/mandos/trunk : revision 731

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

39

import SocketServer as socketserver

43

40

import socket

44

41

import argparse

45

42

import datetime

50

47

import gnutls.library.functions

51

48

import gnutls.library.constants

52

49

import gnutls.library.types

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

50

import ConfigParser as configparser

57

51

import sys

58

52

import re

59

53

import os

68

62

import struct

69

63

import fcntl

70

64

import functools

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

65

import cPickle as pickle

75

66

import multiprocessing

76

67

import types

77

68

import binascii

81

72

82

73

import dbus

83

74

import dbus.service

84

try:

85

import gobject

86

except ImportError:

87

from gi.repository import GObject as gobject

75

import gobject

88

76

import avahi

89

77

from dbus.mainloop.glib import DBusGMainLoop

90

78

import ctypes

103

91

if sys.version_info.major == 2:

104

92

str = unicode

105

93

106

version = "1.6.9"

94

version = "1.6.8"

107

95

stored_state_file = "clients.pickle"

108

96

109

97

logger = logging.getLogger()

110

98

syslogger = None

111

99

112

100

try:

113

if_nametoindex = ctypes.cdll.LoadLibrary(

114

ctypes.util.find_library("c")).if_nametoindex

101

if_nametoindex = (ctypes.cdll.LoadLibrary

102

(ctypes.util.find_library("c"))

103

.if_nametoindex)

115

104

except (OSError, AttributeError):

116

117

105

def if_nametoindex(interface):

118

106

"Get an interface index the hard way, i.e. using fcntl()"

119

107

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

128

116

"""init logger and add loglevel"""

129

117

130

118

global syslogger

131

syslogger = (logging.handlers.SysLogHandler(

132

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

133

address = "/dev/log"))

119

syslogger = (logging.handlers.SysLogHandler

120

(facility =

121

logging.handlers.SysLogHandler.LOG_DAEMON,

122

address = "/dev/log"))

134

123

syslogger.setFormatter(logging.Formatter

135

124

('Mandos [%(process)d]: %(levelname)s:'

136

125

' %(message)s'))

153

142

154

143

class PGPEngine(object):

155

144

"""A simple class for OpenPGP symmetric encryption & decryption"""

156

157

145

def __init__(self):

158

146

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

159

147

self.gnupgargs = ['--batch',

198

186

199

187

def encrypt(self, data, password):

200

188

passphrase = self.password_encode(password)

201

with tempfile.NamedTemporaryFile(

202

dir=self.tempdir) as passfile:

189

with tempfile.NamedTemporaryFile(dir=self.tempdir

190

) as passfile:

203

191

passfile.write(passphrase)

204

192

passfile.flush()

205

193

proc = subprocess.Popen(['gpg', '--symmetric',

216

204

217

205

def decrypt(self, data, password):

218

206

passphrase = self.password_encode(password)

219

with tempfile.NamedTemporaryFile(

220

dir = self.tempdir) as passfile:

207

with tempfile.NamedTemporaryFile(dir = self.tempdir

208

) as passfile:

221

209

passfile.write(passphrase)

222

210

passfile.flush()

223

211

proc = subprocess.Popen(['gpg', '--decrypt',

227

215

stdin = subprocess.PIPE,

228

216

stdout = subprocess.PIPE,

229

217

stderr = subprocess.PIPE)

230

decrypted_plaintext, err = proc.communicate(input = data)

218

decrypted_plaintext, err = proc.communicate(input

219

= data)

231

220

if proc.returncode != 0:

232

221

raise PGPError(err)

233

222

return decrypted_plaintext

239

228

return super(AvahiError, self).__init__(value, *args,

240

229

**kwargs)

241

230

242

243

231

class AvahiServiceError(AvahiError):

244

232

pass

245

233

246

247

234

class AvahiGroupError(AvahiError):

248

235

pass

249

236

269

256

bus: dbus.SystemBus()

270

257

"""

271

258

272

def __init__(self,

273

interface = avahi.IF_UNSPEC,

274

name = None,

275

servicetype = None,

276

port = None,

277

TXT = None,

278

domain = "",

279

host = "",

280

max_renames = 32768,

281

protocol = avahi.PROTO_UNSPEC,

282

bus = None):

259

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

260

servicetype = None, port = None, TXT = None,

261

domain = "", host = "", max_renames = 32768,

262

protocol = avahi.PROTO_UNSPEC, bus = None):

283

263

self.interface = interface

284

264

self.name = name

285

265

self.type = servicetype

295

275

self.bus = bus

296

276

self.entry_group_state_changed_match = None

297

277

298

def rename(self, remove=True):

278

def rename(self):

299

279

"""Derived from the Avahi example code"""

300

280

if self.rename_count >= self.max_renames:

301

281

logger.critical("No suitable Zeroconf service name found"

302

282

" after %i retries, exiting.",

303

283

self.rename_count)

304

284

raise AvahiServiceError("Too many renames")

305

self.name = str(

306

self.server.GetAlternativeServiceName(self.name))

307

self.rename_count += 1

285

self.name = str(self.server

286

.GetAlternativeServiceName(self.name))

308

287

logger.info("Changing Zeroconf service name to %r ...",

309

288

self.name)

310

if remove:

311

self.remove()

289

self.remove()

312

290

try:

313

291

self.add()

314

292

except dbus.exceptions.DBusException as error:

315

if (error.get_dbus_name()

316

== "org.freedesktop.Avahi.CollisionError"):

317

logger.info("Local Zeroconf service name collision.")

318

return self.rename(remove=False)

319

else:

320

logger.critical("D-Bus Exception", exc_info=error)

321

self.cleanup()

322

os._exit(1)

293

logger.critical("D-Bus Exception", exc_info=error)

294

self.cleanup()

295

os._exit(1)

296

self.rename_count += 1

323

297

324

298

def remove(self):

325

299

"""Derived from the Avahi example code"""

364

338

elif state == avahi.ENTRY_GROUP_FAILURE:

365

339

logger.critical("Avahi: Error in group state changed %s",

366

340

str(error))

367

raise AvahiGroupError("State changed: {!s}".format(error))

341

raise AvahiGroupError("State changed: {!s}"

342

.format(error))

368

343

369

344

def cleanup(self):

370

345

"""Derived from the Avahi example code"""

380

355

def server_state_changed(self, state, error=None):

381

356

"""Derived from the Avahi example code"""

382

357

logger.debug("Avahi server state change: %i", state)

383

bad_states = {

384

avahi.SERVER_INVALID: "Zeroconf server invalid",

385

avahi.SERVER_REGISTERING: None,

386

avahi.SERVER_COLLISION: "Zeroconf server name collision",

387

avahi.SERVER_FAILURE: "Zeroconf server failure",

388

}

358

bad_states = { avahi.SERVER_INVALID:

359

"Zeroconf server invalid",

360

avahi.SERVER_REGISTERING: None,

361

avahi.SERVER_COLLISION:

362

"Zeroconf server name collision",

363

avahi.SERVER_FAILURE:

364

"Zeroconf server failure" }

389

365

if state in bad_states:

390

366

if bad_states[state] is not None:

391

367

if error is None:

410

386

follow_name_owner_changes=True),

411

387

avahi.DBUS_INTERFACE_SERVER)

412

388

self.server.connect_to_signal("StateChanged",

413

self.server_state_changed)

389

self.server_state_changed)

414

390

self.server_state_changed(self.server.GetState())

415

391

416

392

417

393

class AvahiServiceToSyslog(AvahiService):

418

def rename(self, *args, **kwargs):

394

def rename(self):

419

395

"""Add the new name to the syslog messages"""

420

ret = AvahiService.rename(self, *args, **kwargs)

421

syslogger.setFormatter(logging.Formatter(

422

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

423

.format(self.name)))

396

ret = AvahiService.rename(self)

397

syslogger.setFormatter(logging.Formatter

398

('Mandos ({}) [%(process)d]:'

399

' %(levelname)s: %(message)s'

400

.format(self.name)))

424

401

return ret

425

402

426

403

473

450

"fingerprint", "host", "interval",

474

451

"last_approval_request", "last_checked_ok",

475

452

"last_enabled", "name", "timeout")

476

client_defaults = {

477

"timeout": "PT5M",

478

"extended_timeout": "PT15M",

479

"interval": "PT2M",

480

"checker": "fping -q -- %%(host)s",

481

"host": "",

482

"approval_delay": "PT0S",

483

"approval_duration": "PT1S",

484

"approved_by_default": "True",

485

"enabled": "True",

486

}

453

client_defaults = { "timeout": "PT5M",

454

"extended_timeout": "PT15M",

455

"interval": "PT2M",

456

"checker": "fping -q -- %%(host)s",

457

"host": "",

458

"approval_delay": "PT0S",

459

"approval_duration": "PT1S",

460

"approved_by_default": "True",

461

"enabled": "True",

462

}

487

463

488

464

@staticmethod

489

465

def config_parser(config):

505

481

client["enabled"] = config.getboolean(client_name,

506

482

"enabled")

507

483

508

# Uppercase and remove spaces from fingerprint for later

509

# comparison purposes with return value from the

510

# fingerprint() function

511

484

client["fingerprint"] = (section["fingerprint"].upper()

512

485

.replace(" ", ""))

513

486

if "secret" in section:

555

528

self.expires = None

556

529

557

530

logger.debug("Creating client %r", self.name)

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the fingerprint()

533

# function

558

534

logger.debug(" Fingerprint: %s", self.fingerprint)

559

535

self.created = settings.get("created",

560

536

datetime.datetime.utcnow())

567

543

self.current_checker_command = None

568

544

self.approved = None

569

545

self.approvals_pending = 0

570

self.changedstate = multiprocessing_manager.Condition(

571

multiprocessing_manager.Lock())

572

self.client_structure = [attr

573

for attr in self.__dict__.iterkeys()

546

self.changedstate = (multiprocessing_manager

547

.Condition(multiprocessing_manager

548

.Lock()))

549

self.client_structure = [attr for attr in

550

self.__dict__.iterkeys()

574

551

if not attr.startswith("_")]

575

552

self.client_structure.append("client_structure")

576

553

577

for name, t in inspect.getmembers(

578

type(self), lambda obj: isinstance(obj, property)):

554

for name, t in inspect.getmembers(type(self),

555

lambda obj:

556

isinstance(obj,

557

property)):

579

558

if not name.startswith("_"):

580

559

self.client_structure.append(name)

581

560

623

602

# and every interval from then on.

624

603

if self.checker_initiator_tag is not None:

625

604

gobject.source_remove(self.checker_initiator_tag)

626

self.checker_initiator_tag = gobject.timeout_add(

627

int(self.interval.total_seconds() * 1000),

628

self.start_checker)

605

self.checker_initiator_tag = (gobject.timeout_add

606

(int(self.interval

607

.total_seconds() * 1000),

608

self.start_checker))

629

609

# Schedule a disable() when 'timeout' has passed

630

610

if self.disable_initiator_tag is not None:

631

611

gobject.source_remove(self.disable_initiator_tag)

632

self.disable_initiator_tag = gobject.timeout_add(

633

int(self.timeout.total_seconds() * 1000), self.disable)

612

self.disable_initiator_tag = (gobject.timeout_add

613

(int(self.timeout

614

.total_seconds() * 1000),

615

self.disable))

634

616

# Also start a new checker *right now*.

635

617

self.start_checker()

636

618

645

627

vars(self))

646

628

self.checked_ok()

647

629

else:

648

logger.info("Checker for %(name)s failed", vars(self))

630

logger.info("Checker for %(name)s failed",

631

vars(self))

649

632

else:

650

633

self.last_checker_status = -1

651

634

logger.warning("Checker for %(name)s crashed?",

665

648

gobject.source_remove(self.disable_initiator_tag)

666

649

self.disable_initiator_tag = None

667

650

if getattr(self, "enabled", False):

668

self.disable_initiator_tag = gobject.timeout_add(

669

int(timeout.total_seconds() * 1000), self.disable)

651

self.disable_initiator_tag = (gobject.timeout_add

652

(int(timeout.total_seconds()

653

* 1000), self.disable))

670

654

self.expires = datetime.datetime.utcnow() + timeout

671

655

672

656

def need_approval(self):

703

687

# Start a new checker if needed

704

688

if self.checker is None:

705

689

# Escape attributes for the shell

706

escaped_attrs = {

707

attr: re.escape(str(getattr(self, attr)))

708

for attr in self.runtime_expansions }

690

escaped_attrs = { attr:

691

re.escape(str(getattr(self, attr)))

692

for attr in self.runtime_expansions }

709

693

try:

710

694

command = self.checker_command % escaped_attrs

711

695

except TypeError as error:

712

696

logger.error('Could not format string "%s"',

713

self.checker_command,

714

exc_info=error)

715

return True # Try again later

697

self.checker_command, exc_info=error)

698

return True # Try again later

716

699

self.current_checker_command = command

717

700

try:

718

logger.info("Starting checker %r for %s", command,

719

self.name)

701

logger.info("Starting checker %r for %s",

702

command, self.name)

720

703

# We don't need to redirect stdout and stderr, since

721

704

# in normal mode, that is already done by daemon(),

722

705

# and in debug mode we don't want to. (Stdin is

731

714

"stderr": wnull })

732

715

self.checker = subprocess.Popen(command,

733

716

close_fds=True,

734

shell=True,

735

cwd="/",

717

shell=True, cwd="/",

736

718

**popen_args)

737

719

except OSError as error:

738

720

logger.error("Failed to start subprocess",

739

721

exc_info=error)

740

722

return True

741

self.checker_callback_tag = gobject.child_watch_add(

742

self.checker.pid, self.checker_callback, data=command)

723

self.checker_callback_tag = (gobject.child_watch_add

724

(self.checker.pid,

725

self.checker_callback,

726

data=command))

743

727

# The checker may have completed before the gobject

744

728

# watch was added. Check for this.

745

729

try:

776

760

self.checker = None

777

761

778

762

779

def dbus_service_property(dbus_interface,

780

signature="v",

781

access="readwrite",

782

byte_arrays=False):

763

def dbus_service_property(dbus_interface, signature="v",

764

access="readwrite", byte_arrays=False):

783

765

"""Decorators for marking methods of a DBusObjectWithProperties to

784

766

become properties on the D-Bus.

785

767

795

777

if byte_arrays and signature != "ay":

796

778

raise ValueError("Byte arrays not supported for non-'ay'"

797

779

" signature {!r}".format(signature))

798

799

780

def decorator(func):

800

781

func._dbus_is_property = True

801

782

func._dbus_interface = dbus_interface

806

787

func._dbus_name = func._dbus_name[:-14]

807

788

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

808

789

return func

809

810

790

return decorator

811

791

812

792

821

801

"org.freedesktop.DBus.Property.EmitsChangedSignal":

822

802

"false"}

823

803

"""

824

825

804

def decorator(func):

826

805

func._dbus_is_interface = True

827

806

func._dbus_interface = dbus_interface

828

807

func._dbus_name = dbus_interface

829

808

return func

830

831

809

return decorator

832

810

833

811

835

813

"""Decorator to annotate D-Bus methods, signals or properties

836

814

Usage:

837

815

838

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

839

"org.freedesktop.DBus.Property."

840

"EmitsChangedSignal": "false"})

841

816

@dbus_service_property("org.example.Interface", signature="b",

842

817

access="r")

818

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

819

"org.freedesktop.DBus.Property."

820

"EmitsChangedSignal": "false"})

843

821

def Property_dbus_property(self):

844

822

return dbus.Boolean(False)

845

823

"""

846

847

824

def decorator(func):

848

825

func._dbus_annotations = annotations

849

826

return func

850

851

827

return decorator

852

828

853

829

856

832

"""

857

833

pass

858

834

859

860

835

class DBusPropertyAccessException(DBusPropertyException):

861

836

"""A property's access permissions disallows an operation.

862

837

"""

890

865

def _get_all_dbus_things(self, thing):

891

866

"""Returns a generator of (name, attribute) pairs

892

867

"""

893

return ((getattr(athing.__get__(self), "_dbus_name", name),

868

return ((getattr(athing.__get__(self), "_dbus_name",

869

name),

894

870

athing.__get__(self))

895

871

for cls in self.__class__.__mro__

896

872

for name, athing in

897

inspect.getmembers(cls, self._is_dbus_thing(thing)))

873

inspect.getmembers(cls,

874

self._is_dbus_thing(thing)))

898

875

899

876

def _get_dbus_property(self, interface_name, property_name):

900

877

"""Returns a bound method if one exists which is a D-Bus

901

878

property with the specified name and interface.

902

879

"""

903

for cls in self.__class__.__mro__:

904

for name, value in inspect.getmembers(

905

cls, self._is_dbus_thing("property")):

880

for cls in self.__class__.__mro__:

881

for name, value in (inspect.getmembers

882

(cls,

883

self._is_dbus_thing("property"))):

906

884

if (value._dbus_name == property_name

907

885

and value._dbus_interface == interface_name):

908

886

return value.__get__(self)

909

887

910

888

# No such property

911

raise DBusPropertyNotFound("{}:{}.{}".format(

912

self.dbus_object_path, interface_name, property_name))

889

raise DBusPropertyNotFound(self.dbus_object_path + ":"

890

+ interface_name + "."

891

+ property_name)

913

892

914

@dbus.service.method(dbus.PROPERTIES_IFACE,

915

in_signature="ss",

893

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

916

894

out_signature="v")

917

895

def Get(self, interface_name, property_name):

918

896

"""Standard D-Bus property Get() method, see D-Bus standard.

943

921

for byte in value))

944

922

prop(value)

945

923

946

@dbus.service.method(dbus.PROPERTIES_IFACE,

947

in_signature="s",

924

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

948

925

out_signature="a{sv}")

949

926

def GetAll(self, interface_name):

950

927

"""Standard D-Bus property GetAll() method, see D-Bus

965

942

if not hasattr(value, "variant_level"):

966

943

properties[name] = value

967

944

continue

968

properties[name] = type(value)(

969

value, variant_level = value.variant_level + 1)

945

properties[name] = type(value)(value, variant_level=

946

value.variant_level+1)

970

947

return dbus.Dictionary(properties, signature="sv")

971

948

972

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

973

def PropertiesChanged(self, interface_name, changed_properties,

974

invalidated_properties):

975

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

976

standard.

977

"""

978

pass

979

980

949

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

981

950

out_signature="s",

982

951

path_keyword='object_path',

990

959

connection)

991

960

try:

992

961

document = xml.dom.minidom.parseString(xmlstring)

993

994

962

def make_tag(document, name, prop):

995

963

e = document.createElement("property")

996

964

e.setAttribute("name", name)

997

965

e.setAttribute("type", prop._dbus_signature)

998

966

e.setAttribute("access", prop._dbus_access)

999

967

return e

1000

1001

968

for if_tag in document.getElementsByTagName("interface"):

1002

969

# Add property tags

1003

970

for tag in (make_tag(document, name, prop)

1015

982

if (name == tag.getAttribute("name")

1016

983

and prop._dbus_interface

1017

984

== if_tag.getAttribute("name")):

1018

annots.update(getattr(

1019

prop, "_dbus_annotations", {}))

985

annots.update(getattr

986

(prop,

987

"_dbus_annotations",

988

{}))

1020

989

for name, value in annots.items():

1021

990

ann_tag = document.createElement(

1022

991

"annotation")

1027

996

for annotation, value in dict(

1028

997

itertools.chain.from_iterable(

1029

998

annotations().items()

1030

for name, annotations

1031

in self._get_all_dbus_things("interface")

999

for name, annotations in

1000

self._get_all_dbus_things("interface")

1032

1001

if name == if_tag.getAttribute("name")

1033

1002

)).items():

1034

1003

ann_tag = document.createElement("annotation")

1063

1032

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1064

1033

if dt is None:

1065

1034

return dbus.String("", variant_level = variant_level)

1066

return dbus.String(dt.isoformat(), variant_level=variant_level)

1035

return dbus.String(dt.isoformat(),

1036

variant_level=variant_level)

1067

1037

1068

1038

1069

1039

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1089

1059

(from DBusObjectWithProperties) and interfaces (from the

1090

1060

dbus_interface_annotations decorator).

1091

1061

"""

1092

1093

1062

def wrapper(cls):

1094

1063

for orig_interface_name, alt_interface_name in (

1095

alt_interface_names.items()):

1064

alt_interface_names.items()):

1096

1065

attr = {}

1097

1066

interface_names = set()

1098

1067

# Go though all attributes of the class

1100

1069

# Ignore non-D-Bus attributes, and D-Bus attributes

1101

1070

# with the wrong interface name

1102

1071

if (not hasattr(attribute, "_dbus_interface")

1103

or not attribute._dbus_interface.startswith(

1104

orig_interface_name)):

1072

or not attribute._dbus_interface

1073

.startswith(orig_interface_name)):

1105

1074

continue

1106

1075

# Create an alternate D-Bus interface name based on

1107

1076

# the current name

1108

alt_interface = attribute._dbus_interface.replace(

1109

orig_interface_name, alt_interface_name)

1077

alt_interface = (attribute._dbus_interface

1078

.replace(orig_interface_name,

1079

alt_interface_name))

1110

1080

interface_names.add(alt_interface)

1111

1081

# Is this a D-Bus signal?

1112

1082

if getattr(attribute, "_dbus_is_signal", False):

1113

1083

# Extract the original non-method undecorated

1114

1084

# function by black magic

1115

1085

nonmethod_func = (dict(

1116

zip(attribute.func_code.co_freevars,

1117

attribute.__closure__))

1118

["func"].cell_contents)

1086

zip(attribute.func_code.co_freevars,

1087

attribute.__closure__))["func"]

1088

.cell_contents)

1119

1089

# Create a new, but exactly alike, function

1120

1090

# object, and decorate it to be a new D-Bus signal

1121

1091

# with the alternate D-Bus interface name

1122

new_function = (dbus.service.signal(

1123

alt_interface, attribute._dbus_signature)

1092

new_function = (dbus.service.signal

1093

(alt_interface,

1094

attribute._dbus_signature)

1124

1095

(types.FunctionType(

1125

nonmethod_func.func_code,

1126

nonmethod_func.func_globals,

1127

nonmethod_func.func_name,

1128

nonmethod_func.func_defaults,

1129

nonmethod_func.func_closure)))

1096

nonmethod_func.func_code,

1097

nonmethod_func.func_globals,

1098

nonmethod_func.func_name,

1099

nonmethod_func.func_defaults,

1100

nonmethod_func.func_closure)))

1130

1101

# Copy annotations, if any

1131

1102

try:

1132

new_function._dbus_annotations = dict(

1133

attribute._dbus_annotations)

1103

new_function._dbus_annotations = (

1104

dict(attribute._dbus_annotations))

1134

1105

except AttributeError:

1135

1106

pass

1136

1107

# Define a creator of a function to call both the

1141

1112

"""This function is a scope container to pass

1142

1113

func1 and func2 to the "call_both" function

1143

1114

outside of its arguments"""

1144

1145

1115

def call_both(*args, **kwargs):

1146

1116

"""This function will emit two D-Bus

1147

1117

signals by calling func1 and func2"""

1148

1118

func1(*args, **kwargs)

1149

1119

func2(*args, **kwargs)

1150

1151

1120

return call_both

1152

1121

# Create the "call_both" function and add it to

1153

1122

# the class

1158

1127

# object. Decorate it to be a new D-Bus method

1159

1128

# with the alternate D-Bus interface name. Add it

1160

1129

# to the class.

1161

attr[attrname] = (

1162

dbus.service.method(

1163

alt_interface,

1164

attribute._dbus_in_signature,

1165

attribute._dbus_out_signature)

1166

(types.FunctionType(attribute.func_code,

1167

attribute.func_globals,

1168

attribute.func_name,

1169

attribute.func_defaults,

1170

attribute.func_closure)))

1130

attr[attrname] = (dbus.service.method

1131

(alt_interface,

1132

attribute._dbus_in_signature,

1133

attribute._dbus_out_signature)

1134

(types.FunctionType

1135

(attribute.func_code,

1136

attribute.func_globals,

1137

attribute.func_name,

1138

attribute.func_defaults,

1139

attribute.func_closure)))

1171

1140

# Copy annotations, if any

1172

1141

try:

1173

attr[attrname]._dbus_annotations = dict(

1174

attribute._dbus_annotations)

1142

attr[attrname]._dbus_annotations = (

1143

dict(attribute._dbus_annotations))

1175

1144

except AttributeError:

1176

1145

pass

1177

1146

# Is this a D-Bus property?

1180

1149

# object, and decorate it to be a new D-Bus

1181

1150

# property with the alternate D-Bus interface

1182

1151

# name. Add it to the class.

1183

attr[attrname] = (dbus_service_property(

1184

alt_interface, attribute._dbus_signature,

1185

attribute._dbus_access,

1186

attribute._dbus_get_args_options

1187

["byte_arrays"])

1188

(types.FunctionType(

1189

attribute.func_code,

1190

attribute.func_globals,

1191

attribute.func_name,

1192

attribute.func_defaults,

1193

attribute.func_closure)))

1152

attr[attrname] = (dbus_service_property

1153

(alt_interface,

1154

attribute._dbus_signature,

1155

attribute._dbus_access,

1156

attribute

1157

._dbus_get_args_options

1158

["byte_arrays"])

1159

(types.FunctionType

1160

(attribute.func_code,

1161

attribute.func_globals,

1162

attribute.func_name,

1163

attribute.func_defaults,

1164

attribute.func_closure)))

1194

1165

# Copy annotations, if any

1195

1166

try:

1196

attr[attrname]._dbus_annotations = dict(

1197

attribute._dbus_annotations)

1167

attr[attrname]._dbus_annotations = (

1168

dict(attribute._dbus_annotations))

1198

1169

except AttributeError:

1199

1170

pass

1200

1171

# Is this a D-Bus interface?

1203

1174

# object. Decorate it to be a new D-Bus interface

1204

1175

# with the alternate D-Bus interface name. Add it

1205

1176

# to the class.

1206

attr[attrname] = (

1207

dbus_interface_annotations(alt_interface)

1208

(types.FunctionType(attribute.func_code,

1209

attribute.func_globals,

1210

attribute.func_name,

1211

attribute.func_defaults,

1212

attribute.func_closure)))

1177

attr[attrname] = (dbus_interface_annotations

1178

(alt_interface)

1179

(types.FunctionType

1180

(attribute.func_code,

1181

attribute.func_globals,

1182

attribute.func_name,

1183

attribute.func_defaults,

1184

attribute.func_closure)))

1213

1185

if deprecate:

1214

1186

# Deprecate all alternate interfaces

1215

1187

iname="_AlternateDBusNames_interface_annotation{}"

1216

1188

for interface_name in interface_names:

1217

1218

1189

@dbus_interface_annotations(interface_name)

1219

1190

def func(self):

1220

1191

return { "org.freedesktop.DBus.Deprecated":

1221

"true" }

1192

"true" }

1222

1193

# Find an unused name

1223

1194

for aname in (iname.format(i)

1224

1195

for i in itertools.count()):

1229

1200

# Replace the class with a new subclass of it with

1230

1201

# methods, signals, etc. as created above.

1231

1202

cls = type(b"{}Alternate".format(cls.__name__),

1232

(cls, ), attr)

1203

(cls,), attr)

1233

1204

return cls

1234

1235

1205

return wrapper

1236

1206

1237

1207

1238

1208

@alternate_dbus_interfaces({"se.recompile.Mandos":

1239

"se.bsnet.fukt.Mandos"})

1209

"se.bsnet.fukt.Mandos"})

1240

1210

class ClientDBus(Client, DBusObjectWithProperties):

1241

1211

"""A Client class using D-Bus

1242

1212

1246

1216

"""

1247

1217

1248

1218

runtime_expansions = (Client.runtime_expansions

1249

+ ("dbus_object_path", ))

1250

1251

_interface = "se.recompile.Mandos.Client"

1219

+ ("dbus_object_path",))

1252

1220

1253

1221

# dbus.service.Object doesn't use super(), so we can't either.

1254

1222

1260

1228

client_object_name = str(self.name).translate(

1261

1229

{ord("."): ord("_"),

1262

1230

ord("-"): ord("_")})

1263

self.dbus_object_path = dbus.ObjectPath(

1264

"/clients/" + client_object_name)

1231

self.dbus_object_path = (dbus.ObjectPath

1232

("/clients/" + client_object_name))

1265

1233

DBusObjectWithProperties.__init__(self, self.bus,

1266

1234

self.dbus_object_path)

1267

1235

1268

def notifychangeproperty(transform_func, dbus_name,

1269

type_func=lambda x: x,

1270

variant_level=1,

1271

invalidate_only=False,

1272

_interface=_interface):

1236

def notifychangeproperty(transform_func,

1237

dbus_name, type_func=lambda x: x,

1238

variant_level=1):

1273

1239

""" Modify a variable so that it's a property which announces

1274

1240

its changes to DBus.

1275

1241

1281

1247

variant_level: D-Bus variant level. Default: 1

1282

1248

"""

1283

1249

attrname = "_{}".format(dbus_name)

1284

1285

1250

def setter(self, value):

1286

1251

if hasattr(self, "dbus_object_path"):

1287

1252

if (not hasattr(self, attrname) or

1288

1253

type_func(getattr(self, attrname, None))

1289

1254

!= type_func(value)):

1290

if invalidate_only:

1291

self.PropertiesChanged(

1292

_interface, dbus.Dictionary(),

1293

dbus.Array((dbus_name, )))

1294

else:

1295

dbus_value = transform_func(

1296

type_func(value),

1297

variant_level = variant_level)

1298

self.PropertyChanged(dbus.String(dbus_name),

1299

dbus_value)

1300

self.PropertiesChanged(

1301

_interface,

1302

dbus.Dictionary({ dbus.String(dbus_name):

1303

dbus_value }),

1304

dbus.Array())

1255

dbus_value = transform_func(type_func(value),

1256

variant_level

1257

=variant_level)

1258

self.PropertyChanged(dbus.String(dbus_name),

1259

dbus_value)

1305

1260

setattr(self, attrname, value)

1306

1261

1307

1262

return property(lambda self: getattr(self, attrname), setter)

1313

1268

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1314

1269

last_enabled = notifychangeproperty(datetime_to_dbus,

1315

1270

"LastEnabled")

1316

checker = notifychangeproperty(

1317

dbus.Boolean, "CheckerRunning",

1318

type_func = lambda checker: checker is not None)

1271

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1272

type_func = lambda checker:

1273

checker is not None)

1319

1274

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1320

1275

"LastCheckedOK")

1321

1276

last_checker_status = notifychangeproperty(dbus.Int16,

1324

1279

datetime_to_dbus, "LastApprovalRequest")

1325

1280

approved_by_default = notifychangeproperty(dbus.Boolean,

1326

1281

"ApprovedByDefault")

1327

approval_delay = notifychangeproperty(

1328

dbus.UInt64, "ApprovalDelay",

1329

type_func = lambda td: td.total_seconds() * 1000)

1282

approval_delay = notifychangeproperty(dbus.UInt64,

1283

"ApprovalDelay",

1284

type_func =

1285

lambda td: td.total_seconds()

1286

* 1000)

1330

1287

approval_duration = notifychangeproperty(

1331

1288

dbus.UInt64, "ApprovalDuration",

1332

1289

type_func = lambda td: td.total_seconds() * 1000)

1333

1290

host = notifychangeproperty(dbus.String, "Host")

1334

timeout = notifychangeproperty(

1335

dbus.UInt64, "Timeout",

1336

type_func = lambda td: td.total_seconds() * 1000)

1291

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1292

type_func = lambda td:

1293

td.total_seconds() * 1000)

1337

1294

extended_timeout = notifychangeproperty(

1338

1295

dbus.UInt64, "ExtendedTimeout",

1339

1296

type_func = lambda td: td.total_seconds() * 1000)

1340

interval = notifychangeproperty(

1341

dbus.UInt64, "Interval",

1342

type_func = lambda td: td.total_seconds() * 1000)

1297

interval = notifychangeproperty(dbus.UInt64,

1298

"Interval",

1299

type_func =

1300

lambda td: td.total_seconds()

1301

* 1000)

1343

1302

checker_command = notifychangeproperty(dbus.String, "Checker")

1344

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1345

invalidate_only=True)

1346

1303

1347

1304

del notifychangeproperty

1348

1305

1395

1352

self.send_changedstate()

1396

1353

1397

1354

## D-Bus methods, signals & properties

1355

_interface = "se.recompile.Mandos.Client"

1398

1356

1399

1357

## Interfaces

1400

1358

1359

@dbus_interface_annotations(_interface)

1360

def _foo(self):

1361

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1362

"false"}

1363

1401

1364

## Signals

1402

1365

1403

1366

# CheckerCompleted - signal

1413

1376

pass

1414

1377

1415

1378

# PropertyChanged - signal

1416

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1417

1379

@dbus.service.signal(_interface, signature="sv")

1418

1380

def PropertyChanged(self, property, value):

1419

1381

"D-Bus signal"

1483

1445

return dbus.Boolean(bool(self.approvals_pending))

1484

1446

1485

1447

# ApprovedByDefault - property

1486

@dbus_service_property(_interface,

1487

signature="b",

1448

@dbus_service_property(_interface, signature="b",

1488

1449

access="readwrite")

1489

1450

def ApprovedByDefault_dbus_property(self, value=None):

1490

1451

if value is None: # get

1492

1453

self.approved_by_default = bool(value)

1493

1454

1494

1455

# ApprovalDelay - property

1495

@dbus_service_property(_interface,

1496

signature="t",

1456

@dbus_service_property(_interface, signature="t",

1497

1457

access="readwrite")

1498

1458

def ApprovalDelay_dbus_property(self, value=None):

1499

1459

if value is None: # get

1502

1462

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1503

1463

1504

1464

# ApprovalDuration - property

1505

@dbus_service_property(_interface,

1506

signature="t",

1465

@dbus_service_property(_interface, signature="t",

1507

1466

access="readwrite")

1508

1467

def ApprovalDuration_dbus_property(self, value=None):

1509

1468

if value is None: # get

1522

1481

return dbus.String(self.fingerprint)

1523

1482

1524

1483

# Host - property

1525

@dbus_service_property(_interface,

1526

signature="s",

1484

@dbus_service_property(_interface, signature="s",

1527

1485

access="readwrite")

1528

1486

def Host_dbus_property(self, value=None):

1529

1487

if value is None: # get

1541

1499

return datetime_to_dbus(self.last_enabled)

1542

1500

1543

1501

# Enabled - property

1544

@dbus_service_property(_interface,

1545

signature="b",

1502

@dbus_service_property(_interface, signature="b",

1546

1503

access="readwrite")

1547

1504

def Enabled_dbus_property(self, value=None):

1548

1505

if value is None: # get

1553

1510

self.disable()

1554

1511

1555

1512

# LastCheckedOK - property

1556

@dbus_service_property(_interface,

1557

signature="s",

1513

@dbus_service_property(_interface, signature="s",

1558

1514

access="readwrite")

1559

1515

def LastCheckedOK_dbus_property(self, value=None):

1560

1516

if value is not None:

1563

1519

return datetime_to_dbus(self.last_checked_ok)

1564

1520

1565

1521

# LastCheckerStatus - property

1566

@dbus_service_property(_interface, signature="n", access="read")

1522

@dbus_service_property(_interface, signature="n",

1523

access="read")

1567

1524

def LastCheckerStatus_dbus_property(self):

1568

1525

return dbus.Int16(self.last_checker_status)

1569

1526

1578

1535

return datetime_to_dbus(self.last_approval_request)

1579

1536

1580

1537

# Timeout - property

1581

@dbus_service_property(_interface,

1582

signature="t",

1538

@dbus_service_property(_interface, signature="t",

1583

1539

access="readwrite")

1584

1540

def Timeout_dbus_property(self, value=None):

1585

1541

if value is None: # get

1598

1554

is None):

1599

1555

return

1600

1556

gobject.source_remove(self.disable_initiator_tag)

1601

self.disable_initiator_tag = gobject.timeout_add(

1602

int((self.expires - now).total_seconds() * 1000),

1603

self.disable)

1557

self.disable_initiator_tag = (

1558

gobject.timeout_add(

1559

int((self.expires - now).total_seconds()

1560

* 1000), self.disable))

1604

1561

1605

1562

# ExtendedTimeout - property

1606

@dbus_service_property(_interface,

1607

signature="t",

1563

@dbus_service_property(_interface, signature="t",

1608

1564

access="readwrite")

1609

1565

def ExtendedTimeout_dbus_property(self, value=None):

1610

1566

if value is None: # get

1613

1569

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1614

1570

1615

1571

# Interval - property

1616

@dbus_service_property(_interface,

1617

signature="t",

1572

@dbus_service_property(_interface, signature="t",

1618

1573

access="readwrite")

1619

1574

def Interval_dbus_property(self, value=None):

1620

1575

if value is None: # get

1625

1580

if self.enabled:

1626

1581

# Reschedule checker run

1627

1582

gobject.source_remove(self.checker_initiator_tag)

1628

self.checker_initiator_tag = gobject.timeout_add(

1629

value, self.start_checker)

1630

self.start_checker() # Start one now, too

1583

self.checker_initiator_tag = (gobject.timeout_add

1584

(value, self.start_checker))

1585

self.start_checker() # Start one now, too

1631

1586

1632

1587

# Checker - property

1633

@dbus_service_property(_interface,

1634

signature="s",

1588

@dbus_service_property(_interface, signature="s",

1635

1589

access="readwrite")

1636

1590

def Checker_dbus_property(self, value=None):

1637

1591

if value is None: # get

1639

1593

self.checker_command = str(value)

1640

1594

1641

1595

# CheckerRunning - property

1642

@dbus_service_property(_interface,

1643

signature="b",

1596

@dbus_service_property(_interface, signature="b",

1644

1597

access="readwrite")

1645

1598

def CheckerRunning_dbus_property(self, value=None):

1646

1599

if value is None: # get

1656

1609

return self.dbus_object_path # is already a dbus.ObjectPath

1657

1610

1658

1611

# Secret = property

1659

@dbus_service_property(_interface,

1660

signature="ay",

1661

access="write",

1662

byte_arrays=True)

1612

@dbus_service_property(_interface, signature="ay",

1613

access="write", byte_arrays=True)

1663

1614

def Secret_dbus_property(self, value):

1664

1615

self.secret = bytes(value)

1665

1616

1681

1632

if data[0] == 'data':

1682

1633

return data[1]

1683

1634

if data[0] == 'function':

1684

1685

1635

def func(*args, **kwargs):

1686

1636

self._pipe.send(('funcall', name, args, kwargs))

1687

1637

return self._pipe.recv()[1]

1688

1689

1638

return func

1690

1639

1691

1640

def __setattr__(self, name, value):

1707

1656

logger.debug("Pipe FD: %d",

1708

1657

self.server.child_pipe.fileno())

1709

1658

1710

session = gnutls.connection.ClientSession(

1711

self.request, gnutls.connection .X509Credentials())

1659

session = (gnutls.connection

1660

.ClientSession(self.request,

1661

gnutls.connection

1662

.X509Credentials()))

1712

1663

1713

1664

# Note: gnutls.connection.X509Credentials is really a

1714

1665

# generic GnuTLS certificate credentials object so long as

1723

1674

priority = self.server.gnutls_priority

1724

1675

if priority is None:

1725

1676

priority = "NORMAL"

1726

gnutls.library.functions.gnutls_priority_set_direct(

1727

session._c_object, priority, None)

1677

(gnutls.library.functions

1678

.gnutls_priority_set_direct(session._c_object,

1679

priority, None))

1728

1680

1729

1681

# Start communication using the Mandos protocol

1730

1682

# Get protocol number

1750

1702

approval_required = False

1751

1703

try:

1752

1704

try:

1753

fpr = self.fingerprint(

1754

self.peer_certificate(session))

1705

fpr = self.fingerprint(self.peer_certificate

1706

(session))

1755

1707

except (TypeError,

1756

1708

gnutls.errors.GNUTLSError) as error:

1757

1709

logger.warning("Bad certificate: %s", error)

1772

1724

while True:

1773

1725

if not client.enabled:

1774

1726

logger.info("Client %s is disabled",

1775

client.name)

1727

client.name)

1776

1728

if self.server.use_dbus:

1777

1729

# Emit D-Bus signal

1778

1730

client.Rejected("Disabled")

1825

1777

logger.warning("gnutls send failed",

1826

1778

exc_info=error)

1827

1779

return

1828

logger.debug("Sent: %d, remaining: %d", sent,

1829

len(client.secret) - (sent_size

1830

+ sent))

1780

logger.debug("Sent: %d, remaining: %d",

1781

sent, len(client.secret)

1782

- (sent_size + sent))

1831

1783

sent_size += sent

1832

1784

1833

1785

logger.info("Sending secret to %s", client.name)

1850

1802

def peer_certificate(session):

1851

1803

"Return the peer's OpenPGP certificate as a bytestring"

1852

1804

# If not an OpenPGP certificate...

1853

if (gnutls.library.functions.gnutls_certificate_type_get(

1854

session._c_object)

1805

if (gnutls.library.functions

1806

.gnutls_certificate_type_get(session._c_object)

1855

1807

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1856

1808

# ...do the normal thing

1857

1809

return session.peer_certificate

1871

1823

def fingerprint(openpgp):

1872

1824

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1873

1825

# New GnuTLS "datum" with the OpenPGP public key

1874

datum = gnutls.library.types.gnutls_datum_t(

1875

ctypes.cast(ctypes.c_char_p(openpgp),

1876

ctypes.POINTER(ctypes.c_ubyte)),

1877

ctypes.c_uint(len(openpgp)))

1826

datum = (gnutls.library.types

1827

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1828

ctypes.POINTER

1829

(ctypes.c_ubyte)),

1830

ctypes.c_uint(len(openpgp))))

1878

1831

# New empty GnuTLS certificate

1879

1832

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1880

gnutls.library.functions.gnutls_openpgp_crt_init(

1881

ctypes.byref(crt))

1833

(gnutls.library.functions

1834

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1882

1835

# Import the OpenPGP public key into the certificate

1883

gnutls.library.functions.gnutls_openpgp_crt_import(

1884

crt, ctypes.byref(datum),

1885

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1836

(gnutls.library.functions

1837

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1838

gnutls.library.constants

1839

.GNUTLS_OPENPGP_FMT_RAW))

1886

1840

# Verify the self signature in the key

1887

1841

crtverify = ctypes.c_uint()

1888

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1889

crt, 0, ctypes.byref(crtverify))

1842

(gnutls.library.functions

1843

.gnutls_openpgp_crt_verify_self(crt, 0,

1844

ctypes.byref(crtverify)))

1890

1845

if crtverify.value != 0:

1891

1846

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1892

raise gnutls.errors.CertificateSecurityError(

1893

"Verify failed")

1847

raise (gnutls.errors.CertificateSecurityError

1848

("Verify failed"))

1894

1849

# New buffer for the fingerprint

1895

1850

buf = ctypes.create_string_buffer(20)

1896

1851

buf_len = ctypes.c_size_t()

1897

1852

# Get the fingerprint from the certificate into the buffer

1898

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1899

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1853

(gnutls.library.functions

1854

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1855

ctypes.byref(buf_len)))

1900

1856

# Deinit the certificate

1901

1857

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1902

1858

# Convert the buffer to a Python bytestring

1908

1864

1909

1865

class MultiprocessingMixIn(object):

1910

1866

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1911

1912

1867

def sub_process_main(self, request, address):

1913

1868

try:

1914

1869

self.finish_request(request, address)

1926

1881

1927

1882

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1928

1883

""" adds a pipe to the MixIn """

1929

1930

1884

def process_request(self, request, client_address):

1931

1885

"""Overrides and wraps the original process_request().

1932

1886

1953

1907

interface: None or a network interface name (string)

1954

1908

use_ipv6: Boolean; to use IPv6 or not

1955

1909

"""

1956

1957

1910

def __init__(self, server_address, RequestHandlerClass,

1958

interface=None,

1959

use_ipv6=True,

1960

socketfd=None):

1911

interface=None, use_ipv6=True, socketfd=None):

1961

1912

"""If socketfd is set, use that file descriptor instead of

1962

1913

creating a new one with socket.socket().

1963

1914

"""

2004

1955

self.interface)

2005

1956

else:

2006

1957

try:

2007

self.socket.setsockopt(

2008

socket.SOL_SOCKET, SO_BINDTODEVICE,

2009

(self.interface + "\0").encode("utf-8"))

1958

self.socket.setsockopt(socket.SOL_SOCKET,

1959

SO_BINDTODEVICE,

1960

(self.interface + "\0")

1961

.encode("utf-8"))

2010

1962

except socket.error as error:

2011

1963

if error.errno == errno.EPERM:

2012

1964

logger.error("No permission to bind to"

2030

1982

self.server_address = (any_address,

2031

1983

self.server_address[1])

2032

1984

elif not self.server_address[1]:

2033

self.server_address = (self.server_address[0], 0)

1985

self.server_address = (self.server_address[0],

1986

0)

2034

1987

# if self.interface:

2035

1988

# self.server_address = (self.server_address[0],

2036

1989

# 0, # port

2050

2003

2051

2004

Assumes a gobject.MainLoop event loop.

2052

2005

"""

2053

2054

2006

def __init__(self, server_address, RequestHandlerClass,

2055

interface=None,

2056

use_ipv6=True,

2057

clients=None,

2058

gnutls_priority=None,

2059

use_dbus=True,

2060

socketfd=None):

2007

interface=None, use_ipv6=True, clients=None,

2008

gnutls_priority=None, use_dbus=True, socketfd=None):

2061

2009

self.enabled = False

2062

2010

self.clients = clients

2063

2011

if self.clients is None:

2069

2017

interface = interface,

2070

2018

use_ipv6 = use_ipv6,

2071

2019

socketfd = socketfd)

2072

2073

2020

def server_activate(self):

2074

2021

if self.enabled:

2075

2022

return socketserver.TCPServer.server_activate(self)

2079

2026

2080

2027

def add_pipe(self, parent_pipe, proc):

2081

2028

# Call "handle_ipc" for both data and EOF events

2082

gobject.io_add_watch(

2083

parent_pipe.fileno(),

2084

gobject.IO_IN | gobject.IO_HUP,

2085

functools.partial(self.handle_ipc,

2086

parent_pipe = parent_pipe,

2087

proc = proc))

2029

gobject.io_add_watch(parent_pipe.fileno(),

2030

gobject.IO_IN | gobject.IO_HUP,

2031

functools.partial(self.handle_ipc,

2032

parent_pipe =

2033

parent_pipe,

2034

proc = proc))

2088

2035

2089

def handle_ipc(self, source, condition,

2090

parent_pipe=None,

2091

proc = None,

2092

client_object=None):

2036

def handle_ipc(self, source, condition, parent_pipe=None,

2037

proc = None, client_object=None):

2093

2038

# error, or the other end of multiprocessing.Pipe has closed

2094

2039

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2095

2040

# Wait for other process to exit

2118

2063

parent_pipe.send(False)

2119

2064

return False

2120

2065

2121

gobject.io_add_watch(

2122

parent_pipe.fileno(),

2123

gobject.IO_IN | gobject.IO_HUP,

2124

functools.partial(self.handle_ipc,

2125

parent_pipe = parent_pipe,

2126

proc = proc,

2127

client_object = client))

2066

gobject.io_add_watch(parent_pipe.fileno(),

2067

gobject.IO_IN | gobject.IO_HUP,

2068

functools.partial(self.handle_ipc,

2069

parent_pipe =

2070

parent_pipe,

2071

proc = proc,

2072

client_object =

2073

client))

2128

2074

parent_pipe.send(True)

2129

2075

# remove the old hook in favor of the new above hook on

2130

2076

# same fileno

2136

2082

2137

2083

parent_pipe.send(('data', getattr(client_object,

2138

2084

funcname)(*args,

2139

**kwargs)))

2085

**kwargs)))

2140

2086

2141

2087

if command == 'getattr':

2142

2088

attrname = request[1]

2143

2089

if callable(client_object.__getattribute__(attrname)):

2144

parent_pipe.send(('function', ))

2090

parent_pipe.send(('function',))

2145

2091

else:

2146

parent_pipe.send((

2147

'data', client_object.__getattribute__(attrname)))

2092

parent_pipe.send(('data', client_object

2093

.__getattribute__(attrname)))

2148

2094

2149

2095

if command == 'setattr':

2150

2096

attrname = request[1]

2190

2136

# None

2191

2137

"followers")) # Tokens valid after

2192

2138

# this token

2193

Token = collections.namedtuple("Token", (

2194

"regexp", # To match token; if "value" is not None, must have

2195

# a "group" containing digits

2196

"value", # datetime.timedelta or None

2197

"followers")) # Tokens valid after this token

2198

2139

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2199

2140

# the "duration" ABNF definition in RFC 3339, Appendix A.

2200

2141

token_end = Token(re.compile(r"$"), None, frozenset())

2201

2142

token_second = Token(re.compile(r"(\d+)S"),

2202

2143

datetime.timedelta(seconds=1),

2203

frozenset((token_end, )))

2144

frozenset((token_end,)))

2204

2145

token_minute = Token(re.compile(r"(\d+)M"),

2205

2146

datetime.timedelta(minutes=1),

2206

2147

frozenset((token_second, token_end)))

2222

2163

frozenset((token_month, token_end)))

2223

2164

token_week = Token(re.compile(r"(\d+)W"),

2224

2165

datetime.timedelta(weeks=1),

2225

frozenset((token_end, )))

2166

frozenset((token_end,)))

2226

2167

token_duration = Token(re.compile(r"P"), None,

2227

2168

frozenset((token_year, token_month,

2228

2169

token_day, token_time,

2296

2237

elif suffix == "w":

2297

2238

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2298

2239

else:

2299

raise ValueError("Unknown suffix {!r}".format(suffix))

2240

raise ValueError("Unknown suffix {!r}"

2241

.format(suffix))

2300

2242

except IndexError as e:

2301

2243

raise ValueError(*(e.args))

2302

2244

timevalue += delta

2318

2260

# Close all standard open file descriptors

2319

2261

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2320

2262

if not stat.S_ISCHR(os.fstat(null).st_mode):

2321

raise OSError(errno.ENODEV,

2322

"{} not a character device"

2263

raise OSError(errno.ENODEV, "{} not a character device"

2323

2264

.format(os.devnull))

2324

2265

os.dup2(null, sys.stdin.fileno())

2325

2266

os.dup2(null, sys.stdout.fileno())

2391

2332

"port": "",

2392

2333

"debug": "False",

2393

2334

"priority":

2394

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2395

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2335

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2396

2336

"servicename": "Mandos",

2397

2337

"use_dbus": "True",

2398

2338

"use_ipv6": "True",

2402

2342

"statedir": "/var/lib/mandos",

2403

2343

"foreground": "False",

2404

2344

"zeroconf": "True",

2405

}

2345

}

2406

2346

2407

2347

# Parse config file for server-global settings

2408

2348

server_config = configparser.SafeConfigParser(server_defaults)

2409

2349

del server_defaults

2410

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2350

server_config.read(os.path.join(options.configdir,

2351

"mandos.conf"))

2411

2352

# Convert the SafeConfigParser object to a dict

2412

2353

server_settings = server_config.defaults()

2413

2354

# Use the appropriate methods on the non-string config options

2431

2372

# Override the settings from the config file with command line

2432

2373

# options, if set.

2433

2374

for option in ("interface", "address", "port", "debug",

2434

"priority", "servicename", "configdir", "use_dbus",

2435

"use_ipv6", "debuglevel", "restore", "statedir",

2436

"socket", "foreground", "zeroconf"):

2375

"priority", "servicename", "configdir",

2376

"use_dbus", "use_ipv6", "debuglevel", "restore",

2377

"statedir", "socket", "foreground", "zeroconf"):

2437

2378

value = getattr(options, option)

2438

2379

if value is not None:

2439

2380

server_settings[option] = value

2454

2395

2455

2396

##################################################################

2456

2397

2457

if (not server_settings["zeroconf"]

2458

and not (server_settings["port"]

2459

or server_settings["socket"] != "")):

2460

parser.error("Needs port or socket to work without Zeroconf")

2398

if (not server_settings["zeroconf"] and

2399

not (server_settings["port"]

2400

or server_settings["socket"] != "")):

2401

parser.error("Needs port or socket to work without"

2402

" Zeroconf")

2461

2403

2462

2404

# For convenience

2463

2405

debug = server_settings["debug"]

2479

2421

initlogger(debug, level)

2480

2422

2481

2423

if server_settings["servicename"] != "Mandos":

2482

syslogger.setFormatter(

2483

logging.Formatter('Mandos ({}) [%(process)d]:'

2484

' %(levelname)s: %(message)s'.format(

2485

server_settings["servicename"])))

2424

syslogger.setFormatter(logging.Formatter

2425

('Mandos ({}) [%(process)d]:'

2426

' %(levelname)s: %(message)s'

2427

.format(server_settings

2428

["servicename"])))

2486

2429

2487

2430

# Parse config file with clients

2488

2431

client_config = configparser.SafeConfigParser(Client

2496

2439

socketfd = None

2497

2440

if server_settings["socket"] != "":

2498

2441

socketfd = server_settings["socket"]

2499

tcp_server = MandosServer(

2500

(server_settings["address"], server_settings["port"]),

2501

ClientHandler,

2502

interface=(server_settings["interface"] or None),

2503

use_ipv6=use_ipv6,

2504

gnutls_priority=server_settings["priority"],

2505

use_dbus=use_dbus,

2506

socketfd=socketfd)

2442

tcp_server = MandosServer((server_settings["address"],

2443

server_settings["port"]),

2444

ClientHandler,

2445

interface=(server_settings["interface"]

2446

or None),

2447

use_ipv6=use_ipv6,

2448

gnutls_priority=

2449

server_settings["priority"],

2450

use_dbus=use_dbus,

2451

socketfd=socketfd)

2507

2452

if not foreground:

2508

2453

pidfilename = "/run/mandos.pid"

2509

2454

if not os.path.isdir("/run/."):

2543

2488

def debug_gnutls(level, string):

2544

2489

logger.debug("GnuTLS: %s", string[:-1])

2545

2490

2546

gnutls.library.functions.gnutls_global_set_log_function(

2547

debug_gnutls)

2491

(gnutls.library.functions

2492

.gnutls_global_set_log_function(debug_gnutls))

2548

2493

2549

2494

# Redirect stdin so all checkers get /dev/null

2550

2495

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2570

2515

if use_dbus:

2571

2516

try:

2572

2517

bus_name = dbus.service.BusName("se.recompile.Mandos",

2573

bus,

2574

do_not_queue=True)

2575

old_bus_name = dbus.service.BusName(

2576

"se.bsnet.fukt.Mandos", bus,

2577

do_not_queue=True)

2518

bus, do_not_queue=True)

2519

old_bus_name = (dbus.service.BusName

2520

("se.bsnet.fukt.Mandos", bus,

2521

do_not_queue=True))

2578

2522

except dbus.exceptions.NameExistsException as e:

2579

2523

logger.error("Disabling D-Bus:", exc_info=e)

2580

2524

use_dbus = False

2582

2526

tcp_server.use_dbus = False

2583

2527

if zeroconf:

2584

2528

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2585

service = AvahiServiceToSyslog(

2586

name = server_settings["servicename"],

2587

servicetype = "_mandos._tcp",

2588

protocol = protocol,

2589

bus = bus)

2529

service = AvahiServiceToSyslog(name =

2530

server_settings["servicename"],

2531

servicetype = "_mandos._tcp",

2532

protocol = protocol, bus = bus)

2590

2533

if server_settings["interface"]:

2591

service.interface = if_nametoindex(

2592

server_settings["interface"].encode("utf-8"))

2534

service.interface = (if_nametoindex

2535

(server_settings["interface"]

2536

.encode("utf-8")))

2593

2537

2594

2538

global multiprocessing_manager

2595

2539

multiprocessing_manager = multiprocessing.Manager()

2614

2558

if server_settings["restore"]:

2615

2559

try:

2616

2560

with open(stored_state_path, "rb") as stored_state:

2617

clients_data, old_client_settings = pickle.load(

2618

stored_state)

2561

clients_data, old_client_settings = (pickle.load

2562

(stored_state))

2619

2563

os.remove(stored_state_path)

2620

2564

except IOError as e:

2621

2565

if e.errno == errno.ENOENT:

2622

logger.warning("Could not load persistent state:"

2623

" {}".format(os.strerror(e.errno)))

2566

logger.warning("Could not load persistent state: {}"

2567

.format(os.strerror(e.errno)))

2624

2568

else:

2625

2569

logger.critical("Could not load persistent state:",

2626

2570

exc_info=e)

2627

2571

raise

2628

2572

except EOFError as e:

2629

2573

logger.warning("Could not load persistent state: "

2630

"EOFError:",

2631

exc_info=e)

2574

"EOFError:", exc_info=e)

2632

2575

2633

2576

with PGPEngine() as pgp:

2634

2577

for client_name, client in clients_data.items():

2646

2589

# For each value in new config, check if it

2647

2590

# differs from the old config value (Except for

2648

2591

# the "secret" attribute)

2649

if (name != "secret"

2650

and (value !=

2651

old_client_settings[client_name][name])):

2592

if (name != "secret" and

2593

value != old_client_settings[client_name]

2594

[name]):

2652

2595

client[name] = value

2653

2596

except KeyError:

2654

2597

pass

2663

2606

if not client["last_checked_ok"]:

2664

2607

logger.warning(

2665

2608

"disabling client {} - Client never "

2666

"performed a successful checker".format(

2667

client_name))

2609

"performed a successful checker"

2610

.format(client_name))

2668

2611

client["enabled"] = False

2669

2612

elif client["last_checker_status"] != 0:

2670

2613

logger.warning(

2671

2614

"disabling client {} - Client last"

2672

" checker failed with error code"

2673

" {}".format(

2674

client_name,

2675

client["last_checker_status"]))

2615

" checker failed with error code {}"

2616

.format(client_name,

2617

client["last_checker_status"]))

2676

2618

client["enabled"] = False

2677

2619

else:

2678

client["expires"] = (

2679

datetime.datetime.utcnow()

2680

+ client["timeout"])

2620

client["expires"] = (datetime.datetime

2621

.utcnow()

2622

+ client["timeout"])

2681

2623

logger.debug("Last checker succeeded,"

2682

" keeping {} enabled".format(

2683

client_name))

2624

" keeping {} enabled"

2625

.format(client_name))

2684

2626

try:

2685

client["secret"] = pgp.decrypt(

2686

client["encrypted_secret"],

2687

client_settings[client_name]["secret"])

2627

client["secret"] = (

2628

pgp.decrypt(client["encrypted_secret"],

2629

client_settings[client_name]

2630

["secret"]))

2688

2631

except PGPError:

2689

2632

# If decryption fails, we use secret from new settings

2690

logger.debug("Failed to decrypt {} old secret".format(

2691

client_name))

2692

client["secret"] = (client_settings[client_name]

2693

["secret"])

2633

logger.debug("Failed to decrypt {} old secret"

2634

.format(client_name))

2635

client["secret"] = (

2636

client_settings[client_name]["secret"])

2694

2637

2695

2638

# Add/remove clients based on new changes made to config

2696

2639

for client_name in (set(old_client_settings)

2703

2646

# Create all client objects

2704

2647

for client_name, client in clients_data.items():

2705

2648

tcp_server.clients[client_name] = client_class(

2706

name = client_name,

2707

settings = client,

2649

name = client_name, settings = client,

2708

2650

server_settings = server_settings)

2709

2651

2710

2652

if not tcp_server.clients:

2726

2668

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2727

2669

2728

2670

if use_dbus:

2729

2730

@alternate_dbus_interfaces(

2731

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2671

@alternate_dbus_interfaces({"se.recompile.Mandos":

2672

"se.bsnet.fukt.Mandos"})

2732

2673

class MandosDBusService(DBusObjectWithProperties):

2733

2674

"""A D-Bus proxy object"""

2734

2735

2675

def __init__(self):

2736

2676

dbus.service.Object.__init__(self, bus, "/")

2737

2738

2677

_interface = "se.recompile.Mandos"

2739

2678

2740

2679

@dbus_interface_annotations(_interface)

2741

2680

def _foo(self):

2742

return {

2743

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2744

"false" }

2681

return { "org.freedesktop.DBus.Property"

2682

".EmitsChangedSignal":

2683

"false"}

2745

2684

2746

2685

@dbus.service.signal(_interface, signature="o")

2747

2686

def ClientAdded(self, objpath):

2761

2700

@dbus.service.method(_interface, out_signature="ao")

2762

2701

def GetAllClients(self):

2763

2702

"D-Bus method"

2764

return dbus.Array(c.dbus_object_path for c in

2703

return dbus.Array(c.dbus_object_path

2704

for c in

2765

2705

tcp_server.clients.itervalues())

2766

2706

2767

2707

@dbus.service.method(_interface,

2769

2709

def GetAllClientsWithProperties(self):

2770

2710

"D-Bus method"

2771

2711

return dbus.Dictionary(

2772

{ c.dbus_object_path: c.GetAll("")

2773

for c in tcp_server.clients.itervalues() },

2712

((c.dbus_object_path, c.GetAll(""))

2713

for c in tcp_server.clients.itervalues()),

2774

2714

signature="oa{sv}")

2775

2715

2776

2716

@dbus.service.method(_interface, in_signature="o")

2816

2756

# + secret.

2817

2757

exclude = { "bus", "changedstate", "secret",

2818

2758

"checker", "server_settings" }

2819

for name, typ in inspect.getmembers(dbus.service

2820

.Object):

2759

for name, typ in (inspect.getmembers

2760

(dbus.service.Object)):

2821

2761

exclude.add(name)

2822

2762

2823

2763

client_dict["encrypted_secret"] = (client

2830

2770

del client_settings[client.name]["secret"]

2831

2771

2832

2772

try:

2833

with tempfile.NamedTemporaryFile(

2834

mode='wb',

2835

suffix=".pickle",

2836

prefix='clients-',

2837

dir=os.path.dirname(stored_state_path),

2838

delete=False) as stored_state:

2773

with (tempfile.NamedTemporaryFile

2774

(mode='wb', suffix=".pickle", prefix='clients-',

2775

dir=os.path.dirname(stored_state_path),

2776

delete=False)) as stored_state:

2839

2777

pickle.dump((clients, client_settings), stored_state)

2840

tempname = stored_state.name

2778

tempname=stored_state.name

2841

2779

os.rename(tempname, stored_state_path)

2842

2780

except (IOError, OSError) as e:

2843

2781

if not debug:

2862

2800

client.disable(quiet=True)

2863

2801

if use_dbus:

2864

2802

# Emit D-Bus signal

2865

mandos_dbus_service.ClientRemoved(

2866

client.dbus_object_path, client.name)

2803

mandos_dbus_service.ClientRemoved(client

2804

.dbus_object_path,

2805

client.name)

2867

2806

client_settings.clear()

2868

2807

2869

2808

atexit.register(cleanup)

2922

2861

# Must run before the D-Bus bus name gets deregistered

2923

2862

cleanup()

2924

2863

2925

2926

2864

if __name__ == '__main__':

2927

2865

main()