ObjectPath

1230

("/clients/" + client_object_name))

1419

1231

DBusObjectWithProperties.__init__(self, self.bus,

1420

1232

self.dbus_object_path)

1421

1233

1422

def notifychangeproperty(transform_func, dbus_name,

1423

type_func=lambda x: x,

1424

variant_level=1,

1425

invalidate_only=False,

1426

_interface=_interface):

1234

def notifychangeproperty(transform_func,

1235

dbus_name, type_func=lambda x: x,

1236

variant_level=1):

1427

1237

""" Modify a variable so that it's a property which announces

1428

1238

its changes to DBus.

1429

1239

1435

1245

variant_level: D-Bus variant level. Default: 1

1436

1246

"""

1437

1247

attrname = "_{}".format(dbus_name)

1438

1439

1248

def setter(self, value):

1440

1249

if hasattr(self, "dbus_object_path"):

1441

1250

if (not hasattr(self, attrname) or

1442

1251

type_func(getattr(self, attrname, None))

1443

1252

!= type_func(value)):

1444

if invalidate_only:

1445

self.PropertiesChanged(

1446

_interface, dbus.Dictionary(),

1447

dbus.Array((dbus_name, )))

1448

else:

1449

dbus_value = transform_func(

1450

type_func(value),

1451

variant_level = variant_level)

1452

self.PropertyChanged(dbus.String(dbus_name),

1453

dbus_value)

1454

self.PropertiesChanged(

1455

_interface,

1456

dbus.Dictionary({ dbus.String(dbus_name):

1457

dbus_value }),

1458

dbus.Array())

1253

dbus_value = transform_func(type_func(value),

1254

variant_level

1255

=variant_level)

1256

self.PropertyChanged(dbus.String(dbus_name),

1257

dbus_value)

1459

1258

setattr(self, attrname, value)

1460

1259

1461

1260

return property(lambda self: getattr(self, attrname), setter)

1467

1266

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1468

1267

last_enabled = notifychangeproperty(datetime_to_dbus,

1469

1268

"LastEnabled")

1470

checker = notifychangeproperty(

1471

dbus.Boolean, "CheckerRunning",

1472

type_func = lambda checker: checker is not None)

1269

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1270

type_func = lambda checker:

1271

checker is not None)

1473

1272

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1474

1273

"LastCheckedOK")

1475

1274

last_checker_status = notifychangeproperty(dbus.Int16,

1478

1277

datetime_to_dbus, "LastApprovalRequest")

1479

1278

approved_by_default = notifychangeproperty(dbus.Boolean,

1480

1279

"ApprovedByDefault")

1481

approval_delay = notifychangeproperty(

1482

dbus.UInt64, "ApprovalDelay",

1483

type_func = lambda td: td.total_seconds() * 1000)

1280

approval_delay = notifychangeproperty(dbus.UInt64,

1281

"ApprovalDelay",

1282

type_func =

1283

lambda td: td.total_seconds()

1284

* 1000)

1484

1285

approval_duration = notifychangeproperty(

1485

1286

dbus.UInt64, "ApprovalDuration",

1486

1287

type_func = lambda td: td.total_seconds() * 1000)

1487

1288

host = notifychangeproperty(dbus.String, "Host")

1488

timeout = notifychangeproperty(

1489

dbus.UInt64, "Timeout",

1490

type_func = lambda td: td.total_seconds() * 1000)

1289

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1290

type_func = lambda td:

1291

td.total_seconds() * 1000)

1491

1292

extended_timeout = notifychangeproperty(

1492

1293

dbus.UInt64, "ExtendedTimeout",

1493

1294

type_func = lambda td: td.total_seconds() * 1000)

1494

interval = notifychangeproperty(

1495

dbus.UInt64, "Interval",

1496

type_func = lambda td: td.total_seconds() * 1000)

1295

interval = notifychangeproperty(dbus.UInt64,

1296

"Interval",

1297

type_func =

1298

lambda td: td.total_seconds()

1299

* 1000)

1497

1300

checker_command = notifychangeproperty(dbus.String, "Checker")

1498

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1499

invalidate_only=True)

1500

1301

1501

1302

del notifychangeproperty

1502

1303

1509

1310

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1510

1311

Client.__del__(self, *args, **kwargs)

1511

1312

1512

def checker_callback(self, source, condition,

1513

connection, command, *args, **kwargs):

1514

ret = Client.checker_callback(self, source, condition,

1515

connection, command, *args,

1516

**kwargs)

1517

exitstatus = self.last_checker_status

1518

if exitstatus >= 0:

1313

def checker_callback(self, pid, condition, command,

1314

*args, **kwargs):

1315

self.checker_callback_tag = None

1316

self.checker = None

1317

if os.WIFEXITED(condition):

1318

exitstatus = os.WEXITSTATUS(condition)

1519

1319

# Emit D-Bus signal

1520

1320

self.CheckerCompleted(dbus.Int16(exitstatus),

1521

# This is specific to GNU libC

1522

dbus.Int64(exitstatus << 8),

1321

dbus.Int64(condition),

1523

1322

dbus.String(command))

1524

1323

else:

1525

1324

# Emit D-Bus signal

1526

1325

self.CheckerCompleted(dbus.Int16(-1),

1527

dbus.Int64(

1528

# This is specific to GNU libC

1529

(exitstatus << 8)

1530

| self.last_checker_signal),

1326

dbus.Int64(condition),

1531

1327

dbus.String(command))

1532

return ret

1328

1329

return Client.checker_callback(self, pid, condition, command,

1330

*args, **kwargs)

1533

1331

1534

1332

def start_checker(self, *args, **kwargs):

1535

1333

old_checker_pid = getattr(self.checker, "pid", None)

1552

1350

self.send_changedstate()

1553

1351

1554

1352

## D-Bus methods, signals & properties

1353

_interface = "se.recompile.Mandos.Client"

1555

1354

1556

1355

## Interfaces

1557

1356

1357

@dbus_interface_annotations(_interface)

1358

def _foo(self):

1359

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1360

"false"}

1361

1558

1362

## Signals

1559

1363

1560

1364

# CheckerCompleted - signal

1570

1374

pass

1571

1375

1572

1376

# PropertyChanged - signal

1573

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1574

1377

@dbus.service.signal(_interface, signature="sv")

1575

1378

def PropertyChanged(self, property, value):

1576

1379

"D-Bus signal"

1610

1413

self.checked_ok()

1611

1414

1612

1415

# Enable - method

1613

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1614

1416

@dbus.service.method(_interface)

1615

1417

def Enable(self):

1616

1418

"D-Bus method"

1617

1419

self.enable()

1618

1420

1619

1421

# StartChecker - method

1620

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1621

1422

@dbus.service.method(_interface)

1622

1423

def StartChecker(self):

1623

1424

"D-Bus method"

1624

1425

self.start_checker()

1625

1426

1626

1427

# Disable - method

1627

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1628

1428

@dbus.service.method(_interface)

1629

1429

def Disable(self):

1630

1430

"D-Bus method"

1631

1431

self.disable()

1632

1432

1633

1433

# StopChecker - method

1634

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1635

1434

@dbus.service.method(_interface)

1636

1435

def StopChecker(self):

1637

1436

self.stop_checker()

1644

1443

return dbus.Boolean(bool(self.approvals_pending))

1645

1444

1646

1445

# ApprovedByDefault - property

1647

@dbus_service_property(_interface,

1648

signature="b",

1446

@dbus_service_property(_interface, signature="b",

1649

1447

access="readwrite")

1650

1448

def ApprovedByDefault_dbus_property(self, value=None):

1651

1449

if value is None: # get

1653

1451

self.approved_by_default = bool(value)

1654

1452

1655

1453

# ApprovalDelay - property

1656

@dbus_service_property(_interface,

1657

signature="t",

1454

@dbus_service_property(_interface, signature="t",

1658

1455

access="readwrite")

1659

1456

def ApprovalDelay_dbus_property(self, value=None):

1660

1457

if value is None: # get

1663

1460

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1664

1461

1665

1462

# ApprovalDuration - property

1666

@dbus_service_property(_interface,

1667

signature="t",

1463

@dbus_service_property(_interface, signature="t",

1668

1464

access="readwrite")

1669

1465

def ApprovalDuration_dbus_property(self, value=None):

1670

1466

if value is None: # get

1673

1469

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1674

1470

1675

1471

# Name - property

1676

@dbus_annotations(

1677

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1678

1472

@dbus_service_property(_interface, signature="s", access="read")

1679

1473

def Name_dbus_property(self):

1680

1474

return dbus.String(self.name)

1681

1475

1682

1476

# Fingerprint - property

1683

@dbus_annotations(

1684

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1685

1477

@dbus_service_property(_interface, signature="s", access="read")

1686

1478

def Fingerprint_dbus_property(self):

1687

1479

return dbus.String(self.fingerprint)

1688

1480

1689

1481

# Host - property

1690

@dbus_service_property(_interface,

1691

signature="s",

1482

@dbus_service_property(_interface, signature="s",

1692

1483

access="readwrite")

1693

1484

def Host_dbus_property(self, value=None):

1694

1485

if value is None: # get

1695

1486

return dbus.String(self.host)

1696

self.host = str(value)

1487

self.host = unicode(value)

1697

1488

1698

1489

# Created - property

1699

@dbus_annotations(

1700

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1701

1490

@dbus_service_property(_interface, signature="s", access="read")

1702

1491

def Created_dbus_property(self):

1703

1492

return datetime_to_dbus(self.created)

1708

1497

return datetime_to_dbus(self.last_enabled)

1709

1498

1710

1499

# Enabled - property

1711

@dbus_service_property(_interface,

1712

signature="b",

1500

@dbus_service_property(_interface, signature="b",

1713

1501

access="readwrite")

1714

1502

def Enabled_dbus_property(self, value=None):

1715

1503

if value is None: # get

1720

1508

self.disable()

1721

1509

1722

1510

# LastCheckedOK - property

1723

@dbus_service_property(_interface,

1724

signature="s",

1511

@dbus_service_property(_interface, signature="s",

1725

1512

access="readwrite")

1726

1513

def LastCheckedOK_dbus_property(self, value=None):

1727

1514

if value is not None:

1730

1517

return datetime_to_dbus(self.last_checked_ok)

1731

1518

1732

1519

# LastCheckerStatus - property

1733

@dbus_service_property(_interface, signature="n", access="read")

1520

@dbus_service_property(_interface, signature="n",

1521

access="read")

1734

1522

def LastCheckerStatus_dbus_property(self):

1735

1523

return dbus.Int16(self.last_checker_status)

1736

1524

1745

1533

return datetime_to_dbus(self.last_approval_request)

1746

1534

1747

1535

# Timeout - property

1748

@dbus_service_property(_interface,

1749

signature="t",

1536

@dbus_service_property(_interface, signature="t",

1750

1537

access="readwrite")

1751

1538

def Timeout_dbus_property(self, value=None):

1752

1539

if value is None: # get

1765

1552

is None):

1766

1553

return

1767

1554

gobject.source_remove(self.disable_initiator_tag)

1768

self.disable_initiator_tag = gobject.timeout_add(

1769

int((self.expires - now).total_seconds() * 1000),

1770

self.disable)

1555

self.disable_initiator_tag = (

1556

gobject.timeout_add(

1557

int((self.expires - now).total_seconds()

1558

* 1000), self.disable))

1771

1559

1772

1560

# ExtendedTimeout - property

1773

@dbus_service_property(_interface,

1774

signature="t",

1561

@dbus_service_property(_interface, signature="t",

1775

1562

access="readwrite")

1776

1563

def ExtendedTimeout_dbus_property(self, value=None):

1777

1564

if value is None: # get

1780

1567

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1781

1568

1782

1569

# Interval - property

1783

@dbus_service_property(_interface,

1784

signature="t",

1570

@dbus_service_property(_interface, signature="t",

1785

1571

access="readwrite")

1786

1572

def Interval_dbus_property(self, value=None):

1787

1573

if value is None: # get

1792

1578

if self.enabled:

1793

1579

# Reschedule checker run

1794

1580

gobject.source_remove(self.checker_initiator_tag)

1795

self.checker_initiator_tag = gobject.timeout_add(

1796

value, self.start_checker)

1797

self.start_checker() # Start one now, too

1581

self.checker_initiator_tag = (gobject.timeout_add

1582

(value, self.start_checker))

1583

self.start_checker() # Start one now, too

1798

1584

1799

1585

# Checker - property

1800

@dbus_service_property(_interface,

1801

signature="s",

1586

@dbus_service_property(_interface, signature="s",

1802

1587

access="readwrite")

1803

1588

def Checker_dbus_property(self, value=None):

1804

1589

if value is None: # get

1805

1590

return dbus.String(self.checker_command)

1806

self.checker_command = str(value)

1591

self.checker_command = unicode(value)

1807

1592

1808

1593

# CheckerRunning - property

1809

@dbus_service_property(_interface,

1810

signature="b",

1594

@dbus_service_property(_interface, signature="b",

1811

1595

access="readwrite")

1812

1596

def CheckerRunning_dbus_property(self, value=None):

1813

1597

if value is None: # get

1818

1602

self.stop_checker()

1819

1603

1820

1604

# ObjectPath - property

1821

@dbus_annotations(

1822

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

1823

"org.freedesktop.DBus.Deprecated": "true"})

1824

1605

@dbus_service_property(_interface, signature="o", access="read")

1825

1606

def ObjectPath_dbus_property(self):

1826

1607

return self.dbus_object_path # is already a dbus.ObjectPath

1827

1608

1828

1609

# Secret = property

1829

@dbus_annotations(

1830

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

1831

"invalidates"})

1832

@dbus_service_property(_interface,

1833

signature="ay",

1834

access="write",

1835

byte_arrays=True)

1610

@dbus_service_property(_interface, signature="ay",

1611

access="write", byte_arrays=True)

1836

1612

def Secret_dbus_property(self, value):

1837

1613

self.secret = bytes(value)

1838

1614

1844

1620

self._pipe = child_pipe

1845

1621

self._pipe.send(('init', fpr, address))

1846

1622

if not self._pipe.recv():

1847

raise KeyError(fpr)

1623

raise KeyError()

1848

1624

1849

1625

def __getattribute__(self, name):

1850

1626

if name == '_pipe':

1854

1630

if data[0] == 'data':

1855

1631

return data[1]

1856

1632

if data[0] == 'function':

1857

1858

1633

def func(*args, **kwargs):

1859

1634

self._pipe.send(('funcall', name, args, kwargs))

1860

1635

return self._pipe.recv()[1]

1861

1862

1636

return func

1863

1637

1864

1638

def __setattr__(self, name, value):

1876

1650

def handle(self):

1877

1651

with contextlib.closing(self.server.child_pipe) as child_pipe:

1878

1652

logger.info("TCP connection from: %s",

1879

str(self.client_address))

1653

unicode(self.client_address))

1880

1654

logger.debug("Pipe FD: %d",

1881

1655

self.server.child_pipe.fileno())

1882

1656

1883

session = gnutls.connection.ClientSession(

1884

self.request, gnutls.connection .X509Credentials())

1657

session = (gnutls.connection

1658

.ClientSession(self.request,

1659

gnutls.connection

1660

.X509Credentials()))

1885

1661

1886

1662

# Note: gnutls.connection.X509Credentials is really a

1887

1663

# generic GnuTLS certificate credentials object so long as

1896

1672

priority = self.server.gnutls_priority

1897

1673

if priority is None:

1898

1674

priority = "NORMAL"

1899

gnutls.library.functions.gnutls_priority_set_direct(

1900

session._c_object, priority, None)

1675

(gnutls.library.functions

1676

.gnutls_priority_set_direct(session._c_object,

1677

priority, None))

1901

1678

1902

1679

# Start communication using the Mandos protocol

1903

1680

# Get protocol number

1923

1700

approval_required = False

1924

1701

try:

1925

1702

try:

1926

fpr = self.fingerprint(

1927

self.peer_certificate(session))

1703

fpr = self.fingerprint(self.peer_certificate

1704

(session))

1928

1705

except (TypeError,

1929

1706

gnutls.errors.GNUTLSError) as error:

1930

1707

logger.warning("Bad certificate: %s", error)

1945

1722

while True:

1946

1723

if not client.enabled:

1947

1724

logger.info("Client %s is disabled",

1948

client.name)

1725

client.name)

1949

1726

if self.server.use_dbus:

1950

1727

# Emit D-Bus signal

1951

1728

client.Rejected("Disabled")

1998

1775

logger.warning("gnutls send failed",

1999

1776

exc_info=error)

2000

1777

return

2001

logger.debug("Sent: %d, remaining: %d", sent,

2002

len(client.secret) - (sent_size

2003

+ sent))

1778

logger.debug("Sent: %d, remaining: %d",

1779

sent, len(client.secret)

1780

- (sent_size + sent))

2004

1781

sent_size += sent

2005

1782

2006

1783

logger.info("Sending secret to %s", client.name)

2023

1800

def peer_certificate(session):

2024

1801

"Return the peer's OpenPGP certificate as a bytestring"

2025

1802

# If not an OpenPGP certificate...

2026

if (gnutls.library.functions.gnutls_certificate_type_get(

2027

session._c_object)

1803

if (gnutls.library.functions

1804

.gnutls_certificate_type_get(session._c_object)

2028

1805

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

2029

1806

# ...do the normal thing

2030

1807

return session.peer_certificate

2044

1821

def fingerprint(openpgp):

2045

1822

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2046

1823

# New GnuTLS "datum" with the OpenPGP public key

2047

datum = gnutls.library.types.gnutls_datum_t(

2048

ctypes.cast(ctypes.c_char_p(openpgp),

2049

ctypes.POINTER(ctypes.c_ubyte)),

2050

ctypes.c_uint(len(openpgp)))

1824

datum = (gnutls.library.types

1825

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1826

ctypes.POINTER

1827

(ctypes.c_ubyte)),

1828

ctypes.c_uint(len(openpgp))))

2051

1829

# New empty GnuTLS certificate

2052

1830

crt = gnutls.library.types.gnutls_openpgp_crt_t()

2053

gnutls.library.functions.gnutls_openpgp_crt_init(

2054

ctypes.byref(crt))

1831

(gnutls.library.functions

1832

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2055

1833

# Import the OpenPGP public key into the certificate

2056

gnutls.library.functions.gnutls_openpgp_crt_import(

2057

crt, ctypes.byref(datum),

2058

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1834

(gnutls.library.functions

1835

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1836

gnutls.library.constants

1837

.GNUTLS_OPENPGP_FMT_RAW))

2059

1838

# Verify the self signature in the key

2060

1839

crtverify = ctypes.c_uint()

2061

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

2062

crt, 0, ctypes.byref(crtverify))

1840

(gnutls.library.functions

1841

.gnutls_openpgp_crt_verify_self(crt, 0,

1842

ctypes.byref(crtverify)))

2063

1843

if crtverify.value != 0:

2064

1844

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2065

raise gnutls.errors.CertificateSecurityError(

2066

"Verify failed")

1845

raise (gnutls.errors.CertificateSecurityError

1846

("Verify failed"))

2067

1847

# New buffer for the fingerprint

2068

1848

buf = ctypes.create_string_buffer(20)

2069

1849

buf_len = ctypes.c_size_t()

2070

1850

# Get the fingerprint from the certificate into the buffer

2071

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

2072

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1851

(gnutls.library.functions

1852

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1853

ctypes.byref(buf_len)))

2073

1854

# Deinit the certificate

2074

1855

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2075

1856

# Convert the buffer to a Python bytestring

2081

1862

2082

1863

class MultiprocessingMixIn(object):

2083

1864

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2084

2085

1865

def sub_process_main(self, request, address):

2086

1866

try:

2087

1867

self.finish_request(request, address)

2099

1879

2100

1880

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2101

1881

""" adds a pipe to the MixIn """

2102

2103

1882

def process_request(self, request, client_address):

2104

1883

"""Overrides and wraps the original process_request().

2105

1884

2126

1905

interface: None or a network interface name (string)

2127

1906

use_ipv6: Boolean; to use IPv6 or not

2128

1907

"""

2129

2130

1908

def __init__(self, server_address, RequestHandlerClass,

2131

interface=None,

2132

use_ipv6=True,

2133

socketfd=None):

1909

interface=None, use_ipv6=True, socketfd=None):

2134

1910

"""If socketfd is set, use that file descriptor instead of

2135

1911

creating a new one with socket.socket().

2136

1912

"""

2177

1953

self.interface)

2178

1954

else:

2179

1955

try:

2180

self.socket.setsockopt(

2181

socket.SOL_SOCKET, SO_BINDTODEVICE,

2182

(self.interface + "\0").encode("utf-8"))

1956

self.socket.setsockopt(socket.SOL_SOCKET,

1957

SO_BINDTODEVICE,

1958

(self.interface + "\0")

1959

.encode("utf-8"))

2183

1960

except socket.error as error:

2184

1961

if error.errno == errno.EPERM:

2185

1962

logger.error("No permission to bind to"

2203

1980

self.server_address = (any_address,

2204

1981

self.server_address[1])

2205

1982

elif not self.server_address[1]:

2206

self.server_address = (self.server_address[0], 0)

1983

self.server_address = (self.server_address[0],

1984

0)

2207

1985

# if self.interface:

2208

1986

# self.server_address = (self.server_address[0],

2209

1987

# 0, # port

2223

2001

2224

2002

Assumes a gobject.MainLoop event loop.

2225

2003

"""

2226

2227

2004

def __init__(self, server_address, RequestHandlerClass,

2228

interface=None,

2229

use_ipv6=True,

2230

clients=None,

2231

gnutls_priority=None,

2232

use_dbus=True,

2233

socketfd=None):

2005

interface=None, use_ipv6=True, clients=None,

2006

gnutls_priority=None, use_dbus=True, socketfd=None):

2234

2007

self.enabled = False

2235

2008

self.clients = clients

2236

2009

if self.clients is None:

2242

2015

interface = interface,

2243

2016

use_ipv6 = use_ipv6,

2244

2017

socketfd = socketfd)

2245

2246

2018

def server_activate(self):

2247

2019

if self.enabled:

2248

2020

return socketserver.TCPServer.server_activate(self)

2252

2024

2253

2025

def add_pipe(self, parent_pipe, proc):

2254

2026

# Call "handle_ipc" for both data and EOF events

2255

gobject.io_add_watch(

2256

parent_pipe.fileno(),

2257

gobject.IO_IN | gobject.IO_HUP,

2258

functools.partial(self.handle_ipc,

2259

parent_pipe = parent_pipe,

2260

proc = proc))

2027

gobject.io_add_watch(parent_pipe.fileno(),

2028

gobject.IO_IN | gobject.IO_HUP,

2029

functools.partial(self.handle_ipc,

2030

parent_pipe =

2031

parent_pipe,

2032

proc = proc))

2261

2033

2262

def handle_ipc(self, source, condition,

2263

parent_pipe=None,

2264

proc = None,

2265

client_object=None):

2034

def handle_ipc(self, source, condition, parent_pipe=None,

2035

proc = None, client_object=None):

2266

2036

# error, or the other end of multiprocessing.Pipe has closed

2267

2037

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2268

2038

# Wait for other process to exit

2291

2061

parent_pipe.send(False)

2292

2062

return False

2293

2063

2294

gobject.io_add_watch(

2295

parent_pipe.fileno(),

2296

gobject.IO_IN | gobject.IO_HUP,

2297

functools.partial(self.handle_ipc,

2298

parent_pipe = parent_pipe,

2299

proc = proc,

2300

client_object = client))

2064

gobject.io_add_watch(parent_pipe.fileno(),

2065

gobject.IO_IN | gobject.IO_HUP,

2066

functools.partial(self.handle_ipc,

2067

parent_pipe =

2068

parent_pipe,

2069

proc = proc,

2070

client_object =

2071

client))

2301

2072

parent_pipe.send(True)

2302

2073

# remove the old hook in favor of the new above hook on

2303

2074

# same fileno

2309

2080

2310

2081

parent_pipe.send(('data', getattr(client_object,

2311

2082

funcname)(*args,

2312

**kwargs)))

2083

**kwargs)))

2313

2084

2314

2085

if command == 'getattr':

2315

2086

attrname = request[1]

2316

if isinstance(client_object.__getattribute__(attrname),

2317

collections.Callable):

2318

parent_pipe.send(('function', ))

2087

if callable(client_object.__getattribute__(attrname)):

2088

parent_pipe.send(('function',))

2319

2089

else:

2320

parent_pipe.send((

2321

'data', client_object.__getattribute__(attrname)))

2090

parent_pipe.send(('data', client_object

2091

.__getattribute__(attrname)))

2322

2092

2323

2093

if command == 'setattr':

2324

2094

attrname = request[1]

2355

2125

# avoid excessive use of external libraries.

2356

2126

2357

2127

# New type for defining tokens, syntax, and semantics all-in-one

2358

Token = collections.namedtuple("Token", (

2359

"regexp", # To match token; if "value" is not None, must have

2360

# a "group" containing digits

2361

"value", # datetime.timedelta or None

2362

"followers")) # Tokens valid after this token

2128

Token = collections.namedtuple("Token",

2129

("regexp", # To match token; if

2130

# "value" is not None,

2131

# must have a "group"

2132

# containing digits

2133

"value", # datetime.timedelta or

2134

# None

2135

"followers")) # Tokens valid after

2136

# this token

2363

2137

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2364

2138

# the "duration" ABNF definition in RFC 3339, Appendix A.

2365

2139

token_end = Token(re.compile(r"$"), None, frozenset())

2366

2140

token_second = Token(re.compile(r"(\d+)S"),

2367

2141

datetime.timedelta(seconds=1),

2368

frozenset((token_end, )))

2142

frozenset((token_end,)))

2369

2143

token_minute = Token(re.compile(r"(\d+)M"),

2370

2144

datetime.timedelta(minutes=1),

2371

2145

frozenset((token_second, token_end)))

2387

2161

frozenset((token_month, token_end)))

2388

2162

token_week = Token(re.compile(r"(\d+)W"),

2389

2163

datetime.timedelta(weeks=1),

2390

frozenset((token_end, )))

2164

frozenset((token_end,)))

2391

2165

token_duration = Token(re.compile(r"P"), None,

2392

2166

frozenset((token_year, token_month,

2393

2167

token_day, token_time,

2395

2169

# Define starting values

2396

2170

value = datetime.timedelta() # Value so far

2397

2171

found_token = None

2398

followers = frozenset((token_duration, )) # Following valid tokens

2172

followers = frozenset((token_duration,)) # Following valid tokens

2399

2173

s = duration # String left to parse

2400

2174

# Loop until end token is found

2401

2175

while found_token is not token_end:

2418

2192

break

2419

2193

else:

2420

2194

# No currently valid tokens were found

2421

raise ValueError("Invalid RFC 3339 duration: {!r}"

2422

.format(duration))

2195

raise ValueError("Invalid RFC 3339 duration")

2423

2196

# End token found

2424

2197

return value

2425

2198

2462

2235

elif suffix == "w":

2463

2236

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2464

2237

else:

2465

raise ValueError("Unknown suffix {!r}".format(suffix))

2238

raise ValueError("Unknown suffix {!r}"

2239

.format(suffix))

2466

2240

except IndexError as e:

2467

2241

raise ValueError(*(e.args))

2468

2242

timevalue += delta

2484

2258

# Close all standard open file descriptors

2485

2259

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2486

2260

if not stat.S_ISCHR(os.fstat(null).st_mode):

2487

raise OSError(errno.ENODEV,

2488

"{} not a character device"

2261

raise OSError(errno.ENODEV, "{} not a character device"

2489

2262

.format(os.devnull))

2490

2263

os.dup2(null, sys.stdin.fileno())

2491

2264

os.dup2(null, sys.stdout.fileno())

2557

2330

"port": "",

2558

2331

"debug": "False",

2559

2332

"priority":

2560

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2561

":+SIGN-DSA-SHA256",

2333

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2562

2334

"servicename": "Mandos",

2563

2335

"use_dbus": "True",

2564

2336

"use_ipv6": "True",

2568

2340

"statedir": "/var/lib/mandos",

2569

2341

"foreground": "False",

2570

2342

"zeroconf": "True",

2571

}

2343

}

2572

2344

2573

2345

# Parse config file for server-global settings

2574

2346

server_config = configparser.SafeConfigParser(server_defaults)

2575

2347

del server_defaults

2576

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2348

server_config.read(os.path.join(options.configdir,

2349

"mandos.conf"))

2577

2350

# Convert the SafeConfigParser object to a dict

2578

2351

server_settings = server_config.defaults()

2579

2352

# Use the appropriate methods on the non-string config options

2597

2370

# Override the settings from the config file with command line

2598

2371

# options, if set.

2599

2372

for option in ("interface", "address", "port", "debug",

2600

"priority", "servicename", "configdir", "use_dbus",

2601

"use_ipv6", "debuglevel", "restore", "statedir",

2602

"socket", "foreground", "zeroconf"):

2373

"priority", "servicename", "configdir",

2374

"use_dbus", "use_ipv6", "debuglevel", "restore",

2375

"statedir", "socket", "foreground", "zeroconf"):

2603

2376

value = getattr(options, option)

2604

2377

if value is not None:

2605

2378

server_settings[option] = value

2620

2393

2621

2394

##################################################################

2622

2395

2623

if (not server_settings["zeroconf"]

2624

and not (server_settings["port"]

2625

or server_settings["socket"] != "")):

2626

parser.error("Needs port or socket to work without Zeroconf")

2396

if (not server_settings["zeroconf"] and

2397

not (server_settings["port"]

2398

or server_settings["socket"] != "")):

2399

parser.error("Needs port or socket to work without"

2400

" Zeroconf")

2627

2401

2628

2402

# For convenience

2629

2403

debug = server_settings["debug"]

2645

2419

initlogger(debug, level)

2646

2420

2647

2421

if server_settings["servicename"] != "Mandos":

2648

syslogger.setFormatter(

2649

logging.Formatter('Mandos ({}) [%(process)d]:'

2650

' %(levelname)s: %(message)s'.format(

2651

server_settings["servicename"])))

2422

syslogger.setFormatter(logging.Formatter

2423

('Mandos ({}) [%(process)d]:'

2424

' %(levelname)s: %(message)s'

2425

.format(server_settings

2426

["servicename"])))

2652

2427

2653

2428

# Parse config file with clients

2654

2429

client_config = configparser.SafeConfigParser(Client

2662

2437

socketfd = None

2663

2438

if server_settings["socket"] != "":

2664

2439

socketfd = server_settings["socket"]

2665

tcp_server = MandosServer(

2666

(server_settings["address"], server_settings["port"]),

2667

ClientHandler,

2668

interface=(server_settings["interface"] or None),

2669

use_ipv6=use_ipv6,

2670

gnutls_priority=server_settings["priority"],

2671

use_dbus=use_dbus,

2672

socketfd=socketfd)

2440

tcp_server = MandosServer((server_settings["address"],

2441

server_settings["port"]),

2442

ClientHandler,

2443

interface=(server_settings["interface"]

2444

or None),

2445

use_ipv6=use_ipv6,

2446

gnutls_priority=

2447

server_settings["priority"],

2448

use_dbus=use_dbus,

2449

socketfd=socketfd)

2673

2450

if not foreground:

2674

2451

pidfilename = "/run/mandos.pid"

2675

2452

if not os.path.isdir("/run/."):

2676

2453

pidfilename = "/var/run/mandos.pid"

2677

2454

pidfile = None

2678

2455

try:

2679

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2456

pidfile = open(pidfilename, "w")

2680

2457

except IOError as e:

2681

2458

logger.error("Could not open file %r", pidfilename,

2682

2459

exc_info=e)

2709

2486

def debug_gnutls(level, string):

2710

2487

logger.debug("GnuTLS: %s", string[:-1])

2711

2488

2712

gnutls.library.functions.gnutls_global_set_log_function(

2713

debug_gnutls)

2489

(gnutls.library.functions

2490

.gnutls_global_set_log_function(debug_gnutls))

2714

2491

2715

2492

# Redirect stdin so all checkers get /dev/null

2716

2493

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2736

2513

if use_dbus:

2737

2514

try:

2738

2515

bus_name = dbus.service.BusName("se.recompile.Mandos",

2739

bus,

2740

do_not_queue=True)

2741

old_bus_name = dbus.service.BusName(

2742

"se.bsnet.fukt.Mandos", bus,

2743

do_not_queue=True)

2744

except dbus.exceptions.DBusException as e:

2516

bus, do_not_queue=True)

2517

old_bus_name = (dbus.service.BusName

2518

("se.bsnet.fukt.Mandos", bus,

2519

do_not_queue=True))

2520

except dbus.exceptions.NameExistsException as e:

2745

2521

logger.error("Disabling D-Bus:", exc_info=e)

2746

2522

use_dbus = False

2747

2523

server_settings["use_dbus"] = False

2748

2524

tcp_server.use_dbus = False

2749

2525

if zeroconf:

2750

2526

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2751

service = AvahiServiceToSyslog(

2752

name = server_settings["servicename"],

2753

servicetype = "_mandos._tcp",

2754

protocol = protocol,

2755

bus = bus)

2527

service = AvahiServiceToSyslog(name =

2528

server_settings["servicename"],

2529

servicetype = "_mandos._tcp",

2530

protocol = protocol, bus = bus)

2756

2531

if server_settings["interface"]:

2757

service.interface = if_nametoindex(

2758

server_settings["interface"].encode("utf-8"))

2532

service.interface = (if_nametoindex

2533

(server_settings["interface"]

2534

.encode("utf-8")))

2759

2535

2760

2536

global multiprocessing_manager

2761

2537

multiprocessing_manager = multiprocessing.Manager()

2780

2556

if server_settings["restore"]:

2781

2557

try:

2782

2558

with open(stored_state_path, "rb") as stored_state:

2783

clients_data, old_client_settings = pickle.load(

2784

stored_state)

2559

clients_data, old_client_settings = (pickle.load

2560

(stored_state))

2785

2561

os.remove(stored_state_path)

2786

2562

except IOError as e:

2787

2563

if e.errno == errno.ENOENT:

2788

logger.warning("Could not load persistent state:"

2789

" {}".format(os.strerror(e.errno)))

2564

logger.warning("Could not load persistent state: {}"

2565

.format(os.strerror(e.errno)))

2790

2566

else:

2791

2567

logger.critical("Could not load persistent state:",

2792

2568

exc_info=e)

2793

2569

raise

2794

2570

except EOFError as e:

2795

2571

logger.warning("Could not load persistent state: "

2796

"EOFError:",

2797

exc_info=e)

2572

"EOFError:", exc_info=e)

2798

2573

2799

2574

with PGPEngine() as pgp:

2800

2575

for client_name, client in clients_data.items():

2812

2587

# For each value in new config, check if it

2813

2588

# differs from the old config value (Except for

2814

2589

# the "secret" attribute)

2815

if (name != "secret"

2816

and (value !=

2817

old_client_settings[client_name][name])):

2590

if (name != "secret" and

2591

value != old_client_settings[client_name]

2592

[name]):

2818

2593

client[name] = value

2819

2594

except KeyError:

2820

2595

pass

2821

2596

2822

2597

# Clients who has passed its expire date can still be

2823

# enabled if its last checker was successful. A Client

2598

# enabled if its last checker was successful. Clients

2824

2599

# whose checker succeeded before we stored its state is

2825

2600

# assumed to have successfully run all checkers during

2826

2601

# downtime.

2829

2604

if not client["last_checked_ok"]:

2830

2605

logger.warning(

2831

2606

"disabling client {} - Client never "

2832

"performed a successful checker".format(

2833

client_name))

2607

"performed a successful checker"

2608

.format(client_name))

2834

2609

client["enabled"] = False

2835

2610

elif client["last_checker_status"] != 0:

2836

2611

logger.warning(

2837

2612

"disabling client {} - Client last"

2838

" checker failed with error code"

2839

" {}".format(

2840

client_name,

2841

client["last_checker_status"]))

2613

" checker failed with error code {}"

2614

.format(client_name,

2615

client["last_checker_status"]))

2842

2616

client["enabled"] = False

2843

2617

else:

2844

client["expires"] = (

2845

datetime.datetime.utcnow()

2846

+ client["timeout"])

2618

client["expires"] = (datetime.datetime

2619

.utcnow()

2620

+ client["timeout"])

2847

2621

logger.debug("Last checker succeeded,"

2848

" keeping {} enabled".format(

2849

client_name))

2622

" keeping {} enabled"

2623

.format(client_name))

2850

2624

try:

2851

client["secret"] = pgp.decrypt(

2852

client["encrypted_secret"],

2853

client_settings[client_name]["secret"])

2625

client["secret"] = (

2626

pgp.decrypt(client["encrypted_secret"],

2627

client_settings[client_name]

2628

["secret"]))

2854

2629

except PGPError:

2855

2630

# If decryption fails, we use secret from new settings

2856

logger.debug("Failed to decrypt {} old secret".format(

2857

client_name))

2858

client["secret"] = (client_settings[client_name]

2859

["secret"])

2631

logger.debug("Failed to decrypt {} old secret"

2632

.format(client_name))

2633

client["secret"] = (

2634

client_settings[client_name]["secret"])

2860

2635

2861

2636

# Add/remove clients based on new changes made to config

2862

2637

for client_name in (set(old_client_settings)

2869

2644

# Create all client objects

2870

2645

for client_name, client in clients_data.items():

2871

2646

tcp_server.clients[client_name] = client_class(

2872

name = client_name,

2873

settings = client,

2647

name = client_name, settings = client,

2874

2648

server_settings = server_settings)

2875

2649

2876

2650

if not tcp_server.clients:

2878

2652

2879

2653

if not foreground:

2880

2654

if pidfile is not None:

2881

pid = os.getpid()

2882

2655

try:

2883

2656

with pidfile:

2884

print(pid, file=pidfile)

2657

pid = os.getpid()

2658

pidfile.write("{}\n".format(pid).encode("utf-8"))

2885

2659

except IOError:

2886

2660

logger.error("Could not write to file %r with PID %d",

2887

2661

pidfilename, pid)

2892

2666

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2893

2667

2894

2668

if use_dbus:

2895

2896

@alternate_dbus_interfaces(

2897

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2898

class MandosDBusService(DBusObjectWithObjectManager):

2669

@alternate_dbus_interfaces({"se.recompile.Mandos":

2670

"se.bsnet.fukt.Mandos"})

2671

class MandosDBusService(DBusObjectWithProperties):

2899

2672

"""A D-Bus proxy object"""

2900

2901

2673

def __init__(self):

2902

2674

dbus.service.Object.__init__(self, bus, "/")

2903

2904

2675

_interface = "se.recompile.Mandos"

2905

2676

2677

@dbus_interface_annotations(_interface)

2678

def _foo(self):

2679

return { "org.freedesktop.DBus.Property"

2680

".EmitsChangedSignal":

2681

"false"}

2682

2906

2683

@dbus.service.signal(_interface, signature="o")

2907

2684

def ClientAdded(self, objpath):

2908

2685

"D-Bus signal"

2913

2690

"D-Bus signal"

2914

2691

pass

2915

2692

2916

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2917

"true"})

2918

2693

@dbus.service.signal(_interface, signature="os")

2919

2694

def ClientRemoved(self, objpath, name):

2920

2695

"D-Bus signal"

2921

2696

pass

2922

2697

2923

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2924

"true"})

2925

2698

@dbus.service.method(_interface, out_signature="ao")

2926

2699

def GetAllClients(self):

2927

2700

"D-Bus method"

2928

return dbus.Array(c.dbus_object_path for c in

2701

return dbus.Array(c.dbus_object_path

2702

for c in

2929

2703

tcp_server.clients.itervalues())

2930

2704

2931

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2932

"true"})

2933

2705

@dbus.service.method(_interface,

2934

2706

out_signature="a{oa{sv}}")

2935

2707

def GetAllClientsWithProperties(self):

2936

2708

"D-Bus method"

2937

2709

return dbus.Dictionary(

2938

{ c.dbus_object_path: c.GetAll(

2939

"se.recompile.Mandos.Client")

2940

for c in tcp_server.clients.itervalues() },

2710

((c.dbus_object_path, c.GetAll(""))

2711

for c in tcp_server.clients.itervalues()),

2941

2712

signature="oa{sv}")

2942

2713

2943

2714

@dbus.service.method(_interface, in_signature="o")

2947

2718

if c.dbus_object_path == object_path:

2948

2719

del tcp_server.clients[c.name]

2949

2720

c.remove_from_connection()

2950

# Don't signal the disabling

2721

# Don't signal anything except ClientRemoved

2951

2722

c.disable(quiet=True)

2952

# Emit D-Bus signal for removal

2953

self.client_removed_signal(c)

2723

# Emit D-Bus signal

2724

self.ClientRemoved(object_path, c.name)

2954

2725

return

2955

2726

raise KeyError(object_path)

2956

2727

2957

2728

del _interface

2958

2959

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

2960

out_signature = "a{oa{sa{sv}}}")

2961

def GetManagedObjects(self):

2962

"""D-Bus method"""

2963

return dbus.Dictionary(

2964

{ client.dbus_object_path:

2965

dbus.Dictionary(

2966

{ interface: client.GetAll(interface)

2967

for interface in

2968

client._get_all_interface_names()})

2969

for client in tcp_server.clients.values()})

2970

2971

def client_added_signal(self, client):

2972

"""Send the new standard signal and the old signal"""

2973

if use_dbus:

2974

# New standard signal

2975

self.InterfacesAdded(

2976

client.dbus_object_path,

2977

dbus.Dictionary(

2978

{ interface: client.GetAll(interface)

2979

for interface in

2980

client._get_all_interface_names()}))

2981

# Old signal

2982

self.ClientAdded(client.dbus_object_path)

2983

2984

def client_removed_signal(self, client):

2985

"""Send the new standard signal and the old signal"""

2986

if use_dbus:

2987

# New standard signal

2988

self.InterfacesRemoved(

2989

client.dbus_object_path,

2990

client._get_all_interface_names())

2991

# Old signal

2992

self.ClientRemoved(client.dbus_object_path,

2993

client.name)

2994

2729

2995

2730

mandos_dbus_service = MandosDBusService()

2996

2731

3019

2754

# + secret.

3020

2755

exclude = { "bus", "changedstate", "secret",

3021

2756

"checker", "server_settings" }

3022

for name, typ in inspect.getmembers(dbus.service

3023

.Object):

2757

for name, typ in (inspect.getmembers

2758

(dbus.service.Object)):

3024

2759

exclude.add(name)

3025

2760

3026

2761

client_dict["encrypted_secret"] = (client

3033

2768

del client_settings[client.name]["secret"]

3034

2769

3035

2770

try:

3036

with tempfile.NamedTemporaryFile(

3037

mode='wb',

3038

suffix=".pickle",

3039

prefix='clients-',

3040

dir=os.path.dirname(stored_state_path),

3041

delete=False) as stored_state:

2771

with (tempfile.NamedTemporaryFile

2772

(mode='wb', suffix=".pickle", prefix='clients-',

2773

dir=os.path.dirname(stored_state_path),

2774

delete=False)) as stored_state:

3042

2775

pickle.dump((clients, client_settings), stored_state)

3043

tempname = stored_state.name

2776

tempname=stored_state.name

3044

2777

os.rename(tempname, stored_state_path)

3045

2778

except (IOError, OSError) as e:

3046

2779

if not debug:

3061

2794

name, client = tcp_server.clients.popitem()

3062

2795

if use_dbus:

3063

2796

client.remove_from_connection()

3064

# Don't signal the disabling

2797

# Don't signal anything except ClientRemoved

3065

2798

client.disable(quiet=True)

3066

# Emit D-Bus signal for removal

3067

mandos_dbus_service.client_removed_signal(client)

2799

if use_dbus:

2800

# Emit D-Bus signal

2801

mandos_dbus_service.ClientRemoved(client

2802

.dbus_object_path,

2803

client.name)

3068

2804

client_settings.clear()

3069

2805

3070

2806

atexit.register(cleanup)

3071

2807

3072

2808

for client in tcp_server.clients.itervalues():

3073

2809

if use_dbus:

3074

# Emit D-Bus signal for adding

3075

mandos_dbus_service.client_added_signal(client)

2810

# Emit D-Bus signal

2811

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3076

2812

# Need to initiate checking of clients

3077

2813

if client.enabled:

3078

2814

client.init_checker()

3123

2859

# Must run before the D-Bus bus name gets deregistered

3124

2860

cleanup()

3125

2861

3126

3127

2862

if __name__ == '__main__':

3128

2863

main()