/mandos/trunk : revision 732

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

39

import SocketServer as socketserver

43

40

import socket

44

41

import argparse

45

42

import datetime

50

47

import gnutls.library.functions

51

48

import gnutls.library.constants

52

49

import gnutls.library.types

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

50

import ConfigParser as configparser

57

51

import sys

58

52

import re

59

53

import os

68

62

import struct

69

63

import fcntl

70

64

import functools

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

65

import cPickle as pickle

75

66

import multiprocessing

76

67

import types

77

68

import binascii

78

69

import tempfile

79

70

import itertools

80

71

import collections

81

import codecs

82

72

83

73

import dbus

84

74

import dbus.service

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

75

import gobject

89

76

import avahi

90

77

from dbus.mainloop.glib import DBusGMainLoop

91

78

import ctypes

104

91

if sys.version_info.major == 2:

105

92

str = unicode

106

93

107

version = "1.6.9"

94

version = "1.6.8"

108

95

stored_state_file = "clients.pickle"

109

96

110

97

logger = logging.getLogger()

111

98

syslogger = None

112

99

113

100

try:

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

101

if_nametoindex = (ctypes.cdll.LoadLibrary

102

(ctypes.util.find_library("c"))

103

.if_nametoindex)

116

104

except (OSError, AttributeError):

117

118

105

def if_nametoindex(interface):

119

106

"Get an interface index the hard way, i.e. using fcntl()"

120

107

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

129

116

"""init logger and add loglevel"""

130

117

131

118

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

119

syslogger = (logging.handlers.SysLogHandler

120

(facility =

121

logging.handlers.SysLogHandler.LOG_DAEMON,

122

address = "/dev/log"))

135

123

syslogger.setFormatter(logging.Formatter

136

124

('Mandos [%(process)d]: %(levelname)s:'

137

125

' %(message)s'))

154

142

155

143

class PGPEngine(object):

156

144

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

158

145

def __init__(self):

159

146

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

160

147

self.gnupgargs = ['--batch',

199

186

200

187

def encrypt(self, data, password):

201

188

passphrase = self.password_encode(password)

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

189

with tempfile.NamedTemporaryFile(dir=self.tempdir

190

) as passfile:

204

191

passfile.write(passphrase)

205

192

passfile.flush()

206

193

proc = subprocess.Popen(['gpg', '--symmetric',

217

204

218

205

def decrypt(self, data, password):

219

206

passphrase = self.password_encode(password)

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

207

with tempfile.NamedTemporaryFile(dir = self.tempdir

208

) as passfile:

222

209

passfile.write(passphrase)

223

210

passfile.flush()

224

211

proc = subprocess.Popen(['gpg', '--decrypt',

228

215

stdin = subprocess.PIPE,

229

216

stdout = subprocess.PIPE,

230

217

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

218

decrypted_plaintext, err = proc.communicate(input

219

= data)

232

220

if proc.returncode != 0:

233

221

raise PGPError(err)

234

222

return decrypted_plaintext

240

228

return super(AvahiError, self).__init__(value, *args,

241

229

**kwargs)

242

230

243

244

231

class AvahiServiceError(AvahiError):

245

232

pass

246

233

247

248

234

class AvahiGroupError(AvahiError):

249

235

pass

250

236

270

256

bus: dbus.SystemBus()

271

257

"""

272

258

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

259

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

260

servicetype = None, port = None, TXT = None,

261

domain = "", host = "", max_renames = 32768,

262

protocol = avahi.PROTO_UNSPEC, bus = None):

284

263

self.interface = interface

285

264

self.name = name

286

265

self.type = servicetype

296

275

self.bus = bus

297

276

self.entry_group_state_changed_match = None

298

277

299

def rename(self, remove=True):

278

def rename(self):

300

279

"""Derived from the Avahi example code"""

301

280

if self.rename_count >= self.max_renames:

302

281

logger.critical("No suitable Zeroconf service name found"

303

282

" after %i retries, exiting.",

304

283

self.rename_count)

305

284

raise AvahiServiceError("Too many renames")

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

308

self.rename_count += 1

285

self.name = str(self.server

286

.GetAlternativeServiceName(self.name))

309

287

logger.info("Changing Zeroconf service name to %r ...",

310

288

self.name)

311

if remove:

312

self.remove()

289

self.remove()

313

290

try:

314

291

self.add()

315

292

except dbus.exceptions.DBusException as error:

316

if (error.get_dbus_name()

317

== "org.freedesktop.Avahi.CollisionError"):

318

logger.info("Local Zeroconf service name collision.")

319

return self.rename(remove=False)

320

else:

321

logger.critical("D-Bus Exception", exc_info=error)

322

self.cleanup()

323

os._exit(1)

293

logger.critical("D-Bus Exception", exc_info=error)

294

self.cleanup()

295

os._exit(1)

296

self.rename_count += 1

324

297

325

298

def remove(self):

326

299

"""Derived from the Avahi example code"""

365

338

elif state == avahi.ENTRY_GROUP_FAILURE:

366

339

logger.critical("Avahi: Error in group state changed %s",

367

340

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

341

raise AvahiGroupError("State changed: {!s}"

342

.format(error))

369

343

370

344

def cleanup(self):

371

345

"""Derived from the Avahi example code"""

381

355

def server_state_changed(self, state, error=None):

382

356

"""Derived from the Avahi example code"""

383

357

logger.debug("Avahi server state change: %i", state)

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

358

bad_states = { avahi.SERVER_INVALID:

359

"Zeroconf server invalid",

360

avahi.SERVER_REGISTERING: None,

361

avahi.SERVER_COLLISION:

362

"Zeroconf server name collision",

363

avahi.SERVER_FAILURE:

364

"Zeroconf server failure" }

390

365

if state in bad_states:

391

366

if bad_states[state] is not None:

392

367

if error is None:

395

370

logger.error(bad_states[state] + ": %r", error)

396

371

self.cleanup()

397

372

elif state == avahi.SERVER_RUNNING:

398

try:

399

self.add()

400

except dbus.exceptions.DBusException as error:

401

if (error.get_dbus_name()

402

== "org.freedesktop.Avahi.CollisionError"):

403

logger.info("Local Zeroconf service name"

404

" collision.")

405

return self.rename(remove=False)

406

else:

407

logger.critical("D-Bus Exception", exc_info=error)

408

self.cleanup()

409

os._exit(1)

373

self.add()

410

374

else:

411

375

if error is None:

412

376

logger.debug("Unknown state: %r", state)

422

386

follow_name_owner_changes=True),

423

387

avahi.DBUS_INTERFACE_SERVER)

424

388

self.server.connect_to_signal("StateChanged",

425

self.server_state_changed)

389

self.server_state_changed)

426

390

self.server_state_changed(self.server.GetState())

427

391

428

392

429

393

class AvahiServiceToSyslog(AvahiService):

430

def rename(self, *args, **kwargs):

394

def rename(self):

431

395

"""Add the new name to the syslog messages"""

432

ret = AvahiService.rename(self, *args, **kwargs)

433

syslogger.setFormatter(logging.Formatter(

434

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

435

.format(self.name)))

396

ret = AvahiService.rename(self)

397

syslogger.setFormatter(logging.Formatter

398

('Mandos ({}) [%(process)d]:'

399

' %(levelname)s: %(message)s'

400

.format(self.name)))

436

401

return ret

437

402

438

def call_pipe(connection, # : multiprocessing.Connection

439

func, *args, **kwargs):

440

"""This function is meant to be called by multiprocessing.Process

441

442

This function runs func(*args, **kwargs), and writes the resulting

443

return value on the provided multiprocessing.Connection.

444

"""

445

connection.send(func(*args, **kwargs))

446

connection.close()

447

403

448

404

class Client(object):

449

405

"""A representation of a client host served by this server.

476

432

last_checker_status: integer between 0 and 255 reflecting exit

477

433

status of last checker. -1 reflects crashed

478

434

checker, -2 means no checker completed yet.

479

last_checker_signal: The signal which killed the last checker, if

480

last_checker_status is -1

481

435

last_enabled: datetime.datetime(); (UTC) or None

482

436

name: string; from the config file, used in log messages and

483

437

D-Bus identifiers

496

450

"fingerprint", "host", "interval",

497

451

"last_approval_request", "last_checked_ok",

498

452

"last_enabled", "name", "timeout")

499

client_defaults = {

500

"timeout": "PT5M",

501

"extended_timeout": "PT15M",

502

"interval": "PT2M",

503

"checker": "fping -q -- %%(host)s",

504

"host": "",

505

"approval_delay": "PT0S",

506

"approval_duration": "PT1S",

507

"approved_by_default": "True",

508

"enabled": "True",

509

}

453

client_defaults = { "timeout": "PT5M",

454

"extended_timeout": "PT15M",

455

"interval": "PT2M",

456

"checker": "fping -q -- %%(host)s",

457

"host": "",

458

"approval_delay": "PT0S",

459

"approval_duration": "PT1S",

460

"approved_by_default": "True",

461

"enabled": "True",

462

}

510

463

511

464

@staticmethod

512

465

def config_parser(config):

528

481

client["enabled"] = config.getboolean(client_name,

529

482

"enabled")

530

483

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the

533

# fingerprint() function

534

484

client["fingerprint"] = (section["fingerprint"].upper()

535

485

.replace(" ", ""))

536

486

if "secret" in section:

578

528

self.expires = None

579

529

580

530

logger.debug("Creating client %r", self.name)

531

# Uppercase and remove spaces from fingerprint for later

532

# comparison purposes with return value from the fingerprint()

533

# function

581

534

logger.debug(" Fingerprint: %s", self.fingerprint)

582

535

self.created = settings.get("created",

583

536

datetime.datetime.utcnow())

590

543

self.current_checker_command = None

591

544

self.approved = None

592

545

self.approvals_pending = 0

593

self.changedstate = multiprocessing_manager.Condition(

594

multiprocessing_manager.Lock())

595

self.client_structure = [attr

596

for attr in self.__dict__.iterkeys()

546

self.changedstate = (multiprocessing_manager

547

.Condition(multiprocessing_manager

548

.Lock()))

549

self.client_structure = [attr for attr in

550

self.__dict__.iterkeys()

597

551

if not attr.startswith("_")]

598

552

self.client_structure.append("client_structure")

599

553

600

for name, t in inspect.getmembers(

601

type(self), lambda obj: isinstance(obj, property)):

554

for name, t in inspect.getmembers(type(self),

555

lambda obj:

556

isinstance(obj,

557

property)):

602

558

if not name.startswith("_"):

603

559

self.client_structure.append(name)

604

560

646

602

# and every interval from then on.

647

603

if self.checker_initiator_tag is not None:

648

604

gobject.source_remove(self.checker_initiator_tag)

649

self.checker_initiator_tag = gobject.timeout_add(

650

int(self.interval.total_seconds() * 1000),

651

self.start_checker)

605

self.checker_initiator_tag = (gobject.timeout_add

606

(int(self.interval

607

.total_seconds() * 1000),

608

self.start_checker))

652

609

# Schedule a disable() when 'timeout' has passed

653

610

if self.disable_initiator_tag is not None:

654

611

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = gobject.timeout_add(

656

int(self.timeout.total_seconds() * 1000), self.disable)

612

self.disable_initiator_tag = (gobject.timeout_add

613

(int(self.timeout

614

.total_seconds() * 1000),

615

self.disable))

657

616

# Also start a new checker *right now*.

658

617

self.start_checker()

659

618

660

def checker_callback(self, source, condition, connection,

661

command):

619

def checker_callback(self, pid, condition, command):

662

620

"""The checker has completed, so take appropriate actions."""

663

621

self.checker_callback_tag = None

664

622

self.checker = None

665

# Read return code from connection (see call_pipe)

666

returncode = connection.recv()

667

connection.close()

668

669

if returncode >= 0:

670

self.last_checker_status = returncode

671

self.last_checker_signal = None

623

if os.WIFEXITED(condition):

624

self.last_checker_status = os.WEXITSTATUS(condition)

672

625

if self.last_checker_status == 0:

673

626

logger.info("Checker for %(name)s succeeded",

674

627

vars(self))

675

628

self.checked_ok()

676

629

else:

677

logger.info("Checker for %(name)s failed", vars(self))

630

logger.info("Checker for %(name)s failed",

631

vars(self))

678

632

else:

679

633

self.last_checker_status = -1

680

self.last_checker_signal = -returncode

681

634

logger.warning("Checker for %(name)s crashed?",

682

635

vars(self))

683

return False

684

636

685

637

def checked_ok(self):

686

638

"""Assert that the client has been seen, alive and well."""

687

639

self.last_checked_ok = datetime.datetime.utcnow()

688

640

self.last_checker_status = 0

689

self.last_checker_signal = None

690

641

self.bump_timeout()

691

642

692

643

def bump_timeout(self, timeout=None):

697

648

gobject.source_remove(self.disable_initiator_tag)

698

649

self.disable_initiator_tag = None

699

650

if getattr(self, "enabled", False):

700

self.disable_initiator_tag = gobject.timeout_add(

701

int(timeout.total_seconds() * 1000), self.disable)

651

self.disable_initiator_tag = (gobject.timeout_add

652

(int(timeout.total_seconds()

653

* 1000), self.disable))

702

654

self.expires = datetime.datetime.utcnow() + timeout

703

655

704

656

def need_approval(self):

718

670

# than 'timeout' for the client to be disabled, which is as it

719

671

# should be.

720

672

721

if self.checker is not None and not self.checker.is_alive():

722

logger.warning("Checker was not alive; joining")

723

self.checker.join()

724

self.checker = None

673

# If a checker exists, make sure it is not a zombie

674

try:

675

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

676

except AttributeError:

677

pass

678

except OSError as error:

679

if error.errno != errno.ECHILD:

680

raise

681

else:

682

if pid:

683

logger.warning("Checker was a zombie")

684

gobject.source_remove(self.checker_callback_tag)

685

self.checker_callback(pid, status,

686

self.current_checker_command)

725

687

# Start a new checker if needed

726

688

if self.checker is None:

727

689

# Escape attributes for the shell

728

escaped_attrs = {

729

attr: re.escape(str(getattr(self, attr)))

730

for attr in self.runtime_expansions }

690

escaped_attrs = { attr:

691

re.escape(str(getattr(self, attr)))

692

for attr in self.runtime_expansions }

731

693

try:

732

694

command = self.checker_command % escaped_attrs

733

695

except TypeError as error:

734

696

logger.error('Could not format string "%s"',

735

self.checker_command,

697

self.checker_command, exc_info=error)

698

return True # Try again later

699

self.current_checker_command = command

700

try:

701

logger.info("Starting checker %r for %s",

702

command, self.name)

703

# We don't need to redirect stdout and stderr, since

704

# in normal mode, that is already done by daemon(),

705

# and in debug mode we don't want to. (Stdin is

706

# always replaced by /dev/null.)

707

# The exception is when not debugging but nevertheless

708

# running in the foreground; use the previously

709

# created wnull.

710

popen_args = {}

711

if (not self.server_settings["debug"]

712

and self.server_settings["foreground"]):

713

popen_args.update({"stdout": wnull,

714

"stderr": wnull })

715

self.checker = subprocess.Popen(command,

716

close_fds=True,

717

shell=True, cwd="/",

718

**popen_args)

719

except OSError as error:

720

logger.error("Failed to start subprocess",

736

721

exc_info=error)

737

return True # Try again later

738

self.current_checker_command = command

739

logger.info("Starting checker %r for %s", command,

740

self.name)

741

# We don't need to redirect stdout and stderr, since

742

# in normal mode, that is already done by daemon(),

743

# and in debug mode we don't want to. (Stdin is

744

# always replaced by /dev/null.)

745

# The exception is when not debugging but nevertheless

746

# running in the foreground; use the previously

747

# created wnull.

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

751

if (not self.server_settings["debug"]

752

and self.server_settings["foreground"]):

753

popen_args.update({"stdout": wnull,

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

756

self.checker = multiprocessing.Process(

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

760

self.checker.start()

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

763

self.checker_callback, pipe[0], command)

722

return True

723

self.checker_callback_tag = (gobject.child_watch_add

724

(self.checker.pid,

725

self.checker_callback,

726

data=command))

727

# The checker may have completed before the gobject

728

# watch was added. Check for this.

729

try:

730

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

731

except OSError as error:

732

if error.errno == errno.ECHILD:

733

# This should never happen

734

logger.error("Child process vanished",

735

exc_info=error)

736

return True

737

raise

738

if pid:

739

gobject.source_remove(self.checker_callback_tag)

740

self.checker_callback(pid, status, command)

764

741

# Re-run this periodically if run by gobject.timeout_add

765

742

return True

766

743

772

749

if getattr(self, "checker", None) is None:

773

750

return

774

751

logger.debug("Stopping checker for %(name)s", vars(self))

775

self.checker.terminate()

752

try:

753

self.checker.terminate()

754

#time.sleep(0.5)

755

#if self.checker.poll() is None:

756

# self.checker.kill()

757

except OSError as error:

758

if error.errno != errno.ESRCH: # No such process

759

raise

776

760

self.checker = None

777

761

778

762

779

def dbus_service_property(dbus_interface,

780

signature="v",

781

access="readwrite",

782

byte_arrays=False):

763

def dbus_service_property(dbus_interface, signature="v",

764

access="readwrite", byte_arrays=False):

783

765

"""Decorators for marking methods of a DBusObjectWithProperties to

784

766

become properties on the D-Bus.

785

767

795

777

if byte_arrays and signature != "ay":

796

778

raise ValueError("Byte arrays not supported for non-'ay'"

797

779

" signature {!r}".format(signature))

798

799

780

def decorator(func):

800

781

func._dbus_is_property = True

801

782

func._dbus_interface = dbus_interface

806

787

func._dbus_name = func._dbus_name[:-14]

807

788

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

808

789

return func

809

810

790

return decorator

811

791

812

792

821

801

"org.freedesktop.DBus.Property.EmitsChangedSignal":

822

802

"false"}

823

803

"""

824

825

804

def decorator(func):

826

805

func._dbus_is_interface = True

827

806

func._dbus_interface = dbus_interface

828

807

func._dbus_name = dbus_interface

829

808

return func

830

831

809

return decorator

832

810

833

811

842

820

access="r")

843

821

def Property_dbus_property(self):

844

822

return dbus.Boolean(False)

845

846

See also the DBusObjectWithAnnotations class.

847

823

"""

848

849

824

def decorator(func):

850

825

func._dbus_annotations = annotations

851

826

return func

852

853

827

return decorator

854

828

855

829

858

832

"""

859

833

pass

860

834

861

862

835

class DBusPropertyAccessException(DBusPropertyException):

863

836

"""A property's access permissions disallows an operation.

864

837

"""

871

844

pass

872

845

873

846

874

class DBusObjectWithAnnotations(dbus.service.Object):

875

"""A D-Bus object with annotations.

847

class DBusObjectWithProperties(dbus.service.Object):

848

"""A D-Bus object with properties.

876

849

877

Classes inheriting from this can use the dbus_annotations

878

decorator to add annotations to methods or signals.

850

Classes inheriting from this can use the dbus_service_property

851

decorator to expose methods as D-Bus properties. It exposes the

852

standard Get(), Set(), and GetAll() methods on the D-Bus.

879

853

"""

880

854

881

855

@staticmethod

891

865

def _get_all_dbus_things(self, thing):

892

866

"""Returns a generator of (name, attribute) pairs

893

867

"""

894

return ((getattr(athing.__get__(self), "_dbus_name", name),

868

return ((getattr(athing.__get__(self), "_dbus_name",

869

name),

895

870

athing.__get__(self))

896

871

for cls in self.__class__.__mro__

897

872

for name, athing in

898

inspect.getmembers(cls, self._is_dbus_thing(thing)))

899

900

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

901

out_signature = "s",

902

path_keyword = 'object_path',

903

connection_keyword = 'connection')

904

def Introspect(self, object_path, connection):

905

"""Overloading of standard D-Bus method.

906

907

Inserts annotation tags on methods and signals.

908

"""

909

xmlstring = dbus.service.Object.Introspect(self, object_path,

910

connection)

911

try:

912

document = xml.dom.minidom.parseString(xmlstring)

913

914

for if_tag in document.getElementsByTagName("interface"):

915

# Add annotation tags

916

for typ in ("method", "signal"):

917

for tag in if_tag.getElementsByTagName(typ):

918

annots = dict()

919

for name, prop in (self.

920

_get_all_dbus_things(typ)):

921

if (name == tag.getAttribute("name")

922

and prop._dbus_interface

923

== if_tag.getAttribute("name")):

924

annots.update(getattr(

925

prop, "_dbus_annotations", {}))

926

for name, value in annots.items():

927

ann_tag = document.createElement(

928

"annotation")

929

ann_tag.setAttribute("name", name)

930

ann_tag.setAttribute("value", value)

931

tag.appendChild(ann_tag)

932

# Add interface annotation tags

933

for annotation, value in dict(

934

itertools.chain.from_iterable(

935

annotations().items()

936

for name, annotations

937

in self._get_all_dbus_things("interface")

938

if name == if_tag.getAttribute("name")

939

)).items():

940

ann_tag = document.createElement("annotation")

941

ann_tag.setAttribute("name", annotation)

942

ann_tag.setAttribute("value", value)

943

if_tag.appendChild(ann_tag)

944

# Fix argument name for the Introspect method itself

945

if (if_tag.getAttribute("name")

946

== dbus.INTROSPECTABLE_IFACE):

947

for cn in if_tag.getElementsByTagName("method"):

948

if cn.getAttribute("name") == "Introspect":

949

for arg in cn.getElementsByTagName("arg"):

950

if (arg.getAttribute("direction")

951

== "out"):

952

arg.setAttribute("name",

953

"xml_data")

954

xmlstring = document.toxml("utf-8")

955

document.unlink()

956

except (AttributeError, xml.dom.DOMException,

957

xml.parsers.expat.ExpatError) as error:

958

logger.error("Failed to override Introspection method",

959

exc_info=error)

960

return xmlstring

961

962

963

class DBusObjectWithProperties(DBusObjectWithAnnotations):

964

"""A D-Bus object with properties.

965

966

Classes inheriting from this can use the dbus_service_property

967

decorator to expose methods as D-Bus properties. It exposes the

968

standard Get(), Set(), and GetAll() methods on the D-Bus.

969

"""

873

inspect.getmembers(cls,

874

self._is_dbus_thing(thing)))

970

875

971

876

def _get_dbus_property(self, interface_name, property_name):

972

877

"""Returns a bound method if one exists which is a D-Bus

973

878

property with the specified name and interface.

974

879

"""

975

for cls in self.__class__.__mro__:

976

for name, value in inspect.getmembers(

977

cls, self._is_dbus_thing("property")):

880

for cls in self.__class__.__mro__:

881

for name, value in (inspect.getmembers

882

(cls,

883

self._is_dbus_thing("property"))):

978

884

if (value._dbus_name == property_name

979

885

and value._dbus_interface == interface_name):

980

886

return value.__get__(self)

981

887

982

888

# No such property

983

raise DBusPropertyNotFound("{}:{}.{}".format(

984

self.dbus_object_path, interface_name, property_name))

889

raise DBusPropertyNotFound(self.dbus_object_path + ":"

890

+ interface_name + "."

891

+ property_name)

985

892

986

@dbus.service.method(dbus.PROPERTIES_IFACE,

987

in_signature="ss",

893

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

988

894

out_signature="v")

989

895

def Get(self, interface_name, property_name):

990

896

"""Standard D-Bus property Get() method, see D-Bus standard.

1015

921

for byte in value))

1016

922

prop(value)

1017

923

1018

@dbus.service.method(dbus.PROPERTIES_IFACE,

1019

in_signature="s",

924

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1020

925

out_signature="a{sv}")

1021

926

def GetAll(self, interface_name):

1022

927

"""Standard D-Bus property GetAll() method, see D-Bus

1037

942

if not hasattr(value, "variant_level"):

1038

943

properties[name] = value

1039

944

continue

1040

properties[name] = type(value)(

1041

value, variant_level = value.variant_level + 1)

945

properties[name] = type(value)(value, variant_level=

946

value.variant_level+1)

1042

947

return dbus.Dictionary(properties, signature="sv")

1043

948

1044

949

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1058

963

1059

964

Inserts property tags and interface annotation tags.

1060

965

"""

1061

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1062

object_path,

1063

connection)

966

xmlstring = dbus.service.Object.Introspect(self, object_path,

967

connection)

1064

968

try:

1065

969

document = xml.dom.minidom.parseString(xmlstring)

1066

1067

970

def make_tag(document, name, prop):

1068

971

e = document.createElement("property")

1069

972

e.setAttribute("name", name)

1070

973

e.setAttribute("type", prop._dbus_signature)

1071

974

e.setAttribute("access", prop._dbus_access)

1072

975

return e

1073

1074

976

for if_tag in document.getElementsByTagName("interface"):

1075

977

# Add property tags

1076

978

for tag in (make_tag(document, name, prop)

1079

981

if prop._dbus_interface

1080

982

== if_tag.getAttribute("name")):

1081

983

if_tag.appendChild(tag)

1082

# Add annotation tags for properties

1083

for tag in if_tag.getElementsByTagName("property"):

1084

annots = dict()

1085

for name, prop in self._get_all_dbus_things(

1086

"property"):

1087

if (name == tag.getAttribute("name")

1088

and prop._dbus_interface

1089

== if_tag.getAttribute("name")):

1090

annots.update(getattr(

1091

prop, "_dbus_annotations", {}))

1092

for name, value in annots.items():

1093

ann_tag = document.createElement(

1094

"annotation")

1095

ann_tag.setAttribute("name", name)

1096

ann_tag.setAttribute("value", value)

1097

tag.appendChild(ann_tag)

984

# Add annotation tags

985

for typ in ("method", "signal", "property"):

986

for tag in if_tag.getElementsByTagName(typ):

987

annots = dict()

988

for name, prop in (self.

989

_get_all_dbus_things(typ)):

990

if (name == tag.getAttribute("name")

991

and prop._dbus_interface

992

== if_tag.getAttribute("name")):

993

annots.update(getattr

994

(prop,

995

"_dbus_annotations",

996

{}))

997

for name, value in annots.items():

998

ann_tag = document.createElement(

999

"annotation")

1000

ann_tag.setAttribute("name", name)

1001

ann_tag.setAttribute("value", value)

1002

tag.appendChild(ann_tag)

1003

# Add interface annotation tags

1004

for annotation, value in dict(

1005

itertools.chain.from_iterable(

1006

annotations().items()

1007

for name, annotations in

1008

self._get_all_dbus_things("interface")

1009

if name == if_tag.getAttribute("name")

1010

)).items():

1011

ann_tag = document.createElement("annotation")

1012

ann_tag.setAttribute("name", annotation)

1013

ann_tag.setAttribute("value", value)

1014

if_tag.appendChild(ann_tag)

1098

1015

# Add the names to the return values for the

1099

1016

# "org.freedesktop.DBus.Properties" methods

1100

1017

if (if_tag.getAttribute("name")

1123

1040

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1124

1041

if dt is None:

1125

1042

return dbus.String("", variant_level = variant_level)

1126

return dbus.String(dt.isoformat(), variant_level=variant_level)

1043

return dbus.String(dt.isoformat(),

1044

variant_level=variant_level)

1127

1045

1128

1046

1129

1047

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1149

1067

(from DBusObjectWithProperties) and interfaces (from the

1150

1068

dbus_interface_annotations decorator).

1151

1069

"""

1152

1153

1070

def wrapper(cls):

1154

1071

for orig_interface_name, alt_interface_name in (

1155

alt_interface_names.items()):

1072

alt_interface_names.items()):

1156

1073

attr = {}

1157

1074

interface_names = set()

1158

1075

# Go though all attributes of the class

1160

1077

# Ignore non-D-Bus attributes, and D-Bus attributes

1161

1078

# with the wrong interface name

1162

1079

if (not hasattr(attribute, "_dbus_interface")

1163

or not attribute._dbus_interface.startswith(

1164

orig_interface_name)):

1080

or not attribute._dbus_interface

1081

.startswith(orig_interface_name)):

1165

1082

continue

1166

1083

# Create an alternate D-Bus interface name based on

1167

1084

# the current name

1168

alt_interface = attribute._dbus_interface.replace(

1169

orig_interface_name, alt_interface_name)

1085

alt_interface = (attribute._dbus_interface

1086

.replace(orig_interface_name,

1087

alt_interface_name))

1170

1088

interface_names.add(alt_interface)

1171

1089

# Is this a D-Bus signal?

1172

1090

if getattr(attribute, "_dbus_is_signal", False):

1173

if sys.version_info.major == 2:

1174

# Extract the original non-method undecorated

1175

# function by black magic

1176

nonmethod_func = (dict(

1091

# Extract the original non-method undecorated

1092

# function by black magic

1093

nonmethod_func = (dict(

1177

1094

zip(attribute.func_code.co_freevars,

1178

attribute.__closure__))

1179

["func"].cell_contents)

1180

else:

1181

nonmethod_func = attribute

1095

attribute.__closure__))["func"]

1096

.cell_contents)

1182

1097

# Create a new, but exactly alike, function

1183

1098

# object, and decorate it to be a new D-Bus signal

1184

1099

# with the alternate D-Bus interface name

1185

if sys.version_info.major == 2:

1186

new_function = types.FunctionType(

1187

nonmethod_func.func_code,

1188

nonmethod_func.func_globals,

1189

nonmethod_func.func_name,

1190

nonmethod_func.func_defaults,

1191

nonmethod_func.func_closure)

1192

else:

1193

new_function = types.FunctionType(

1194

nonmethod_func.__code__,

1195

nonmethod_func.__globals__,

1196

nonmethod_func.__name__,

1197

nonmethod_func.__defaults__,

1198

nonmethod_func.__closure__)

1199

new_function = (dbus.service.signal(

1200

alt_interface,

1201

attribute._dbus_signature)(new_function))

1100

new_function = (dbus.service.signal

1101

(alt_interface,

1102

attribute._dbus_signature)

1103

(types.FunctionType(

1104

nonmethod_func.func_code,

1105

nonmethod_func.func_globals,

1106

nonmethod_func.func_name,

1107

nonmethod_func.func_defaults,

1108

nonmethod_func.func_closure)))

1202

1109

# Copy annotations, if any

1203

1110

try:

1204

new_function._dbus_annotations = dict(

1205

attribute._dbus_annotations)

1111

new_function._dbus_annotations = (

1112

dict(attribute._dbus_annotations))

1206

1113

except AttributeError:

1207

1114

pass

1208

1115

# Define a creator of a function to call both the

1213

1120

"""This function is a scope container to pass

1214

1121

func1 and func2 to the "call_both" function

1215

1122

outside of its arguments"""

1216

1217

1123

def call_both(*args, **kwargs):

1218

1124

"""This function will emit two D-Bus

1219

1125

signals by calling func1 and func2"""

1220

1126

func1(*args, **kwargs)

1221

1127

func2(*args, **kwargs)

1222

1223

1128

return call_both

1224

1129

# Create the "call_both" function and add it to

1225

1130

# the class

1230

1135

# object. Decorate it to be a new D-Bus method

1231

1136

# with the alternate D-Bus interface name. Add it

1232

1137

# to the class.

1233

attr[attrname] = (

1234

dbus.service.method(

1235

alt_interface,

1236

attribute._dbus_in_signature,

1237

attribute._dbus_out_signature)

1238

(types.FunctionType(attribute.func_code,

1239

attribute.func_globals,

1240

attribute.func_name,

1241

attribute.func_defaults,

1242

attribute.func_closure)))

1138

attr[attrname] = (dbus.service.method

1139

(alt_interface,

1140

attribute._dbus_in_signature,

1141

attribute._dbus_out_signature)

1142

(types.FunctionType

1143

(attribute.func_code,

1144

attribute.func_globals,

1145

attribute.func_name,

1146

attribute.func_defaults,

1147

attribute.func_closure)))

1243

1148

# Copy annotations, if any

1244

1149

try:

1245

attr[attrname]._dbus_annotations = dict(

1246

attribute._dbus_annotations)

1150

attr[attrname]._dbus_annotations = (

1151

dict(attribute._dbus_annotations))

1247

1152

except AttributeError:

1248

1153

pass

1249

1154

# Is this a D-Bus property?

1252

1157

# object, and decorate it to be a new D-Bus

1253

1158

# property with the alternate D-Bus interface

1254

1159

# name. Add it to the class.

1255

attr[attrname] = (dbus_service_property(

1256

alt_interface, attribute._dbus_signature,

1257

attribute._dbus_access,

1258

attribute._dbus_get_args_options

1259

["byte_arrays"])

1260

(types.FunctionType(

1261

attribute.func_code,

1262

attribute.func_globals,

1263

attribute.func_name,

1264

attribute.func_defaults,

1265

attribute.func_closure)))

1160

attr[attrname] = (dbus_service_property

1161

(alt_interface,

1162

attribute._dbus_signature,

1163

attribute._dbus_access,

1164

attribute

1165

._dbus_get_args_options

1166

["byte_arrays"])

1167

(types.FunctionType

1168

(attribute.func_code,

1169

attribute.func_globals,

1170

attribute.func_name,

1171

attribute.func_defaults,

1172

attribute.func_closure)))

1266

1173

# Copy annotations, if any

1267

1174

try:

1268

attr[attrname]._dbus_annotations = dict(

1269

attribute._dbus_annotations)

1175

attr[attrname]._dbus_annotations = (

1176

dict(attribute._dbus_annotations))

1270

1177

except AttributeError:

1271

1178

pass

1272

1179

# Is this a D-Bus interface?

1275

1182

# object. Decorate it to be a new D-Bus interface

1276

1183

# with the alternate D-Bus interface name. Add it

1277

1184

# to the class.

1278

attr[attrname] = (

1279

dbus_interface_annotations(alt_interface)

1280

(types.FunctionType(attribute.func_code,

1281

attribute.func_globals,

1282

attribute.func_name,

1283

attribute.func_defaults,

1284

attribute.func_closure)))

1185

attr[attrname] = (dbus_interface_annotations

1186

(alt_interface)

1187

(types.FunctionType

1188

(attribute.func_code,

1189

attribute.func_globals,

1190

attribute.func_name,

1191

attribute.func_defaults,

1192

attribute.func_closure)))

1285

1193

if deprecate:

1286

1194

# Deprecate all alternate interfaces

1287

1195

iname="_AlternateDBusNames_interface_annotation{}"

1288

1196

for interface_name in interface_names:

1289

1290

1197

@dbus_interface_annotations(interface_name)

1291

1198

def func(self):

1292

1199

return { "org.freedesktop.DBus.Deprecated":

1293

"true" }

1200

"true" }

1294

1201

# Find an unused name

1295

1202

for aname in (iname.format(i)

1296

1203

for i in itertools.count()):

1301

1208

# Replace the class with a new subclass of it with

1302

1209

# methods, signals, etc. as created above.

1303

1210

cls = type(b"{}Alternate".format(cls.__name__),

1304

(cls, ), attr)

1211

(cls,), attr)

1305

1212

return cls

1306

1307

1213

return wrapper

1308

1214

1309

1215

1310

1216

@alternate_dbus_interfaces({"se.recompile.Mandos":

1311

"se.bsnet.fukt.Mandos"})

1217

"se.bsnet.fukt.Mandos"})

1312

1218

class ClientDBus(Client, DBusObjectWithProperties):

1313

1219

"""A Client class using D-Bus

1314

1220

1318

1224

"""

1319

1225

1320

1226

runtime_expansions = (Client.runtime_expansions

1321

+ ("dbus_object_path", ))

1227

+ ("dbus_object_path",))

1322

1228

1323

1229

_interface = "se.recompile.Mandos.Client"

1324

1230

1332

1238

client_object_name = str(self.name).translate(

1333

1239

{ord("."): ord("_"),

1334

1240

ord("-"): ord("_")})

1335

self.dbus_object_path = dbus.ObjectPath(

1336

"/clients/" + client_object_name)

1241

self.dbus_object_path = (dbus.ObjectPath

1242

("/clients/" + client_object_name))

1337

1243

DBusObjectWithProperties.__init__(self, self.bus,

1338

1244

self.dbus_object_path)

1339

1245

1340

def notifychangeproperty(transform_func, dbus_name,

1341

type_func=lambda x: x,

1342

variant_level=1,

1343

invalidate_only=False,

1246

def notifychangeproperty(transform_func,

1247

dbus_name, type_func=lambda x: x,

1248

variant_level=1, invalidate_only=False,

1344

1249

_interface=_interface):

1345

1250

""" Modify a variable so that it's a property which announces

1346

1251

its changes to DBus.

1353

1258

variant_level: D-Bus variant level. Default: 1

1354

1259

"""

1355

1260

attrname = "_{}".format(dbus_name)

1356

1357

1261

def setter(self, value):

1358

1262

if hasattr(self, "dbus_object_path"):

1359

1263

if (not hasattr(self, attrname) or

1360

1264

type_func(getattr(self, attrname, None))

1361

1265

!= type_func(value)):

1362

1266

if invalidate_only:

1363

self.PropertiesChanged(

1364

_interface, dbus.Dictionary(),

1365

dbus.Array((dbus_name, )))

1267

self.PropertiesChanged(_interface,

1268

dbus.Dictionary(),

1269

dbus.Array

1270

((dbus_name,)))

1366

1271

else:

1367

dbus_value = transform_func(

1368

type_func(value),

1369

variant_level = variant_level)

1272

dbus_value = transform_func(type_func(value),

1273

variant_level

1274

=variant_level)

1370

1275

self.PropertyChanged(dbus.String(dbus_name),

1371

1276

dbus_value)

1372

self.PropertiesChanged(

1373

_interface,

1374

dbus.Dictionary({ dbus.String(dbus_name):

1375

dbus_value }),

1376

dbus.Array())

1277

self.PropertiesChanged(_interface,

1278

dbus.Dictionary({

1279

dbus.String(dbus_name):

1280

dbus_value }), dbus.Array())

1377

1281

setattr(self, attrname, value)

1378

1282

1379

1283

return property(lambda self: getattr(self, attrname), setter)

1385

1289

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1386

1290

last_enabled = notifychangeproperty(datetime_to_dbus,

1387

1291

"LastEnabled")

1388

checker = notifychangeproperty(

1389

dbus.Boolean, "CheckerRunning",

1390

type_func = lambda checker: checker is not None)

1292

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1293

type_func = lambda checker:

1294

checker is not None)

1391

1295

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1392

1296

"LastCheckedOK")

1393

1297

last_checker_status = notifychangeproperty(dbus.Int16,

1396

1300

datetime_to_dbus, "LastApprovalRequest")

1397

1301

approved_by_default = notifychangeproperty(dbus.Boolean,

1398

1302

"ApprovedByDefault")

1399

approval_delay = notifychangeproperty(

1400

dbus.UInt64, "ApprovalDelay",

1401

type_func = lambda td: td.total_seconds() * 1000)

1303

approval_delay = notifychangeproperty(dbus.UInt64,

1304

"ApprovalDelay",

1305

type_func =

1306

lambda td: td.total_seconds()

1307

* 1000)

1402

1308

approval_duration = notifychangeproperty(

1403

1309

dbus.UInt64, "ApprovalDuration",

1404

1310

type_func = lambda td: td.total_seconds() * 1000)

1405

1311

host = notifychangeproperty(dbus.String, "Host")

1406

timeout = notifychangeproperty(

1407

dbus.UInt64, "Timeout",

1408

type_func = lambda td: td.total_seconds() * 1000)

1312

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1313

type_func = lambda td:

1314

td.total_seconds() * 1000)

1409

1315

extended_timeout = notifychangeproperty(

1410

1316

dbus.UInt64, "ExtendedTimeout",

1411

1317

type_func = lambda td: td.total_seconds() * 1000)

1412

interval = notifychangeproperty(

1413

dbus.UInt64, "Interval",

1414

type_func = lambda td: td.total_seconds() * 1000)

1318

interval = notifychangeproperty(dbus.UInt64,

1319

"Interval",

1320

type_func =

1321

lambda td: td.total_seconds()

1322

* 1000)

1415

1323

checker_command = notifychangeproperty(dbus.String, "Checker")

1416

1324

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1417

1325

invalidate_only=True)

1427

1335

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1428

1336

Client.__del__(self, *args, **kwargs)

1429

1337

1430

def checker_callback(self, source, condition,

1431

connection, command, *args, **kwargs):

1432

ret = Client.checker_callback(self, source, condition,

1433

connection, command, *args,

1434

**kwargs)

1435

exitstatus = self.last_checker_status

1436

if exitstatus >= 0:

1338

def checker_callback(self, pid, condition, command,

1339

*args, **kwargs):

1340

self.checker_callback_tag = None

1341

self.checker = None

1342

if os.WIFEXITED(condition):

1343

exitstatus = os.WEXITSTATUS(condition)

1437

1344

# Emit D-Bus signal

1438

1345

self.CheckerCompleted(dbus.Int16(exitstatus),

1439

# This is specific to GNU libC

1440

dbus.Int64(exitstatus << 8),

1346

dbus.Int64(condition),

1441

1347

dbus.String(command))

1442

1348

else:

1443

1349

# Emit D-Bus signal

1444

1350

self.CheckerCompleted(dbus.Int16(-1),

1445

dbus.Int64(

1446

# This is specific to GNU libC

1447

(exitstatus << 8)

1448

| self.last_checker_signal),

1351

dbus.Int64(condition),

1449

1352

dbus.String(command))

1450

return ret

1353

1354

return Client.checker_callback(self, pid, condition, command,

1355

*args, **kwargs)

1451

1356

1452

1357

def start_checker(self, *args, **kwargs):

1453

1358

old_checker_pid = getattr(self.checker, "pid", None)

1528

1433

self.checked_ok()

1529

1434

1530

1435

# Enable - method

1531

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1532

1436

@dbus.service.method(_interface)

1533

1437

def Enable(self):

1534

1438

"D-Bus method"

1535

1439

self.enable()

1536

1440

1537

1441

# StartChecker - method

1538

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1539

1442

@dbus.service.method(_interface)

1540

1443

def StartChecker(self):

1541

1444

"D-Bus method"

1542

1445

self.start_checker()

1543

1446

1544

1447

# Disable - method

1545

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1546

1448

@dbus.service.method(_interface)

1547

1449

def Disable(self):

1548

1450

"D-Bus method"

1549

1451

self.disable()

1550

1452

1551

1453

# StopChecker - method

1552

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1553

1454

@dbus.service.method(_interface)

1554

1455

def StopChecker(self):

1555

1456

self.stop_checker()

1562

1463

return dbus.Boolean(bool(self.approvals_pending))

1563

1464

1564

1465

# ApprovedByDefault - property

1565

@dbus_service_property(_interface,

1566

signature="b",

1466

@dbus_service_property(_interface, signature="b",

1567

1467

access="readwrite")

1568

1468

def ApprovedByDefault_dbus_property(self, value=None):

1569

1469

if value is None: # get

1571

1471

self.approved_by_default = bool(value)

1572

1472

1573

1473

# ApprovalDelay - property

1574

@dbus_service_property(_interface,

1575

signature="t",

1474

@dbus_service_property(_interface, signature="t",

1576

1475

access="readwrite")

1577

1476

def ApprovalDelay_dbus_property(self, value=None):

1578

1477

if value is None: # get

1581

1480

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1582

1481

1583

1482

# ApprovalDuration - property

1584

@dbus_service_property(_interface,

1585

signature="t",

1483

@dbus_service_property(_interface, signature="t",

1586

1484

access="readwrite")

1587

1485

def ApprovalDuration_dbus_property(self, value=None):

1588

1486

if value is None: # get

1591

1489

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1592

1490

1593

1491

# Name - property

1594

@dbus_annotations(

1595

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1596

1492

@dbus_service_property(_interface, signature="s", access="read")

1597

1493

def Name_dbus_property(self):

1598

1494

return dbus.String(self.name)

1599

1495

1600

1496

# Fingerprint - property

1601

@dbus_annotations(

1602

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1603

1497

@dbus_service_property(_interface, signature="s", access="read")

1604

1498

def Fingerprint_dbus_property(self):

1605

1499

return dbus.String(self.fingerprint)

1606

1500

1607

1501

# Host - property

1608

@dbus_service_property(_interface,

1609

signature="s",

1502

@dbus_service_property(_interface, signature="s",

1610

1503

access="readwrite")

1611

1504

def Host_dbus_property(self, value=None):

1612

1505

if value is None: # get

1614

1507

self.host = str(value)

1615

1508

1616

1509

# Created - property

1617

@dbus_annotations(

1618

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1619

1510

@dbus_service_property(_interface, signature="s", access="read")

1620

1511

def Created_dbus_property(self):

1621

1512

return datetime_to_dbus(self.created)

1626

1517

return datetime_to_dbus(self.last_enabled)

1627

1518

1628

1519

# Enabled - property

1629

@dbus_service_property(_interface,

1630

signature="b",

1520

@dbus_service_property(_interface, signature="b",

1631

1521

access="readwrite")

1632

1522

def Enabled_dbus_property(self, value=None):

1633

1523

if value is None: # get

1638

1528

self.disable()

1639

1529

1640

1530

# LastCheckedOK - property

1641

@dbus_service_property(_interface,

1642

signature="s",

1531

@dbus_service_property(_interface, signature="s",

1643

1532

access="readwrite")

1644

1533

def LastCheckedOK_dbus_property(self, value=None):

1645

1534

if value is not None:

1648

1537

return datetime_to_dbus(self.last_checked_ok)

1649

1538

1650

1539

# LastCheckerStatus - property

1651

@dbus_service_property(_interface, signature="n", access="read")

1540

@dbus_service_property(_interface, signature="n",

1541

access="read")

1652

1542

def LastCheckerStatus_dbus_property(self):

1653

1543

return dbus.Int16(self.last_checker_status)

1654

1544

1663

1553

return datetime_to_dbus(self.last_approval_request)

1664

1554

1665

1555

# Timeout - property

1666

@dbus_service_property(_interface,

1667

signature="t",

1556

@dbus_service_property(_interface, signature="t",

1668

1557

access="readwrite")

1669

1558

def Timeout_dbus_property(self, value=None):

1670

1559

if value is None: # get

1683

1572

is None):

1684

1573

return

1685

1574

gobject.source_remove(self.disable_initiator_tag)

1686

self.disable_initiator_tag = gobject.timeout_add(

1687

int((self.expires - now).total_seconds() * 1000),

1688

self.disable)

1575

self.disable_initiator_tag = (

1576

gobject.timeout_add(

1577

int((self.expires - now).total_seconds()

1578

* 1000), self.disable))

1689

1579

1690

1580

# ExtendedTimeout - property

1691

@dbus_service_property(_interface,

1692

signature="t",

1581

@dbus_service_property(_interface, signature="t",

1693

1582

access="readwrite")

1694

1583

def ExtendedTimeout_dbus_property(self, value=None):

1695

1584

if value is None: # get

1698

1587

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1699

1588

1700

1589

# Interval - property

1701

@dbus_service_property(_interface,

1702

signature="t",

1590

@dbus_service_property(_interface, signature="t",

1703

1591

access="readwrite")

1704

1592

def Interval_dbus_property(self, value=None):

1705

1593

if value is None: # get

1710

1598

if self.enabled:

1711

1599

# Reschedule checker run

1712

1600

gobject.source_remove(self.checker_initiator_tag)

1713

self.checker_initiator_tag = gobject.timeout_add(

1714

value, self.start_checker)

1715

self.start_checker() # Start one now, too

1601

self.checker_initiator_tag = (gobject.timeout_add

1602

(value, self.start_checker))

1603

self.start_checker() # Start one now, too

1716

1604

1717

1605

# Checker - property

1718

@dbus_service_property(_interface,

1719

signature="s",

1606

@dbus_service_property(_interface, signature="s",

1720

1607

access="readwrite")

1721

1608

def Checker_dbus_property(self, value=None):

1722

1609

if value is None: # get

1724

1611

self.checker_command = str(value)

1725

1612

1726

1613

# CheckerRunning - property

1727

@dbus_service_property(_interface,

1728

signature="b",

1614

@dbus_service_property(_interface, signature="b",

1729

1615

access="readwrite")

1730

1616

def CheckerRunning_dbus_property(self, value=None):

1731

1617

if value is None: # get

1736

1622

self.stop_checker()

1737

1623

1738

1624

# ObjectPath - property

1739

@dbus_annotations(

1740

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

1741

"org.freedesktop.DBus.Deprecated": "true"})

1742

1625

@dbus_service_property(_interface, signature="o", access="read")

1743

1626

def ObjectPath_dbus_property(self):

1744

1627

return self.dbus_object_path # is already a dbus.ObjectPath

1745

1628

1746

1629

# Secret = property

1747

@dbus_annotations(

1748

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

1749

"invalidates"})

1750

@dbus_service_property(_interface,

1751

signature="ay",

1752

access="write",

1753

byte_arrays=True)

1630

@dbus_service_property(_interface, signature="ay",

1631

access="write", byte_arrays=True)

1754

1632

def Secret_dbus_property(self, value):

1755

1633

self.secret = bytes(value)

1756

1634

1762

1640

self._pipe = child_pipe

1763

1641

self._pipe.send(('init', fpr, address))

1764

1642

if not self._pipe.recv():

1765

raise KeyError(fpr)

1643

raise KeyError()

1766

1644

1767

1645

def __getattribute__(self, name):

1768

1646

if name == '_pipe':

1772

1650

if data[0] == 'data':

1773

1651

return data[1]

1774

1652

if data[0] == 'function':

1775

1776

1653

def func(*args, **kwargs):

1777

1654

self._pipe.send(('funcall', name, args, kwargs))

1778

1655

return self._pipe.recv()[1]

1779

1780

1656

return func

1781

1657

1782

1658

def __setattr__(self, name, value):

1798

1674

logger.debug("Pipe FD: %d",

1799

1675

self.server.child_pipe.fileno())

1800

1676

1801

session = gnutls.connection.ClientSession(

1802

self.request, gnutls.connection .X509Credentials())

1677

session = (gnutls.connection

1678

.ClientSession(self.request,

1679

gnutls.connection

1680

.X509Credentials()))

1803

1681

1804

1682

# Note: gnutls.connection.X509Credentials is really a

1805

1683

# generic GnuTLS certificate credentials object so long as

1814

1692

priority = self.server.gnutls_priority

1815

1693

if priority is None:

1816

1694

priority = "NORMAL"

1817

gnutls.library.functions.gnutls_priority_set_direct(

1818

session._c_object, priority, None)

1695

(gnutls.library.functions

1696

.gnutls_priority_set_direct(session._c_object,

1697

priority, None))

1819

1698

1820

1699

# Start communication using the Mandos protocol

1821

1700

# Get protocol number

1841

1720

approval_required = False

1842

1721

try:

1843

1722

try:

1844

fpr = self.fingerprint(

1845

self.peer_certificate(session))

1723

fpr = self.fingerprint(self.peer_certificate

1724

(session))

1846

1725

except (TypeError,

1847

1726

gnutls.errors.GNUTLSError) as error:

1848

1727

logger.warning("Bad certificate: %s", error)

1863

1742

while True:

1864

1743

if not client.enabled:

1865

1744

logger.info("Client %s is disabled",

1866

client.name)

1745

client.name)

1867

1746

if self.server.use_dbus:

1868

1747

# Emit D-Bus signal

1869

1748

client.Rejected("Disabled")

1916

1795

logger.warning("gnutls send failed",

1917

1796

exc_info=error)

1918

1797

return

1919

logger.debug("Sent: %d, remaining: %d", sent,

1920

len(client.secret) - (sent_size

1921

+ sent))

1798

logger.debug("Sent: %d, remaining: %d",

1799

sent, len(client.secret)

1800

- (sent_size + sent))

1922

1801

sent_size += sent

1923

1802

1924

1803

logger.info("Sending secret to %s", client.name)

1941

1820

def peer_certificate(session):

1942

1821

"Return the peer's OpenPGP certificate as a bytestring"

1943

1822

# If not an OpenPGP certificate...

1944

if (gnutls.library.functions.gnutls_certificate_type_get(

1945

session._c_object)

1823

if (gnutls.library.functions

1824

.gnutls_certificate_type_get(session._c_object)

1946

1825

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1947

1826

# ...do the normal thing

1948

1827

return session.peer_certificate

1962

1841

def fingerprint(openpgp):

1963

1842

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1964

1843

# New GnuTLS "datum" with the OpenPGP public key

1965

datum = gnutls.library.types.gnutls_datum_t(

1966

ctypes.cast(ctypes.c_char_p(openpgp),

1967

ctypes.POINTER(ctypes.c_ubyte)),

1968

ctypes.c_uint(len(openpgp)))

1844

datum = (gnutls.library.types

1845

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1846

ctypes.POINTER

1847

(ctypes.c_ubyte)),

1848

ctypes.c_uint(len(openpgp))))

1969

1849

# New empty GnuTLS certificate

1970

1850

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1971

gnutls.library.functions.gnutls_openpgp_crt_init(

1972

ctypes.byref(crt))

1851

(gnutls.library.functions

1852

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1973

1853

# Import the OpenPGP public key into the certificate

1974

gnutls.library.functions.gnutls_openpgp_crt_import(

1975

crt, ctypes.byref(datum),

1976

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1854

(gnutls.library.functions

1855

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1856

gnutls.library.constants

1857

.GNUTLS_OPENPGP_FMT_RAW))

1977

1858

# Verify the self signature in the key

1978

1859

crtverify = ctypes.c_uint()

1979

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1980

crt, 0, ctypes.byref(crtverify))

1860

(gnutls.library.functions

1861

.gnutls_openpgp_crt_verify_self(crt, 0,

1862

ctypes.byref(crtverify)))

1981

1863

if crtverify.value != 0:

1982

1864

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1983

raise gnutls.errors.CertificateSecurityError(

1984

"Verify failed")

1865

raise (gnutls.errors.CertificateSecurityError

1866

("Verify failed"))

1985

1867

# New buffer for the fingerprint

1986

1868

buf = ctypes.create_string_buffer(20)

1987

1869

buf_len = ctypes.c_size_t()

1988

1870

# Get the fingerprint from the certificate into the buffer

1989

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1990

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1871

(gnutls.library.functions

1872

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1873

ctypes.byref(buf_len)))

1991

1874

# Deinit the certificate

1992

1875

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1993

1876

# Convert the buffer to a Python bytestring

1999

1882

2000

1883

class MultiprocessingMixIn(object):

2001

1884

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2002

2003

1885

def sub_process_main(self, request, address):

2004

1886

try:

2005

1887

self.finish_request(request, address)

2017

1899

2018

1900

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2019

1901

""" adds a pipe to the MixIn """

2020

2021

1902

def process_request(self, request, client_address):

2022

1903

"""Overrides and wraps the original process_request().

2023

1904

2044

1925

interface: None or a network interface name (string)

2045

1926

use_ipv6: Boolean; to use IPv6 or not

2046

1927

"""

2047

2048

1928

def __init__(self, server_address, RequestHandlerClass,

2049

interface=None,

2050

use_ipv6=True,

2051

socketfd=None):

1929

interface=None, use_ipv6=True, socketfd=None):

2052

1930

"""If socketfd is set, use that file descriptor instead of

2053

1931

creating a new one with socket.socket().

2054

1932

"""

2095

1973

self.interface)

2096

1974

else:

2097

1975

try:

2098

self.socket.setsockopt(

2099

socket.SOL_SOCKET, SO_BINDTODEVICE,

2100

(self.interface + "\0").encode("utf-8"))

1976

self.socket.setsockopt(socket.SOL_SOCKET,

1977

SO_BINDTODEVICE,

1978

(self.interface + "\0")

1979

.encode("utf-8"))

2101

1980

except socket.error as error:

2102

1981

if error.errno == errno.EPERM:

2103

1982

logger.error("No permission to bind to"

2121

2000

self.server_address = (any_address,

2122

2001

self.server_address[1])

2123

2002

elif not self.server_address[1]:

2124

self.server_address = (self.server_address[0], 0)

2003

self.server_address = (self.server_address[0],

2004

0)

2125

2005

# if self.interface:

2126

2006

# self.server_address = (self.server_address[0],

2127

2007

# 0, # port

2141

2021

2142

2022

Assumes a gobject.MainLoop event loop.

2143

2023

"""

2144

2145

2024

def __init__(self, server_address, RequestHandlerClass,

2146

interface=None,

2147

use_ipv6=True,

2148

clients=None,

2149

gnutls_priority=None,

2150

use_dbus=True,

2151

socketfd=None):

2025

interface=None, use_ipv6=True, clients=None,

2026

gnutls_priority=None, use_dbus=True, socketfd=None):

2152

2027

self.enabled = False

2153

2028

self.clients = clients

2154

2029

if self.clients is None:

2160

2035

interface = interface,

2161

2036

use_ipv6 = use_ipv6,

2162

2037

socketfd = socketfd)

2163

2164

2038

def server_activate(self):

2165

2039

if self.enabled:

2166

2040

return socketserver.TCPServer.server_activate(self)

2170

2044

2171

2045

def add_pipe(self, parent_pipe, proc):

2172

2046

# Call "handle_ipc" for both data and EOF events

2173

gobject.io_add_watch(

2174

parent_pipe.fileno(),

2175

gobject.IO_IN | gobject.IO_HUP,

2176

functools.partial(self.handle_ipc,

2177

parent_pipe = parent_pipe,

2178

proc = proc))

2047

gobject.io_add_watch(parent_pipe.fileno(),

2048

gobject.IO_IN | gobject.IO_HUP,

2049

functools.partial(self.handle_ipc,

2050

parent_pipe =

2051

parent_pipe,

2052

proc = proc))

2179

2053

2180

def handle_ipc(self, source, condition,

2181

parent_pipe=None,

2182

proc = None,

2183

client_object=None):

2054

def handle_ipc(self, source, condition, parent_pipe=None,

2055

proc = None, client_object=None):

2184

2056

# error, or the other end of multiprocessing.Pipe has closed

2185

2057

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2186

2058

# Wait for other process to exit

2209

2081

parent_pipe.send(False)

2210

2082

return False

2211

2083

2212

gobject.io_add_watch(

2213

parent_pipe.fileno(),

2214

gobject.IO_IN | gobject.IO_HUP,

2215

functools.partial(self.handle_ipc,

2216

parent_pipe = parent_pipe,

2217

proc = proc,

2218

client_object = client))

2084

gobject.io_add_watch(parent_pipe.fileno(),

2085

gobject.IO_IN | gobject.IO_HUP,

2086

functools.partial(self.handle_ipc,

2087

parent_pipe =

2088

parent_pipe,

2089

proc = proc,

2090

client_object =

2091

client))

2219

2092

parent_pipe.send(True)

2220

2093

# remove the old hook in favor of the new above hook on

2221

2094

# same fileno

2227

2100

2228

2101

parent_pipe.send(('data', getattr(client_object,

2229

2102

funcname)(*args,

2230

**kwargs)))

2103

**kwargs)))

2231

2104

2232

2105

if command == 'getattr':

2233

2106

attrname = request[1]

2234

if isinstance(client_object.__getattribute__(attrname),

2235

collections.Callable):

2236

parent_pipe.send(('function', ))

2107

if callable(client_object.__getattribute__(attrname)):

2108

parent_pipe.send(('function',))

2237

2109

else:

2238

parent_pipe.send((

2239

'data', client_object.__getattribute__(attrname)))

2110

parent_pipe.send(('data', client_object

2111

.__getattribute__(attrname)))

2240

2112

2241

2113

if command == 'setattr':

2242

2114

attrname = request[1]

2273

2145

# avoid excessive use of external libraries.

2274

2146

2275

2147

# New type for defining tokens, syntax, and semantics all-in-one

2276

Token = collections.namedtuple("Token", (

2277

"regexp", # To match token; if "value" is not None, must have

2278

# a "group" containing digits

2279

"value", # datetime.timedelta or None

2280

"followers")) # Tokens valid after this token

2148

Token = collections.namedtuple("Token",

2149

("regexp", # To match token; if

2150

# "value" is not None,

2151

# must have a "group"

2152

# containing digits

2153

"value", # datetime.timedelta or

2154

# None

2155

"followers")) # Tokens valid after

2156

# this token

2281

2157

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2282

2158

# the "duration" ABNF definition in RFC 3339, Appendix A.

2283

2159

token_end = Token(re.compile(r"$"), None, frozenset())

2284

2160

token_second = Token(re.compile(r"(\d+)S"),

2285

2161

datetime.timedelta(seconds=1),

2286

frozenset((token_end, )))

2162

frozenset((token_end,)))

2287

2163

token_minute = Token(re.compile(r"(\d+)M"),

2288

2164

datetime.timedelta(minutes=1),

2289

2165

frozenset((token_second, token_end)))

2305

2181

frozenset((token_month, token_end)))

2306

2182

token_week = Token(re.compile(r"(\d+)W"),

2307

2183

datetime.timedelta(weeks=1),

2308

frozenset((token_end, )))

2184

frozenset((token_end,)))

2309

2185

token_duration = Token(re.compile(r"P"), None,

2310

2186

frozenset((token_year, token_month,

2311

2187

token_day, token_time,

2313

2189

# Define starting values

2314

2190

value = datetime.timedelta() # Value so far

2315

2191

found_token = None

2316

followers = frozenset((token_duration, )) # Following valid tokens

2192

followers = frozenset((token_duration,)) # Following valid tokens

2317

2193

s = duration # String left to parse

2318

2194

# Loop until end token is found

2319

2195

while found_token is not token_end:

2336

2212

break

2337

2213

else:

2338

2214

# No currently valid tokens were found

2339

raise ValueError("Invalid RFC 3339 duration: {!r}"

2340

.format(duration))

2215

raise ValueError("Invalid RFC 3339 duration")

2341

2216

# End token found

2342

2217

return value

2343

2218

2380

2255

elif suffix == "w":

2381

2256

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2382

2257

else:

2383

raise ValueError("Unknown suffix {!r}".format(suffix))

2258

raise ValueError("Unknown suffix {!r}"

2259

.format(suffix))

2384

2260

except IndexError as e:

2385

2261

raise ValueError(*(e.args))

2386

2262

timevalue += delta

2402

2278

# Close all standard open file descriptors

2403

2279

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2404

2280

if not stat.S_ISCHR(os.fstat(null).st_mode):

2405

raise OSError(errno.ENODEV,

2406

"{} not a character device"

2281

raise OSError(errno.ENODEV, "{} not a character device"

2407

2282

.format(os.devnull))

2408

2283

os.dup2(null, sys.stdin.fileno())

2409

2284

os.dup2(null, sys.stdout.fileno())

2475

2350

"port": "",

2476

2351

"debug": "False",

2477

2352

"priority":

2478

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2479

":+SIGN-DSA-SHA256",

2353

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2480

2354

"servicename": "Mandos",

2481

2355

"use_dbus": "True",

2482

2356

"use_ipv6": "True",

2486

2360

"statedir": "/var/lib/mandos",

2487

2361

"foreground": "False",

2488

2362

"zeroconf": "True",

2489

}

2363

}

2490

2364

2491

2365

# Parse config file for server-global settings

2492

2366

server_config = configparser.SafeConfigParser(server_defaults)

2493

2367

del server_defaults

2494

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2368

server_config.read(os.path.join(options.configdir,

2369

"mandos.conf"))

2495

2370

# Convert the SafeConfigParser object to a dict

2496

2371

server_settings = server_config.defaults()

2497

2372

# Use the appropriate methods on the non-string config options

2515

2390

# Override the settings from the config file with command line

2516

2391

# options, if set.

2517

2392

for option in ("interface", "address", "port", "debug",

2518

"priority", "servicename", "configdir", "use_dbus",

2519

"use_ipv6", "debuglevel", "restore", "statedir",

2520

"socket", "foreground", "zeroconf"):

2393

"priority", "servicename", "configdir",

2394

"use_dbus", "use_ipv6", "debuglevel", "restore",

2395

"statedir", "socket", "foreground", "zeroconf"):

2521

2396

value = getattr(options, option)

2522

2397

if value is not None:

2523

2398

server_settings[option] = value

2538

2413

2539

2414

##################################################################

2540

2415

2541

if (not server_settings["zeroconf"]

2542

and not (server_settings["port"]

2543

or server_settings["socket"] != "")):

2544

parser.error("Needs port or socket to work without Zeroconf")

2416

if (not server_settings["zeroconf"] and

2417

not (server_settings["port"]

2418

or server_settings["socket"] != "")):

2419

parser.error("Needs port or socket to work without"

2420

" Zeroconf")

2545

2421

2546

2422

# For convenience

2547

2423

debug = server_settings["debug"]

2563

2439

initlogger(debug, level)

2564

2440

2565

2441

if server_settings["servicename"] != "Mandos":

2566

syslogger.setFormatter(

2567

logging.Formatter('Mandos ({}) [%(process)d]:'

2568

' %(levelname)s: %(message)s'.format(

2569

server_settings["servicename"])))

2442

syslogger.setFormatter(logging.Formatter

2443

('Mandos ({}) [%(process)d]:'

2444

' %(levelname)s: %(message)s'

2445

.format(server_settings

2446

["servicename"])))

2570

2447

2571

2448

# Parse config file with clients

2572

2449

client_config = configparser.SafeConfigParser(Client

2580

2457

socketfd = None

2581

2458

if server_settings["socket"] != "":

2582

2459

socketfd = server_settings["socket"]

2583

tcp_server = MandosServer(

2584

(server_settings["address"], server_settings["port"]),

2585

ClientHandler,

2586

interface=(server_settings["interface"] or None),

2587

use_ipv6=use_ipv6,

2588

gnutls_priority=server_settings["priority"],

2589

use_dbus=use_dbus,

2590

socketfd=socketfd)

2460

tcp_server = MandosServer((server_settings["address"],

2461

server_settings["port"]),

2462

ClientHandler,

2463

interface=(server_settings["interface"]

2464

or None),

2465

use_ipv6=use_ipv6,

2466

gnutls_priority=

2467

server_settings["priority"],

2468

use_dbus=use_dbus,

2469

socketfd=socketfd)

2591

2470

if not foreground:

2592

2471

pidfilename = "/run/mandos.pid"

2593

2472

if not os.path.isdir("/run/."):

2594

2473

pidfilename = "/var/run/mandos.pid"

2595

2474

pidfile = None

2596

2475

try:

2597

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2476

pidfile = open(pidfilename, "w")

2598

2477

except IOError as e:

2599

2478

logger.error("Could not open file %r", pidfilename,

2600

2479

exc_info=e)

2627

2506

def debug_gnutls(level, string):

2628

2507

logger.debug("GnuTLS: %s", string[:-1])

2629

2508

2630

gnutls.library.functions.gnutls_global_set_log_function(

2631

debug_gnutls)

2509

(gnutls.library.functions

2510

.gnutls_global_set_log_function(debug_gnutls))

2632

2511

2633

2512

# Redirect stdin so all checkers get /dev/null

2634

2513

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2654

2533

if use_dbus:

2655

2534

try:

2656

2535

bus_name = dbus.service.BusName("se.recompile.Mandos",

2657

bus,

2658

do_not_queue=True)

2659

old_bus_name = dbus.service.BusName(

2660

"se.bsnet.fukt.Mandos", bus,

2661

do_not_queue=True)

2662

except dbus.exceptions.DBusException as e:

2536

bus, do_not_queue=True)

2537

old_bus_name = (dbus.service.BusName

2538

("se.bsnet.fukt.Mandos", bus,

2539

do_not_queue=True))

2540

except dbus.exceptions.NameExistsException as e:

2663

2541

logger.error("Disabling D-Bus:", exc_info=e)

2664

2542

use_dbus = False

2665

2543

server_settings["use_dbus"] = False

2666

2544

tcp_server.use_dbus = False

2667

2545

if zeroconf:

2668

2546

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2669

service = AvahiServiceToSyslog(

2670

name = server_settings["servicename"],

2671

servicetype = "_mandos._tcp",

2672

protocol = protocol,

2673

bus = bus)

2547

service = AvahiServiceToSyslog(name =

2548

server_settings["servicename"],

2549

servicetype = "_mandos._tcp",

2550

protocol = protocol, bus = bus)

2674

2551

if server_settings["interface"]:

2675

service.interface = if_nametoindex(

2676

server_settings["interface"].encode("utf-8"))

2552

service.interface = (if_nametoindex

2553

(server_settings["interface"]

2554

.encode("utf-8")))

2677

2555

2678

2556

global multiprocessing_manager

2679

2557

multiprocessing_manager = multiprocessing.Manager()

2698

2576

if server_settings["restore"]:

2699

2577

try:

2700

2578

with open(stored_state_path, "rb") as stored_state:

2701

clients_data, old_client_settings = pickle.load(

2702

stored_state)

2579

clients_data, old_client_settings = (pickle.load

2580

(stored_state))

2703

2581

os.remove(stored_state_path)

2704

2582

except IOError as e:

2705

2583

if e.errno == errno.ENOENT:

2706

logger.warning("Could not load persistent state:"

2707

" {}".format(os.strerror(e.errno)))

2584

logger.warning("Could not load persistent state: {}"

2585

.format(os.strerror(e.errno)))

2708

2586

else:

2709

2587

logger.critical("Could not load persistent state:",

2710

2588

exc_info=e)

2711

2589

raise

2712

2590

except EOFError as e:

2713

2591

logger.warning("Could not load persistent state: "

2714

"EOFError:",

2715

exc_info=e)

2592

"EOFError:", exc_info=e)

2716

2593

2717

2594

with PGPEngine() as pgp:

2718

2595

for client_name, client in clients_data.items():

2730

2607

# For each value in new config, check if it

2731

2608

# differs from the old config value (Except for

2732

2609

# the "secret" attribute)

2733

if (name != "secret"

2734

and (value !=

2735

old_client_settings[client_name][name])):

2610

if (name != "secret" and

2611

value != old_client_settings[client_name]

2612

[name]):

2736

2613

client[name] = value

2737

2614

except KeyError:

2738

2615

pass

2739

2616

2740

2617

# Clients who has passed its expire date can still be

2741

# enabled if its last checker was successful. A Client

2618

# enabled if its last checker was successful. Clients

2742

2619

# whose checker succeeded before we stored its state is

2743

2620

# assumed to have successfully run all checkers during

2744

2621

# downtime.

2747

2624

if not client["last_checked_ok"]:

2748

2625

logger.warning(

2749

2626

"disabling client {} - Client never "

2750

"performed a successful checker".format(

2751

client_name))

2627

"performed a successful checker"

2628

.format(client_name))

2752

2629

client["enabled"] = False

2753

2630

elif client["last_checker_status"] != 0:

2754

2631

logger.warning(

2755

2632

"disabling client {} - Client last"

2756

" checker failed with error code"

2757

" {}".format(

2758

client_name,

2759

client["last_checker_status"]))

2633

" checker failed with error code {}"

2634

.format(client_name,

2635

client["last_checker_status"]))

2760

2636

client["enabled"] = False

2761

2637

else:

2762

client["expires"] = (

2763

datetime.datetime.utcnow()

2764

+ client["timeout"])

2638

client["expires"] = (datetime.datetime

2639

.utcnow()

2640

+ client["timeout"])

2765

2641

logger.debug("Last checker succeeded,"

2766

" keeping {} enabled".format(

2767

client_name))

2642

" keeping {} enabled"

2643

.format(client_name))

2768

2644

try:

2769

client["secret"] = pgp.decrypt(

2770

client["encrypted_secret"],

2771

client_settings[client_name]["secret"])

2645

client["secret"] = (

2646

pgp.decrypt(client["encrypted_secret"],

2647

client_settings[client_name]

2648

["secret"]))

2772

2649

except PGPError:

2773

2650

# If decryption fails, we use secret from new settings

2774

logger.debug("Failed to decrypt {} old secret".format(

2775

client_name))

2776

client["secret"] = (client_settings[client_name]

2777

["secret"])

2651

logger.debug("Failed to decrypt {} old secret"

2652

.format(client_name))

2653

client["secret"] = (

2654

client_settings[client_name]["secret"])

2778

2655

2779

2656

# Add/remove clients based on new changes made to config

2780

2657

for client_name in (set(old_client_settings)

2787

2664

# Create all client objects

2788

2665

for client_name, client in clients_data.items():

2789

2666

tcp_server.clients[client_name] = client_class(

2790

name = client_name,

2791

settings = client,

2667

name = client_name, settings = client,

2792

2668

server_settings = server_settings)

2793

2669

2794

2670

if not tcp_server.clients:

2796

2672

2797

2673

if not foreground:

2798

2674

if pidfile is not None:

2799

pid = os.getpid()

2800

2675

try:

2801

2676

with pidfile:

2802

print(pid, file=pidfile)

2677

pid = os.getpid()

2678

pidfile.write("{}\n".format(pid).encode("utf-8"))

2803

2679

except IOError:

2804

2680

logger.error("Could not write to file %r with PID %d",

2805

2681

pidfilename, pid)

2810

2686

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2811

2687

2812

2688

if use_dbus:

2813

2814

@alternate_dbus_interfaces(

2815

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2816

class MandosDBusService(DBusObjectWithAnnotations):

2689

@alternate_dbus_interfaces({"se.recompile.Mandos":

2690

"se.bsnet.fukt.Mandos"})

2691

class MandosDBusService(DBusObjectWithProperties):

2817

2692

"""A D-Bus proxy object"""

2818

2819

2693

def __init__(self):

2820

2694

dbus.service.Object.__init__(self, bus, "/")

2821

2822

2695

_interface = "se.recompile.Mandos"

2823

2696

2697

@dbus_interface_annotations(_interface)

2698

def _foo(self):

2699

return { "org.freedesktop.DBus.Property"

2700

".EmitsChangedSignal":

2701

"false"}

2702

2824

2703

@dbus.service.signal(_interface, signature="o")

2825

2704

def ClientAdded(self, objpath):

2826

2705

"D-Bus signal"

2839

2718

@dbus.service.method(_interface, out_signature="ao")

2840

2719

def GetAllClients(self):

2841

2720

"D-Bus method"

2842

return dbus.Array(c.dbus_object_path for c in

2721

return dbus.Array(c.dbus_object_path

2722

for c in

2843

2723

tcp_server.clients.itervalues())

2844

2724

2845

2725

@dbus.service.method(_interface,

2894

2774

# + secret.

2895

2775

exclude = { "bus", "changedstate", "secret",

2896

2776

"checker", "server_settings" }

2897

for name, typ in inspect.getmembers(dbus.service

2898

.Object):

2777

for name, typ in (inspect.getmembers

2778

(dbus.service.Object)):

2899

2779

exclude.add(name)

2900

2780

2901

2781

client_dict["encrypted_secret"] = (client

2908

2788

del client_settings[client.name]["secret"]

2909

2789

2910

2790

try:

2911

with tempfile.NamedTemporaryFile(

2912

mode='wb',

2913

suffix=".pickle",

2914

prefix='clients-',

2915

dir=os.path.dirname(stored_state_path),

2916

delete=False) as stored_state:

2791

with (tempfile.NamedTemporaryFile

2792

(mode='wb', suffix=".pickle", prefix='clients-',

2793

dir=os.path.dirname(stored_state_path),

2794

delete=False)) as stored_state:

2917

2795

pickle.dump((clients, client_settings), stored_state)

2918

tempname = stored_state.name

2796

tempname=stored_state.name

2919

2797

os.rename(tempname, stored_state_path)

2920

2798

except (IOError, OSError) as e:

2921

2799

if not debug:

2940

2818

client.disable(quiet=True)

2941

2819

if use_dbus:

2942

2820

# Emit D-Bus signal

2943

mandos_dbus_service.ClientRemoved(

2944

client.dbus_object_path, client.name)

2821

mandos_dbus_service.ClientRemoved(client

2822

.dbus_object_path,

2823

client.name)

2945

2824

client_settings.clear()

2946

2825

2947

2826

atexit.register(cleanup)

3000

2879

# Must run before the D-Bus bus name gets deregistered

3001

2880

cleanup()

3002

2881

3003

3004

2882

if __name__ == '__main__':

3005

2883

main()