/mandos/trunk : revision 750

1

#!/usr/bin/python

1

#!/usr/bin/python2.7

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

44

import argparse

45

import datetime

46

import errno

47

import gnutls.crypto

48

import gnutls.connection

49

import gnutls.errors

50

import gnutls.library.functions

51

import gnutls.library.constants

52

import gnutls.library.types

47

53

try:

48

54

import ConfigParser as configparser

49

55

except ImportError:

72

78

import tempfile

73

79

import itertools

74

80

import collections

75

import codecs

76

81

77

82

import dbus

78

83

import dbus.service

98

103

if sys.version_info.major == 2:

99

104

str = unicode

100

105

101

version = "1.7.2"

106

version = "1.6.9"

102

107

stored_state_file = "clients.pickle"

103

108

104

109

logger = logging.getLogger()

151

156

152

157

def __init__(self):

153

158

self.tempdir = tempfile.mkdtemp(prefix="mandos-")

154

self.gpg = "gpg"

155

try:

156

output = subprocess.check_output(["gpgconf"])

157

for line in output.splitlines():

158

name, text, path = line.split(":")

159

if name == "gpg":

160

self.gpg = path

161

break

162

except OSError as e:

163

if e.errno != errno.ENOENT:

164

raise

165

159

self.gnupgargs = ['--batch',

166

'--homedir', self.tempdir,

160

'--home', self.tempdir,

167

161

'--force-mdc',

168

162

'--quiet',

169

163

'--no-use-agent']

208

202

dir=self.tempdir) as passfile:

209

203

passfile.write(passphrase)

210

204

passfile.flush()

211

proc = subprocess.Popen([self.gpg, '--symmetric',

205

proc = subprocess.Popen(['gpg', '--symmetric',

212

206

'--passphrase-file',

213

207

passfile.name]

214

208

+ self.gnupgargs,

226

220

dir = self.tempdir) as passfile:

227

221

passfile.write(passphrase)

228

222

passfile.flush()

229

proc = subprocess.Popen([self.gpg, '--decrypt',

223

proc = subprocess.Popen(['gpg', '--decrypt',

230

224

'--passphrase-file',

231

225

passfile.name]

232

226

+ self.gnupgargs,

400

394

logger.error(bad_states[state] + ": %r", error)

401

395

self.cleanup()

402

396

elif state == avahi.SERVER_RUNNING:

403

try:

404

self.add()

405

except dbus.exceptions.DBusException as error:

406

if (error.get_dbus_name()

407

== "org.freedesktop.Avahi.CollisionError"):

408

logger.info("Local Zeroconf service name"

409

" collision.")

410

return self.rename(remove=False)

411

else:

412

logger.critical("D-Bus Exception", exc_info=error)

413

self.cleanup()

414

os._exit(1)

397

self.add()

415

398

else:

416

399

if error is None:

417

400

logger.debug("Unknown state: %r", state)

440

423

.format(self.name)))

441

424

return ret

442

425

443

# Pretend that we have a GnuTLS module

444

class GnuTLS(object):

445

"""This isn't so much a class as it is a module-like namespace.

446

It is instantiated once, and simulates having a GnuTLS module."""

447

448

_library = ctypes.cdll.LoadLibrary(

449

ctypes.util.find_library("gnutls"))

450

_need_version = "3.3.0"

451

def __init__(self):

452

# Need to use class name "GnuTLS" here, since this method is

453

# called before the assignment to the "gnutls" global variable

454

# happens.

455

if GnuTLS.check_version(self._need_version) is None:

456

raise GnuTLS.Error("Needs GnuTLS {} or later"

457

.format(self._need_version))

458

459

# Unless otherwise indicated, the constants and types below are

460

# all from the gnutls/gnutls.h C header file.

461

462

# Constants

463

E_SUCCESS = 0

464

E_INTERRUPTED = -52

465

E_AGAIN = -28

466

CRT_OPENPGP = 2

467

CLIENT = 2

468

SHUT_RDWR = 0

469

CRD_CERTIFICATE = 1

470

E_NO_CERTIFICATE_FOUND = -49

471

OPENPGP_FMT_RAW = 0 # gnutls/openpgp.h

472

473

# Types

474

class session_int(ctypes.Structure):

475

_fields_ = []

476

session_t = ctypes.POINTER(session_int)

477

class certificate_credentials_st(ctypes.Structure):

478

_fields_ = []

479

certificate_credentials_t = ctypes.POINTER(

480

certificate_credentials_st)

481

certificate_type_t = ctypes.c_int

482

class datum_t(ctypes.Structure):

483

_fields_ = [('data', ctypes.POINTER(ctypes.c_ubyte)),

484

('size', ctypes.c_uint)]

485

class openpgp_crt_int(ctypes.Structure):

486

_fields_ = []

487

openpgp_crt_t = ctypes.POINTER(openpgp_crt_int)

488

openpgp_crt_fmt_t = ctypes.c_int # gnutls/openpgp.h

489

log_func = ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_char_p)

490

credentials_type_t = ctypes.c_int #

491

transport_ptr_t = ctypes.c_void_p

492

close_request_t = ctypes.c_int

493

494

# Exceptions

495

class Error(Exception):

496

# We need to use the class name "GnuTLS" here, since this

497

# exception might be raised from within GnuTLS.__init__,

498

# which is called before the assignment to the "gnutls"

499

# global variable has happened.

500

def __init__(self, message = None, code = None, args=()):

501

# Default usage is by a message string, but if a return

502

# code is passed, convert it to a string with

503

# gnutls.strerror()

504

self.code = code

505

if message is None and code is not None:

506

message = GnuTLS.strerror(code)

507

return super(GnuTLS.Error, self).__init__(

508

message, *args)

509

510

class CertificateSecurityError(Error):

511

pass

512

513

# Classes

514

class Credentials(object):

515

def __init__(self):

516

self._c_object = gnutls.certificate_credentials_t()

517

gnutls.certificate_allocate_credentials(

518

ctypes.byref(self._c_object))

519

self.type = gnutls.CRD_CERTIFICATE

520

521

def __del__(self):

522

gnutls.certificate_free_credentials(self._c_object)

523

524

class ClientSession(object):

525

def __init__(self, socket, credentials = None):

526

self._c_object = gnutls.session_t()

527

gnutls.init(ctypes.byref(self._c_object), gnutls.CLIENT)

528

gnutls.set_default_priority(self._c_object)

529

gnutls.transport_set_ptr(self._c_object, socket.fileno())

530

gnutls.handshake_set_private_extensions(self._c_object,

531

True)

532

self.socket = socket

533

if credentials is None:

534

credentials = gnutls.Credentials()

535

gnutls.credentials_set(self._c_object, credentials.type,

536

ctypes.cast(credentials._c_object,

537

ctypes.c_void_p))

538

self.credentials = credentials

539

540

def __del__(self):

541

gnutls.deinit(self._c_object)

542

543

def handshake(self):

544

return gnutls.handshake(self._c_object)

545

546

def send(self, data):

547

data = bytes(data)

548

data_len = len(data)

549

while data_len > 0:

550

data_len -= gnutls.record_send(self._c_object,

551

data[-data_len:],

552

data_len)

553

554

def bye(self):

555

return gnutls.bye(self._c_object, gnutls.SHUT_RDWR)

556

557

# Error handling functions

558

def _error_code(result):

559

"""A function to raise exceptions on errors, suitable

560

for the 'restype' attribute on ctypes functions"""

561

if result >= 0:

562

return result

563

if result == gnutls.E_NO_CERTIFICATE_FOUND:

564

raise gnutls.CertificateSecurityError(code = result)

565

raise gnutls.Error(code = result)

566

567

def _retry_on_error(result, func, arguments):

568

"""A function to retry on some errors, suitable

569

for the 'errcheck' attribute on ctypes functions"""

570

while result < 0:

571

if result not in (gnutls.E_INTERRUPTED, gnutls.E_AGAIN):

572

return _error_code(result)

573

result = func(*arguments)

574

return result

575

576

# Unless otherwise indicated, the function declarations below are

577

# all from the gnutls/gnutls.h C header file.

578

579

# Functions

580

priority_set_direct = _library.gnutls_priority_set_direct

581

priority_set_direct.argtypes = [session_t, ctypes.c_char_p,

582

ctypes.POINTER(ctypes.c_char_p)]

583

priority_set_direct.restype = _error_code

584

585

init = _library.gnutls_init

586

init.argtypes = [ctypes.POINTER(session_t), ctypes.c_int]

587

init.restype = _error_code

588

589

set_default_priority = _library.gnutls_set_default_priority

590

set_default_priority.argtypes = [session_t]

591

set_default_priority.restype = _error_code

592

593

record_send = _library.gnutls_record_send

594

record_send.argtypes = [session_t, ctypes.c_void_p,

595

ctypes.c_size_t]

596

record_send.restype = ctypes.c_ssize_t

597

record_send.errcheck = _retry_on_error

598

599

certificate_allocate_credentials = (

600

_library.gnutls_certificate_allocate_credentials)

601

certificate_allocate_credentials.argtypes = [

602

ctypes.POINTER(certificate_credentials_t)]

603

certificate_allocate_credentials.restype = _error_code

604

605

certificate_free_credentials = (

606

_library.gnutls_certificate_free_credentials)

607

certificate_free_credentials.argtypes = [certificate_credentials_t]

608

certificate_free_credentials.restype = None

609

610

handshake_set_private_extensions = (

611

_library.gnutls_handshake_set_private_extensions)

612

handshake_set_private_extensions.argtypes = [session_t,

613

ctypes.c_int]

614

handshake_set_private_extensions.restype = None

615

616

credentials_set = _library.gnutls_credentials_set

617

credentials_set.argtypes = [session_t, credentials_type_t,

618

ctypes.c_void_p]

619

credentials_set.restype = _error_code

620

621

strerror = _library.gnutls_strerror

622

strerror.argtypes = [ctypes.c_int]

623

strerror.restype = ctypes.c_char_p

624

625

certificate_type_get = _library.gnutls_certificate_type_get

626

certificate_type_get.argtypes = [session_t]

627

certificate_type_get.restype = _error_code

628

629

certificate_get_peers = _library.gnutls_certificate_get_peers

630

certificate_get_peers.argtypes = [session_t,

631

ctypes.POINTER(ctypes.c_uint)]

632

certificate_get_peers.restype = ctypes.POINTER(datum_t)

633

634

global_set_log_level = _library.gnutls_global_set_log_level

635

global_set_log_level.argtypes = [ctypes.c_int]

636

global_set_log_level.restype = None

637

638

global_set_log_function = _library.gnutls_global_set_log_function

639

global_set_log_function.argtypes = [log_func]

640

global_set_log_function.restype = None

641

642

deinit = _library.gnutls_deinit

643

deinit.argtypes = [session_t]

644

deinit.restype = None

645

646

handshake = _library.gnutls_handshake

647

handshake.argtypes = [session_t]

648

handshake.restype = _error_code

649

handshake.errcheck = _retry_on_error

650

651

transport_set_ptr = _library.gnutls_transport_set_ptr

652

transport_set_ptr.argtypes = [session_t, transport_ptr_t]

653

transport_set_ptr.restype = None

654

655

bye = _library.gnutls_bye

656

bye.argtypes = [session_t, close_request_t]

657

bye.restype = _error_code

658

bye.errcheck = _retry_on_error

659

660

check_version = _library.gnutls_check_version

661

check_version.argtypes = [ctypes.c_char_p]

662

check_version.restype = ctypes.c_char_p

663

664

# All the function declarations below are from gnutls/openpgp.h

665

666

openpgp_crt_init = _library.gnutls_openpgp_crt_init

667

openpgp_crt_init.argtypes = [ctypes.POINTER(openpgp_crt_t)]

668

openpgp_crt_init.restype = _error_code

669

670

openpgp_crt_import = _library.gnutls_openpgp_crt_import

671

openpgp_crt_import.argtypes = [openpgp_crt_t,

672

ctypes.POINTER(datum_t),

673

openpgp_crt_fmt_t]

674

openpgp_crt_import.restype = _error_code

675

676

openpgp_crt_verify_self = _library.gnutls_openpgp_crt_verify_self

677

openpgp_crt_verify_self.argtypes = [openpgp_crt_t, ctypes.c_uint,

678

ctypes.POINTER(ctypes.c_uint)]

679

openpgp_crt_verify_self.restype = _error_code

680

681

openpgp_crt_deinit = _library.gnutls_openpgp_crt_deinit

682

openpgp_crt_deinit.argtypes = [openpgp_crt_t]

683

openpgp_crt_deinit.restype = None

684

685

openpgp_crt_get_fingerprint = (

686

_library.gnutls_openpgp_crt_get_fingerprint)

687

openpgp_crt_get_fingerprint.argtypes = [openpgp_crt_t,

688

ctypes.c_void_p,

689

ctypes.POINTER(

690

ctypes.c_size_t)]

691

openpgp_crt_get_fingerprint.restype = _error_code

692

693

# Remove non-public functions

694

del _error_code, _retry_on_error

695

# Create the global "gnutls" object, simulating a module

696

gnutls = GnuTLS()

697

698

def call_pipe(connection, # : multiprocessing.Connection

699

func, *args, **kwargs):

700

"""This function is meant to be called by multiprocessing.Process

701

702

This function runs func(*args, **kwargs), and writes the resulting

703

return value on the provided multiprocessing.Connection.

704

"""

705

connection.send(func(*args, **kwargs))

706

connection.close()

707

426

708

427

class Client(object):

709

428

"""A representation of a client host served by this server.

736

455

last_checker_status: integer between 0 and 255 reflecting exit

737

456

status of last checker. -1 reflects crashed

738

457

checker, -2 means no checker completed yet.

739

last_checker_signal: The signal which killed the last checker, if

740

last_checker_status is -1

741

458

last_enabled: datetime.datetime(); (UTC) or None

742

459

name: string; from the config file, used in log messages and

743

460

D-Bus identifiers

917

634

# Also start a new checker *right now*.

918

635

self.start_checker()

919

636

920

def checker_callback(self, source, condition, connection,

921

command):

637

def checker_callback(self, pid, condition, command):

922

638

"""The checker has completed, so take appropriate actions."""

923

639

self.checker_callback_tag = None

924

640

self.checker = None

925

# Read return code from connection (see call_pipe)

926

returncode = connection.recv()

927

connection.close()

928

929

if returncode >= 0:

930

self.last_checker_status = returncode

931

self.last_checker_signal = None

641

if os.WIFEXITED(condition):

642

self.last_checker_status = os.WEXITSTATUS(condition)

932

643

if self.last_checker_status == 0:

933

644

logger.info("Checker for %(name)s succeeded",

934

645

vars(self))

937

648

logger.info("Checker for %(name)s failed", vars(self))

938

649

else:

939

650

self.last_checker_status = -1

940

self.last_checker_signal = -returncode

941

651

logger.warning("Checker for %(name)s crashed?",

942

652

vars(self))

943

return False

944

653

945

654

def checked_ok(self):

946

655

"""Assert that the client has been seen, alive and well."""

947

656

self.last_checked_ok = datetime.datetime.utcnow()

948

657

self.last_checker_status = 0

949

self.last_checker_signal = None

950

658

self.bump_timeout()

951

659

952

660

def bump_timeout(self, timeout=None):

978

686

# than 'timeout' for the client to be disabled, which is as it

979

687

# should be.

980

688

981

if self.checker is not None and not self.checker.is_alive():

982

logger.warning("Checker was not alive; joining")

983

self.checker.join()

984

self.checker = None

689

# If a checker exists, make sure it is not a zombie

690

try:

691

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

692

except AttributeError:

693

pass

694

except OSError as error:

695

if error.errno != errno.ECHILD:

696

raise

697

else:

698

if pid:

699

logger.warning("Checker was a zombie")

700

gobject.source_remove(self.checker_callback_tag)

701

self.checker_callback(pid, status,

702

self.current_checker_command)

985

703

# Start a new checker if needed

986

704

if self.checker is None:

987

705

# Escape attributes for the shell

996

714

exc_info=error)

997

715

return True # Try again later

998

716

self.current_checker_command = command

999

logger.info("Starting checker %r for %s", command,

1000

self.name)

1001

# We don't need to redirect stdout and stderr, since

1002

# in normal mode, that is already done by daemon(),

1003

# and in debug mode we don't want to. (Stdin is

1004

# always replaced by /dev/null.)

1005

# The exception is when not debugging but nevertheless

1006

# running in the foreground; use the previously

1007

# created wnull.

1008

popen_args = { "close_fds": True,

1009

"shell": True,

1010

"cwd": "/" }

1011

if (not self.server_settings["debug"]

1012

and self.server_settings["foreground"]):

1013

popen_args.update({"stdout": wnull,

1014

"stderr": wnull })

1015

pipe = multiprocessing.Pipe(duplex = False)

1016

self.checker = multiprocessing.Process(

1017

target = call_pipe,

1018

args = (pipe[1], subprocess.call, command),

1019

kwargs = popen_args)

1020

self.checker.start()

1021

self.checker_callback_tag = gobject.io_add_watch(

1022

pipe[0].fileno(), gobject.IO_IN,

1023

self.checker_callback, pipe[0], command)

717

try:

718

logger.info("Starting checker %r for %s", command,

719

self.name)

720

# We don't need to redirect stdout and stderr, since

721

# in normal mode, that is already done by daemon(),

722

# and in debug mode we don't want to. (Stdin is

723

# always replaced by /dev/null.)

724

# The exception is when not debugging but nevertheless

725

# running in the foreground; use the previously

726

# created wnull.

727

popen_args = {}

728

if (not self.server_settings["debug"]

729

and self.server_settings["foreground"]):

730

popen_args.update({"stdout": wnull,

731

"stderr": wnull })

732

self.checker = subprocess.Popen(command,

733

close_fds=True,

734

shell=True,

735

cwd="/",

736

**popen_args)

737

except OSError as error:

738

logger.error("Failed to start subprocess",

739

exc_info=error)

740

return True

741

self.checker_callback_tag = gobject.child_watch_add(

742

self.checker.pid, self.checker_callback, data=command)

743

# The checker may have completed before the gobject

744

# watch was added. Check for this.

745

try:

746

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

747

except OSError as error:

748

if error.errno == errno.ECHILD:

749

# This should never happen

750

logger.error("Child process vanished",

751

exc_info=error)

752

return True

753

raise

754

if pid:

755

gobject.source_remove(self.checker_callback_tag)

756

self.checker_callback(pid, status, command)

1024

757

# Re-run this periodically if run by gobject.timeout_add

1025

758

return True

1026

759

1032

765

if getattr(self, "checker", None) is None:

1033

766

return

1034

767

logger.debug("Stopping checker for %(name)s", vars(self))

1035

self.checker.terminate()

768

try:

769

self.checker.terminate()

770

#time.sleep(0.5)

771

#if self.checker.poll() is None:

772

# self.checker.kill()

773

except OSError as error:

774

if error.errno != errno.ESRCH: # No such process

775

raise

1036

776

self.checker = None

1037

777

1038

778

1102

842

access="r")

1103

843

def Property_dbus_property(self):

1104

844

return dbus.Boolean(False)

1105

1106

See also the DBusObjectWithAnnotations class.

1107

845

"""

1108

846

1109

847

def decorator(func):

1131

869

pass

1132

870

1133

871

1134

class DBusObjectWithAnnotations(dbus.service.Object):

1135

"""A D-Bus object with annotations.

872

class DBusObjectWithProperties(dbus.service.Object):

873

"""A D-Bus object with properties.

1136

874

1137

Classes inheriting from this can use the dbus_annotations

1138

decorator to add annotations to methods or signals.

875

Classes inheriting from this can use the dbus_service_property

876

decorator to expose methods as D-Bus properties. It exposes the

877

standard Get(), Set(), and GetAll() methods on the D-Bus.

1139

878

"""

1140

879

1141

880

@staticmethod

1157

896

for name, athing in

1158

897

inspect.getmembers(cls, self._is_dbus_thing(thing)))

1159

898

1160

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1161

out_signature = "s",

1162

path_keyword = 'object_path',

1163

connection_keyword = 'connection')

1164

def Introspect(self, object_path, connection):

1165

"""Overloading of standard D-Bus method.

1166

1167

Inserts annotation tags on methods and signals.

1168

"""

1169

xmlstring = dbus.service.Object.Introspect(self, object_path,

1170

connection)

1171

try:

1172

document = xml.dom.minidom.parseString(xmlstring)

1173

1174

for if_tag in document.getElementsByTagName("interface"):

1175

# Add annotation tags

1176

for typ in ("method", "signal"):

1177

for tag in if_tag.getElementsByTagName(typ):

1178

annots = dict()

1179

for name, prop in (self.

1180

_get_all_dbus_things(typ)):

1181

if (name == tag.getAttribute("name")

1182

and prop._dbus_interface

1183

== if_tag.getAttribute("name")):

1184

annots.update(getattr(

1185

prop, "_dbus_annotations", {}))

1186

for name, value in annots.items():

1187

ann_tag = document.createElement(

1188

"annotation")

1189

ann_tag.setAttribute("name", name)

1190

ann_tag.setAttribute("value", value)

1191

tag.appendChild(ann_tag)

1192

# Add interface annotation tags

1193

for annotation, value in dict(

1194

itertools.chain.from_iterable(

1195

annotations().items()

1196

for name, annotations

1197

in self._get_all_dbus_things("interface")

1198

if name == if_tag.getAttribute("name")

1199

)).items():

1200

ann_tag = document.createElement("annotation")

1201

ann_tag.setAttribute("name", annotation)

1202

ann_tag.setAttribute("value", value)

1203

if_tag.appendChild(ann_tag)

1204

# Fix argument name for the Introspect method itself

1205

if (if_tag.getAttribute("name")

1206

== dbus.INTROSPECTABLE_IFACE):

1207

for cn in if_tag.getElementsByTagName("method"):

1208

if cn.getAttribute("name") == "Introspect":

1209

for arg in cn.getElementsByTagName("arg"):

1210

if (arg.getAttribute("direction")

1211

== "out"):

1212

arg.setAttribute("name",

1213

"xml_data")

1214

xmlstring = document.toxml("utf-8")

1215

document.unlink()

1216

except (AttributeError, xml.dom.DOMException,

1217

xml.parsers.expat.ExpatError) as error:

1218

logger.error("Failed to override Introspection method",

1219

exc_info=error)

1220

return xmlstring

1221

1222

1223

class DBusObjectWithProperties(DBusObjectWithAnnotations):

1224

"""A D-Bus object with properties.

1225

1226

Classes inheriting from this can use the dbus_service_property

1227

decorator to expose methods as D-Bus properties. It exposes the

1228

standard Get(), Set(), and GetAll() methods on the D-Bus.

1229

"""

1230

1231

899

def _get_dbus_property(self, interface_name, property_name):

1232

900

"""Returns a bound method if one exists which is a D-Bus

1233

901

property with the specified name and interface.

1243

911

raise DBusPropertyNotFound("{}:{}.{}".format(

1244

912

self.dbus_object_path, interface_name, property_name))

1245

913

1246

@classmethod

1247

def _get_all_interface_names(cls):

1248

"""Get a sequence of all interfaces supported by an object"""

1249

return (name for name in set(getattr(getattr(x, attr),

1250

"_dbus_interface", None)

1251

for x in (inspect.getmro(cls))

1252

for attr in dir(x))

1253

if name is not None)

1254

1255

914

@dbus.service.method(dbus.PROPERTIES_IFACE,

1256

915

in_signature="ss",

1257

916

out_signature="v")

1327

986

1328

987

Inserts property tags and interface annotation tags.

1329

988

"""

1330

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1331

object_path,

1332

connection)

989

xmlstring = dbus.service.Object.Introspect(self, object_path,

990

connection)

1333

991

try:

1334

992

document = xml.dom.minidom.parseString(xmlstring)

1335

993

1348

1006

if prop._dbus_interface

1349

1007

== if_tag.getAttribute("name")):

1350

1008

if_tag.appendChild(tag)

1351

# Add annotation tags for properties

1352

for tag in if_tag.getElementsByTagName("property"):

1353

annots = dict()

1354

for name, prop in self._get_all_dbus_things(

1355

"property"):

1356

if (name == tag.getAttribute("name")

1357

and prop._dbus_interface

1358

== if_tag.getAttribute("name")):

1359

annots.update(getattr(

1360

prop, "_dbus_annotations", {}))

1361

for name, value in annots.items():

1362

ann_tag = document.createElement(

1363

"annotation")

1364

ann_tag.setAttribute("name", name)

1365

ann_tag.setAttribute("value", value)

1366

tag.appendChild(ann_tag)

1009

# Add annotation tags

1010

for typ in ("method", "signal", "property"):

1011

for tag in if_tag.getElementsByTagName(typ):

1012

annots = dict()

1013

for name, prop in (self.

1014

_get_all_dbus_things(typ)):

1015

if (name == tag.getAttribute("name")

1016

and prop._dbus_interface

1017

== if_tag.getAttribute("name")):

1018

annots.update(getattr(

1019

prop, "_dbus_annotations", {}))

1020

for name, value in annots.items():

1021

ann_tag = document.createElement(

1022

"annotation")

1023

ann_tag.setAttribute("name", name)

1024

ann_tag.setAttribute("value", value)

1025

tag.appendChild(ann_tag)

1026

# Add interface annotation tags

1027

for annotation, value in dict(

1028

itertools.chain.from_iterable(

1029

annotations().items()

1030

for name, annotations

1031

in self._get_all_dbus_things("interface")

1032

if name == if_tag.getAttribute("name")

1033

)).items():

1034

ann_tag = document.createElement("annotation")

1035

ann_tag.setAttribute("name", annotation)

1036

ann_tag.setAttribute("value", value)

1037

if_tag.appendChild(ann_tag)

1367

1038

# Add the names to the return values for the

1368

1039

# "org.freedesktop.DBus.Properties" methods

1369

1040

if (if_tag.getAttribute("name")

1387

1058

exc_info=error)

1388

1059

return xmlstring

1389

1060

1390

try:

1391

dbus.OBJECT_MANAGER_IFACE

1392

except AttributeError:

1393

dbus.OBJECT_MANAGER_IFACE = "org.freedesktop.DBus.ObjectManager"

1394

1395

class DBusObjectWithObjectManager(DBusObjectWithAnnotations):

1396

"""A D-Bus object with an ObjectManager.

1397

1398

Classes inheriting from this exposes the standard

1399

GetManagedObjects call and the InterfacesAdded and

1400

InterfacesRemoved signals on the standard

1401

"org.freedesktop.DBus.ObjectManager" interface.

1402

1403

Note: No signals are sent automatically; they must be sent

1404

manually.

1405

"""

1406

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

1407

out_signature = "a{oa{sa{sv}}}")

1408

def GetManagedObjects(self):

1409

"""This function must be overridden"""

1410

raise NotImplementedError()

1411

1412

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE,

1413

signature = "oa{sa{sv}}")

1414

def InterfacesAdded(self, object_path, interfaces_and_properties):

1415

pass

1416

1417

@dbus.service.signal(dbus.OBJECT_MANAGER_IFACE, signature = "oas")

1418

def InterfacesRemoved(self, object_path, interfaces):

1419

pass

1420

1421

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

1422

out_signature = "s",

1423

path_keyword = 'object_path',

1424

connection_keyword = 'connection')

1425

def Introspect(self, object_path, connection):

1426

"""Overloading of standard D-Bus method.

1427

1428

Override return argument name of GetManagedObjects to be

1429

"objpath_interfaces_and_properties"

1430

"""

1431

xmlstring = DBusObjectWithAnnotations.Introspect(self,

1432

object_path,

1433

connection)

1434

try:

1435

document = xml.dom.minidom.parseString(xmlstring)

1436

1437

for if_tag in document.getElementsByTagName("interface"):

1438

# Fix argument name for the GetManagedObjects method

1439

if (if_tag.getAttribute("name")

1440

== dbus.OBJECT_MANAGER_IFACE):

1441

for cn in if_tag.getElementsByTagName("method"):

1442

if (cn.getAttribute("name")

1443

== "GetManagedObjects"):

1444

for arg in cn.getElementsByTagName("arg"):

1445

if (arg.getAttribute("direction")

1446

== "out"):

1447

arg.setAttribute(

1448

"name",

1449

"objpath_interfaces"

1450

"_and_properties")

1451

xmlstring = document.toxml("utf-8")

1452

document.unlink()

1453

except (AttributeError, xml.dom.DOMException,

1454

xml.parsers.expat.ExpatError) as error:

1455

logger.error("Failed to override Introspection method",

1456

exc_info = error)

1457

return xmlstring

1458

1061

1459

1062

def datetime_to_dbus(dt, variant_level=0):

1460

1063

"""Convert a UTC datetime.datetime() to a D-Bus type."""

1507

1110

interface_names.add(alt_interface)

1508

1111

# Is this a D-Bus signal?

1509

1112

if getattr(attribute, "_dbus_is_signal", False):

1510

if sys.version_info.major == 2:

1511

# Extract the original non-method undecorated

1512

# function by black magic

1513

nonmethod_func = (dict(

1514

zip(attribute.func_code.co_freevars,

1515

attribute.__closure__))

1516

["func"].cell_contents)

1517

else:

1518

nonmethod_func = attribute

1113

# Extract the original non-method undecorated

1114

# function by black magic

1115

nonmethod_func = (dict(

1116

zip(attribute.func_code.co_freevars,

1117

attribute.__closure__))

1118

["func"].cell_contents)

1519

1119

# Create a new, but exactly alike, function

1520

1120

# object, and decorate it to be a new D-Bus signal

1521

1121

# with the alternate D-Bus interface name

1522

if sys.version_info.major == 2:

1523

new_function = types.FunctionType(

1524

nonmethod_func.func_code,

1525

nonmethod_func.func_globals,

1526

nonmethod_func.func_name,

1527

nonmethod_func.func_defaults,

1528

nonmethod_func.func_closure)

1529

else:

1530

new_function = types.FunctionType(

1531

nonmethod_func.__code__,

1532

nonmethod_func.__globals__,

1533

nonmethod_func.__name__,

1534

nonmethod_func.__defaults__,

1535

nonmethod_func.__closure__)

1536

1122

new_function = (dbus.service.signal(

1537

alt_interface,

1538

attribute._dbus_signature)(new_function))

1123

alt_interface, attribute._dbus_signature)

1124

(types.FunctionType(

1125

nonmethod_func.func_code,

1126

nonmethod_func.func_globals,

1127

nonmethod_func.func_name,

1128

nonmethod_func.func_defaults,

1129

nonmethod_func.func_closure)))

1539

1130

# Copy annotations, if any

1540

1131

try:

1541

1132

new_function._dbus_annotations = dict(

1551

1142

func1 and func2 to the "call_both" function

1552

1143

outside of its arguments"""

1553

1144

1554

@functools.wraps(func2)

1555

1145

def call_both(*args, **kwargs):

1556

1146

"""This function will emit two D-Bus

1557

1147

signals by calling func1 and func2"""

1558

1148

func1(*args, **kwargs)

1559

1149

func2(*args, **kwargs)

1560

# Make wrapper function look like a D-Bus signal

1561

for name, attr in inspect.getmembers(func2):

1562

if name.startswith("_dbus_"):

1563

setattr(call_both, name, attr)

1564

1150

1565

1151

return call_both

1566

1152

# Create the "call_both" function and add it to

1769

1355

DBusObjectWithProperties.__del__(self, *args, **kwargs)

1770

1356

Client.__del__(self, *args, **kwargs)

1771

1357

1772

def checker_callback(self, source, condition,

1773

connection, command, *args, **kwargs):

1774

ret = Client.checker_callback(self, source, condition,

1775

connection, command, *args,

1776

**kwargs)

1777

exitstatus = self.last_checker_status

1778

if exitstatus >= 0:

1358

def checker_callback(self, pid, condition, command,

1359

*args, **kwargs):

1360

self.checker_callback_tag = None

1361

self.checker = None

1362

if os.WIFEXITED(condition):

1363

exitstatus = os.WEXITSTATUS(condition)

1779

1364

# Emit D-Bus signal

1780

1365

self.CheckerCompleted(dbus.Int16(exitstatus),

1781

# This is specific to GNU libC

1782

dbus.Int64(exitstatus << 8),

1366

dbus.Int64(condition),

1783

1367

dbus.String(command))

1784

1368

else:

1785

1369

# Emit D-Bus signal

1786

1370

self.CheckerCompleted(dbus.Int16(-1),

1787

dbus.Int64(

1788

# This is specific to GNU libC

1789

(exitstatus << 8)

1790

| self.last_checker_signal),

1371

dbus.Int64(condition),

1791

1372

dbus.String(command))

1792

return ret

1373

1374

return Client.checker_callback(self, pid, condition, command,

1375

*args, **kwargs)

1793

1376

1794

1377

def start_checker(self, *args, **kwargs):

1795

1378

old_checker_pid = getattr(self.checker, "pid", None)

1870

1453

self.checked_ok()

1871

1454

1872

1455

# Enable - method

1873

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1874

1456

@dbus.service.method(_interface)

1875

1457

def Enable(self):

1876

1458

"D-Bus method"

1877

1459

self.enable()

1878

1460

1879

1461

# StartChecker - method

1880

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1881

1462

@dbus.service.method(_interface)

1882

1463

def StartChecker(self):

1883

1464

"D-Bus method"

1884

1465

self.start_checker()

1885

1466

1886

1467

# Disable - method

1887

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1888

1468

@dbus.service.method(_interface)

1889

1469

def Disable(self):

1890

1470

"D-Bus method"

1891

1471

self.disable()

1892

1472

1893

1473

# StopChecker - method

1894

@dbus_annotations({"org.freedesktop.DBus.Deprecated": "true"})

1895

1474

@dbus.service.method(_interface)

1896

1475

def StopChecker(self):

1897

1476

self.stop_checker()

1933

1512

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1934

1513

1935

1514

# Name - property

1936

@dbus_annotations(

1937

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1938

1515

@dbus_service_property(_interface, signature="s", access="read")

1939

1516

def Name_dbus_property(self):

1940

1517

return dbus.String(self.name)

1941

1518

1942

1519

# Fingerprint - property

1943

@dbus_annotations(

1944

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1945

1520

@dbus_service_property(_interface, signature="s", access="read")

1946

1521

def Fingerprint_dbus_property(self):

1947

1522

return dbus.String(self.fingerprint)

1956

1531

self.host = str(value)

1957

1532

1958

1533

# Created - property

1959

@dbus_annotations(

1960

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const"})

1961

1534

@dbus_service_property(_interface, signature="s", access="read")

1962

1535

def Created_dbus_property(self):

1963

1536

return datetime_to_dbus(self.created)

2078

1651

self.stop_checker()

2079

1652

2080

1653

# ObjectPath - property

2081

@dbus_annotations(

2082

{"org.freedesktop.DBus.Property.EmitsChangedSignal": "const",

2083

"org.freedesktop.DBus.Deprecated": "true"})

2084

1654

@dbus_service_property(_interface, signature="o", access="read")

2085

1655

def ObjectPath_dbus_property(self):

2086

1656

return self.dbus_object_path # is already a dbus.ObjectPath

2087

1657

2088

1658

# Secret = property

2089

@dbus_annotations(

2090

{"org.freedesktop.DBus.Property.EmitsChangedSignal":

2091

"invalidates"})

2092

1659

@dbus_service_property(_interface,

2093

1660

signature="ay",

2094

1661

access="write",

2104

1671

self._pipe = child_pipe

2105

1672

self._pipe.send(('init', fpr, address))

2106

1673

if not self._pipe.recv():

2107

raise KeyError(fpr)

1674

raise KeyError()

2108

1675

2109

1676

def __getattribute__(self, name):

2110

1677

if name == '_pipe':

2140

1707

logger.debug("Pipe FD: %d",

2141

1708

self.server.child_pipe.fileno())

2142

1709

2143

session = gnutls.ClientSession(self.request)

1710

session = gnutls.connection.ClientSession(

1711

self.request, gnutls.connection .X509Credentials())

1712

1713

# Note: gnutls.connection.X509Credentials is really a

1714

# generic GnuTLS certificate credentials object so long as

1715

# no X.509 keys are added to it. Therefore, we can use it

1716

# here despite using OpenPGP certificates.

2144

1717

2145

1718

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

2146

1719

# "+AES-256-CBC", "+SHA1",

2150

1723

priority = self.server.gnutls_priority

2151

1724

if priority is None:

2152

1725

priority = "NORMAL"

2153

gnutls.priority_set_direct(session._c_object, priority,

2154

None)

1726

gnutls.library.functions.gnutls_priority_set_direct(

1727

session._c_object, priority, None)

2155

1728

2156

1729

# Start communication using the Mandos protocol

2157

1730

# Get protocol number

2167

1740

# Start GnuTLS connection

2168

1741

try:

2169

1742

session.handshake()

2170

except gnutls.Error as error:

1743

except gnutls.errors.GNUTLSError as error:

2171

1744

logger.warning("Handshake failed: %s", error)

2172

1745

# Do not run session.bye() here: the session is not

2173

1746

# established. Just abandon the request.

2179

1752

try:

2180

1753

fpr = self.fingerprint(

2181

1754

self.peer_certificate(session))

2182

except (TypeError, gnutls.Error) as error:

1755

except (TypeError,

1756

gnutls.errors.GNUTLSError) as error:

2183

1757

logger.warning("Bad certificate: %s", error)

2184

1758

return

2185

1759

logger.debug("Fingerprint: %s", fpr)

2243

1817

else:

2244

1818

delay -= time2 - time

2245

1819

2246

try:

2247

session.send(client.secret)

2248

except gnutls.Error as error:

2249

logger.warning("gnutls send failed",

2250

exc_info = error)

2251

return

1820

sent_size = 0

1821

while sent_size < len(client.secret):

1822

try:

1823

sent = session.send(client.secret[sent_size:])

1824

except gnutls.errors.GNUTLSError as error:

1825

logger.warning("gnutls send failed",

1826

exc_info=error)

1827

return

1828

logger.debug("Sent: %d, remaining: %d", sent,

1829

len(client.secret) - (sent_size

1830

+ sent))

1831

sent_size += sent

2252

1832

2253

1833

logger.info("Sending secret to %s", client.name)

2254

1834

# bump the timeout using extended_timeout

2262

1842

client.approvals_pending -= 1

2263

1843

try:

2264

1844

session.bye()

2265

except gnutls.Error as error:

1845

except gnutls.errors.GNUTLSError as error:

2266

1846

logger.warning("GnuTLS bye failed",

2267

1847

exc_info=error)

2268

1848

2270

1850

def peer_certificate(session):

2271

1851

"Return the peer's OpenPGP certificate as a bytestring"

2272

1852

# If not an OpenPGP certificate...

2273

if (gnutls.certificate_type_get(session._c_object)

2274

!= gnutls.CRT_OPENPGP):

2275

# ...return invalid data

2276

return b""

1853

if (gnutls.library.functions.gnutls_certificate_type_get(

1854

session._c_object)

1855

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1856

# ...do the normal thing

1857

return session.peer_certificate

2277

1858

list_size = ctypes.c_uint(1)

2278

cert_list = (gnutls.certificate_get_peers

1859

cert_list = (gnutls.library.functions

1860

.gnutls_certificate_get_peers

2279

1861

(session._c_object, ctypes.byref(list_size)))

2280

1862

if not bool(cert_list) and list_size.value != 0:

2281

raise gnutls.Error("error getting peer certificate")

1863

raise gnutls.errors.GNUTLSError("error getting peer"

1864

" certificate")

2282

1865

if list_size.value == 0:

2283

1866

return None

2284

1867

cert = cert_list[0]

2288

1871

def fingerprint(openpgp):

2289

1872

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

2290

1873

# New GnuTLS "datum" with the OpenPGP public key

2291

datum = gnutls.datum_t(

1874

datum = gnutls.library.types.gnutls_datum_t(

2292

1875

ctypes.cast(ctypes.c_char_p(openpgp),

2293

1876

ctypes.POINTER(ctypes.c_ubyte)),

2294

1877

ctypes.c_uint(len(openpgp)))

2295

1878

# New empty GnuTLS certificate

2296

crt = gnutls.openpgp_crt_t()

2297

gnutls.openpgp_crt_init(ctypes.byref(crt))

1879

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1880

gnutls.library.functions.gnutls_openpgp_crt_init(

1881

ctypes.byref(crt))

2298

1882

# Import the OpenPGP public key into the certificate

2299

gnutls.openpgp_crt_import(crt, ctypes.byref(datum),

2300

gnutls.OPENPGP_FMT_RAW)

1883

gnutls.library.functions.gnutls_openpgp_crt_import(

1884

crt, ctypes.byref(datum),

1885

gnutls.library.constants.GNUTLS_OPENPGP_FMT_RAW)

2301

1886

# Verify the self signature in the key

2302

1887

crtverify = ctypes.c_uint()

2303

gnutls.openpgp_crt_verify_self(crt, 0,

2304

ctypes.byref(crtverify))

1888

gnutls.library.functions.gnutls_openpgp_crt_verify_self(

1889

crt, 0, ctypes.byref(crtverify))

2305

1890

if crtverify.value != 0:

2306

gnutls.openpgp_crt_deinit(crt)

2307

raise gnutls.CertificateSecurityError("Verify failed")

1891

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1892

raise gnutls.errors.CertificateSecurityError(

1893

"Verify failed")

2308

1894

# New buffer for the fingerprint

2309

1895

buf = ctypes.create_string_buffer(20)

2310

1896

buf_len = ctypes.c_size_t()

2311

1897

# Get the fingerprint from the certificate into the buffer

2312

gnutls.openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

2313

ctypes.byref(buf_len))

1898

gnutls.library.functions.gnutls_openpgp_crt_get_fingerprint(

1899

crt, ctypes.byref(buf), ctypes.byref(buf_len))

2314

1900

# Deinit the certificate

2315

gnutls.openpgp_crt_deinit(crt)

1901

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

2316

1902

# Convert the buffer to a Python bytestring

2317

1903

fpr = ctypes.string_at(buf, buf_len.value)

2318

1904

# Convert the bytestring to hexadecimal notation

2554

2140

2555

2141

if command == 'getattr':

2556

2142

attrname = request[1]

2557

if isinstance(client_object.__getattribute__(attrname),

2558

collections.Callable):

2143

if callable(client_object.__getattribute__(attrname)):

2559

2144

parent_pipe.send(('function', ))

2560

2145

else:

2561

2146

parent_pipe.send((

2596

2181

# avoid excessive use of external libraries.

2597

2182

2598

2183

# New type for defining tokens, syntax, and semantics all-in-one

2184

Token = collections.namedtuple("Token",

2185

("regexp", # To match token; if

2186

# "value" is not None,

2187

# must have a "group"

2188

# containing digits

2189

"value", # datetime.timedelta or

2190

# None

2191

"followers")) # Tokens valid after

2192

# this token

2599

2193

Token = collections.namedtuple("Token", (

2600

2194

"regexp", # To match token; if "value" is not None, must have

2601

2195

# a "group" containing digits

2636

2230

# Define starting values

2637

2231

value = datetime.timedelta() # Value so far

2638

2232

found_token = None

2639

followers = frozenset((token_duration, )) # Following valid tokens

2233

followers = frozenset((token_duration,)) # Following valid tokens

2640

2234

s = duration # String left to parse

2641

2235

# Loop until end token is found

2642

2236

while found_token is not token_end:

2659

2253

break

2660

2254

else:

2661

2255

# No currently valid tokens were found

2662

raise ValueError("Invalid RFC 3339 duration: {!r}"

2663

.format(duration))

2256

raise ValueError("Invalid RFC 3339 duration")

2664

2257

# End token found

2665

2258

return value

2666

2259

2799

2392

"debug": "False",

2800

2393

"priority":

2801

2394

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP:!RSA"

2802

":+SIGN-DSA-SHA256",

2395

":+SIGN-RSA-SHA224:+SIGN-RSA-RMD160",

2803

2396

"servicename": "Mandos",

2804

2397

"use_dbus": "True",

2805

2398

"use_ipv6": "True",

2917

2510

pidfilename = "/var/run/mandos.pid"

2918

2511

pidfile = None

2919

2512

try:

2920

pidfile = codecs.open(pidfilename, "w", encoding="utf-8")

2513

pidfile = open(pidfilename, "w")

2921

2514

except IOError as e:

2922

2515

logger.error("Could not open file %r", pidfilename,

2923

2516

exc_info=e)

2944

2537

2945

2538

# "Use a log level over 10 to enable all debugging options."

2946

2539

# - GnuTLS manual

2947

gnutls.global_set_log_level(11)

2540

gnutls.library.functions.gnutls_global_set_log_level(11)

2948

2541

2949

@gnutls.log_func

2542

@gnutls.library.types.gnutls_log_func

2950

2543

def debug_gnutls(level, string):

2951

2544

logger.debug("GnuTLS: %s", string[:-1])

2952

2545

2953

gnutls.global_set_log_function(debug_gnutls)

2546

gnutls.library.functions.gnutls_global_set_log_function(

2547

debug_gnutls)

2954

2548

2955

2549

# Redirect stdin so all checkers get /dev/null

2956

2550

null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)

3060

2654

pass

3061

2655

3062

2656

# Clients who has passed its expire date can still be

3063

# enabled if its last checker was successful. A Client

2657

# enabled if its last checker was successful. Clients

3064

2658

# whose checker succeeded before we stored its state is

3065

2659

# assumed to have successfully run all checkers during

3066

2660

# downtime.

3118

2712

3119

2713

if not foreground:

3120

2714

if pidfile is not None:

3121

pid = os.getpid()

3122

2715

try:

3123

2716

with pidfile:

3124

print(pid, file=pidfile)

2717

pid = os.getpid()

2718

pidfile.write("{}\n".format(pid).encode("utf-8"))

3125

2719

except IOError:

3126

2720

logger.error("Could not write to file %r with PID %d",

3127

2721

pidfilename, pid)

3135

2729

3136

2730

@alternate_dbus_interfaces(

3137

2731

{ "se.recompile.Mandos": "se.bsnet.fukt.Mandos" })

3138

class MandosDBusService(DBusObjectWithObjectManager):

2732

class MandosDBusService(DBusObjectWithProperties):

3139

2733

"""A D-Bus proxy object"""

3140

2734

3141

2735

def __init__(self):

3143

2737

3144

2738

_interface = "se.recompile.Mandos"

3145

2739

2740

@dbus_interface_annotations(_interface)

2741

def _foo(self):

2742

return {

2743

"org.freedesktop.DBus.Property.EmitsChangedSignal":

2744

"false" }

2745

3146

2746

@dbus.service.signal(_interface, signature="o")

3147

2747

def ClientAdded(self, objpath):

3148

2748

"D-Bus signal"

3153

2753

"D-Bus signal"

3154

2754

pass

3155

2755

3156

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3157

"true"})

3158

2756

@dbus.service.signal(_interface, signature="os")

3159

2757

def ClientRemoved(self, objpath, name):

3160

2758

"D-Bus signal"

3161

2759

pass

3162

2760

3163

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3164

"true"})

3165

2761

@dbus.service.method(_interface, out_signature="ao")

3166

2762

def GetAllClients(self):

3167

2763

"D-Bus method"

3168

2764

return dbus.Array(c.dbus_object_path for c in

3169

2765

tcp_server.clients.itervalues())

3170

2766

3171

@dbus_annotations({"org.freedesktop.DBus.Deprecated":

3172

"true"})

3173

2767

@dbus.service.method(_interface,

3174

2768

out_signature="a{oa{sv}}")

3175

2769

def GetAllClientsWithProperties(self):

3176

2770

"D-Bus method"

3177

2771

return dbus.Dictionary(

3178

{ c.dbus_object_path: c.GetAll(

3179

"se.recompile.Mandos.Client")

2772

{ c.dbus_object_path: c.GetAll("")

3180

2773

for c in tcp_server.clients.itervalues() },

3181

2774

signature="oa{sv}")

3182

2775

3187

2780

if c.dbus_object_path == object_path:

3188

2781

del tcp_server.clients[c.name]

3189

2782

c.remove_from_connection()

3190

# Don't signal the disabling

2783

# Don't signal anything except ClientRemoved

3191

2784

c.disable(quiet=True)

3192

# Emit D-Bus signal for removal

3193

self.client_removed_signal(c)

2785

# Emit D-Bus signal

2786

self.ClientRemoved(object_path, c.name)

3194

2787

return

3195

2788

raise KeyError(object_path)

3196

2789

3197

2790

del _interface

3198

3199

@dbus.service.method(dbus.OBJECT_MANAGER_IFACE,

3200

out_signature = "a{oa{sa{sv}}}")

3201

def GetManagedObjects(self):

3202

"""D-Bus method"""

3203

return dbus.Dictionary(

3204

{ client.dbus_object_path:

3205

dbus.Dictionary(

3206

{ interface: client.GetAll(interface)

3207

for interface in

3208

client._get_all_interface_names()})

3209

for client in tcp_server.clients.values()})

3210

3211

def client_added_signal(self, client):

3212

"""Send the new standard signal and the old signal"""

3213

if use_dbus:

3214

# New standard signal

3215

self.InterfacesAdded(

3216

client.dbus_object_path,

3217

dbus.Dictionary(

3218

{ interface: client.GetAll(interface)

3219

for interface in

3220

client._get_all_interface_names()}))

3221

# Old signal

3222

self.ClientAdded(client.dbus_object_path)

3223

3224

def client_removed_signal(self, client):

3225

"""Send the new standard signal and the old signal"""

3226

if use_dbus:

3227

# New standard signal

3228

self.InterfacesRemoved(

3229

client.dbus_object_path,

3230

client._get_all_interface_names())

3231

# Old signal

3232

self.ClientRemoved(client.dbus_object_path,

3233

client.name)

3234

2791

3235

2792

mandos_dbus_service = MandosDBusService()

3236

2793

3301

2858

name, client = tcp_server.clients.popitem()

3302

2859

if use_dbus:

3303

2860

client.remove_from_connection()

3304

# Don't signal the disabling

2861

# Don't signal anything except ClientRemoved

3305

2862

client.disable(quiet=True)

3306

# Emit D-Bus signal for removal

3307

2863

if use_dbus:

3308

mandos_dbus_service.client_removed_signal(client)

2864

# Emit D-Bus signal

2865

mandos_dbus_service.ClientRemoved(

2866

client.dbus_object_path, client.name)

3309

2867

client_settings.clear()

3310

2868

3311

2869

atexit.register(cleanup)

3312

2870

3313

2871

for client in tcp_server.clients.itervalues():

3314

2872

if use_dbus:

3315

# Emit D-Bus signal for adding

3316

mandos_dbus_service.client_added_signal(client)

2873

# Emit D-Bus signal

2874

mandos_dbus_service.ClientAdded(client.dbus_object_path)

3317

2875

# Need to initiate checking of clients

3318

2876

if client.enabled:

3319

2877

client.init_checker()