/mandos/trunk : revision 740

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

36

37

from future_builtins import *

38

39

try:

40

import SocketServer as socketserver

41

except ImportError:

42

import socketserver

39

import SocketServer as socketserver

43

40

import socket

44

41

import argparse

45

42

import datetime

50

47

import gnutls.library.functions

51

48

import gnutls.library.constants

52

49

import gnutls.library.types

53

try:

54

import ConfigParser as configparser

55

except ImportError:

56

import configparser

50

import ConfigParser as configparser

57

51

import sys

58

52

import re

59

53

import os

68

62

import struct

69

63

import fcntl

70

64

import functools

71

try:

72

import cPickle as pickle

73

except ImportError:

74

import pickle

65

import cPickle as pickle

75

66

import multiprocessing

76

67

import types

77

68

import binascii

78

69

import tempfile

79

70

import itertools

80

71

import collections

81

import codecs

82

72

83

73

import dbus

84

74

import dbus.service

85

try:

86

import gobject

87

except ImportError:

88

from gi.repository import GObject as gobject

75

import gobject

89

76

import avahi

90

77

from dbus.mainloop.glib import DBusGMainLoop

91

78

import ctypes

111

98

syslogger = None

112

99

113

100

try:

114

if_nametoindex = ctypes.cdll.LoadLibrary(

115

ctypes.util.find_library("c")).if_nametoindex

101

if_nametoindex = (ctypes.cdll.LoadLibrary

102

(ctypes.util.find_library("c"))

103

.if_nametoindex)

116

104

except (OSError, AttributeError):

117

118

105

def if_nametoindex(interface):

119

106

"Get an interface index the hard way, i.e. using fcntl()"

120

107

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

129

116

"""init logger and add loglevel"""

130

117

131

118

global syslogger

132

syslogger = (logging.handlers.SysLogHandler(

133

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

134

address = "/dev/log"))

119

syslogger = (logging.handlers.SysLogHandler

120

(facility =

121

logging.handlers.SysLogHandler.LOG_DAEMON,

122

address = "/dev/log"))

135

123

syslogger.setFormatter(logging.Formatter

136

124

('Mandos [%(process)d]: %(levelname)s:'

137

125

' %(message)s'))

154

142

155

143

class PGPEngine(object):

156

144

"""A simple class for OpenPGP symmetric encryption & decryption"""

157

158

145

def __init__(self):

159

146

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

160

147

self.gnupgargs = ['--batch',

199

186

200

187

def encrypt(self, data, password):

201

188

passphrase = self.password_encode(password)

202

with tempfile.NamedTemporaryFile(

203

dir=self.tempdir) as passfile:

189

with tempfile.NamedTemporaryFile(dir=self.tempdir

190

) as passfile:

204

191

passfile.write(passphrase)

205

192

passfile.flush()

206

193

proc = subprocess.Popen(['gpg', '--symmetric',

217

204

218

205

def decrypt(self, data, password):

219

206

passphrase = self.password_encode(password)

220

with tempfile.NamedTemporaryFile(

221

dir = self.tempdir) as passfile:

207

with tempfile.NamedTemporaryFile(dir = self.tempdir

208

) as passfile:

222

209

passfile.write(passphrase)

223

210

passfile.flush()

224

211

proc = subprocess.Popen(['gpg', '--decrypt',

228

215

stdin = subprocess.PIPE,

229

216

stdout = subprocess.PIPE,

230

217

stderr = subprocess.PIPE)

231

decrypted_plaintext, err = proc.communicate(input = data)

218

decrypted_plaintext, err = proc.communicate(input

219

= data)

232

220

if proc.returncode != 0:

233

221

raise PGPError(err)

234

222

return decrypted_plaintext

240

228

return super(AvahiError, self).__init__(value, *args,

241

229

**kwargs)

242

230

243

244

231

class AvahiServiceError(AvahiError):

245

232

pass

246

233

247

248

234

class AvahiGroupError(AvahiError):

249

235

pass

250

236

270

256

bus: dbus.SystemBus()

271

257

"""

272

258

273

def __init__(self,

274

interface = avahi.IF_UNSPEC,

275

name = None,

276

servicetype = None,

277

port = None,

278

TXT = None,

279

domain = "",

280

host = "",

281

max_renames = 32768,

282

protocol = avahi.PROTO_UNSPEC,

283

bus = None):

259

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

260

servicetype = None, port = None, TXT = None,

261

domain = "", host = "", max_renames = 32768,

262

protocol = avahi.PROTO_UNSPEC, bus = None):

284

263

self.interface = interface

285

264

self.name = name

286

265

self.type = servicetype

303

282

" after %i retries, exiting.",

304

283

self.rename_count)

305

284

raise AvahiServiceError("Too many renames")

306

self.name = str(

307

self.server.GetAlternativeServiceName(self.name))

285

self.name = str(self.server

286

.GetAlternativeServiceName(self.name))

308

287

self.rename_count += 1

309

288

logger.info("Changing Zeroconf service name to %r ...",

310

289

self.name)

365

344

elif state == avahi.ENTRY_GROUP_FAILURE:

366

345

logger.critical("Avahi: Error in group state changed %s",

367

346

str(error))

368

raise AvahiGroupError("State changed: {!s}".format(error))

347

raise AvahiGroupError("State changed: {!s}"

348

.format(error))

369

349

370

350

def cleanup(self):

371

351

"""Derived from the Avahi example code"""

381

361

def server_state_changed(self, state, error=None):

382

362

"""Derived from the Avahi example code"""

383

363

logger.debug("Avahi server state change: %i", state)

384

bad_states = {

385

avahi.SERVER_INVALID: "Zeroconf server invalid",

386

avahi.SERVER_REGISTERING: None,

387

avahi.SERVER_COLLISION: "Zeroconf server name collision",

388

avahi.SERVER_FAILURE: "Zeroconf server failure",

389

}

364

bad_states = { avahi.SERVER_INVALID:

365

"Zeroconf server invalid",

366

avahi.SERVER_REGISTERING: None,

367

avahi.SERVER_COLLISION:

368

"Zeroconf server name collision",

369

avahi.SERVER_FAILURE:

370

"Zeroconf server failure" }

390

371

if state in bad_states:

391

372

if bad_states[state] is not None:

392

373

if error is None:

395

376

logger.error(bad_states[state] + ": %r", error)

396

377

self.cleanup()

397

378

elif state == avahi.SERVER_RUNNING:

398

try:

399

self.add()

400

except dbus.exceptions.DBusException as error:

401

if (error.get_dbus_name()

402

== "org.freedesktop.Avahi.CollisionError"):

403

logger.info("Local Zeroconf service name"

404

" collision.")

405

return self.rename(remove=False)

406

else:

407

logger.critical("D-Bus Exception", exc_info=error)

408

self.cleanup()

409

os._exit(1)

379

self.add()

410

380

else:

411

381

if error is None:

412

382

logger.debug("Unknown state: %r", state)

422

392

follow_name_owner_changes=True),

423

393

avahi.DBUS_INTERFACE_SERVER)

424

394

self.server.connect_to_signal("StateChanged",

425

self.server_state_changed)

395

self.server_state_changed)

426

396

self.server_state_changed(self.server.GetState())

427

397

428

398

430

400

def rename(self, *args, **kwargs):

431

401

"""Add the new name to the syslog messages"""

432

402

ret = AvahiService.rename(self, *args, **kwargs)

433

syslogger.setFormatter(logging.Formatter(

434

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

435

.format(self.name)))

403

syslogger.setFormatter(logging.Formatter

404

('Mandos ({}) [%(process)d]:'

405

' %(levelname)s: %(message)s'

406

.format(self.name)))

436

407

return ret

437

408

438

def call_pipe(connection, # : multiprocessing.Connection

439

func, *args, **kwargs):

440

"""This function is meant to be called by multiprocessing.Process

441

442

This function runs func(*args, **kwargs), and writes the resulting

443

return value on the provided multiprocessing.Connection.

444

"""

445

connection.send(func(*args, **kwargs))

446

connection.close()

447

409

448

410

class Client(object):

449

411

"""A representation of a client host served by this server.

476

438

last_checker_status: integer between 0 and 255 reflecting exit

477

439

status of last checker. -1 reflects crashed

478

440

checker, -2 means no checker completed yet.

479

last_checker_signal: The signal which killed the last checker, if

480

last_checker_status is -1

481

441

last_enabled: datetime.datetime(); (UTC) or None

482

442

name: string; from the config file, used in log messages and

483

443

D-Bus identifiers

496

456

"fingerprint", "host", "interval",

497

457

"last_approval_request", "last_checked_ok",

498

458

"last_enabled", "name", "timeout")

499

client_defaults = {

500

"timeout": "PT5M",

501

"extended_timeout": "PT15M",

502

"interval": "PT2M",

503

"checker": "fping -q -- %%(host)s",

504

"host": "",

505

"approval_delay": "PT0S",

506

"approval_duration": "PT1S",

507

"approved_by_default": "True",

508

"enabled": "True",

509

}

459

client_defaults = { "timeout": "PT5M",

460

"extended_timeout": "PT15M",

461

"interval": "PT2M",

462

"checker": "fping -q -- %%(host)s",

463

"host": "",

464

"approval_delay": "PT0S",

465

"approval_duration": "PT1S",

466

"approved_by_default": "True",

467

"enabled": "True",

468

}

510

469

511

470

@staticmethod

512

471

def config_parser(config):

590

549

self.current_checker_command = None

591

550

self.approved = None

592

551

self.approvals_pending = 0

593

self.changedstate = multiprocessing_manager.Condition(

594

multiprocessing_manager.Lock())

595

self.client_structure = [attr

596

for attr in self.__dict__.iterkeys()

552

self.changedstate = (multiprocessing_manager

553

.Condition(multiprocessing_manager

554

.Lock()))

555

self.client_structure = [attr for attr in

556

self.__dict__.iterkeys()

597

557

if not attr.startswith("_")]

598

558

self.client_structure.append("client_structure")

599

559

600

for name, t in inspect.getmembers(

601

type(self), lambda obj: isinstance(obj, property)):

560

for name, t in inspect.getmembers(type(self),

561

lambda obj:

562

isinstance(obj,

563

property)):

602

564

if not name.startswith("_"):

603

565

self.client_structure.append(name)

604

566

646

608

# and every interval from then on.

647

609

if self.checker_initiator_tag is not None:

648

610

gobject.source_remove(self.checker_initiator_tag)

649

self.checker_initiator_tag = gobject.timeout_add(

650

int(self.interval.total_seconds() * 1000),

651

self.start_checker)

611

self.checker_initiator_tag = (gobject.timeout_add

612

(int(self.interval

613

.total_seconds() * 1000),

614

self.start_checker))

652

615

# Schedule a disable() when 'timeout' has passed

653

616

if self.disable_initiator_tag is not None:

654

617

gobject.source_remove(self.disable_initiator_tag)

655

self.disable_initiator_tag = gobject.timeout_add(

656

int(self.timeout.total_seconds() * 1000), self.disable)

618

self.disable_initiator_tag = (gobject.timeout_add

619

(int(self.timeout

620

.total_seconds() * 1000),

621

self.disable))

657

622

# Also start a new checker *right now*.

658

623

self.start_checker()

659

624

660

def checker_callback(self, source, condition, connection,

661

command):

625

def checker_callback(self, pid, condition, command):

662

626

"""The checker has completed, so take appropriate actions."""

663

627

self.checker_callback_tag = None

664

628

self.checker = None

665

# Read return code from connection (see call_pipe)

666

returncode = connection.recv()

667

connection.close()

668

669

if returncode >= 0:

670

self.last_checker_status = returncode

671

self.last_checker_signal = None

629

if os.WIFEXITED(condition):

630

self.last_checker_status = os.WEXITSTATUS(condition)

672

631

if self.last_checker_status == 0:

673

632

logger.info("Checker for %(name)s succeeded",

674

633

vars(self))

675

634

self.checked_ok()

676

635

else:

677

logger.info("Checker for %(name)s failed", vars(self))

636

logger.info("Checker for %(name)s failed",

637

vars(self))

678

638

else:

679

639

self.last_checker_status = -1

680

self.last_checker_signal = -returncode

681

640

logger.warning("Checker for %(name)s crashed?",

682

641

vars(self))

683

return False

684

642

685

643

def checked_ok(self):

686

644

"""Assert that the client has been seen, alive and well."""

687

645

self.last_checked_ok = datetime.datetime.utcnow()

688

646

self.last_checker_status = 0

689

self.last_checker_signal = None

690

647

self.bump_timeout()

691

648

692

649

def bump_timeout(self, timeout=None):

697

654

gobject.source_remove(self.disable_initiator_tag)

698

655

self.disable_initiator_tag = None

699

656

if getattr(self, "enabled", False):

700

self.disable_initiator_tag = gobject.timeout_add(

701

int(timeout.total_seconds() * 1000), self.disable)

657

self.disable_initiator_tag = (gobject.timeout_add

658

(int(timeout.total_seconds()

659

* 1000), self.disable))

702

660

self.expires = datetime.datetime.utcnow() + timeout

703

661

704

662

def need_approval(self):

718

676

# than 'timeout' for the client to be disabled, which is as it

719

677

# should be.

720

678

721

if self.checker is not None and not self.checker.is_alive():

722

logger.warning("Checker was not alive; joining")

723

self.checker.join()

724

self.checker = None

679

# If a checker exists, make sure it is not a zombie

680

try:

681

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

682

except AttributeError:

683

pass

684

except OSError as error:

685

if error.errno != errno.ECHILD:

686

raise

687

else:

688

if pid:

689

logger.warning("Checker was a zombie")

690

gobject.source_remove(self.checker_callback_tag)

691

self.checker_callback(pid, status,

692

self.current_checker_command)

725

693

# Start a new checker if needed

726

694

if self.checker is None:

727

695

# Escape attributes for the shell

728

escaped_attrs = {

729

attr: re.escape(str(getattr(self, attr)))

730

for attr in self.runtime_expansions }

696

escaped_attrs = { attr:

697

re.escape(str(getattr(self, attr)))

698

for attr in self.runtime_expansions }

731

699

try:

732

700

command = self.checker_command % escaped_attrs

733

701

except TypeError as error:

734

702

logger.error('Could not format string "%s"',

735

self.checker_command,

703

self.checker_command, exc_info=error)

704

return True # Try again later

705

self.current_checker_command = command

706

try:

707

logger.info("Starting checker %r for %s",

708

command, self.name)

709

# We don't need to redirect stdout and stderr, since

710

# in normal mode, that is already done by daemon(),

711

# and in debug mode we don't want to. (Stdin is

712

# always replaced by /dev/null.)

713

# The exception is when not debugging but nevertheless

714

# running in the foreground; use the previously

715

# created wnull.

716

popen_args = {}

717

if (not self.server_settings["debug"]

718

and self.server_settings["foreground"]):

719

popen_args.update({"stdout": wnull,

720

"stderr": wnull })

721

self.checker = subprocess.Popen(command,

722

close_fds=True,

723

shell=True, cwd="/",

724

**popen_args)

725

except OSError as error:

726

logger.error("Failed to start subprocess",

736

727

exc_info=error)

737

return True # Try again later

738

self.current_checker_command = command

739

logger.info("Starting checker %r for %s", command,

740

self.name)

741

# We don't need to redirect stdout and stderr, since

742

# in normal mode, that is already done by daemon(),

743

# and in debug mode we don't want to. (Stdin is

744

# always replaced by /dev/null.)

745

# The exception is when not debugging but nevertheless

746

# running in the foreground; use the previously

747

# created wnull.

748

popen_args = { "close_fds": True,

749

"shell": True,

750

"cwd": "/" }

751

if (not self.server_settings["debug"]

752

and self.server_settings["foreground"]):

753

popen_args.update({"stdout": wnull,

754

"stderr": wnull })

755

pipe = multiprocessing.Pipe(duplex = False)

756

self.checker = multiprocessing.Process(

757

target = call_pipe,

758

args = (pipe[1], subprocess.call, command),

759

kwargs = popen_args)

760

self.checker.start()

761

self.checker_callback_tag = gobject.io_add_watch(

762

pipe[0].fileno(), gobject.IO_IN,

763

self.checker_callback, pipe[0], command)

728

return True

729

self.checker_callback_tag = (gobject.child_watch_add

730

(self.checker.pid,

731

self.checker_callback,

732

data=command))

733

# The checker may have completed before the gobject

734

# watch was added. Check for this.

735

try:

736

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

737

except OSError as error:

738

if error.errno == errno.ECHILD:

739

# This should never happen

740

logger.error("Child process vanished",

741

exc_info=error)

742

return True

743

raise

744

if pid:

745

gobject.source_remove(self.checker_callback_tag)

746

self.checker_callback(pid, status, command)

764

747

# Re-run this periodically if run by gobject.timeout_add

765

748

return True

766

749

772

755

if getattr(self, "checker", None) is None:

773

756

return

774

757

logger.debug("Stopping checker for %(name)s", vars(self))

775

self.checker.terminate()

758

try:

759

self.checker.terminate()

760

#time.sleep(0.5)

761

#if self.checker.poll() is None:

762

# self.checker.kill()

763

except OSError as error:

764

if error.errno != errno.ESRCH: # No such process

765

raise

776

766

self.checker = None

777

767

778

768

779

def dbus_service_property(dbus_interface,

780

signature="v",

781

access="readwrite",

782

byte_arrays=False):

769

def dbus_service_property(dbus_interface, signature="v",

770

access="readwrite", byte_arrays=False):

783

771

"""Decorators for marking methods of a DBusObjectWithProperties to

784

772

become properties on the D-Bus.

785

773

795

783

if byte_arrays and signature != "ay":

796

784

raise ValueError("Byte arrays not supported for non-'ay'"

797

785

" signature {!r}".format(signature))

798

799

786

def decorator(func):

800

787

func._dbus_is_property = True

801

788

func._dbus_interface = dbus_interface

806

793

func._dbus_name = func._dbus_name[:-14]

807

794

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

808

795

return func

809

810

796

return decorator

811

797

812

798

821

807

"org.freedesktop.DBus.Property.EmitsChangedSignal":

822

808

"false"}

823

809

"""

824

825

810

def decorator(func):

826

811

func._dbus_is_interface = True

827

812

func._dbus_interface = dbus_interface

828

813

func._dbus_name = dbus_interface

829

814

return func

830

831

815

return decorator

832

816

833

817

842

826

access="r")

843

827

def Property_dbus_property(self):

844

828

return dbus.Boolean(False)

845

846

See also the DBusObjectWithAnnotations class.

847

829

"""

848

849

830

def decorator(func):

850

831

func._dbus_annotations = annotations

851

832

return func

852

853

833

return decorator

854

834

855

835

858

838

"""

859

839

pass

860

840

861

862

841

class DBusPropertyAccessException(DBusPropertyException):

863

842

"""A property's access permissions disallows an operation.

864

843

"""

871

850

pass

872

851

873

852

874

class DBusObjectWithAnnotations(dbus.service.Object):

875

"""A D-Bus object with annotations.

853

class DBusObjectWithProperties(dbus.service.Object):

854

"""A D-Bus object with properties.

876

855

877

Classes inheriting from this can use the dbus_annotations

878

decorator to add annotations to methods or signals.

856

Classes inheriting from this can use the dbus_service_property

857

decorator to expose methods as D-Bus properties. It exposes the

858

standard Get(), Set(), and GetAll() methods on the D-Bus.

879

859

"""

880

860

881

861

@staticmethod

891

871

def _get_all_dbus_things(self, thing):

892

872

"""Returns a generator of (name, attribute) pairs

893

873

"""

894

return ((getattr(athing.__get__(self), "_dbus_name", name),

874

return ((getattr(athing.__get__(self), "_dbus_name",

875

name),

895

876

athing.__get__(self))

896

877

for cls in self.__class__.__mro__

897

878

for name, athing in

898

inspect.getmembers(cls, self._is_dbus_thing(thing)))

899

900

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

901

out_signature = "s",

902

path_keyword = 'object_path',

903

connection_keyword = 'connection')

904

def Introspect(self, object_path, connection):

905

"""Overloading of standard D-Bus method.

906

907

Inserts annotation tags on methods and signals.

908

"""

909

xmlstring = dbus.service.Object.Introspect(self, object_path,

910

connection)

911

try:

912

document = xml.dom.minidom.parseString(xmlstring)

913

914

for if_tag in document.getElementsByTagName("interface"):

915

# Add annotation tags

916

for typ in ("method", "signal"):

917

for tag in if_tag.getElementsByTagName(typ):

918

annots = dict()

919

for name, prop in (self.

920

_get_all_dbus_things(typ)):

921

if (name == tag.getAttribute("name")

922

and prop._dbus_interface

923

== if_tag.getAttribute("name")):

924

annots.update(getattr(

925

prop, "_dbus_annotations", {}))

926

for name, value in annots.items():

927

ann_tag = document.createElement(

928

"annotation")

929

ann_tag.setAttribute("name", name)

930

ann_tag.setAttribute("value", value)

931

tag.appendChild(ann_tag)

932

# Add interface annotation tags

933

for annotation, value in dict(

934

itertools.chain.from_iterable(

935

annotations().items()

936

for name, annotations

937

in self._get_all_dbus_things("interface")

938

if name == if_tag.getAttribute("name")

939

)).items():

940

ann_tag = document.createElement("annotation")

941

ann_tag.setAttribute("name", annotation)

942

ann_tag.setAttribute("value", value)

943

if_tag.appendChild(ann_tag)

944

# Fix argument name for the Introspect method itself

945

if (if_tag.getAttribute("name")

946

== dbus.INTROSPECTABLE_IFACE):

947

for cn in if_tag.getElementsByTagName("method"):

948

if cn.getAttribute("name") == "Introspect":

949

for arg in cn.getElementsByTagName("arg"):

950

if (arg.getAttribute("direction")

951

== "out"):

952

arg.setAttribute("name",

953

"xml_data")

954

xmlstring = document.toxml("utf-8")

955

document.unlink()

956

except (AttributeError, xml.dom.DOMException,

957

xml.parsers.expat.ExpatError) as error:

958

logger.error("Failed to override Introspection method",

959

exc_info=error)

960

return xmlstring

961

962

963

class DBusObjectWithProperties(DBusObjectWithAnnotations):

964

"""A D-Bus object with properties.

965

966

Classes inheriting from this can use the dbus_service_property

967

decorator to expose methods as D-Bus properties. It exposes the

968

standard Get(), Set(), and GetAll() methods on the D-Bus.

969

"""

879

inspect.getmembers(cls,

880

self._is_dbus_thing(thing)))

970

881

971

882

def _get_dbus_property(self, interface_name, property_name):

972

883

"""Returns a bound method if one exists which is a D-Bus

973

884

property with the specified name and interface.

974

885

"""

975

for cls in self.__class__.__mro__:

976

for name, value in inspect.getmembers(

977

cls, self._is_dbus_thing("property")):

886

for cls in self.__class__.__mro__:

887

for name, value in (inspect.getmembers

888

(cls,

889

self._is_dbus_thing("property"))):

978

890

if (value._dbus_name == property_name

979

891

and value._dbus_interface == interface_name):

980

892

return value.__get__(self)

981

893

982

894

# No such property

983

raise DBusPropertyNotFound("{}:{}.{}".format(

984

self.dbus_object_path, interface_name, property_name))

985

986

@classmethod

987

def _get_all_interface_names(cls):

988

"""Get a sequence of all interfaces supported by an object"""

989

return (name for name in set(getattr(getattr(x, attr),

990

"_dbus_interface", None)

991

for x in (inspect.getmro(cls))

992

for attr in dir(x))

993

if name is not None)

994

995

@dbus.service.method(dbus.PROPERTIES_IFACE,

996

in_signature="ss",

895

raise DBusPropertyNotFound(self.dbus_object_path + ":"

896

+ interface_name + "."

897

+ property_name)

898

899

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

997

900

out_signature="v")

998

901

def Get(self, interface_name, property_name):

999

902

"""Standard D-Bus property Get() method, see D-Bus standard.

1024

927

for byte in value))

1025

928

prop(value)

1026

929

1027

@dbus.service.method(dbus.PROPERTIES_IFACE,

1028

in_signature="s",

930

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

1029

931

out_signature="a{sv}")

1030

932

def GetAll(self, interface_name):

1031

933

"""Standard D-Bus property GetAll() method, see D-Bus

1046

948

if not hasattr(value, "variant_level"):

1047

949

properties[name] = value

1048

950

continue

1049

properties[name] = type(value)(

1050

value, variant_level = value.variant_level + 1)

951

properties[name] = type(value)(value, variant_level=

952

value.variant_level+1)

1051

953

return dbus.Dictionary(properties, signature="sv")

1052

954

1053

955

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

1067

969

1068

970

Inserts property tags and interface annotation tags.

1069

971

"""

1070

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1071

object_path,

1072

connection)

972

xmlstring = dbus.service.Object.Introspect(self, object_path,

973

connection)

1073

974

try:

1074

975

document = xml.dom.minidom.parseString(xmlstring)

1075

1076

976

def make_tag(document, name, prop):

1077

977

e = document.createElement("property")

1078

978

e.setAttribute("name", name)

1079

979

e.setAttribute("type", prop._dbus_signature)

1080

980

e.setAttribute("access", prop._dbus_access)

1081

981

return e

1082

1083

982

for if_tag in document.getElementsByTagName("interface"):

1084

983

# Add property tags

1085

984

for tag in (make_tag(document, name, prop)

1088

987

if prop._dbus_interface

1089

988

== if_tag.getAttribute("name")):

1090

989

if_tag.appendChild(tag)

1091

# Add annotation tags for properties

1092

for tag in if_tag.getElementsByTagName("property"):

1093

annots = dict()

1094

for name, prop in self._get_all_dbus_things(

1095

"property"):

1096

if (name == tag.getAttribute("name")

1097

and prop._dbus_interface

1098

== if_tag.getAttribute("name")):

1099

annots.update(getattr(

1100

prop, "_dbus_annotations", {}))

1101

for name, value in annots.items():

1102

ann_tag = document.createElement(

1103

"annotation")

1104

ann_tag.setAttribute("name", name)

1105

ann_tag.setAttribute("value", value)

1106

tag.appendChild(ann_tag)

990

# Add annotation tags

991

for typ in ("method", "signal", "property"):

992

for tag in if_tag.getElementsByTagName(typ):

993

annots = dict()

994

for name, prop in (self.

995

_get_all_dbus_things(typ)):

996

if (name == tag.getAttribute("name")

997

and prop._dbus_interface

998

== if_tag.getAttribute("name")):

999

annots.update(getattr

1000

(prop,

1001

"_dbus_annotations",

1002

{}))

1003

for name, value in annots.items():

1004

ann_tag = document.createElement(

1005

"annotation")

1006

ann_tag.setAttribute("name", name)

1007

ann_tag.setAttribute("value", value)

1008

tag.appendChild(ann_tag)

1009

# Add interface annotation tags

1010

for annotation, value in dict(

1011

itertools.chain.from_iterable(

1012

annotations().items()

1013

for name, annotations in

1014

self._get_all_dbus_things("interface")

1015

if name == if_tag.getAttribute("name")

1016

)).items():

1017

ann_tag = document.createElement("annotation")

1018

ann_tag.setAttribute("name", annotation)

1019

ann_tag.setAttribute("value", value)

1020

if_tag.appendChild(ann_tag)

1107

1021

# Add the names to the return values for the

1108

1022

# "org.freedesktop.DBus.Properties" methods

1109

1023

if (if_tag.getAttribute("name")

1127

1041

exc_info=error)

1128

1042

return xmlstring

1129

1043

1130

try:

1131

dbus.OBJECT_MANAGER_IFACE

1132

except AttributeError:

1133

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1134

1135

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1136

"""A D-Bus object with an ObjectManager.

1137

1138

Classes inheriting from this exposes the standard

1139

GetManagedObjects call and the InterfacesAdded and

1140

InterfacesRemoved signals on the standard

1141

"org.freedesktop.DBus.ObjectManager" interface.

1142

1143

Note: No signals are sent automatically; they must be sent

1144

manually.

1145

"""

1146

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1147

out_signature = "a{oa{sa{sv}}}")

1148

def GetManagedObjects(self):

1149

"""This function must be overridden"""

1150

raise NotImplementedError()

1151

1152

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1153

signature = "oa{sa{sv}}")

1154

def InterfacesAdded(self, object_path, interfaces_and_properties):

1155

pass

1156

1157

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1158

signature = "oas")

1159

def InterfacesRemoved(self, object_path, interfaces):

1160

pass

1161

1162

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1163

out_signature = "s",

1164

path_keyword = 'object_path',

1165

connection_keyword = 'connection')

1166

def Introspect(self, object_path, connection):

1167

"""Overloading of standard D-Bus method.

1168

1169

Override return argument name of GetManagedObjects to be

1170

"objpath_interfaces_and_properties"

1171

"""

1172

xmlstring = DBusObjectWithAnnotations(self, object_path,

1173

connection)

1174

try:

1175

document = xml.dom.minidom.parseString(xmlstring)

1176

1177

for if_tag in document.getElementsByTagName("interface"):

1178

# Fix argument name for the GetManagedObjects method

1179

if (if_tag.getAttribute("name")

1180

== dbus.OBJECT_MANAGER_IFACE):

1181

for cn in if_tag.getElementsByTagName("method"):

1182

if (cn.getAttribute("name")

1183

== "GetManagedObjects"):

1184

for arg in cn.getElementsByTagName("arg"):

1185

if (arg.getAttribute("direction")

1186

== "out"):

1187

arg.setAttribute(

1188

"name",

1189

"objpath_interfaces"

1190

"_and_properties")

1191

xmlstring = document.toxml("utf-8")

1192

document.unlink()

1193

except (AttributeError, xml.dom.DOMException,

1194

xml.parsers.expat.ExpatError) as error:

1195

logger.error("Failed to override Introspection method",

1196

exc_info = error)

1197

return xmlstring

1198

1044

1199

1045

def datetime_to_dbus(dt, variant_level=0):

1200

1046

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1201

1047

if dt is None:

1202

1048

return dbus.String("", variant_level = variant_level)

1203

return dbus.String(dt.isoformat(), variant_level=variant_level)

1049

return dbus.String(dt.isoformat(),

1050

variant_level=variant_level)

1204

1051

1205

1052

1206

1053

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1226

1073

(from DBusObjectWithProperties) and interfaces (from the

1227

1074

dbus_interface_annotations decorator).

1228

1075

"""

1229

1230

1076

def wrapper(cls):

1231

1077

for orig_interface_name, alt_interface_name in (

1232

alt_interface_names.items()):

1078

alt_interface_names.items()):

1233

1079

attr = {}

1234

1080

interface_names = set()

1235

1081

# Go though all attributes of the class

1237

1083

# Ignore non-D-Bus attributes, and D-Bus attributes

1238

1084

# with the wrong interface name

1239

1085

if (not hasattr(attribute, "_dbus_interface")

1240

or not attribute._dbus_interface.startswith(

1241

orig_interface_name)):

1086

or not attribute._dbus_interface

1087

.startswith(orig_interface_name)):

1242

1088

continue

1243

1089

# Create an alternate D-Bus interface name based on

1244

1090

# the current name

1245

alt_interface = attribute._dbus_interface.replace(

1246

orig_interface_name, alt_interface_name)

1091

alt_interface = (attribute._dbus_interface

1092

.replace(orig_interface_name,

1093

alt_interface_name))

1247

1094

interface_names.add(alt_interface)

1248

1095

# Is this a D-Bus signal?

1249

1096

if getattr(attribute, "_dbus_is_signal", False):

1250

if sys.version_info.major == 2:

1251

# Extract the original non-method undecorated

1252

# function by black magic

1253

nonmethod_func = (dict(

1097

# Extract the original non-method undecorated

1098

# function by black magic

1099

nonmethod_func = (dict(

1254

1100

zip(attribute.func_code.co_freevars,

1255

attribute.__closure__))

1256

["func"].cell_contents)

1257

else:

1258

nonmethod_func = attribute

1101

attribute.__closure__))["func"]

1102

.cell_contents)

1259

1103

# Create a new, but exactly alike, function

1260

1104

# object, and decorate it to be a new D-Bus signal

1261

1105

# with the alternate D-Bus interface name

1262

if sys.version_info.major == 2:

1263

new_function = types.FunctionType(

1264

nonmethod_func.func_code,

1265

nonmethod_func.func_globals,

1266

nonmethod_func.func_name,

1267

nonmethod_func.func_defaults,

1268

nonmethod_func.func_closure)

1269

else:

1270

new_function = types.FunctionType(

1271

nonmethod_func.__code__,

1272

nonmethod_func.__globals__,

1273

nonmethod_func.__name__,

1274

nonmethod_func.__defaults__,

1275

nonmethod_func.__closure__)

1276

new_function = (dbus.service.signal(

1277

alt_interface,

1278

attribute._dbus_signature)(new_function))

1106

new_function = (dbus.service.signal

1107

(alt_interface,

1108

attribute._dbus_signature)

1109

(types.FunctionType(

1110

nonmethod_func.func_code,

1111

nonmethod_func.func_globals,

1112

nonmethod_func.func_name,

1113

nonmethod_func.func_defaults,

1114

nonmethod_func.func_closure)))

1279

1115

# Copy annotations, if any

1280

1116

try:

1281

new_function._dbus_annotations = dict(

1282

attribute._dbus_annotations)

1117

new_function._dbus_annotations = (

1118

dict(attribute._dbus_annotations))

1283

1119

except AttributeError:

1284

1120

pass

1285

1121

# Define a creator of a function to call both the

1290

1126

"""This function is a scope container to pass

1291

1127

func1 and func2 to the "call_both" function

1292

1128

outside of its arguments"""

1293

1294

1129

def call_both(*args, **kwargs):

1295

1130

"""This function will emit two D-Bus

1296

1131

signals by calling func1 and func2"""

1297

1132

func1(*args, **kwargs)

1298

1133

func2(*args, **kwargs)

1299

1300

1134

return call_both

1301

1135

# Create the "call_both" function and add it to

1302

1136

# the class

1307

1141

# object. Decorate it to be a new D-Bus method

1308

1142

# with the alternate D-Bus interface name. Add it

1309

1143

# to the class.

1310

attr[attrname] = (

1311

dbus.service.method(

1312

alt_interface,

1313

attribute._dbus_in_signature,

1314

attribute._dbus_out_signature)

1315

(types.FunctionType(attribute.func_code,

1316

attribute.func_globals,

1317

attribute.func_name,

1318

attribute.func_defaults,

1319

attribute.func_closure)))

1144

attr[attrname] = (dbus.service.method

1145

(alt_interface,

1146

attribute._dbus_in_signature,

1147

attribute._dbus_out_signature)

1148

(types.FunctionType

1149

(attribute.func_code,

1150

attribute.func_globals,

1151

attribute.func_name,

1152

attribute.func_defaults,

1153

attribute.func_closure)))

1320

1154

# Copy annotations, if any

1321

1155

try:

1322

attr[attrname]._dbus_annotations = dict(

1323

attribute._dbus_annotations)

1156

attr[attrname]._dbus_annotations = (

1157

dict(attribute._dbus_annotations))

1324

1158

except AttributeError:

1325

1159

pass

1326

1160

# Is this a D-Bus property?

1329

1163

# object, and decorate it to be a new D-Bus

1330

1164

# property with the alternate D-Bus interface

1331

1165

# name. Add it to the class.

1332

attr[attrname] = (dbus_service_property(

1333

alt_interface, attribute._dbus_signature,

1334

attribute._dbus_access,

1335

attribute._dbus_get_args_options

1336

["byte_arrays"])

1337

(types.FunctionType(

1338

attribute.func_code,

1339

attribute.func_globals,

1340

attribute.func_name,

1341

attribute.func_defaults,

1342

attribute.func_closure)))

1166

attr[attrname] = (dbus_service_property

1167

(alt_interface,

1168

attribute._dbus_signature,

1169

attribute._dbus_access,

1170

attribute

1171

._dbus_get_args_options

1172

["byte_arrays"])

1173

(types.FunctionType

1174

(attribute.func_code,

1175

attribute.func_globals,

1176

attribute.func_name,

1177

attribute.func_defaults,

1178

attribute.func_closure)))

1343

1179

# Copy annotations, if any

1344

1180

try:

1345

attr[attrname]._dbus_annotations = dict(

1346

attribute._dbus_annotations)

1181

attr[attrname]._dbus_annotations = (

1182

dict(attribute._dbus_annotations))

1347

1183

except AttributeError:

1348

1184

pass

1349

1185

# Is this a D-Bus interface?

1352

1188

# object. Decorate it to be a new D-Bus interface

1353

1189

# with the alternate D-Bus interface name. Add it

1354

1190

# to the class.

1355

attr[attrname] = (

1356

dbus_interface_annotations(alt_interface)

1357

(types.FunctionType(attribute.func_code,

1358

attribute.func_globals,

1359

attribute.func_name,

1360

attribute.func_defaults,

1361

attribute.func_closure)))

1191

attr[attrname] = (dbus_interface_annotations

1192

(alt_interface)

1193

(types.FunctionType

1194

(attribute.func_code,

1195

attribute.func_globals,

1196

attribute.func_name,

1197

attribute.func_defaults,

1198

attribute.func_closure)))

1362

1199

if deprecate:

1363

1200

# Deprecate all alternate interfaces

1364

1201

iname="_AlternateDBusNames_interface_annotation{}"

1365

1202

for interface_name in interface_names:

1366

1367

1203

@dbus_interface_annotations(interface_name)

1368

1204

def func(self):

1369

1205

return { "org.freedesktop.DBus.Deprecated":

1370

"true" }

1206

"true" }

1371

1207

# Find an unused name

1372

1208

for aname in (iname.format(i)

1373

1209

for i in itertools.count()):

1378

1214

# Replace the class with a new subclass of it with

1379

1215

# methods, signals, etc. as created above.

1380

1216

cls = type(b"{}Alternate".format(cls.__name__),

1381

(cls, ), attr)

1217

(cls,), attr)

1382

1218

return cls

1383

1384

1219

return wrapper

1385

1220

1386

1221

1387

1222

@alternate_dbus_interfaces({"se.recompile.Mandos":

1388

"se.bsnet.fukt.Mandos"})

1223

"se.bsnet.fukt.Mandos"})

1389

1224

class ClientDBus(Client, DBusObjectWithProperties):

1390

1225

"""A Client class using D-Bus

1391

1226

1395

1230

"""

1396

1231

1397

1232

runtime_expansions = (Client.runtime_expansions

1398

+ ("dbus_object_path", ))

1233

+ ("dbus_object_path",))

1399

1234

1400

1235

_interface = "se.recompile.Mandos.Client"

1401

1236

1409

1244

client_object_name = str(self.name).translate(

1410

1245

{ord("."): ord("_"),

1411

1246

ord("-"): ord("_")})

1412

self.dbus_object_path = dbus.ObjectPath(

1413

"/clients/" + client_object_name)

1247

self.dbus_object_path = (dbus.ObjectPath

1248

("/clients/" + client_object_name))

1414

1249

DBusObjectWithProperties.__init__(self, self.bus,

1415

1250

self.dbus_object_path)

1416

1251

1417

def notifychangeproperty(transform_func, dbus_name,

1418

type_func=lambda x: x,

1419

variant_level=1,

1420

invalidate_only=False,

1252

def notifychangeproperty(transform_func,

1253

dbus_name, type_func=lambda x: x,

1254

variant_level=1, invalidate_only=False,

1421

1255

_interface=_interface):

1422

1256

""" Modify a variable so that it's a property which announces

1423

1257

its changes to DBus.

1430

1264

variant_level: D-Bus variant level. Default: 1

1431

1265

"""

1432

1266

attrname = "_{}".format(dbus_name)

1433

1434

1267

def setter(self, value):

1435

1268

if hasattr(self, "dbus_object_path"):

1436

1269

if (not hasattr(self, attrname) or

1437

1270

type_func(getattr(self, attrname, None))

1438

1271

!= type_func(value)):

1439

1272

if invalidate_only:

1440

self.PropertiesChanged(

1441

_interface, dbus.Dictionary(),

1442

dbus.Array((dbus_name, )))

1273

self.PropertiesChanged(_interface,

1274

dbus.Dictionary(),

1275

dbus.Array

1276

((dbus_name,)))

1443

1277

else:

1444

dbus_value = transform_func(

1445

type_func(value),

1446

variant_level = variant_level)

1278

dbus_value = transform_func(type_func(value),

1279

variant_level

1280

=variant_level)

1447

1281

self.PropertyChanged(dbus.String(dbus_name),

1448

1282

dbus_value)

1449

self.PropertiesChanged(

1450

_interface,

1451

dbus.Dictionary({ dbus.String(dbus_name):

1452

dbus_value }),

1453

dbus.Array())

1283

self.PropertiesChanged(_interface,

1284

dbus.Dictionary({

1285

dbus.String(dbus_name):

1286

dbus_value }), dbus.Array())

1454

1287

setattr(self, attrname, value)

1455

1288

1456

1289

return property(lambda self: getattr(self, attrname), setter)

1462

1295

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1463

1296

last_enabled = notifychangeproperty(datetime_to_dbus,

1464

1297

"LastEnabled")

1465

checker = notifychangeproperty(

1466

dbus.Boolean, "CheckerRunning",

1467

type_func = lambda checker: checker is not None)

1298

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1299

type_func = lambda checker:

1300

checker is not None)

1468

1301

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1469

1302

"LastCheckedOK")

1470

1303

last_checker_status = notifychangeproperty(dbus.Int16,

1473

1306

datetime_to_dbus, "LastApprovalRequest")

1474

1307

approved_by_default = notifychangeproperty(dbus.Boolean,

1475

1308

"ApprovedByDefault")

1476

approval_delay = notifychangeproperty(

1477

dbus.UInt64, "ApprovalDelay",

1478

type_func = lambda td: td.total_seconds() * 1000)

1309

approval_delay = notifychangeproperty(dbus.UInt64,

1310

"ApprovalDelay",

1311

type_func =

1312

lambda td: td.total_seconds()

1313

* 1000)

1479

1314

approval_duration = notifychangeproperty(

1480

1315

dbus.UInt64, "ApprovalDuration",

1481

1316

type_func = lambda td: td.total_seconds() * 1000)

1482

1317

host = notifychangeproperty(dbus.String, "Host")

1483

timeout = notifychangeproperty(

1484

dbus.UInt64, "Timeout",

1485

type_func = lambda td: td.total_seconds() * 1000)

1318

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1319

type_func = lambda td:

1320

td.total_seconds() * 1000)

1486

1321

extended_timeout = notifychangeproperty(

1487

1322

dbus.UInt64, "ExtendedTimeout",

1488

1323

type_func = lambda td: td.total_seconds() * 1000)

1489

interval = notifychangeproperty(

1490

dbus.UInt64, "Interval",

1491

type_func = lambda td: td.total_seconds() * 1000)

1324

interval = notifychangeproperty(dbus.UInt64,

1325

"Interval",

1326

type_func =

1327

lambda td: td.total_seconds()

1328

* 1000)

1492

1329

checker_command = notifychangeproperty(dbus.String, "Checker")

1493

1330

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1494

1331

invalidate_only=True)

1504

1341

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1505

1342

Client.__del__(self, *args, **kwargs)

1506

1343

1507

def checker_callback(self, source, condition,

1508

connection, command, *args, **kwargs):

1509

ret = Client.checker_callback(self, source, condition,

1510

connection, command, *args,

1511

**kwargs)

1512

exitstatus = self.last_checker_status

1513

if exitstatus >= 0:

1344

def checker_callback(self, pid, condition, command,

1345

*args, **kwargs):

1346

self.checker_callback_tag = None

1347

self.checker = None

1348

if os.WIFEXITED(condition):

1349

exitstatus = os.WEXITSTATUS(condition)

1514

1350

# Emit D-Bus signal

1515

1351

self.CheckerCompleted(dbus.Int16(exitstatus),

1516

# This is specific to GNU libC

1517

dbus.Int64(exitstatus << 8),

1352

dbus.Int64(condition),

1518

1353

dbus.String(command))

1519

1354

else:

1520

1355

# Emit D-Bus signal

1521

1356

self.CheckerCompleted(dbus.Int16(-1),

1522

dbus.Int64(

1523

# This is specific to GNU libC

1524

(exitstatus << 8)

1525

| self.last_checker_signal),

1357

dbus.Int64(condition),

1526

1358

dbus.String(command))

1527

return ret

1359

1360

return Client.checker_callback(self, pid, condition, command,

1361

*args, **kwargs)

1528

1362

1529

1363

def start_checker(self, *args, **kwargs):

1530

1364

old_checker_pid = getattr(self.checker, "pid", None)

1605

1439

self.checked_ok()

1606

1440

1607

1441

# Enable - method

1608

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1609

1442

@dbus.service.method(_interface)

1610

1443

def Enable(self):

1611

1444

"D-Bus method"

1612

1445

self.enable()

1613

1446

1614

1447

# StartChecker - method

1615

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1616

1448

@dbus.service.method(_interface)

1617

1449

def StartChecker(self):

1618

1450

"D-Bus method"

1619

1451

self.start_checker()

1620

1452

1621

1453

# Disable - method

1622

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1623

1454

@dbus.service.method(_interface)

1624

1455

def Disable(self):

1625

1456

"D-Bus method"

1626

1457

self.disable()

1627

1458

1628

1459

# StopChecker - method

1629

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1630

1460

@dbus.service.method(_interface)

1631

1461

def StopChecker(self):

1632

1462

self.stop_checker()

1639

1469

return dbus.Boolean(bool(self.approvals_pending))

1640

1470

1641

1471

# ApprovedByDefault - property

1642

@dbus_service_property(_interface,

1643

signature="b",

1472

@dbus_service_property(_interface, signature="b",

1644

1473

access="readwrite")

1645

1474

def ApprovedByDefault_dbus_property(self, value=None):

1646

1475

if value is None: # get

1648

1477

self.approved_by_default = bool(value)

1649

1478

1650

1479

# ApprovalDelay - property

1651

@dbus_service_property(_interface,

1652

signature="t",

1480

@dbus_service_property(_interface, signature="t",

1653

1481

access="readwrite")

1654

1482

def ApprovalDelay_dbus_property(self, value=None):

1655

1483

if value is None: # get

1658

1486

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1659

1487

1660

1488

# ApprovalDuration - property

1661

@dbus_service_property(_interface,

1662

signature="t",

1489

@dbus_service_property(_interface, signature="t",

1663

1490

access="readwrite")

1664

1491

def ApprovalDuration_dbus_property(self, value=None):

1665

1492

if value is None: # get

1668

1495

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1669

1496

1670

1497

# Name - property

1671

@dbus_annotations(

1672

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1673

1498

@dbus_service_property(_interface, signature="s", access="read")

1674

1499

def Name_dbus_property(self):

1675

1500

return dbus.String(self.name)

1676

1501

1677

1502

# Fingerprint - property

1678

@dbus_annotations(

1679

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1680

1503

@dbus_service_property(_interface, signature="s", access="read")

1681

1504

def Fingerprint_dbus_property(self):

1682

1505

return dbus.String(self.fingerprint)

1683

1506

1684

1507

# Host - property

1685

@dbus_service_property(_interface,

1686

signature="s",

1508

@dbus_service_property(_interface, signature="s",

1687

1509

access="readwrite")

1688

1510

def Host_dbus_property(self, value=None):

1689

1511

if value is None: # get

1691

1513

self.host = str(value)

1692

1514

1693

1515

# Created - property

1694

@dbus_annotations(

1695

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1696

1516

@dbus_service_property(_interface, signature="s", access="read")

1697

1517

def Created_dbus_property(self):

1698

1518

return datetime_to_dbus(self.created)

1703

1523

return datetime_to_dbus(self.last_enabled)

1704

1524

1705

1525

# Enabled - property

1706

@dbus_service_property(_interface,

1707

signature="b",

1526

@dbus_service_property(_interface, signature="b",

1708

1527

access="readwrite")

1709

1528

def Enabled_dbus_property(self, value=None):

1710

1529

if value is None: # get

1715

1534

self.disable()

1716

1535

1717

1536

# LastCheckedOK - property

1718

@dbus_service_property(_interface,

1719

signature="s",

1537

@dbus_service_property(_interface, signature="s",

1720

1538

access="readwrite")

1721

1539

def LastCheckedOK_dbus_property(self, value=None):

1722

1540

if value is not None:

1725

1543

return datetime_to_dbus(self.last_checked_ok)

1726

1544

1727

1545

# LastCheckerStatus - property

1728

@dbus_service_property(_interface, signature="n", access="read")

1546

@dbus_service_property(_interface, signature="n",

1547

access="read")

1729

1548

def LastCheckerStatus_dbus_property(self):

1730

1549

return dbus.Int16(self.last_checker_status)

1731

1550

1740

1559

return datetime_to_dbus(self.last_approval_request)

1741

1560

1742

1561

# Timeout - property

1743

@dbus_service_property(_interface,

1744

signature="t",

1562

@dbus_service_property(_interface, signature="t",

1745

1563

access="readwrite")

1746

1564

def Timeout_dbus_property(self, value=None):

1747

1565

if value is None: # get

1760

1578

is None):

1761

1579

return

1762

1580

gobject.source_remove(self.disable_initiator_tag)

1763

self.disable_initiator_tag = gobject.timeout_add(

1764

int((self.expires - now).total_seconds() * 1000),

1765

self.disable)

1581

self.disable_initiator_tag = (

1582

gobject.timeout_add(

1583

int((self.expires - now).total_seconds()

1584

* 1000), self.disable))

1766

1585

1767

1586

# ExtendedTimeout - property

1768

@dbus_service_property(_interface,

1769

signature="t",

1587

@dbus_service_property(_interface, signature="t",

1770

1588

access="readwrite")

1771

1589

def ExtendedTimeout_dbus_property(self, value=None):

1772

1590

if value is None: # get

1775

1593

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1776

1594

1777

1595

# Interval - property

1778

@dbus_service_property(_interface,

1779

signature="t",

1596

@dbus_service_property(_interface, signature="t",

1780

1597

access="readwrite")

1781

1598

def Interval_dbus_property(self, value=None):

1782

1599

if value is None: # get

1787

1604

if self.enabled:

1788

1605

# Reschedule checker run

1789

1606

gobject.source_remove(self.checker_initiator_tag)

1790

self.checker_initiator_tag = gobject.timeout_add(

1791

value, self.start_checker)

1792

self.start_checker() # Start one now, too

1607

self.checker_initiator_tag = (gobject.timeout_add

1608

(value, self.start_checker))

1609

self.start_checker() # Start one now, too

1793

1610

1794

1611

# Checker - property

1795

@dbus_service_property(_interface,

1796

signature="s",

1612

@dbus_service_property(_interface, signature="s",

1797

1613

access="readwrite")

1798

1614

def Checker_dbus_property(self, value=None):

1799

1615

if value is None: # get

1801

1617

self.checker_command = str(value)

1802

1618

1803

1619

# CheckerRunning - property

1804

@dbus_service_property(_interface,

1805

signature="b",

1620

@dbus_service_property(_interface, signature="b",

1806

1621

access="readwrite")

1807

1622

def CheckerRunning_dbus_property(self, value=None):

1808

1623

if value is None: # get

1813

1628

self.stop_checker()

1814

1629

1815

1630

# ObjectPath - property

1816

@dbus_annotations(

1817

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

1818

"org.freedesktop.DBus.Deprecated": "true"})

1819

1631

@dbus_service_property(_interface, signature="o", access="read")

1820

1632

def ObjectPath_dbus_property(self):

1821

1633

return self.dbus_object_path # is already a dbus.ObjectPath

1822

1634

1823

1635

# Secret = property

1824

@dbus_annotations(

1825

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

1826

"invalidates"})

1827

@dbus_service_property(_interface,

1828

signature="ay",

1829

access="write",

1830

byte_arrays=True)

1636

@dbus_service_property(_interface, signature="ay",

1637

access="write", byte_arrays=True)

1831

1638

def Secret_dbus_property(self, value):

1832

1639

self.secret = bytes(value)

1833

1640

1839

1646

self._pipe = child_pipe

1840

1647

self._pipe.send(('init', fpr, address))

1841

1648

if not self._pipe.recv():

1842

raise KeyError(fpr)

1649

raise KeyError()

1843

1650

1844

1651

def __getattribute__(self, name):

1845

1652

if name == '_pipe':

1849

1656

if data[0] == 'data':

1850

1657

return data[1]

1851

1658

if data[0] == 'function':

1852

1853

1659

def func(*args, **kwargs):

1854

1660

self._pipe.send(('funcall', name, args, kwargs))

1855

1661

return self._pipe.recv()[1]

1856

1857

1662

return func

1858

1663

1859

1664

def __setattr__(self, name, value):

1875

1680

logger.debug("Pipe FD: %d",

1876

1681

self.server.child_pipe.fileno())

1877

1682

1878

session = gnutls.connection.ClientSession(

1879

self.request, gnutls.connection .X509Credentials())

1683

session = (gnutls.connection

1684

.ClientSession(self.request,

1685

gnutls.connection

1686

.X509Credentials()))

1880

1687

1881

1688

# Note: gnutls.connection.X509Credentials is really a

1882

1689

# generic GnuTLS certificate credentials object so long as

1891

1698

priority = self.server.gnutls_priority

1892

1699

if priority is None:

1893

1700

priority = "NORMAL"

1894

gnutls.library.functions.gnutls_priority_set_direct(

1895

session._c_object, priority, None)

1701

(gnutls.library.functions

1702

.gnutls_priority_set_direct(session._c_object,

1703

priority, None))

1896

1704

1897

1705

# Start communication using the Mandos protocol

1898

1706

# Get protocol number

1918

1726

approval_required = False

1919

1727

try:

1920

1728

try:

1921

fpr = self.fingerprint(

1922

self.peer_certificate(session))

1729

fpr = self.fingerprint(self.peer_certificate

1730

(session))

1923

1731

except (TypeError,

1924

1732

gnutls.errors.GNUTLSError) as error:

1925

1733

logger.warning("Bad certificate: %s", error)

1940

1748

while True:

1941

1749

if not client.enabled:

1942

1750

logger.info("Client %s is disabled",

1943

client.name)

1751

client.name)

1944

1752

if self.server.use_dbus:

1945

1753

# Emit D-Bus signal

1946

1754

client.Rejected("Disabled")

1993

1801

logger.warning("gnutls send failed",

1994

1802

exc_info=error)

1995

1803

return

1996

logger.debug("Sent: %d, remaining: %d", sent,

1997

len(client.secret) - (sent_size

1998

+ sent))

1804

logger.debug("Sent: %d, remaining: %d",

1805

sent, len(client.secret)

1806

- (sent_size + sent))

1999

1807

sent_size += sent

2000

1808

2001

1809

logger.info("Sending secret to %s", client.name)

2018

1826

def peer_certificate(session):

2019

1827

"Return the peer's OpenPGP certificate as a bytestring"

2020

1828

# If not an OpenPGP certificate...

2021

if (gnutls.library.functions.gnutls_certificate_type_get(

2022

session._c_object)

1829

if (gnutls.library.functions

1830

.gnutls_certificate_type_get(session._c_object)

2023

1831

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

2024

1832

# ...do the normal thing

2025

1833

return session.peer_certificate

2039

1847

def fingerprint(openpgp):

2040

1848

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2041

1849

# New GnuTLS "datum" with the OpenPGP public key

2042

datum = gnutls.library.types.gnutls_datum_t(

2043

ctypes.cast(ctypes.c_char_p(openpgp),

2044

ctypes.POINTER(ctypes.c_ubyte)),

2045

ctypes.c_uint(len(openpgp)))

1850

datum = (gnutls.library.types

1851

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1852

ctypes.POINTER

1853

(ctypes.c_ubyte)),

1854

ctypes.c_uint(len(openpgp))))

2046

1855

# New empty GnuTLS certificate

2047

1856

crt = gnutls.library.types.gnutls_openpgp_crt_t()

2048

gnutls.library.functions.gnutls_openpgp_crt_init(

2049

ctypes.byref(crt))

1857

(gnutls.library.functions

1858

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

2050

1859

# Import the OpenPGP public key into the certificate

2051

gnutls.library.functions.gnutls_openpgp_crt_import(

2052

crt, ctypes.byref(datum),

2053

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1860

(gnutls.library.functions

1861

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1862

gnutls.library.constants

1863

.GNUTLS_OPENPGP_FMT_RAW))

2054

1864

# Verify the self signature in the key

2055

1865

crtverify = ctypes.c_uint()

2056

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

2057

crt, 0, ctypes.byref(crtverify))

1866

(gnutls.library.functions

1867

.gnutls_openpgp_crt_verify_self(crt, 0,

1868

ctypes.byref(crtverify)))

2058

1869

if crtverify.value != 0:

2059

1870

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2060

raise gnutls.errors.CertificateSecurityError(

2061

"Verify failed")

1871

raise (gnutls.errors.CertificateSecurityError

1872

("Verify failed"))

2062

1873

# New buffer for the fingerprint

2063

1874

buf = ctypes.create_string_buffer(20)

2064

1875

buf_len = ctypes.c_size_t()

2065

1876

# Get the fingerprint from the certificate into the buffer

2066

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

2067

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1877

(gnutls.library.functions

1878

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1879

ctypes.byref(buf_len)))

2068

1880

# Deinit the certificate

2069

1881

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2070

1882

# Convert the buffer to a Python bytestring

2076

1888

2077

1889

class MultiprocessingMixIn(object):

2078

1890

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

2079

2080

1891

def sub_process_main(self, request, address):

2081

1892

try:

2082

1893

self.finish_request(request, address)

2094

1905

2095

1906

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

2096

1907

""" adds a pipe to the MixIn """

2097

2098

1908

def process_request(self, request, client_address):

2099

1909

"""Overrides and wraps the original process_request().

2100

1910

2121

1931

interface: None or a network interface name (string)

2122

1932

use_ipv6: Boolean; to use IPv6 or not

2123

1933

"""

2124

2125

1934

def __init__(self, server_address, RequestHandlerClass,

2126

interface=None,

2127

use_ipv6=True,

2128

socketfd=None):

1935

interface=None, use_ipv6=True, socketfd=None):

2129

1936

"""If socketfd is set, use that file descriptor instead of

2130

1937

creating a new one with socket.socket().

2131

1938

"""

2172

1979

self.interface)

2173

1980

else:

2174

1981

try:

2175

self.socket.setsockopt(

2176

socket.SOL_SOCKET, SO_BINDTODEVICE,

2177

(self.interface + "\0").encode("utf-8"))

1982

self.socket.setsockopt(socket.SOL_SOCKET,

1983

SO_BINDTODEVICE,

1984

(self.interface + "\0")

1985

.encode("utf-8"))

2178

1986

except socket.error as error:

2179

1987

if error.errno == errno.EPERM:

2180

1988

logger.error("No permission to bind to"

2198

2006

self.server_address = (any_address,

2199

2007

self.server_address[1])

2200

2008

elif not self.server_address[1]:

2201

self.server_address = (self.server_address[0], 0)

2009

self.server_address = (self.server_address[0],

2010

0)

2202

2011

# if self.interface:

2203

2012

# self.server_address = (self.server_address[0],

2204

2013

# 0, # port

2218

2027

2219

2028

Assumes a gobject.MainLoop event loop.

2220

2029

"""

2221

2222

2030

def __init__(self, server_address, RequestHandlerClass,

2223

interface=None,

2224

use_ipv6=True,

2225

clients=None,

2226

gnutls_priority=None,

2227

use_dbus=True,

2228

socketfd=None):

2031

interface=None, use_ipv6=True, clients=None,

2032

gnutls_priority=None, use_dbus=True, socketfd=None):

2229

2033

self.enabled = False

2230

2034

self.clients = clients

2231

2035

if self.clients is None:

2237

2041

interface = interface,

2238

2042

use_ipv6 = use_ipv6,

2239

2043

socketfd = socketfd)

2240

2241

2044

def server_activate(self):

2242

2045

if self.enabled:

2243

2046

return socketserver.TCPServer.server_activate(self)

2247

2050

2248

2051

def add_pipe(self, parent_pipe, proc):

2249

2052

# Call "handle_ipc" for both data and EOF events

2250

gobject.io_add_watch(

2251

parent_pipe.fileno(),

2252

gobject.IO_IN | gobject.IO_HUP,

2253

functools.partial(self.handle_ipc,

2254

parent_pipe = parent_pipe,

2255

proc = proc))

2053

gobject.io_add_watch(parent_pipe.fileno(),

2054

gobject.IO_IN | gobject.IO_HUP,

2055

functools.partial(self.handle_ipc,

2056

parent_pipe =

2057

parent_pipe,

2058

proc = proc))

2256

2059

2257

def handle_ipc(self, source, condition,

2258

parent_pipe=None,

2259

proc = None,

2260

client_object=None):

2060

def handle_ipc(self, source, condition, parent_pipe=None,

2061

proc = None, client_object=None):

2261

2062

# error, or the other end of multiprocessing.Pipe has closed

2262

2063

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2263

2064

# Wait for other process to exit

2286

2087

parent_pipe.send(False)

2287

2088

return False

2288

2089

2289

gobject.io_add_watch(

2290

parent_pipe.fileno(),

2291

gobject.IO_IN | gobject.IO_HUP,

2292

functools.partial(self.handle_ipc,

2293

parent_pipe = parent_pipe,

2294

proc = proc,

2295

client_object = client))

2090

gobject.io_add_watch(parent_pipe.fileno(),

2091

gobject.IO_IN | gobject.IO_HUP,

2092

functools.partial(self.handle_ipc,

2093

parent_pipe =

2094

parent_pipe,

2095

proc = proc,

2096

client_object =

2097

client))

2296

2098

parent_pipe.send(True)

2297

2099

# remove the old hook in favor of the new above hook on

2298

2100

# same fileno

2304

2106

2305

2107

parent_pipe.send(('data', getattr(client_object,

2306

2108

funcname)(*args,

2307

**kwargs)))

2109

**kwargs)))

2308

2110

2309

2111

if command == 'getattr':

2310

2112

attrname = request[1]

2311

if isinstance(client_object.__getattribute__(attrname),

2312

collections.Callable):

2313

parent_pipe.send(('function', ))

2113

if callable(client_object.__getattribute__(attrname)):

2114

parent_pipe.send(('function',))

2314

2115

else:

2315

parent_pipe.send((

2316

'data', client_object.__getattribute__(attrname)))

2116

parent_pipe.send(('data', client_object

2117

.__getattribute__(attrname)))

2317

2118

2318

2119

if command == 'setattr':

2319

2120

attrname = request[1]

2350

2151

# avoid excessive use of external libraries.

2351

2152

2352

2153

# New type for defining tokens, syntax, and semantics all-in-one

2353

Token = collections.namedtuple("Token", (

2354

"regexp", # To match token; if "value" is not None, must have

2355

# a "group" containing digits

2356

"value", # datetime.timedelta or None

2357

"followers")) # Tokens valid after this token

2154

Token = collections.namedtuple("Token",

2155

("regexp", # To match token; if

2156

# "value" is not None,

2157

# must have a "group"

2158

# containing digits

2159

"value", # datetime.timedelta or

2160

# None

2161

"followers")) # Tokens valid after

2162

# this token

2358

2163

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2359

2164

# the "duration" ABNF definition in RFC 3339, Appendix A.

2360

2165

token_end = Token(re.compile(r"$"), None, frozenset())

2361

2166

token_second = Token(re.compile(r"(\d+)S"),

2362

2167

datetime.timedelta(seconds=1),

2363

frozenset((token_end, )))

2168

frozenset((token_end,)))

2364

2169

token_minute = Token(re.compile(r"(\d+)M"),

2365

2170

datetime.timedelta(minutes=1),

2366

2171

frozenset((token_second, token_end)))

2382

2187

frozenset((token_month, token_end)))

2383

2188

token_week = Token(re.compile(r"(\d+)W"),

2384

2189

datetime.timedelta(weeks=1),

2385

frozenset((token_end, )))

2190

frozenset((token_end,)))

2386

2191

token_duration = Token(re.compile(r"P"), None,

2387

2192

frozenset((token_year, token_month,

2388

2193

token_day, token_time,

2390

2195

# Define starting values

2391

2196

value = datetime.timedelta() # Value so far

2392

2197

found_token = None

2393

followers = frozenset((token_duration, )) # Following valid tokens

2198

followers = frozenset((token_duration,)) # Following valid tokens

2394

2199

s = duration # String left to parse

2395

2200

# Loop until end token is found

2396

2201

while found_token is not token_end:

2413

2218

break

2414

2219

else:

2415

2220

# No currently valid tokens were found

2416

raise ValueError("Invalid RFC 3339 duration: {!r}"

2417

.format(duration))

2221

raise ValueError("Invalid RFC 3339 duration")

2418

2222

# End token found

2419

2223

return value

2420

2224

2457

2261

elif suffix == "w":

2458

2262

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2459

2263

else:

2460

raise ValueError("Unknown suffix {!r}".format(suffix))

2264

raise ValueError("Unknown suffix {!r}"

2265

.format(suffix))

2461

2266

except IndexError as e:

2462

2267

raise ValueError(*(e.args))

2463

2268

timevalue += delta

2479

2284

# Close all standard open file descriptors

2480

2285

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2481

2286

if not stat.S_ISCHR(os.fstat(null).st_mode):

2482

raise OSError(errno.ENODEV,

2483

"{} not a character device"

2287

raise OSError(errno.ENODEV, "{} not a character device"

2484

2288

.format(os.devnull))

2485

2289

os.dup2(null, sys.stdin.fileno())

2486

2290

os.dup2(null, sys.stdout.fileno())

2552

2356

"port": "",

2553

2357

"debug": "False",

2554

2358

"priority":

2555

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2556

":+SIGN-DSA-SHA256",

2359

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2557

2360

"servicename": "Mandos",

2558

2361

"use_dbus": "True",

2559

2362

"use_ipv6": "True",

2563

2366

"statedir": "/var/lib/mandos",

2564

2367

"foreground": "False",

2565

2368

"zeroconf": "True",

2566

}

2369

}

2567

2370

2568

2371

# Parse config file for server-global settings

2569

2372

server_config = configparser.SafeConfigParser(server_defaults)

2570

2373

del server_defaults

2571

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2374

server_config.read(os.path.join(options.configdir,

2375

"mandos.conf"))

2572

2376

# Convert the SafeConfigParser object to a dict

2573

2377

server_settings = server_config.defaults()

2574

2378

# Use the appropriate methods on the non-string config options

2592

2396

# Override the settings from the config file with command line

2593

2397

# options, if set.

2594

2398

for option in ("interface", "address", "port", "debug",

2595

"priority", "servicename", "configdir", "use_dbus",

2596

"use_ipv6", "debuglevel", "restore", "statedir",

2597

"socket", "foreground", "zeroconf"):

2399

"priority", "servicename", "configdir",

2400

"use_dbus", "use_ipv6", "debuglevel", "restore",

2401

"statedir", "socket", "foreground", "zeroconf"):

2598

2402

value = getattr(options, option)

2599

2403

if value is not None:

2600

2404

server_settings[option] = value

2615

2419

2616

2420

##################################################################

2617

2421

2618

if (not server_settings["zeroconf"]

2619

and not (server_settings["port"]

2620

or server_settings["socket"] != "")):

2621

parser.error("Needs port or socket to work without Zeroconf")

2422

if (not server_settings["zeroconf"] and

2423

not (server_settings["port"]

2424

or server_settings["socket"] != "")):

2425

parser.error("Needs port or socket to work without"

2426

" Zeroconf")

2622

2427

2623

2428

# For convenience

2624

2429

debug = server_settings["debug"]

2640

2445

initlogger(debug, level)

2641

2446

2642

2447

if server_settings["servicename"] != "Mandos":

2643

syslogger.setFormatter(

2644

logging.Formatter('Mandos ({}) [%(process)d]:'

2645

' %(levelname)s: %(message)s'.format(

2646

server_settings["servicename"])))

2448

syslogger.setFormatter(logging.Formatter

2449

('Mandos ({}) [%(process)d]:'

2450

' %(levelname)s: %(message)s'

2451

.format(server_settings

2452

["servicename"])))

2647

2453

2648

2454

# Parse config file with clients

2649

2455

client_config = configparser.SafeConfigParser(Client

2657

2463

socketfd = None

2658

2464

if server_settings["socket"] != "":

2659

2465

socketfd = server_settings["socket"]

2660

tcp_server = MandosServer(

2661

(server_settings["address"], server_settings["port"]),

2662

ClientHandler,

2663

interface=(server_settings["interface"] or None),

2664

use_ipv6=use_ipv6,

2665

gnutls_priority=server_settings["priority"],

2666

use_dbus=use_dbus,

2667

socketfd=socketfd)

2466

tcp_server = MandosServer((server_settings["address"],

2467

server_settings["port"]),

2468

ClientHandler,

2469

interface=(server_settings["interface"]

2470

or None),

2471

use_ipv6=use_ipv6,

2472

gnutls_priority=

2473

server_settings["priority"],

2474

use_dbus=use_dbus,

2475

socketfd=socketfd)

2668

2476

if not foreground:

2669

2477

pidfilename = "/run/mandos.pid"

2670

2478

if not os.path.isdir("/run/."):

2671

2479

pidfilename = "/var/run/mandos.pid"

2672

2480

pidfile = None

2673

2481

try:

2674

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2482

pidfile = open(pidfilename, "w")

2675

2483

except IOError as e:

2676

2484

logger.error("Could not open file %r", pidfilename,

2677

2485

exc_info=e)

2704

2512

def debug_gnutls(level, string):

2705

2513

logger.debug("GnuTLS: %s", string[:-1])

2706

2514

2707

gnutls.library.functions.gnutls_global_set_log_function(

2708

debug_gnutls)

2515

(gnutls.library.functions

2516

.gnutls_global_set_log_function(debug_gnutls))

2709

2517

2710

2518

# Redirect stdin so all checkers get /dev/null

2711

2519

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2731

2539

if use_dbus:

2732

2540

try:

2733

2541

bus_name = dbus.service.BusName("se.recompile.Mandos",

2734

bus,

2735

do_not_queue=True)

2736

old_bus_name = dbus.service.BusName(

2737

"se.bsnet.fukt.Mandos", bus,

2738

do_not_queue=True)

2739

except dbus.exceptions.DBusException as e:

2542

bus, do_not_queue=True)

2543

old_bus_name = (dbus.service.BusName

2544

("se.bsnet.fukt.Mandos", bus,

2545

do_not_queue=True))

2546

except dbus.exceptions.NameExistsException as e:

2740

2547

logger.error("Disabling D-Bus:", exc_info=e)

2741

2548

use_dbus = False

2742

2549

server_settings["use_dbus"] = False

2743

2550

tcp_server.use_dbus = False

2744

2551

if zeroconf:

2745

2552

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2746

service = AvahiServiceToSyslog(

2747

name = server_settings["servicename"],

2748

servicetype = "_mandos._tcp",

2749

protocol = protocol,

2750

bus = bus)

2553

service = AvahiServiceToSyslog(name =

2554

server_settings["servicename"],

2555

servicetype = "_mandos._tcp",

2556

protocol = protocol, bus = bus)

2751

2557

if server_settings["interface"]:

2752

service.interface = if_nametoindex(

2753

server_settings["interface"].encode("utf-8"))

2558

service.interface = (if_nametoindex

2559

(server_settings["interface"]

2560

.encode("utf-8")))

2754

2561

2755

2562

global multiprocessing_manager

2756

2563

multiprocessing_manager = multiprocessing.Manager()

2775

2582

if server_settings["restore"]:

2776

2583

try:

2777

2584

with open(stored_state_path, "rb") as stored_state:

2778

clients_data, old_client_settings = pickle.load(

2779

stored_state)

2585

clients_data, old_client_settings = (pickle.load

2586

(stored_state))

2780

2587

os.remove(stored_state_path)

2781

2588

except IOError as e:

2782

2589

if e.errno == errno.ENOENT:

2783

logger.warning("Could not load persistent state:"

2784

" {}".format(os.strerror(e.errno)))

2590

logger.warning("Could not load persistent state: {}"

2591

.format(os.strerror(e.errno)))

2785

2592

else:

2786

2593

logger.critical("Could not load persistent state:",

2787

2594

exc_info=e)

2788

2595

raise

2789

2596

except EOFError as e:

2790

2597

logger.warning("Could not load persistent state: "

2791

"EOFError:",

2792

exc_info=e)

2598

"EOFError:", exc_info=e)

2793

2599

2794

2600

with PGPEngine() as pgp:

2795

2601

for client_name, client in clients_data.items():

2807

2613

# For each value in new config, check if it

2808

2614

# differs from the old config value (Except for

2809

2615

# the "secret" attribute)

2810

if (name != "secret"

2811

and (value !=

2812

old_client_settings[client_name][name])):

2616

if (name != "secret" and

2617

value != old_client_settings[client_name]

2618

[name]):

2813

2619

client[name] = value

2814

2620

except KeyError:

2815

2621

pass

2816

2622

2817

2623

# Clients who has passed its expire date can still be

2818

# enabled if its last checker was successful. A Client

2624

# enabled if its last checker was successful. Clients

2819

2625

# whose checker succeeded before we stored its state is

2820

2626

# assumed to have successfully run all checkers during

2821

2627

# downtime.

2824

2630

if not client["last_checked_ok"]:

2825

2631

logger.warning(

2826

2632

"disabling client {} - Client never "

2827

"performed a successful checker".format(

2828

client_name))

2633

"performed a successful checker"

2634

.format(client_name))

2829

2635

client["enabled"] = False

2830

2636

elif client["last_checker_status"] != 0:

2831

2637

logger.warning(

2832

2638

"disabling client {} - Client last"

2833

" checker failed with error code"

2834

" {}".format(

2835

client_name,

2836

client["last_checker_status"]))

2639

" checker failed with error code {}"

2640

.format(client_name,

2641

client["last_checker_status"]))

2837

2642

client["enabled"] = False

2838

2643

else:

2839

client["expires"] = (

2840

datetime.datetime.utcnow()

2841

+ client["timeout"])

2644

client["expires"] = (datetime.datetime

2645

.utcnow()

2646

+ client["timeout"])

2842

2647

logger.debug("Last checker succeeded,"

2843

" keeping {} enabled".format(

2844

client_name))

2648

" keeping {} enabled"

2649

.format(client_name))

2845

2650

try:

2846

client["secret"] = pgp.decrypt(

2847

client["encrypted_secret"],

2848

client_settings[client_name]["secret"])

2651

client["secret"] = (

2652

pgp.decrypt(client["encrypted_secret"],

2653

client_settings[client_name]

2654

["secret"]))

2849

2655

except PGPError:

2850

2656

# If decryption fails, we use secret from new settings

2851

logger.debug("Failed to decrypt {} old secret".format(

2852

client_name))

2853

client["secret"] = (client_settings[client_name]

2854

["secret"])

2657

logger.debug("Failed to decrypt {} old secret"

2658

.format(client_name))

2659

client["secret"] = (

2660

client_settings[client_name]["secret"])

2855

2661

2856

2662

# Add/remove clients based on new changes made to config

2857

2663

for client_name in (set(old_client_settings)

2864

2670

# Create all client objects

2865

2671

for client_name, client in clients_data.items():

2866

2672

tcp_server.clients[client_name] = client_class(

2867

name = client_name,

2868

settings = client,

2673

name = client_name, settings = client,

2869

2674

server_settings = server_settings)

2870

2675

2871

2676

if not tcp_server.clients:

2873

2678

2874

2679

if not foreground:

2875

2680

if pidfile is not None:

2876

pid = os.getpid()

2877

2681

try:

2878

2682

with pidfile:

2879

print(pid, file=pidfile)

2683

pid = os.getpid()

2684

pidfile.write("{}\n".format(pid).encode("utf-8"))

2880

2685

except IOError:

2881

2686

logger.error("Could not write to file %r with PID %d",

2882

2687

pidfilename, pid)

2887

2692

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2888

2693

2889

2694

if use_dbus:

2890

2891

@alternate_dbus_interfaces(

2892

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2893

class MandosDBusService(DBusObjectWithObjectManager):

2695

@alternate_dbus_interfaces({"se.recompile.Mandos":

2696

"se.bsnet.fukt.Mandos"})

2697

class MandosDBusService(DBusObjectWithProperties):

2894

2698

"""A D-Bus proxy object"""

2895

2896

2699

def __init__(self):

2897

2700

dbus.service.Object.__init__(self, bus, "/")

2898

2899

2701

_interface = "se.recompile.Mandos"

2900

2702

2703

@dbus_interface_annotations(_interface)

2704

def _foo(self):

2705

return { "org.freedesktop.DBus.Property"

2706

".EmitsChangedSignal":

2707

"false"}

2708

2901

2709

@dbus.service.signal(_interface, signature="o")

2902

2710

def ClientAdded(self, objpath):

2903

2711

"D-Bus signal"

2908

2716

"D-Bus signal"

2909

2717

pass

2910

2718

2911

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2912

"true"})

2913

2719

@dbus.service.signal(_interface, signature="os")

2914

2720

def ClientRemoved(self, objpath, name):

2915

2721

"D-Bus signal"

2916

2722

pass

2917

2723

2918

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2919

"true"})

2920

2724

@dbus.service.method(_interface, out_signature="ao")

2921

2725

def GetAllClients(self):

2922

2726

"D-Bus method"

2923

return dbus.Array(c.dbus_object_path for c in

2727

return dbus.Array(c.dbus_object_path

2728

for c in

2924

2729

tcp_server.clients.itervalues())

2925

2730

2926

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

2927

"true"})

2928

2731

@dbus.service.method(_interface,

2929

2732

out_signature="a{oa{sv}}")

2930

2733

def GetAllClientsWithProperties(self):

2931

2734

"D-Bus method"

2932

2735

return dbus.Dictionary(

2933

{ c.dbus_object_path: c.GetAll(

2934

"se.recompile.Mandos.Client")

2736

{ c.dbus_object_path: c.GetAll("")

2935

2737

for c in tcp_server.clients.itervalues() },

2936

2738

signature="oa{sv}")

2937

2739

2942

2744

if c.dbus_object_path == object_path:

2943

2745

del tcp_server.clients[c.name]

2944

2746

c.remove_from_connection()

2945

# Don't signal the disabling

2747

# Don't signal anything except ClientRemoved

2946

2748

c.disable(quiet=True)

2947

# Emit D-Bus signal for removal

2948

self.client_removed_signal(c)

2749

# Emit D-Bus signal

2750

self.ClientRemoved(object_path, c.name)

2949

2751

return

2950

2752

raise KeyError(object_path)

2951

2753

2952

2754

del _interface

2953

2954

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

2955

out_signature = "a{oa{sa{sv}}}")

2956

def GetManagedObjects(self):

2957

"""D-Bus method"""

2958

return dbus.Dictionary(

2959

{ client.dbus_object_path:

2960

dbus.Dictionary(

2961

{ interface: client.GetAll(interface)

2962

for interface in

2963

client._get_all_interface_names()})

2964

for client in tcp_server.clients.values()})

2965

2966

def client_added_signal(self, client):

2967

"""Send the new standard signal and the old signal"""

2968

if use_dbus:

2969

# New standard signal

2970

self.InterfacesAdded(

2971

client.dbus_object_path,

2972

dbus.Dictionary(

2973

{ interface: client.GetAll(interface)

2974

for interface in

2975

client._get_all_interface_names()}))

2976

# Old signal

2977

self.ClientAdded(client.dbus_object_path)

2978

2979

def client_removed_signal(self, client):

2980

"""Send the new standard signal and the old signal"""

2981

if use_dbus:

2982

# New standard signal

2983

self.InterfacesRemoved(

2984

client.dbus_object_path,

2985

client._get_all_interface_names())

2986

# Old signal

2987

self.ClientRemoved(client.dbus_object_path,

2988

client.name)

2989

2755

2990

2756

mandos_dbus_service = MandosDBusService()

2991

2757

3014

2780

# + secret.

3015

2781

exclude = { "bus", "changedstate", "secret",

3016

2782

"checker", "server_settings" }

3017

for name, typ in inspect.getmembers(dbus.service

3018

.Object):

2783

for name, typ in (inspect.getmembers

2784

(dbus.service.Object)):

3019

2785

exclude.add(name)

3020

2786

3021

2787

client_dict["encrypted_secret"] = (client

3028

2794

del client_settings[client.name]["secret"]

3029

2795

3030

2796

try:

3031

with tempfile.NamedTemporaryFile(

3032

mode='wb',

3033

suffix=".pickle",

3034

prefix='clients-',

3035

dir=os.path.dirname(stored_state_path),

3036

delete=False) as stored_state:

2797

with (tempfile.NamedTemporaryFile

2798

(mode='wb', suffix=".pickle", prefix='clients-',

2799

dir=os.path.dirname(stored_state_path),

2800

delete=False)) as stored_state:

3037

2801

pickle.dump((clients, client_settings), stored_state)

3038

tempname = stored_state.name

2802

tempname=stored_state.name

3039

2803

os.rename(tempname, stored_state_path)

3040

2804

except (IOError, OSError) as e:

3041

2805

if not debug:

3056

2820

name, client = tcp_server.clients.popitem()

3057

2821

if use_dbus:

3058

2822

client.remove_from_connection()

3059

# Don't signal the disabling

2823

# Don't signal anything except ClientRemoved

3060

2824

client.disable(quiet=True)

3061

# Emit D-Bus signal for removal

3062

mandos_dbus_service.client_removed_signal(client)

2825

if use_dbus:

2826

# Emit D-Bus signal

2827

mandos_dbus_service.ClientRemoved(client

2828

.dbus_object_path,

2829

client.name)

3063

2830

client_settings.clear()

3064

2831

3065

2832

atexit.register(cleanup)

3066

2833

3067

2834

for client in tcp_server.clients.itervalues():

3068

2835

if use_dbus:

3069

# Emit D-Bus signal for adding

3070

mandos_dbus_service.client_added_signal(client)

2836

# Emit D-Bus signal

2837

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3071

2838

# Need to initiate checking of clients

3072

2839

if client.enabled:

3073

2840

client.init_checker()

3118

2885

# Must run before the D-Bus bus name gets deregistered

3119

2886

cleanup()

3120

2887

3121

3122

2888

if __name__ == '__main__':

3123

2889

main()