/mandos/trunk : revision 748

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

88

except ImportError:

89

SO_BINDTODEVICE = None

90

91

version = "1.6.7"

91

if sys.version_info.major == 2:

92

str = unicode

93

94

version = "1.6.9"

92

95

stored_state_file = "clients.pickle"

93

96

94

97

logger = logging.getLogger()

95

98

syslogger = None

96

99

97

100

try:

98

if_nametoindex = (ctypes.cdll.LoadLibrary

99

(ctypes.util.find_library("c"))

100

.if_nametoindex)

101

if_nametoindex = ctypes.cdll.LoadLibrary(

102

ctypes.util.find_library("c")).if_nametoindex

101

103

except (OSError, AttributeError):

104

102

105

def if_nametoindex(interface):

103

106

"Get an interface index the hard way, i.e. using fcntl()"

104

107

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

105

108

with contextlib.closing(socket.socket()) as s:

106

109

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

107

struct.pack(str("16s16x"),

108

interface))

109

interface_index = struct.unpack(str("I"),

110

ifreq[16:20])[0]

110

struct.pack(b"16s16x", interface))

111

interface_index = struct.unpack("I", ifreq[16:20])[0]

111

112

return interface_index

112

113

114

115

116

"""init logger and add loglevel"""

116

117

118

global syslogger

118

syslogger = (logging.handlers.SysLogHandler

119

(facility =

120

logging.handlers.SysLogHandler.LOG_DAEMON,

121

address = str("/dev/log")))

119

syslogger = (logging.handlers.SysLogHandler(

120

facility = logging.handlers.SysLogHandler.LOG_DAEMON,

121

address = "/dev/log"))

122

syslogger.setFormatter(logging.Formatter

123

('Mandos [%(process)d]: %(levelname)s:'

124

' %(message)s'))

141

142

class PGPEngine(object):

143

"""A simple class for OpenPGP symmetric encryption & decryption"""

144

145

def __init__(self):

145

146

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

146

147

self.gnupgargs = ['--batch',

185

186

187

def encrypt(self, data, password):

187

188

passphrase = self.password_encode(password)

188

with tempfile.NamedTemporaryFile(dir=self.tempdir

189

) as passfile:

189

with tempfile.NamedTemporaryFile(

190

dir=self.tempdir) as passfile:

190

191

passfile.write(passphrase)

191

192

passfile.flush()

192

193

proc = subprocess.Popen(['gpg', '--symmetric',

203

204

205

def decrypt(self, data, password):

205

206

passphrase = self.password_encode(password)

206

with tempfile.NamedTemporaryFile(dir = self.tempdir

207

) as passfile:

207

with tempfile.NamedTemporaryFile(

208

dir = self.tempdir) as passfile:

208

209

passfile.write(passphrase)

209

210

passfile.flush()

210

211

proc = subprocess.Popen(['gpg', '--decrypt',

214

215

stdin = subprocess.PIPE,

215

216

stdout = subprocess.PIPE,

216

217

stderr = subprocess.PIPE)

217

decrypted_plaintext, err = proc.communicate(input

218

= data)

218

decrypted_plaintext, err = proc.communicate(input = data)

219

if proc.returncode != 0:

220

raise PGPError(err)

221

return decrypted_plaintext

224

class AvahiError(Exception):

225

def __init__(self, value, *args, **kwargs):

226

self.value = value

227

super(AvahiError, self).__init__(value, *args, **kwargs)

228

def __unicode__(self):

229

return unicode(repr(self.value))

227

return super(AvahiError, self).__init__(value, *args,

228

**kwargs)

229

230

231

class AvahiServiceError(AvahiError):

232

pass

233

234

235

class AvahiGroupError(AvahiError):

235

236

pass

236

237

256

257

bus: dbus.SystemBus()

257

258

"""

258

259

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

260

servicetype = None, port = None, TXT = None,

261

domain = "", host = "", max_renames = 32768,

262

protocol = avahi.PROTO_UNSPEC, bus = None):

260

def __init__(self,

261

interface = avahi.IF_UNSPEC,

262

name = None,

263

servicetype = None,

264

port = None,

265

TXT = None,

266

domain = "",

267

host = "",

268

max_renames = 32768,

269

protocol = avahi.PROTO_UNSPEC,

270

bus = None):

263

271

self.interface = interface

264

272

self.name = name

265

273

self.type = servicetype

275

283

self.bus = bus

276

284

self.entry_group_state_changed_match = None

277

285

278

def rename(self):

286

def rename(self, remove=True):

279

287

"""Derived from the Avahi example code"""

280

288

if self.rename_count >= self.max_renames:

281

289

logger.critical("No suitable Zeroconf service name found"

282

290

" after %i retries, exiting.",

283

291

self.rename_count)

284

292

raise AvahiServiceError("Too many renames")

285

self.name = unicode(self.server

286

.GetAlternativeServiceName(self.name))

293

self.name = str(

294

self.server.GetAlternativeServiceName(self.name))

295

self.rename_count += 1

287

296

logger.info("Changing Zeroconf service name to %r ...",

288

297

self.name)

289

self.remove()

298

if remove:

299

self.remove()

290

300

try:

291

301

self.add()

292

302

except dbus.exceptions.DBusException as error:

293

logger.critical("D-Bus Exception", exc_info=error)

294

self.cleanup()

295

os._exit(1)

296

self.rename_count += 1

303

if (error.get_dbus_name()

304

== "org.freedesktop.Avahi.CollisionError"):

305

logger.info("Local Zeroconf service name collision.")

306

return self.rename(remove=False)

307

else:

308

logger.critical("D-Bus Exception", exc_info=error)

309

self.cleanup()

310

os._exit(1)

297

311

298

312

def remove(self):

299

313

"""Derived from the Avahi example code"""

337

351

self.rename()

338

352

elif state == avahi.ENTRY_GROUP_FAILURE:

339

353

logger.critical("Avahi: Error in group state changed %s",

340

unicode(error))

341

raise AvahiGroupError("State changed: {!s}"

342

.format(error))

354

str(error))

355

raise AvahiGroupError("State changed: {!s}".format(error))

343

356

344

357

def cleanup(self):

345

358

"""Derived from the Avahi example code"""

355

368

def server_state_changed(self, state, error=None):

356

369

"""Derived from the Avahi example code"""

357

370

logger.debug("Avahi server state change: %i", state)

358

bad_states = { avahi.SERVER_INVALID:

359

"Zeroconf server invalid",

360

avahi.SERVER_REGISTERING: None,

361

avahi.SERVER_COLLISION:

362

"Zeroconf server name collision",

363

avahi.SERVER_FAILURE:

364

"Zeroconf server failure" }

371

bad_states = {

372

avahi.SERVER_INVALID: "Zeroconf server invalid",

373

avahi.SERVER_REGISTERING: None,

374

avahi.SERVER_COLLISION: "Zeroconf server name collision",

375

avahi.SERVER_FAILURE: "Zeroconf server failure",

376

}

365

377

if state in bad_states:

366

378

if bad_states[state] is not None:

367

379

if error is None:

386

398

follow_name_owner_changes=True),

387

399

avahi.DBUS_INTERFACE_SERVER)

388

400

self.server.connect_to_signal("StateChanged",

389

self.server_state_changed)

401

self.server_state_changed)

390

402

self.server_state_changed(self.server.GetState())

391

403

392

404

393

405

class AvahiServiceToSyslog(AvahiService):

394

def rename(self):

406

def rename(self, *args, **kwargs):

395

407

"""Add the new name to the syslog messages"""

396

ret = AvahiService.rename(self)

397

syslogger.setFormatter(logging.Formatter

398

('Mandos ({}) [%(process)d]:'

399

' %(levelname)s: %(message)s'

400

.format(self.name)))

408

ret = AvahiService.rename(self, *args, **kwargs)

409

syslogger.setFormatter(logging.Formatter(

410

'Mandos ({}) [%(process)d]: %(levelname)s: %(message)s'

411

.format(self.name)))

401

412

return ret

402

413

403

414

404

def timedelta_to_milliseconds(td):

405

"Convert a datetime.timedelta() to milliseconds"

406

return ((td.days * 24 * 60 * 60 * 1000)

407

+ (td.seconds * 1000)

408

+ (td.microseconds // 1000))

409

410

411

415

class Client(object):

412

416

"""A representation of a client host served by this server.

413

417

457

461

"fingerprint", "host", "interval",

458

462

"last_approval_request", "last_checked_ok",

459

463

"last_enabled", "name", "timeout")

460

client_defaults = { "timeout": "PT5M",

461

"extended_timeout": "PT15M",

462

"interval": "PT2M",

463

"checker": "fping -q -- %%(host)s",

464

"host": "",

465

"approval_delay": "PT0S",

466

"approval_duration": "PT1S",

467

"approved_by_default": "True",

468

"enabled": "True",

469

}

470

471

def timeout_milliseconds(self):

472

"Return the 'timeout' attribute in milliseconds"

473

return timedelta_to_milliseconds(self.timeout)

474

475

def extended_timeout_milliseconds(self):

476

"Return the 'extended_timeout' attribute in milliseconds"

477

return timedelta_to_milliseconds(self.extended_timeout)

478

479

def interval_milliseconds(self):

480

"Return the 'interval' attribute in milliseconds"

481

return timedelta_to_milliseconds(self.interval)

482

483

def approval_delay_milliseconds(self):

484

return timedelta_to_milliseconds(self.approval_delay)

464

client_defaults = {

465

"timeout": "PT5M",

466

"extended_timeout": "PT15M",

467

"interval": "PT2M",

468

"checker": "fping -q -- %%(host)s",

469

"host": "",

470

"approval_delay": "PT0S",

471

"approval_duration": "PT1S",

472

"approved_by_default": "True",

473

"enabled": "True",

474

}

485

475

486

476

@staticmethod

487

477

def config_parser(config):

503

493

client["enabled"] = config.getboolean(client_name,

504

494

"enabled")

505

495

496

# Uppercase and remove spaces from fingerprint for later

497

# comparison purposes with return value from the

498

# fingerprint() function

506

499

client["fingerprint"] = (section["fingerprint"].upper()

507

500

.replace(" ", ""))

508

501

if "secret" in section:

550

543

self.expires = None

551

544

552

545

logger.debug("Creating client %r", self.name)

553

# Uppercase and remove spaces from fingerprint for later

554

# comparison purposes with return value from the fingerprint()

555

# function

556

546

logger.debug(" Fingerprint: %s", self.fingerprint)

557

547

self.created = settings.get("created",

558

548

datetime.datetime.utcnow())

565

555

self.current_checker_command = None

566

556

self.approved = None

567

557

self.approvals_pending = 0

568

self.changedstate = (multiprocessing_manager

569

.Condition(multiprocessing_manager

570

.Lock()))

571

self.client_structure = [attr for attr in

572

self.__dict__.iterkeys()

558

self.changedstate = multiprocessing_manager.Condition(

559

multiprocessing_manager.Lock())

560

self.client_structure = [attr

561

for attr in self.__dict__.iterkeys()

573

562

if not attr.startswith("_")]

574

563

self.client_structure.append("client_structure")

575

564

576

for name, t in inspect.getmembers(type(self),

577

lambda obj:

578

isinstance(obj,

579

property)):

565

for name, t in inspect.getmembers(

566

type(self), lambda obj: isinstance(obj, property)):

580

567

if not name.startswith("_"):

581

568

self.client_structure.append(name)

582

569

624

611

# and every interval from then on.

625

612

if self.checker_initiator_tag is not None:

626

613

gobject.source_remove(self.checker_initiator_tag)

627

self.checker_initiator_tag = (gobject.timeout_add

628

(self.interval_milliseconds(),

629

self.start_checker))

614

self.checker_initiator_tag = gobject.timeout_add(

615

int(self.interval.total_seconds() * 1000),

616

self.start_checker)

630

617

# Schedule a disable() when 'timeout' has passed

631

618

if self.disable_initiator_tag is not None:

632

619

gobject.source_remove(self.disable_initiator_tag)

633

self.disable_initiator_tag = (gobject.timeout_add

634

(self.timeout_milliseconds(),

635

self.disable))

620

self.disable_initiator_tag = gobject.timeout_add(

621

int(self.timeout.total_seconds() * 1000), self.disable)

636

622

# Also start a new checker *right now*.

637

623

self.start_checker()

638

624

647

633

vars(self))

648

634

self.checked_ok()

649

635

else:

650

logger.info("Checker for %(name)s failed",

651

vars(self))

636

logger.info("Checker for %(name)s failed", vars(self))

652

637

else:

653

638

self.last_checker_status = -1

654

639

logger.warning("Checker for %(name)s crashed?",

668

653

gobject.source_remove(self.disable_initiator_tag)

669

654

self.disable_initiator_tag = None

670

655

if getattr(self, "enabled", False):

671

self.disable_initiator_tag = (gobject.timeout_add

672

(timedelta_to_milliseconds

673

(timeout), self.disable))

656

self.disable_initiator_tag = gobject.timeout_add(

657

int(timeout.total_seconds() * 1000), self.disable)

674

658

self.expires = datetime.datetime.utcnow() + timeout

675

659

676

660

def need_approval(self):

707

691

# Start a new checker if needed

708

692

if self.checker is None:

709

693

# Escape attributes for the shell

710

escaped_attrs = { attr:

711

re.escape(unicode(getattr(self,

712

attr)))

713

for attr in self.runtime_expansions }

694

escaped_attrs = {

695

attr: re.escape(str(getattr(self, attr)))

696

for attr in self.runtime_expansions }

714

697

try:

715

698

command = self.checker_command % escaped_attrs

716

699

except TypeError as error:

717

700

logger.error('Could not format string "%s"',

718

self.checker_command, exc_info=error)

719

return True # Try again later

701

self.checker_command,

702

exc_info=error)

703

return True # Try again later

720

704

self.current_checker_command = command

721

705

try:

722

logger.info("Starting checker %r for %s",

723

command, self.name)

706

logger.info("Starting checker %r for %s", command,

707

self.name)

724

708

# We don't need to redirect stdout and stderr, since

725

709

# in normal mode, that is already done by daemon(),

726

710

# and in debug mode we don't want to. (Stdin is

735

719

"stderr": wnull })

736

720

self.checker = subprocess.Popen(command,

737

721

close_fds=True,

738

shell=True, cwd="/",

722

shell=True,

723

cwd="/",

739

724

**popen_args)

740

725

except OSError as error:

741

726

logger.error("Failed to start subprocess",

742

727

exc_info=error)

743

728

return True

744

self.checker_callback_tag = (gobject.child_watch_add

745

(self.checker.pid,

746

self.checker_callback,

747

data=command))

729

self.checker_callback_tag = gobject.child_watch_add(

730

self.checker.pid, self.checker_callback, data=command)

748

731

# The checker may have completed before the gobject

749

732

# watch was added. Check for this.

750

733

try:

781

764

self.checker = None

782

765

783

766

784

def dbus_service_property(dbus_interface, signature="v",

785

access="readwrite", byte_arrays=False):

767

def dbus_service_property(dbus_interface,

768

signature="v",

769

access="readwrite",

770

byte_arrays=False):

786

771

"""Decorators for marking methods of a DBusObjectWithProperties to

787

772

become properties on the D-Bus.

788

773

798

783

if byte_arrays and signature != "ay":

799

784

raise ValueError("Byte arrays not supported for non-'ay'"

800

785

" signature {!r}".format(signature))

786

801

787

def decorator(func):

802

788

func._dbus_is_property = True

803

789

func._dbus_interface = dbus_interface

808

794

func._dbus_name = func._dbus_name[:-14]

809

795

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

810

796

return func

797

811

798

return decorator

812

799

813

800

822

809

"org.freedesktop.DBus.Property.EmitsChangedSignal":

823

810

"false"}

824

811

"""

812

825

813

def decorator(func):

826

814

func._dbus_is_interface = True

827

815

func._dbus_interface = dbus_interface

828

816

func._dbus_name = dbus_interface

829

817

return func

818

830

819

return decorator

831

820

832

821

834

823

"""Decorator to annotate D-Bus methods, signals or properties

835

824

Usage:

836

825

826

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true",

827

"org.freedesktop.DBus.Property."

828

"EmitsChangedSignal": "false"})

837

829

@dbus_service_property("org.example.Interface", signature="b",

838

830

access="r")

839

@dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",

840

"org.freedesktop.DBus.Property."

841

"EmitsChangedSignal": "false"})

842

831

def Property_dbus_property(self):

843

832

return dbus.Boolean(False)

844

833

"""

834

845

835

def decorator(func):

846

836

func._dbus_annotations = annotations

847

837

return func

838

848

839

return decorator

849

840

850

841

851

842

class DBusPropertyException(dbus.exceptions.DBusException):

852

843

"""A base class for D-Bus property-related exceptions

853

844

"""

854

def __unicode__(self):

855

return unicode(str(self))

845

pass

856

846

857

847

858

848

class DBusPropertyAccessException(DBusPropertyException):

888

878

def _get_all_dbus_things(self, thing):

889

879

"""Returns a generator of (name, attribute) pairs

890

880

"""

891

return ((getattr(athing.__get__(self), "_dbus_name",

892

name),

881

return ((getattr(athing.__get__(self), "_dbus_name", name),

893

882

athing.__get__(self))

894

883

for cls in self.__class__.__mro__

895

884

for name, athing in

896

inspect.getmembers(cls,

897

self._is_dbus_thing(thing)))

885

inspect.getmembers(cls, self._is_dbus_thing(thing)))

898

886

899

887

def _get_dbus_property(self, interface_name, property_name):

900

888

"""Returns a bound method if one exists which is a D-Bus

901

889

property with the specified name and interface.

902

890

"""

903

for cls in self.__class__.__mro__:

904

for name, value in (inspect.getmembers

905

(cls,

906

self._is_dbus_thing("property"))):

891

for cls in self.__class__.__mro__:

892

for name, value in inspect.getmembers(

893

cls, self._is_dbus_thing("property")):

907

894

if (value._dbus_name == property_name

908

895

and value._dbus_interface == interface_name):

909

896

return value.__get__(self)

910

897

911

898

# No such property

912

raise DBusPropertyNotFound(self.dbus_object_path + ":"

913

+ interface_name + "."

914

+ property_name)

899

raise DBusPropertyNotFound("{}:{}.{}".format(

900

self.dbus_object_path, interface_name, property_name))

915

901

916

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

902

@dbus.service.method(dbus.PROPERTIES_IFACE,

903

in_signature="ss",

917

904

out_signature="v")

918

905

def Get(self, interface_name, property_name):

919

906

"""Standard D-Bus property Get() method, see D-Bus standard.

944

931

for byte in value))

945

932

prop(value)

946

933

947

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

934

@dbus.service.method(dbus.PROPERTIES_IFACE,

935

in_signature="s",

948

936

out_signature="a{sv}")

949

937

def GetAll(self, interface_name):

950

938

"""Standard D-Bus property GetAll() method, see D-Bus

965

953

if not hasattr(value, "variant_level"):

966

954

properties[name] = value

967

955

continue

968

properties[name] = type(value)(value, variant_level=

969

value.variant_level+1)

956

properties[name] = type(value)(

957

value, variant_level = value.variant_level + 1)

970

958

return dbus.Dictionary(properties, signature="sv")

971

959

960

@dbus.service.signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")

961

def PropertiesChanged(self, interface_name, changed_properties,

962

invalidated_properties):

963

"""Standard D-Bus PropertiesChanged() signal, see D-Bus

964

standard.

965

"""

966

pass

967

972

968

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

973

969

out_signature="s",

974

970

path_keyword='object_path',

982

978

connection)

983

979

try:

984

980

document = xml.dom.minidom.parseString(xmlstring)

981

985

982

def make_tag(document, name, prop):

986

983

e = document.createElement("property")

987

984

e.setAttribute("name", name)

988

985

e.setAttribute("type", prop._dbus_signature)

989

986

e.setAttribute("access", prop._dbus_access)

990

987

return e

988

991

989

for if_tag in document.getElementsByTagName("interface"):

992

990

# Add property tags

993

991

for tag in (make_tag(document, name, prop)

1005

1003

if (name == tag.getAttribute("name")

1006

1004

and prop._dbus_interface

1007

1005

== if_tag.getAttribute("name")):

1008

annots.update(getattr

1009

(prop,

1010

"_dbus_annotations",

1011

{}))

1006

annots.update(getattr(

1007

prop, "_dbus_annotations", {}))

1012

1008

for name, value in annots.items():

1013

1009

ann_tag = document.createElement(

1014

1010

"annotation")

1019

1015

for annotation, value in dict(

1020

1016

itertools.chain.from_iterable(

1021

1017

annotations().items()

1022

for name, annotations in

1023

self._get_all_dbus_things("interface")

1018

for name, annotations

1019

in self._get_all_dbus_things("interface")

1024

1020

if name == if_tag.getAttribute("name")

1025

1021

)).items():

1026

1022

ann_tag = document.createElement("annotation")

1055

1051

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1056

1052

if dt is None:

1057

1053

return dbus.String("", variant_level = variant_level)

1058

return dbus.String(dt.isoformat(),

1059

variant_level=variant_level)

1054

return dbus.String(dt.isoformat(), variant_level=variant_level)

1060

1055

1061

1056

1062

1057

def alternate_dbus_interfaces(alt_interface_names, deprecate=True):

1082

1077

(from DBusObjectWithProperties) and interfaces (from the

1083

1078

dbus_interface_annotations decorator).

1084

1079

"""

1080

1085

1081

def wrapper(cls):

1086

1082

for orig_interface_name, alt_interface_name in (

1087

alt_interface_names.items()):

1083

alt_interface_names.items()):

1088

1084

attr = {}

1089

1085

interface_names = set()

1090

1086

# Go though all attributes of the class

1092

1088

# Ignore non-D-Bus attributes, and D-Bus attributes

1093

1089

# with the wrong interface name

1094

1090

if (not hasattr(attribute, "_dbus_interface")

1095

or not attribute._dbus_interface

1096

.startswith(orig_interface_name)):

1091

or not attribute._dbus_interface.startswith(

1092

orig_interface_name)):

1097

1093

continue

1098

1094

# Create an alternate D-Bus interface name based on

1099

1095

# the current name

1100

alt_interface = (attribute._dbus_interface

1101

.replace(orig_interface_name,

1102

alt_interface_name))

1096

alt_interface = attribute._dbus_interface.replace(

1097

orig_interface_name, alt_interface_name)

1103

1098

interface_names.add(alt_interface)

1104

1099

# Is this a D-Bus signal?

1105

1100

if getattr(attribute, "_dbus_is_signal", False):

1106

1101

# Extract the original non-method undecorated

1107

1102

# function by black magic

1108

1103

nonmethod_func = (dict(

1109

zip(attribute.func_code.co_freevars,

1110

attribute.__closure__))["func"]

1111

.cell_contents)

1104

zip(attribute.func_code.co_freevars,

1105

attribute.__closure__))

1106

["func"].cell_contents)

1112

1107

# Create a new, but exactly alike, function

1113

1108

# object, and decorate it to be a new D-Bus signal

1114

1109

# with the alternate D-Bus interface name

1115

new_function = (dbus.service.signal

1116

(alt_interface,

1117

attribute._dbus_signature)

1110

new_function = (dbus.service.signal(

1111

alt_interface, attribute._dbus_signature)

1118

1112

(types.FunctionType(

1119

nonmethod_func.func_code,

1120

nonmethod_func.func_globals,

1121

nonmethod_func.func_name,

1122

nonmethod_func.func_defaults,

1123

nonmethod_func.func_closure)))

1113

nonmethod_func.func_code,

1114

nonmethod_func.func_globals,

1115

nonmethod_func.func_name,

1116

nonmethod_func.func_defaults,

1117

nonmethod_func.func_closure)))

1124

1118

# Copy annotations, if any

1125

1119

try:

1126

new_function._dbus_annotations = (

1127

dict(attribute._dbus_annotations))

1120

new_function._dbus_annotations = dict(

1121

attribute._dbus_annotations)

1128

1122

except AttributeError:

1129

1123

pass

1130

1124

# Define a creator of a function to call both the

1135

1129

"""This function is a scope container to pass

1136

1130

func1 and func2 to the "call_both" function

1137

1131

outside of its arguments"""

1132

1138

1133

def call_both(*args, **kwargs):

1139

1134

"""This function will emit two D-Bus

1140

1135

signals by calling func1 and func2"""

1141

1136

func1(*args, **kwargs)

1142

1137

func2(*args, **kwargs)

1138

1143

1139

return call_both

1144

1140

# Create the "call_both" function and add it to

1145

1141

# the class

1150

1146

# object. Decorate it to be a new D-Bus method

1151

1147

# with the alternate D-Bus interface name. Add it

1152

1148

# to the class.

1153

attr[attrname] = (dbus.service.method

1154

(alt_interface,

1155

attribute._dbus_in_signature,

1156

attribute._dbus_out_signature)

1157

(types.FunctionType

1158

(attribute.func_code,

1159

attribute.func_globals,

1160

attribute.func_name,

1161

attribute.func_defaults,

1162

attribute.func_closure)))

1149

attr[attrname] = (

1150

dbus.service.method(

1151

alt_interface,

1152

attribute._dbus_in_signature,

1153

attribute._dbus_out_signature)

1154

(types.FunctionType(attribute.func_code,

1155

attribute.func_globals,

1156

attribute.func_name,

1157

attribute.func_defaults,

1158

attribute.func_closure)))

1163

1159

# Copy annotations, if any

1164

1160

try:

1165

attr[attrname]._dbus_annotations = (

1166

dict(attribute._dbus_annotations))

1161

attr[attrname]._dbus_annotations = dict(

1162

attribute._dbus_annotations)

1167

1163

except AttributeError:

1168

1164

pass

1169

1165

# Is this a D-Bus property?

1172

1168

# object, and decorate it to be a new D-Bus

1173

1169

# property with the alternate D-Bus interface

1174

1170

# name. Add it to the class.

1175

attr[attrname] = (dbus_service_property

1176

(alt_interface,

1177

attribute._dbus_signature,

1178

attribute._dbus_access,

1179

attribute

1180

._dbus_get_args_options

1181

["byte_arrays"])

1182

(types.FunctionType

1183

(attribute.func_code,

1184

attribute.func_globals,

1185

attribute.func_name,

1186

attribute.func_defaults,

1187

attribute.func_closure)))

1171

attr[attrname] = (dbus_service_property(

1172

alt_interface, attribute._dbus_signature,

1173

attribute._dbus_access,

1174

attribute._dbus_get_args_options

1175

["byte_arrays"])

1176

(types.FunctionType(

1177

attribute.func_code,

1178

attribute.func_globals,

1179

attribute.func_name,

1180

attribute.func_defaults,

1181

attribute.func_closure)))

1188

1182

# Copy annotations, if any

1189

1183

try:

1190

attr[attrname]._dbus_annotations = (

1191

dict(attribute._dbus_annotations))

1184

attr[attrname]._dbus_annotations = dict(

1185

attribute._dbus_annotations)

1192

1186

except AttributeError:

1193

1187

pass

1194

1188

# Is this a D-Bus interface?

1197

1191

# object. Decorate it to be a new D-Bus interface

1198

1192

# with the alternate D-Bus interface name. Add it

1199

1193

# to the class.

1200

attr[attrname] = (dbus_interface_annotations

1201

(alt_interface)

1202

(types.FunctionType

1203

(attribute.func_code,

1204

attribute.func_globals,

1205

attribute.func_name,

1206

attribute.func_defaults,

1207

attribute.func_closure)))

1194

attr[attrname] = (

1195

dbus_interface_annotations(alt_interface)

1196

(types.FunctionType(attribute.func_code,

1197

attribute.func_globals,

1198

attribute.func_name,

1199

attribute.func_defaults,

1200

attribute.func_closure)))

1208

1201

if deprecate:

1209

1202

# Deprecate all alternate interfaces

1210

1203

iname="_AlternateDBusNames_interface_annotation{}"

1211

1204

for interface_name in interface_names:

1205

1212

1206

@dbus_interface_annotations(interface_name)

1213

1207

def func(self):

1214

1208

return { "org.freedesktop.DBus.Deprecated":

1215

"true" }

1209

"true" }

1216

1210

# Find an unused name

1217

1211

for aname in (iname.format(i)

1218

1212

for i in itertools.count()):

1223

1217

# Replace the class with a new subclass of it with

1224

1218

# methods, signals, etc. as created above.

1225

1219

cls = type(b"{}Alternate".format(cls.__name__),

1226

(cls,), attr)

1220

(cls, ), attr)

1227

1221

return cls

1222

1228

1223

return wrapper

1229

1224

1230

1225

1231

1226

@alternate_dbus_interfaces({"se.recompile.Mandos":

1232

"se.bsnet.fukt.Mandos"})

1227

"se.bsnet.fukt.Mandos"})

1233

1228

class ClientDBus(Client, DBusObjectWithProperties):

1234

1229

"""A Client class using D-Bus

1235

1230

1239

1234

"""

1240

1235

1241

1236

runtime_expansions = (Client.runtime_expansions

1242

+ ("dbus_object_path",))

1237

+ ("dbus_object_path", ))

1238

1239

_interface = "se.recompile.Mandos.Client"

1243

1240

1244

1241

# dbus.service.Object doesn't use super(), so we can't either.

1245

1242

1248

1245

Client.__init__(self, *args, **kwargs)

1249

1246

# Only now, when this client is initialized, can it show up on

1250

1247

# the D-Bus

1251

client_object_name = unicode(self.name).translate(

1248

client_object_name = str(self.name).translate(

1252

1249

{ord("."): ord("_"),

1253

1250

ord("-"): ord("_")})

1254

self.dbus_object_path = (dbus.ObjectPath

1255

("/clients/" + client_object_name))

1251

self.dbus_object_path = dbus.ObjectPath(

1252

"/clients/" + client_object_name)

1256

1253

DBusObjectWithProperties.__init__(self, self.bus,

1257

1254

self.dbus_object_path)

1258

1255

1259

def notifychangeproperty(transform_func,

1260

dbus_name, type_func=lambda x: x,

1261

variant_level=1):

1256

def notifychangeproperty(transform_func, dbus_name,

1257

type_func=lambda x: x,

1258

variant_level=1,

1259

invalidate_only=False,

1260

_interface=_interface):

1262

1261

""" Modify a variable so that it's a property which announces

1263

1262

its changes to DBus.

1264

1263

1270

1269

variant_level: D-Bus variant level. Default: 1

1271

1270

"""

1272

1271

attrname = "_{}".format(dbus_name)

1272

1273

def setter(self, value):

1274

if hasattr(self, "dbus_object_path"):

1275

if (not hasattr(self, attrname) or

1276

type_func(getattr(self, attrname, None))

1277

!= type_func(value)):

1278

dbus_value = transform_func(type_func(value),

1279

variant_level

1280

=variant_level)

1281

self.PropertyChanged(dbus.String(dbus_name),

1282

dbus_value)

1278

if invalidate_only:

1279

self.PropertiesChanged(

1280

_interface, dbus.Dictionary(),

1281

dbus.Array((dbus_name, )))

1282

else:

1283

dbus_value = transform_func(

1284

type_func(value),

1285

variant_level = variant_level)

1286

self.PropertyChanged(dbus.String(dbus_name),

1287

dbus_value)

1288

self.PropertiesChanged(

1289

_interface,

1290

dbus.Dictionary({ dbus.String(dbus_name):

1291

dbus_value }),

1292

dbus.Array())

1283

1293

setattr(self, attrname, value)

1284

1294

1285

1295

return property(lambda self: getattr(self, attrname), setter)

1291

1301

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

1292

1302

last_enabled = notifychangeproperty(datetime_to_dbus,

1293

1303

"LastEnabled")

1294

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

1295

type_func = lambda checker:

1296

checker is not None)

1304

checker = notifychangeproperty(

1305

dbus.Boolean, "CheckerRunning",

1306

type_func = lambda checker: checker is not None)

1297

1307

last_checked_ok = notifychangeproperty(datetime_to_dbus,

1298

1308

"LastCheckedOK")

1299

1309

last_checker_status = notifychangeproperty(dbus.Int16,

1302

1312

datetime_to_dbus, "LastApprovalRequest")

1303

1313

approved_by_default = notifychangeproperty(dbus.Boolean,

1304

1314

"ApprovedByDefault")

1305

approval_delay = notifychangeproperty(dbus.UInt64,

1306

"ApprovalDelay",

1307

type_func =

1308

timedelta_to_milliseconds)

1315

approval_delay = notifychangeproperty(

1316

dbus.UInt64, "ApprovalDelay",

1317

type_func = lambda td: td.total_seconds() * 1000)

1309

1318

approval_duration = notifychangeproperty(

1310

1319

dbus.UInt64, "ApprovalDuration",

1311

type_func = timedelta_to_milliseconds)

1320

type_func = lambda td: td.total_seconds() * 1000)

1312

1321

host = notifychangeproperty(dbus.String, "Host")

1313

timeout = notifychangeproperty(dbus.UInt64, "Timeout",

1314

type_func =

1315

timedelta_to_milliseconds)

1322

timeout = notifychangeproperty(

1323

dbus.UInt64, "Timeout",

1324

type_func = lambda td: td.total_seconds() * 1000)

1316

1325

extended_timeout = notifychangeproperty(

1317

1326

dbus.UInt64, "ExtendedTimeout",

1318

type_func = timedelta_to_milliseconds)

1319

interval = notifychangeproperty(dbus.UInt64,

1320

"Interval",

1321

type_func =

1322

timedelta_to_milliseconds)

1327

type_func = lambda td: td.total_seconds() * 1000)

1328

interval = notifychangeproperty(

1329

dbus.UInt64, "Interval",

1330

type_func = lambda td: td.total_seconds() * 1000)

1323

1331

checker_command = notifychangeproperty(dbus.String, "Checker")

1332

secret = notifychangeproperty(dbus.ByteArray, "Secret",

1333

invalidate_only=True)

1324

1334

1325

1335

del notifychangeproperty

1326

1336

1368

1378

1369

1379

def approve(self, value=True):

1370

1380

self.approved = value

1371

gobject.timeout_add(timedelta_to_milliseconds

1372

(self.approval_duration),

1373

self._reset_approved)

1381

gobject.timeout_add(int(self.approval_duration.total_seconds()

1382

* 1000), self._reset_approved)

1374

1383

self.send_changedstate()

1375

1384

1376

1385

## D-Bus methods, signals & properties

1377

_interface = "se.recompile.Mandos.Client"

1378

1386

1379

1387

## Interfaces

1380

1388

1381

@dbus_interface_annotations(_interface)

1382

def _foo(self):

1383

return { "org.freedesktop.DBus.Property.EmitsChangedSignal":

1384

"false"}

1385

1386

1389

## Signals

1387

1390

1388

1391

# CheckerCompleted - signal

1398

1401

pass

1399

1402

1400

1403

# PropertyChanged - signal

1404

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1401

1405

@dbus.service.signal(_interface, signature="sv")

1402

1406

def PropertyChanged(self, property, value):

1403

1407

"D-Bus signal"

1467

1471

return dbus.Boolean(bool(self.approvals_pending))

1468

1472

1469

1473

# ApprovedByDefault - property

1470

@dbus_service_property(_interface, signature="b",

1474

@dbus_service_property(_interface,

1475

signature="b",

1471

1476

access="readwrite")

1472

1477

def ApprovedByDefault_dbus_property(self, value=None):

1473

1478

if value is None: # get

1475

1480

self.approved_by_default = bool(value)

1476

1481

1477

1482

# ApprovalDelay - property

1478

@dbus_service_property(_interface, signature="t",

1483

@dbus_service_property(_interface,

1484

signature="t",

1479

1485

access="readwrite")

1480

1486

def ApprovalDelay_dbus_property(self, value=None):

1481

1487

if value is None: # get

1482

return dbus.UInt64(self.approval_delay_milliseconds())

1488

return dbus.UInt64(self.approval_delay.total_seconds()

1489

* 1000)

1483

1490

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1484

1491

1485

1492

# ApprovalDuration - property

1486

@dbus_service_property(_interface, signature="t",

1493

@dbus_service_property(_interface,

1494

signature="t",

1487

1495

access="readwrite")

1488

1496

def ApprovalDuration_dbus_property(self, value=None):

1489

1497

if value is None: # get

1490

return dbus.UInt64(timedelta_to_milliseconds(

1491

self.approval_duration))

1498

return dbus.UInt64(self.approval_duration.total_seconds()

1499

* 1000)

1492

1500

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1493

1501

1494

1502

# Name - property

1502

1510

return dbus.String(self.fingerprint)

1503

1511

1504

1512

# Host - property

1505

@dbus_service_property(_interface, signature="s",

1513

@dbus_service_property(_interface,

1514

signature="s",

1506

1515

access="readwrite")

1507

1516

def Host_dbus_property(self, value=None):

1508

1517

if value is None: # get

1509

1518

return dbus.String(self.host)

1510

self.host = unicode(value)

1519

self.host = str(value)

1511

1520

1512

1521

# Created - property

1513

1522

@dbus_service_property(_interface, signature="s", access="read")

1520

1529

return datetime_to_dbus(self.last_enabled)

1521

1530

1522

1531

# Enabled - property

1523

@dbus_service_property(_interface, signature="b",

1532

@dbus_service_property(_interface,

1533

signature="b",

1524

1534

access="readwrite")

1525

1535

def Enabled_dbus_property(self, value=None):

1526

1536

if value is None: # get

1531

1541

self.disable()

1532

1542

1533

1543

# LastCheckedOK - property

1534

@dbus_service_property(_interface, signature="s",

1544

@dbus_service_property(_interface,

1545

signature="s",

1535

1546

access="readwrite")

1536

1547

def LastCheckedOK_dbus_property(self, value=None):

1537

1548

if value is not None:

1540

1551

return datetime_to_dbus(self.last_checked_ok)

1541

1552

1542

1553

# LastCheckerStatus - property

1543

@dbus_service_property(_interface, signature="n",

1544

access="read")

1554

@dbus_service_property(_interface, signature="n", access="read")

1545

1555

def LastCheckerStatus_dbus_property(self):

1546

1556

return dbus.Int16(self.last_checker_status)

1547

1557

1556

1566

return datetime_to_dbus(self.last_approval_request)

1557

1567

1558

1568

# Timeout - property

1559

@dbus_service_property(_interface, signature="t",

1569

@dbus_service_property(_interface,

1570

signature="t",

1560

1571

access="readwrite")

1561

1572

def Timeout_dbus_property(self, value=None):

1562

1573

if value is None: # get

1563

return dbus.UInt64(self.timeout_milliseconds())

1574

return dbus.UInt64(self.timeout.total_seconds() * 1000)

1564

1575

old_timeout = self.timeout

1565

1576

self.timeout = datetime.timedelta(0, 0, 0, value)

1566

1577

# Reschedule disabling

1575

1586

is None):

1576

1587

return

1577

1588

gobject.source_remove(self.disable_initiator_tag)

1578

self.disable_initiator_tag = (

1579

gobject.timeout_add(

1580

timedelta_to_milliseconds(self.expires - now),

1581

self.disable))

1589

self.disable_initiator_tag = gobject.timeout_add(

1590

int((self.expires - now).total_seconds() * 1000),

1591

self.disable)

1582

1592

1583

1593

# ExtendedTimeout - property

1584

@dbus_service_property(_interface, signature="t",

1594

@dbus_service_property(_interface,

1595

signature="t",

1585

1596

access="readwrite")

1586

1597

def ExtendedTimeout_dbus_property(self, value=None):

1587

1598

if value is None: # get

1588

return dbus.UInt64(self.extended_timeout_milliseconds())

1599

return dbus.UInt64(self.extended_timeout.total_seconds()

1600

* 1000)

1589

1601

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1590

1602

1591

1603

# Interval - property

1592

@dbus_service_property(_interface, signature="t",

1604

@dbus_service_property(_interface,

1605

signature="t",

1593

1606

access="readwrite")

1594

1607

def Interval_dbus_property(self, value=None):

1595

1608

if value is None: # get

1596

return dbus.UInt64(self.interval_milliseconds())

1609

return dbus.UInt64(self.interval.total_seconds() * 1000)

1597

1610

self.interval = datetime.timedelta(0, 0, 0, value)

1598

1611

if getattr(self, "checker_initiator_tag", None) is None:

1599

1612

return

1600

1613

if self.enabled:

1601

1614

# Reschedule checker run

1602

1615

gobject.source_remove(self.checker_initiator_tag)

1603

self.checker_initiator_tag = (gobject.timeout_add

1604

(value, self.start_checker))

1605

self.start_checker() # Start one now, too

1616

self.checker_initiator_tag = gobject.timeout_add(

1617

value, self.start_checker)

1618

self.start_checker() # Start one now, too

1606

1619

1607

1620

# Checker - property

1608

@dbus_service_property(_interface, signature="s",

1621

@dbus_service_property(_interface,

1622

signature="s",

1609

1623

access="readwrite")

1610

1624

def Checker_dbus_property(self, value=None):

1611

1625

if value is None: # get

1612

1626

return dbus.String(self.checker_command)

1613

self.checker_command = unicode(value)

1627

self.checker_command = str(value)

1614

1628

1615

1629

# CheckerRunning - property

1616

@dbus_service_property(_interface, signature="b",

1630

@dbus_service_property(_interface,

1631

signature="b",

1617

1632

access="readwrite")

1618

1633

def CheckerRunning_dbus_property(self, value=None):

1619

1634

if value is None: # get

1629

1644

return self.dbus_object_path # is already a dbus.ObjectPath

1630

1645

1631

1646

# Secret = property

1632

@dbus_service_property(_interface, signature="ay",

1633

access="write", byte_arrays=True)

1647

@dbus_service_property(_interface,

1648

signature="ay",

1649

access="write",

1650

byte_arrays=True)

1634

1651

def Secret_dbus_property(self, value):

1635

self.secret = str(value)

1652

self.secret = bytes(value)

1636

1653

1637

1654

del _interface

1638

1655

1652

1669

if data[0] == 'data':

1653

1670

return data[1]

1654

1671

if data[0] == 'function':

1672

1655

1673

def func(*args, **kwargs):

1656

1674

self._pipe.send(('funcall', name, args, kwargs))

1657

1675

return self._pipe.recv()[1]

1676

1658

1677

return func

1659

1678

1660

1679

def __setattr__(self, name, value):

1672

1691

def handle(self):

1673

1692

with contextlib.closing(self.server.child_pipe) as child_pipe:

1674

1693

logger.info("TCP connection from: %s",

1675

unicode(self.client_address))

1694

str(self.client_address))

1676

1695

logger.debug("Pipe FD: %d",

1677

1696

self.server.child_pipe.fileno())

1678

1697

1679

session = (gnutls.connection

1680

.ClientSession(self.request,

1681

gnutls.connection

1682

.X509Credentials()))

1698

session = gnutls.connection.ClientSession(

1699

self.request, gnutls.connection .X509Credentials())

1683

1700

1684

1701

# Note: gnutls.connection.X509Credentials is really a

1685

1702

# generic GnuTLS certificate credentials object so long as

1694

1711

priority = self.server.gnutls_priority

1695

1712

if priority is None:

1696

1713

priority = "NORMAL"

1697

(gnutls.library.functions

1698

.gnutls_priority_set_direct(session._c_object,

1699

priority, None))

1714

gnutls.library.functions.gnutls_priority_set_direct(

1715

session._c_object, priority, None)

1700

1716

1701

1717

# Start communication using the Mandos protocol

1702

1718

# Get protocol number

1722

1738

approval_required = False

1723

1739

try:

1724

1740

try:

1725

fpr = self.fingerprint(self.peer_certificate

1726

(session))

1741

fpr = self.fingerprint(

1742

self.peer_certificate(session))

1727

1743

except (TypeError,

1728

1744

gnutls.errors.GNUTLSError) as error:

1729

1745

logger.warning("Bad certificate: %s", error)

1744

1760

while True:

1745

1761

if not client.enabled:

1746

1762

logger.info("Client %s is disabled",

1747

client.name)

1763

client.name)

1748

1764

if self.server.use_dbus:

1749

1765

# Emit D-Bus signal

1750

1766

client.Rejected("Disabled")

1759

1775

if self.server.use_dbus:

1760

1776

# Emit D-Bus signal

1761

1777

client.NeedApproval(

1762

client.approval_delay_milliseconds(),

1763

client.approved_by_default)

1778

client.approval_delay.total_seconds()

1779

* 1000, client.approved_by_default)

1764

1780

else:

1765

1781

logger.warning("Client %s was not approved",

1766

1782

client.name)

1772

1788

#wait until timeout or approved

1773

1789

time = datetime.datetime.now()

1774

1790

client.changedstate.acquire()

1775

client.changedstate.wait(

1776

float(timedelta_to_milliseconds(delay)

1777

/ 1000))

1791

client.changedstate.wait(delay.total_seconds())

1778

1792

client.changedstate.release()

1779

1793

time2 = datetime.datetime.now()

1780

1794

if (time2 - time) >= delay:

1799

1813

logger.warning("gnutls send failed",

1800

1814

exc_info=error)

1801

1815

return

1802

logger.debug("Sent: %d, remaining: %d",

1803

sent, len(client.secret)

1804

- (sent_size + sent))

1816

logger.debug("Sent: %d, remaining: %d", sent,

1817

len(client.secret) - (sent_size

1818

+ sent))

1805

1819

sent_size += sent

1806

1820

1807

1821

logger.info("Sending secret to %s", client.name)

1824

1838

def peer_certificate(session):

1825

1839

"Return the peer's OpenPGP certificate as a bytestring"

1826

1840

# If not an OpenPGP certificate...

1827

if (gnutls.library.functions

1828

.gnutls_certificate_type_get(session._c_object)

1841

if (gnutls.library.functions.gnutls_certificate_type_get(

1842

session._c_object)

1829

1843

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1830

1844

# ...do the normal thing

1831

1845

return session.peer_certificate

1845

1859

def fingerprint(openpgp):

1846

1860

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1847

1861

# New GnuTLS "datum" with the OpenPGP public key

1848

datum = (gnutls.library.types

1849

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1850

ctypes.POINTER

1851

(ctypes.c_ubyte)),

1852

ctypes.c_uint(len(openpgp))))

1862

datum = gnutls.library.types.gnutls_datum_t(

1863

ctypes.cast(ctypes.c_char_p(openpgp),

1864

ctypes.POINTER(ctypes.c_ubyte)),

1865

ctypes.c_uint(len(openpgp)))

1853

1866

# New empty GnuTLS certificate

1854

1867

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1855

(gnutls.library.functions

1856

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1868

gnutls.library.functions.gnutls_openpgp_crt_init(

1869

ctypes.byref(crt))

1857

1870

# Import the OpenPGP public key into the certificate

1858

(gnutls.library.functions

1859

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1860

gnutls.library.constants

1861

.GNUTLS_OPENPGP_FMT_RAW))

1871

gnutls.library.functions.gnutls_openpgp_crt_import(

1872

crt, ctypes.byref(datum),

1873

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

1862

1874

# Verify the self signature in the key

1863

1875

crtverify = ctypes.c_uint()

1864

(gnutls.library.functions

1865

.gnutls_openpgp_crt_verify_self(crt, 0,

1866

ctypes.byref(crtverify)))

1876

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1877

crt, 0, ctypes.byref(crtverify))

1867

1878

if crtverify.value != 0:

1868

1879

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1869

raise (gnutls.errors.CertificateSecurityError

1870

("Verify failed"))

1880

raise gnutls.errors.CertificateSecurityError(

1881

"Verify failed")

1871

1882

# New buffer for the fingerprint

1872

1883

buf = ctypes.create_string_buffer(20)

1873

1884

buf_len = ctypes.c_size_t()

1874

1885

# Get the fingerprint from the certificate into the buffer

1875

(gnutls.library.functions

1876

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1877

ctypes.byref(buf_len)))

1886

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1887

crt, ctypes.byref(buf), ctypes.byref(buf_len))

1878

1888

# Deinit the certificate

1879

1889

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1880

1890

# Convert the buffer to a Python bytestring

1886

1896

1887

1897

class MultiprocessingMixIn(object):

1888

1898

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1899

1889

1900

def sub_process_main(self, request, address):

1890

1901

try:

1891

1902

self.finish_request(request, address)

1903

1914

1904

1915

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1905

1916

""" adds a pipe to the MixIn """

1917

1906

1918

def process_request(self, request, client_address):

1907

1919

"""Overrides and wraps the original process_request().

1908

1920

1929

1941

interface: None or a network interface name (string)

1930

1942

use_ipv6: Boolean; to use IPv6 or not

1931

1943

"""

1944

1932

1945

def __init__(self, server_address, RequestHandlerClass,

1933

interface=None, use_ipv6=True, socketfd=None):

1946

interface=None,

1947

use_ipv6=True,

1948

socketfd=None):

1934

1949

"""If socketfd is set, use that file descriptor instead of

1935

1950

creating a new one with socket.socket().

1936

1951

"""

1977

1992

self.interface)

1978

1993

else:

1979

1994

try:

1980

self.socket.setsockopt(socket.SOL_SOCKET,

1981

SO_BINDTODEVICE,

1982

str(self.interface + '\0'))

1995

self.socket.setsockopt(

1996

socket.SOL_SOCKET, SO_BINDTODEVICE,

1997

(self.interface + "\0").encode("utf-8"))

1983

1998

except socket.error as error:

1984

1999

if error.errno == errno.EPERM:

1985

2000

logger.error("No permission to bind to"

2003

2018

self.server_address = (any_address,

2004

2019

self.server_address[1])

2005

2020

elif not self.server_address[1]:

2006

self.server_address = (self.server_address[0],

2007

0)

2021

self.server_address = (self.server_address[0], 0)

2008

2022

# if self.interface:

2009

2023

# self.server_address = (self.server_address[0],

2010

2024

# 0, # port

2024

2038

2025

2039

Assumes a gobject.MainLoop event loop.

2026

2040

"""

2041

2027

2042

def __init__(self, server_address, RequestHandlerClass,

2028

interface=None, use_ipv6=True, clients=None,

2029

gnutls_priority=None, use_dbus=True, socketfd=None):

2043

interface=None,

2044

use_ipv6=True,

2045

clients=None,

2046

gnutls_priority=None,

2047

use_dbus=True,

2048

socketfd=None):

2030

2049

self.enabled = False

2031

2050

self.clients = clients

2032

2051

if self.clients is None:

2038

2057

interface = interface,

2039

2058

use_ipv6 = use_ipv6,

2040

2059

socketfd = socketfd)

2060

2041

2061

def server_activate(self):

2042

2062

if self.enabled:

2043

2063

return socketserver.TCPServer.server_activate(self)

2047

2067

2048

2068

def add_pipe(self, parent_pipe, proc):

2049

2069

# Call "handle_ipc" for both data and EOF events

2050

gobject.io_add_watch(parent_pipe.fileno(),

2051

gobject.IO_IN | gobject.IO_HUP,

2052

functools.partial(self.handle_ipc,

2053

parent_pipe =

2054

parent_pipe,

2055

proc = proc))

2070

gobject.io_add_watch(

2071

parent_pipe.fileno(),

2072

gobject.IO_IN | gobject.IO_HUP,

2073

functools.partial(self.handle_ipc,

2074

parent_pipe = parent_pipe,

2075

proc = proc))

2056

2076

2057

def handle_ipc(self, source, condition, parent_pipe=None,

2058

proc = None, client_object=None):

2077

def handle_ipc(self, source, condition,

2078

parent_pipe=None,

2079

proc = None,

2080

client_object=None):

2059

2081

# error, or the other end of multiprocessing.Pipe has closed

2060

2082

if condition & (gobject.IO_ERR | gobject.IO_HUP):

2061

2083

# Wait for other process to exit

2084

2106

parent_pipe.send(False)

2085

2107

return False

2086

2108

2087

gobject.io_add_watch(parent_pipe.fileno(),

2088

gobject.IO_IN | gobject.IO_HUP,

2089

functools.partial(self.handle_ipc,

2090

parent_pipe =

2091

parent_pipe,

2092

proc = proc,

2093

client_object =

2094

client))

2109

gobject.io_add_watch(

2110

parent_pipe.fileno(),

2111

gobject.IO_IN | gobject.IO_HUP,

2112

functools.partial(self.handle_ipc,

2113

parent_pipe = parent_pipe,

2114

proc = proc,

2115

client_object = client))

2095

2116

parent_pipe.send(True)

2096

2117

# remove the old hook in favor of the new above hook on

2097

2118

# same fileno

2103

2124

2104

2125

parent_pipe.send(('data', getattr(client_object,

2105

2126

funcname)(*args,

2106

**kwargs)))

2127

**kwargs)))

2107

2128

2108

2129

if command == 'getattr':

2109

2130

attrname = request[1]

2110

2131

if callable(client_object.__getattribute__(attrname)):

2111

parent_pipe.send(('function',))

2132

parent_pipe.send(('function', ))

2112

2133

else:

2113

parent_pipe.send(('data', client_object

2114

.__getattribute__(attrname)))

2134

parent_pipe.send((

2135

'data', client_object.__getattribute__(attrname)))

2115

2136

2116

2137

if command == 'setattr':

2117

2138

attrname = request[1]

2157

2178

# None

2158

2179

"followers")) # Tokens valid after

2159

2180

# this token

2181

Token = collections.namedtuple("Token", (

2182

"regexp", # To match token; if "value" is not None, must have

2183

# a "group" containing digits

2184

"value", # datetime.timedelta or None

2185

"followers")) # Tokens valid after this token

2160

2186

# RFC 3339 "duration" tokens, syntax, and semantics; taken from

2161

2187

# the "duration" ABNF definition in RFC 3339, Appendix A.

2162

2188

token_end = Token(re.compile(r"$"), None, frozenset())

2163

2189

token_second = Token(re.compile(r"(\d+)S"),

2164

2190

datetime.timedelta(seconds=1),

2165

frozenset((token_end,)))

2191

frozenset((token_end, )))

2166

2192

token_minute = Token(re.compile(r"(\d+)M"),

2167

2193

datetime.timedelta(minutes=1),

2168

2194

frozenset((token_second, token_end)))

2184

2210

frozenset((token_month, token_end)))

2185

2211

token_week = Token(re.compile(r"(\d+)W"),

2186

2212

datetime.timedelta(weeks=1),

2187

frozenset((token_end,)))

2213

frozenset((token_end, )))

2188

2214

token_duration = Token(re.compile(r"P"), None,

2189

2215

frozenset((token_year, token_month,

2190

2216

token_day, token_time,

2245

2271

timevalue = datetime.timedelta(0)

2246

2272

for s in interval.split():

2247

2273

try:

2248

suffix = unicode(s[-1])

2274

suffix = s[-1]

2249

2275

value = int(s[:-1])

2250

2276

if suffix == "d":

2251

2277

delta = datetime.timedelta(value)

2258

2284

elif suffix == "w":

2259

2285

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

2260

2286

else:

2261

raise ValueError("Unknown suffix {!r}"

2262

.format(suffix))

2287

raise ValueError("Unknown suffix {!r}".format(suffix))

2263

2288

except IndexError as e:

2264

2289

raise ValueError(*(e.args))

2265

2290

timevalue += delta

2281

2306

# Close all standard open file descriptors

2282

2307

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2283

2308

if not stat.S_ISCHR(os.fstat(null).st_mode):

2284

raise OSError(errno.ENODEV, "{} not a character device"

2309

raise OSError(errno.ENODEV,

2310

"{} not a character device"

2285

2311

.format(os.devnull))

2286

2312

os.dup2(null, sys.stdin.fileno())

2287

2313

os.dup2(null, sys.stdout.fileno())

2353

2379

"port": "",

2354

2380

"debug": "False",

2355

2381

"priority":

2356

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2382

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2383

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2357

2384

"servicename": "Mandos",

2358

2385

"use_dbus": "True",

2359

2386

"use_ipv6": "True",

2363

2390

"statedir": "/var/lib/mandos",

2364

2391

"foreground": "False",

2365

2392

"zeroconf": "True",

2366

}

2393

}

2367

2394

2368

2395

# Parse config file for server-global settings

2369

2396

server_config = configparser.SafeConfigParser(server_defaults)

2370

2397

del server_defaults

2371

server_config.read(os.path.join(options.configdir,

2372

"mandos.conf"))

2398

server_config.read(os.path.join(options.configdir, "mandos.conf"))

2373

2399

# Convert the SafeConfigParser object to a dict

2374

2400

server_settings = server_config.defaults()

2375

2401

# Use the appropriate methods on the non-string config options

2393

2419

# Override the settings from the config file with command line

2394

2420

# options, if set.

2395

2421

for option in ("interface", "address", "port", "debug",

2396

"priority", "servicename", "configdir",

2397

"use_dbus", "use_ipv6", "debuglevel", "restore",

2398

"statedir", "socket", "foreground", "zeroconf"):

2422

"priority", "servicename", "configdir", "use_dbus",

2423

"use_ipv6", "debuglevel", "restore", "statedir",

2424

"socket", "foreground", "zeroconf"):

2399

2425

value = getattr(options, option)

2400

2426

if value is not None:

2401

2427

server_settings[option] = value

2402

2428

del options

2403

2429

# Force all strings to be unicode

2404

2430

for option in server_settings.keys():

2405

if type(server_settings[option]) is str:

2406

server_settings[option] = unicode(server_settings[option])

2431

if isinstance(server_settings[option], bytes):

2432

server_settings[option] = (server_settings[option]

2433

.decode("utf-8"))

2407

2434

# Force all boolean options to be boolean

2408

2435

for option in ("debug", "use_dbus", "use_ipv6", "restore",

2409

2436

"foreground", "zeroconf"):

2415

2442

2416

2443

##################################################################

2417

2444

2418

if (not server_settings["zeroconf"] and

2419

not (server_settings["port"]

2420

or server_settings["socket"] != "")):

2421

parser.error("Needs port or socket to work without"

2422

" Zeroconf")

2445

if (not server_settings["zeroconf"]

2446

and not (server_settings["port"]

2447

or server_settings["socket"] != "")):

2448

parser.error("Needs port or socket to work without Zeroconf")

2423

2449

2424

2450

# For convenience

2425

2451

debug = server_settings["debug"]

2441

2467

initlogger(debug, level)

2442

2468

2443

2469

if server_settings["servicename"] != "Mandos":

2444

syslogger.setFormatter(logging.Formatter

2445

('Mandos ({}) [%(process)d]:'

2446

' %(levelname)s: %(message)s'

2447

.format(server_settings

2448

["servicename"])))

2470

syslogger.setFormatter(

2471

logging.Formatter('Mandos ({}) [%(process)d]:'

2472

' %(levelname)s: %(message)s'.format(

2473

server_settings["servicename"])))

2449

2474

2450

2475

# Parse config file with clients

2451

2476

client_config = configparser.SafeConfigParser(Client

2459

2484

socketfd = None

2460

2485

if server_settings["socket"] != "":

2461

2486

socketfd = server_settings["socket"]

2462

tcp_server = MandosServer((server_settings["address"],

2463

server_settings["port"]),

2464

ClientHandler,

2465

interface=(server_settings["interface"]

2466

or None),

2467

use_ipv6=use_ipv6,

2468

gnutls_priority=

2469

server_settings["priority"],

2470

use_dbus=use_dbus,

2471

socketfd=socketfd)

2487

tcp_server = MandosServer(

2488

(server_settings["address"], server_settings["port"]),

2489

ClientHandler,

2490

interface=(server_settings["interface"] or None),

2491

use_ipv6=use_ipv6,

2492

gnutls_priority=server_settings["priority"],

2493

use_dbus=use_dbus,

2494

socketfd=socketfd)

2472

2495

if not foreground:

2473

2496

pidfilename = "/run/mandos.pid"

2474

2497

if not os.path.isdir("/run/."):

2508

2531

def debug_gnutls(level, string):

2509

2532

logger.debug("GnuTLS: %s", string[:-1])

2510

2533

2511

(gnutls.library.functions

2512

.gnutls_global_set_log_function(debug_gnutls))

2534

gnutls.library.functions.gnutls_global_set_log_function(

2535

debug_gnutls)

2513

2536

2514

2537

# Redirect stdin so all checkers get /dev/null

2515

2538

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

2535

2558

if use_dbus:

2536

2559

try:

2537

2560

bus_name = dbus.service.BusName("se.recompile.Mandos",

2538

bus, do_not_queue=True)

2539

old_bus_name = (dbus.service.BusName

2540

("se.bsnet.fukt.Mandos", bus,

2541

do_not_queue=True))

2561

bus,

2562

do_not_queue=True)

2563

old_bus_name = dbus.service.BusName(

2564

"se.bsnet.fukt.Mandos", bus,

2565

do_not_queue=True)

2542

2566

except dbus.exceptions.NameExistsException as e:

2543

2567

logger.error("Disabling D-Bus:", exc_info=e)

2544

2568

use_dbus = False

2546

2570

tcp_server.use_dbus = False

2547

2571

if zeroconf:

2548

2572

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2549

service = AvahiServiceToSyslog(name =

2550

server_settings["servicename"],

2551

servicetype = "_mandos._tcp",

2552

protocol = protocol, bus = bus)

2573

service = AvahiServiceToSyslog(

2574

name = server_settings["servicename"],

2575

servicetype = "_mandos._tcp",

2576

protocol = protocol,

2577

bus = bus)

2553

2578

if server_settings["interface"]:

2554

service.interface = (if_nametoindex

2555

(str(server_settings["interface"])))

2579

service.interface = if_nametoindex(

2580

server_settings["interface"].encode("utf-8"))

2556

2581

2557

2582

global multiprocessing_manager

2558

2583

multiprocessing_manager = multiprocessing.Manager()

2577

2602

if server_settings["restore"]:

2578

2603

try:

2579

2604

with open(stored_state_path, "rb") as stored_state:

2580

clients_data, old_client_settings = (pickle.load

2581

(stored_state))

2605

clients_data, old_client_settings = pickle.load(

2606

stored_state)

2582

2607

os.remove(stored_state_path)

2583

2608

except IOError as e:

2584

2609

if e.errno == errno.ENOENT:

2585

logger.warning("Could not load persistent state: {}"

2586

.format(os.strerror(e.errno)))

2610

logger.warning("Could not load persistent state:"

2611

" {}".format(os.strerror(e.errno)))

2587

2612

else:

2588

2613

logger.critical("Could not load persistent state:",

2589

2614

exc_info=e)

2590

2615

raise

2591

2616

except EOFError as e:

2592

2617

logger.warning("Could not load persistent state: "

2593

"EOFError:", exc_info=e)

2618

"EOFError:",

2619

exc_info=e)

2594

2620

2595

2621

with PGPEngine() as pgp:

2596

2622

for client_name, client in clients_data.items():

2608

2634

# For each value in new config, check if it

2609

2635

# differs from the old config value (Except for

2610

2636

# the "secret" attribute)

2611

if (name != "secret" and

2612

value != old_client_settings[client_name]

2613

[name]):

2637

if (name != "secret"

2638

and (value !=

2639

old_client_settings[client_name][name])):

2614

2640

client[name] = value

2615

2641

except KeyError:

2616

2642

pass

2625

2651

if not client["last_checked_ok"]:

2626

2652

logger.warning(

2627

2653

"disabling client {} - Client never "

2628

"performed a successful checker"

2629

.format(client_name))

2654

"performed a successful checker".format(

2655

client_name))

2630

2656

client["enabled"] = False

2631

2657

elif client["last_checker_status"] != 0:

2632

2658

logger.warning(

2633

2659

"disabling client {} - Client last"

2634

" checker failed with error code {}"

2635

.format(client_name,

2636

client["last_checker_status"]))

2660

" checker failed with error code"

2661

" {}".format(

2662

client_name,

2663

client["last_checker_status"]))

2637

2664

client["enabled"] = False

2638

2665

else:

2639

client["expires"] = (datetime.datetime

2640

.utcnow()

2641

+ client["timeout"])

2666

client["expires"] = (

2667

datetime.datetime.utcnow()

2668

+ client["timeout"])

2642

2669

logger.debug("Last checker succeeded,"

2643

" keeping {} enabled"

2644

.format(client_name))

2670

" keeping {} enabled".format(

2671

client_name))

2645

2672

try:

2646

client["secret"] = (

2647

pgp.decrypt(client["encrypted_secret"],

2648

client_settings[client_name]

2649

["secret"]))

2673

client["secret"] = pgp.decrypt(

2674

client["encrypted_secret"],

2675

client_settings[client_name]["secret"])

2650

2676

except PGPError:

2651

2677

# If decryption fails, we use secret from new settings

2652

logger.debug("Failed to decrypt {} old secret"

2653

.format(client_name))

2654

client["secret"] = (

2655

client_settings[client_name]["secret"])

2678

logger.debug("Failed to decrypt {} old secret".format(

2679

client_name))

2680

client["secret"] = (client_settings[client_name]

2681

["secret"])

2656

2682

2657

2683

# Add/remove clients based on new changes made to config

2658

2684

for client_name in (set(old_client_settings)

2665

2691

# Create all client objects

2666

2692

for client_name, client in clients_data.items():

2667

2693

tcp_server.clients[client_name] = client_class(

2668

name = client_name, settings = client,

2694

name = client_name,

2695

settings = client,

2669

2696

server_settings = server_settings)

2670

2697

2671

2698

if not tcp_server.clients:

2676

2703

try:

2677

2704

with pidfile:

2678

2705

pid = os.getpid()

2679

pidfile.write(str(pid) + "\n".encode("utf-8"))

2706

pidfile.write("{}\n".format(pid).encode("utf-8"))

2680

2707

except IOError:

2681

2708

logger.error("Could not write to file %r with PID %d",

2682

2709

pidfilename, pid)

2687

2714

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2688

2715

2689

2716

if use_dbus:

2690

@alternate_dbus_interfaces({"se.recompile.Mandos":

2691

"se.bsnet.fukt.Mandos"})

2717

2718

@alternate_dbus_interfaces(

2719

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

2692

2720

class MandosDBusService(DBusObjectWithProperties):

2693

2721

"""A D-Bus proxy object"""

2722

2694

2723

def __init__(self):

2695

2724

dbus.service.Object.__init__(self, bus, "/")

2725

2696

2726

_interface = "se.recompile.Mandos"

2697

2727

2698

2728

@dbus_interface_annotations(_interface)

2699

2729

def _foo(self):

2700

return { "org.freedesktop.DBus.Property"

2701

".EmitsChangedSignal":

2702

"false"}

2730

return {

2731

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2732

"false" }

2703

2733

2704

2734

@dbus.service.signal(_interface, signature="o")

2705

2735

def ClientAdded(self, objpath):

2719

2749

@dbus.service.method(_interface, out_signature="ao")

2720

2750

def GetAllClients(self):

2721

2751

"D-Bus method"

2722

return dbus.Array(c.dbus_object_path

2723

for c in

2752

return dbus.Array(c.dbus_object_path for c in

2724

2753

tcp_server.clients.itervalues())

2725

2754

2726

2755

@dbus.service.method(_interface,

2728

2757

def GetAllClientsWithProperties(self):

2729

2758

"D-Bus method"

2730

2759

return dbus.Dictionary(

2731

((c.dbus_object_path, c.GetAll(""))

2732

for c in tcp_server.clients.itervalues()),

2760

{ c.dbus_object_path: c.GetAll("")

2761

for c in tcp_server.clients.itervalues() },

2733

2762

signature="oa{sv}")

2734

2763

2735

2764

@dbus.service.method(_interface, in_signature="o")

2775

2804

# + secret.

2776

2805

exclude = { "bus", "changedstate", "secret",

2777

2806

"checker", "server_settings" }

2778

for name, typ in (inspect.getmembers

2779

(dbus.service.Object)):

2807

for name, typ in inspect.getmembers(dbus.service

2808

.Object):

2780

2809

exclude.add(name)

2781

2810

2782

2811

client_dict["encrypted_secret"] = (client

2789

2818

del client_settings[client.name]["secret"]

2790

2819

2791

2820

try:

2792

with (tempfile.NamedTemporaryFile

2793

(mode='wb', suffix=".pickle", prefix='clients-',

2794

dir=os.path.dirname(stored_state_path),

2795

delete=False)) as stored_state:

2821

with tempfile.NamedTemporaryFile(

2822

mode='wb',

2823

suffix=".pickle",

2824

prefix='clients-',

2825

dir=os.path.dirname(stored_state_path),

2826

delete=False) as stored_state:

2796

2827

pickle.dump((clients, client_settings), stored_state)

2797

tempname=stored_state.name

2828

tempname = stored_state.name

2798

2829

os.rename(tempname, stored_state_path)

2799

2830

except (IOError, OSError) as e:

2800

2831

if not debug:

2819

2850

client.disable(quiet=True)

2820

2851

if use_dbus:

2821

2852

# Emit D-Bus signal

2822

mandos_dbus_service.ClientRemoved(client

2823

.dbus_object_path,

2824

client.name)

2853

mandos_dbus_service.ClientRemoved(

2854

client.dbus_object_path, client.name)

2825

2855

client_settings.clear()

2826

2856

2827

2857

atexit.register(cleanup)

2880

2910

# Must run before the D-Bus bus name gets deregistered

2881

2911

cleanup()

2882

2912

2913

2883

2914

if __name__ == '__main__':

2884

2915

main()